From 6c9c58884a97f36785c7778940ee303838fd2ebc Mon Sep 17 00:00:00 2001
From: Nick Kralevich <nnk@google.com>
Date: Thu, 12 Jun 2014 18:54:10 -0700
Subject: [PATCH] runas: allow pipe communication from the shell
run-as won't communicate with shell via pipes. Allow it.
nnk@nnk:~$ adb shell "cat /dev/zero | run-as com.google.foo sh -c 'cat'"
/system/bin/sh: cat: <stdout>: Broken pipe
<4>[ 1485.483517] type=1400 audit(1402623577.085:25): avc: denied { read } for pid=6026 comm="run-as" path="pipe:[29823]" dev="pipefs" ino=29823 scontext=u:r:runas:s0 tcontext=u:r:shell:s0 tclass=fifo_file
read is definitely needed. Not sure about write, but adding it just
in case.
Change-Id: Ifdf838b0df79a5f1e9559af57c2d1fdb8c41a201
---
runas.te | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/runas.te b/runas.te
index 8cc0eeac9..1ce8e64ea 100644
--- a/runas.te
+++ b/runas.te
@@ -4,7 +4,8 @@ type runas_exec, exec_type, file_type;
# ndk-gdb invokes adb shell run-as.
domain_auto_trans(shell, runas_exec, runas)
allow runas adbd:process sigchld;
-allow runas shell:fd use;
+allow runas shell:fd use;
+allow runas shell:fifo_file { read write };
allow runas devpts:chr_file { read write ioctl };
# run-as reads package information.
--
GitLab