From 6d8a876a4c52599b5abb1e86cfa2a3f4e866ac6d Mon Sep 17 00:00:00 2001
From: Jeff Vander Stoep <jeffv@google.com>
Date: Thu, 18 Jan 2018 08:55:02 -0800
Subject: [PATCH] Suppress denials for non-API access
avc: denied { read } scontext=u:r:priv_app:s0:c512,c768
tcontext=u:object_r:proc_version:s0 tclass=file
avc: denied { read } scontext=u:r:priv_app:s0:c512,c768
tcontext=u:object_r:wifi_prop:s0 tclass=file
avc: denied { read } scontext=u:r:priv_app:s0:c512,c768
tcontext=u:object_r:net_dns_prop:s0 tclass=file
Bug: 72151306
Test: build
Change-Id: I4b658ccd128746356f635ca7955385a89609eea1
---
private/priv_app.te | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/private/priv_app.te b/private/priv_app.te
index 9909e067d..ec52d5691 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -122,11 +122,14 @@ allow priv_app traced:fd use;
allow priv_app traced_tmpfs:file { read write getattr map };
unix_socket_connect(priv_app, traced_producer, traced)
-# suppress denials when safetynet scans /system
+# suppress denials for non-API accesses.
dontaudit priv_app exec_type:file getattr;
dontaudit priv_app device:dir read;
dontaudit priv_app proc_interrupts:file read;
dontaudit priv_app proc_modules:file read;
+dontaudit priv_app proc_version:file read;
+dontaudit priv_app wifi_prop:file read;
+dontaudit priv_app net_dns_prop:file read;
# allow privileged apps to use UDP sockets provided by the system server but not
# modify them other than to connect
--
GitLab