diff --git a/system_server.te b/system_server.te index b59f5a35922389ff607baa17ed3f45a9b487f877..76998a92394b3181820fa20f0db3a0f77a6d09bc 100644 --- a/system_server.te +++ b/system_server.te @@ -80,6 +80,13 @@ r_dir_file(system_server, appdomain) # Write to /proc/pid/oom_adj_score for apps. allow system_server appdomain:file write; +# Silently deny access to any /proc/pid files other than +# the ones allowed via allow rule. Avoids filling the logs +# with noise from /proc/pid traversals by ActivityManager, +# CpuTracker, and possibly other system_server components. +dontaudit system_server domain:dir r_dir_perms; +dontaudit system_server domain:{ file lnk_file } r_file_perms; + # Read/Write to /proc/net/xt_qtaguid/ctrl and and /dev/xt_qtaguid. allow system_server qtaguid_proc:file rw_file_perms; allow system_server qtaguid_device:chr_file rw_file_perms;