From 71bccc7a74e98ff389de5c02caa2d3bdf0d457ca Mon Sep 17 00:00:00 2001
From: Tianjie Xu <xunchang@google.com>
Date: Fri, 14 Apr 2017 14:06:22 -0700
Subject: [PATCH] Allow recovery to read thermal info on sailfish
Encountered more denials on sailfish:
avc: denied { read } for pid=439 comm="recovery" name="thermal"
dev="sysfs" ino=28516 scontext=u:r:recovery:s0
tcontext=u:object_r:sysfs_thermal:s0 tclass=dir permissive=0
avc: denied { read } for pid=441 comm="recovery"
name="thermal_zone9" dev="sysfs" ino=40364 scontext=u:r:recovery:s0
tcontext=u:object_r:sysfs_thermal:s0 tclass=lnk_file permissive=0
Bug: 36920500
Test: sideload a package in sailfish
(cherry picked from commit b4e4565d58218cc5a878d4998dc9dd079d4b7dc0)
Change-Id: I46b14babd47168e87c0d30ec06281aaa237563bf
---
public/recovery.te | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/public/recovery.te b/public/recovery.te
index 784596dd0..886f4fd48 100644
--- a/public/recovery.te
+++ b/public/recovery.te
@@ -93,8 +93,7 @@ recovery_only(`
allow recovery { cache_file cache_recovery_file }:file create_file_perms;
# Read /sys/class/thermal/*/temp for thermal info.
- allow recovery sysfs_thermal:dir search;
- allow recovery sysfs_thermal:file r_file_perms;
+ r_dir_file(recovery, sysfs_thermal)
# Read files on /oem.
r_dir_file(recovery, oemfs);
--
GitLab