am 0264fd11: am 76f3fe33: Add neverallow rule for set_context_mgr.

* commit '0264fd11': Add neverallow rule for set_context_mgr.

am 0264fd11: am 76f3fe33: Add neverallow rule for set_context_mgr.
7938ae7e · dcashman · Android Git Automerger · 18805ee1 · 0264fd11 · 7938ae7e
Commit 7938ae7e authored 10 years ago by dcashman Committed by Android Git Automerger 10 years ago
--- a/domain.te
+++ b/domain.te
@@ -329,3 +329,6 @@ neverallow { domain -recovery } system_block_device:blk_file write;

 # No domains other than install_recovery or recovery can write to recovery.
 neverallow { domain -install_recovery -recovery } recovery_block_device:blk_file write;
+
+# Only servicemanager should be able to register with binder as the context manager
+neverallow { domain -servicemanager } *:binder set_context_mgr;