diff --git a/private/genfs_contexts b/private/genfs_contexts index f7016851d7183f7cd6c702b5e6c1505ba734c0dc..6386101120eb9dc5f95894975ef50e500e93a12f 100644 --- a/private/genfs_contexts +++ b/private/genfs_contexts @@ -32,6 +32,7 @@ genfscon proc /timer_stats u:object_r:proc_timer:s0 genfscon proc /tty/drivers u:object_r:proc_tty_drivers:s0 genfscon proc /uid_cputime/show_uid_stat u:object_r:proc_uid_cputime_showstat:s0 genfscon proc /uid_cputime/remove_uid_range u:object_r:proc_uid_cputime_removeuid:s0 +genfscon proc /uid_procstat/set u:object_r:proc_uid_procstat_set:s0 genfscon proc /zoneinfo u:object_r:proc_zoneinfo:s0 # selinuxfs booleans can be individually labeled. diff --git a/public/file.te b/public/file.te index 8b3b62c83ffe902360a93a6b53ba9dbd566baa06..99c2a9e57ef1139b99bd4875192e4d6e72d04257 100644 --- a/public/file.te +++ b/public/file.te @@ -23,6 +23,7 @@ type proc_timer, fs_type; type proc_tty_drivers, fs_type; type proc_uid_cputime_showstat, fs_type; type proc_uid_cputime_removeuid, fs_type; +type proc_uid_procstat_set, fs_type; type proc_zoneinfo, fs_type; type selinuxfs, fs_type, mlstrustedobject; type cgroup, fs_type, mlstrustedobject; diff --git a/public/system_server.te b/public/system_server.te index ee552630b06fd911daec1ac5fd37a4666b1f82e0..f36fa9f1ba5964598a8520be6e751d42001c01f7 100644 --- a/public/system_server.te +++ b/public/system_server.te @@ -112,6 +112,9 @@ allow system_server proc_uid_cputime_showstat:file r_file_perms; # Write /proc/uid_cputime/remove_uid_range. allow system_server proc_uid_cputime_removeuid:file { w_file_perms getattr }; +# Write /proc/uid_procstat/set. +allow system_server proc_uid_procstat_set:file { w_file_perms getattr }; + # Write to /proc/sysrq-trigger. allow system_server proc_sysrq:file rw_file_perms;