From 7cacc85dafad5e71335d0bcaaef4a8ee896c96ff Mon Sep 17 00:00:00 2001
From: yro <yro@google.com>
Date: Fri, 30 Mar 2018 18:40:30 -0700
Subject: [PATCH] Update sepolicy to have system_server access stats_data
Bug: 75968642
Test: manual testing to check for sepolicy violation
Cherry-picked from aosp/652222
Change-Id: Idc83669feaf9fd17bed26f89dfce33e3f2f5424f
---
private/statsd.te | 4 ++--
private/system_server.te | 4 ++++
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/private/statsd.te b/private/statsd.te
index dfec7a482..fec10a4b6 100644
--- a/private/statsd.te
+++ b/private/statsd.te
@@ -101,7 +101,7 @@ neverallow {
# Only statsd and the other root services in limited circumstances.
# can get to the files in /data/misc/stats-data, /data/misc/stats-service.
# Other services are prohibitted from accessing the file.
-neverallow { domain -statsd -init -vold } stats_data_file:file *;
+neverallow { domain -statsd -system_server -init -vold } stats_data_file:file *;
# Limited access to the directory itself.
-neverallow { domain -statsd -init -vold } stats_data_file:dir *;
+neverallow { domain -statsd -system_server -init -vold } stats_data_file:dir *;
diff --git a/private/system_server.te b/private/system_server.te
index 0c9067d67..1bf7a9078 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -139,6 +139,10 @@ allow system_server proc_sysrq:file rw_file_perms;
allow system_server debugfs:file r_file_perms;
allow system_server debugfs_wakeup_sources:file r_file_perms;
+# Delete /data/misc/stats-data/ and /data/misc/stats-service/ directories.
+allow system_server stats_data_file:dir { open read remove_name search write };
+allow system_server stats_data_file:file unlink;
+
# The DhcpClient and WifiWatchdog use packet_sockets
allow system_server self:packet_socket create_socket_perms_no_ioctl;
--
GitLab