From 82bdd796e1265bd0e4b0497e9bed1d0cafc9883b Mon Sep 17 00:00:00 2001
From: Nick Kralevich <nnk@google.com>
Date: Wed, 14 Oct 2015 09:41:47 -0700
Subject: [PATCH] system_server: (eng builds) remove JIT capabilities
23cde8776b94ff2228f3a8d845d41052af52319e removed JIT capabilities
from system_server for user and userdebug builds. Remove the capability
from eng builds to be consistent across build types.
Add a neverallow rule (compile time assertion + CTS test) to verify
this doesn't regress on our devices or partner devices.
Bug: 23468805
Bug: 24915206
Change-Id: Ib2154255c611b8812aa1092631a89bc59a27514b
---
system_server.te | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/system_server.te b/system_server.te
index 4ab42d6f5..b17624346 100644
--- a/system_server.te
+++ b/system_server.te
@@ -7,13 +7,6 @@ type system_server, domain, mlstrustedsubject;
# Define a type for tmpfs-backed ashmem regions.
tmpfs_domain(system_server)
-eng(`
- # JIT mappings
- allow system_server self:process execmem;
- allow system_server ashmem_device:chr_file execute;
- allow system_server system_server_tmpfs:file execute;
-')
-
# For art.
allow system_server dalvikcache_data_file:file execute;
allow system_server dalvikcache_data_file:dir r_dir_perms;
@@ -472,3 +465,8 @@ neverallow system_server {
# the frp_block_device. This helps avoid a system_server to root
# escalation by writing to raw block devices.
neverallow system_server { dev_type -frp_block_device }:blk_file no_rw_file_perms;
+
+# system_server should never use JIT functionality
+neverallow system_server self:process execmem;
+neverallow system_server ashmem_device:chr_file execute;
+neverallow system_server system_server_tmpfs:file execute;
--
GitLab