From 89740a6967225ca837c2bf0c59c058e5cac1d83b Mon Sep 17 00:00:00 2001
From: Nick Kralevich <nnk@google.com>
Date: Fri, 10 Jan 2014 21:41:26 +0000
Subject: [PATCH] Revert "Strip exec* permissions from unconfined domains."
As discussed in https://android-review.googlesource.com/78634 , the removal of execmem may cause OTA problems. Not sure...
Revert this patch to give us more time to investigate.
This reverts commit 4e416ea4caf023299c84f4a06f3db59dd9aa1967.
Change-Id: Ie05f90235da5b9ee20b374298494cbc0a58b9b49
---
unconfined.te | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/unconfined.te b/unconfined.te
index 96fa4fcb4..ef134026d 100644
--- a/unconfined.te
+++ b/unconfined.te
@@ -19,7 +19,7 @@
allow unconfineddomain self:capability_class_set *;
allow unconfineddomain kernel:security ~{ load_policy setenforce setcheckreqprot };
allow unconfineddomain kernel:system *;
-allow unconfineddomain domain:process ~{ execmem execstack execheap ptrace };
+allow unconfineddomain domain:process ~ptrace;
allow unconfineddomain domain:fd *;
allow unconfineddomain domain:dir r_dir_perms;
allow unconfineddomain domain:lnk_file r_file_perms;
@@ -29,9 +29,9 @@ allow unconfineddomain domain:ipc_class_set *;
allow unconfineddomain domain:key *;
allow unconfineddomain fs_type:filesystem *;
allow unconfineddomain {fs_type dev_type file_type}:{ dir blk_file lnk_file sock_file fifo_file } ~relabelto;
-allow unconfineddomain {fs_type -usermodehelper -proc_security}:{ chr_file file } ~{entrypoint execmod relabelto};
-allow unconfineddomain {dev_type -kmem_device}:{ chr_file file } ~{entrypoint execmod relabelto};
-allow unconfineddomain file_type:{ chr_file file } ~{entrypoint execmod relabelto};
+allow unconfineddomain {fs_type -usermodehelper -proc_security}:{ chr_file file } ~{entrypoint relabelto};
+allow unconfineddomain {dev_type -kmem_device}:{ chr_file file } ~{entrypoint relabelto};
+allow unconfineddomain file_type:{ chr_file file } ~{entrypoint relabelto};
allow unconfineddomain node_type:node *;
allow unconfineddomain node_type:{ tcp_socket udp_socket rawip_socket } node_bind;
allow unconfineddomain netif_type:netif *;
--
GitLab