From 89d771871e3cbce8bc9fadb31e38bd5fb624bf8f Mon Sep 17 00:00:00 2001
From: Jeff Vander Stoep <jeffv@google.com>
Date: Mon, 9 Oct 2017 13:44:46 -0700
Subject: [PATCH] Remove unnecessary HAL permissions
Comments indicate that these permissions are used to access already
open FDs. However, getattr of a directory is clearly not necessary
for that, search of system_data_file is already granted to domain
and following symlinks is clearly not needed for reading an already
open FD.
Bug: 34980020
Test: boot marlin. Test drm with google play movies, no related
denials
Test: cts-tradefed run cts -m CtsMediaTestCases -t \
android.media.cts.MediaCasTest
5/6 tests fail with no related selinux denials. The same 5/6
also fail in selinux permissive mode.
Change-Id: Ib4b9a1e18bdc479d656b2d64917bbc0358515525
---
public/hal_cas.te | 2 --
public/hal_drm.te | 2 --
2 files changed, 4 deletions(-)
diff --git a/public/hal_cas.te b/public/hal_cas.te
index fd5d63bb4..b4801c5c3 100644
--- a/public/hal_cas.te
+++ b/public/hal_cas.te
@@ -10,9 +10,7 @@ allow hal_cas_server hidl_memory_hwservice:hwservice_manager find;
get_prop(hal_cas, serialno_prop)
# Read files already opened under /data
-allow hal_cas system_data_file:dir { search getattr };
allow hal_cas system_data_file:file { getattr read };
-allow hal_cas system_data_file:lnk_file r_file_perms;
# Read access to pseudo filesystems
r_dir_file(hal_cas, cgroup)
diff --git a/public/hal_drm.te b/public/hal_drm.te
index 5a6bf5c74..666b1ba82 100644
--- a/public/hal_drm.te
+++ b/public/hal_drm.te
@@ -19,9 +19,7 @@ allow hal_drm system_file:file r_file_perms;
allow hal_drm system_file:lnk_file r_file_perms;
# Read files already opened under /data
-allow hal_drm system_data_file:dir { search getattr };
allow hal_drm system_data_file:file { getattr read };
-allow hal_drm system_data_file:lnk_file r_file_perms;
# Read access to pseudo filesystems
r_dir_file(hal_drm, cgroup)
--
GitLab