diff --git a/private/init.te b/private/init.te index 49da9d3c14a68dab3c1c780a5c79935d9bc4bb27..afbd87895821f319683ac874762f0e58523a8ba1 100644 --- a/private/init.te +++ b/private/init.te @@ -14,8 +14,7 @@ recovery_only(` domain_trans(init, shell_exec, shell) domain_trans(init, init_exec, ueventd) domain_trans(init, init_exec, watchdogd) -domain_trans(init, rootfs, modprobe) -domain_trans(init, toolbox_exec, modprobe) +domain_trans(init, { rootfs toolbox_exec vendor_toolbox_exec }, modprobe) # case where logpersistd is actually logcat -f in logd context (nee: logcatd) userdebug_or_eng(` domain_auto_trans(init, logcat_exec, logpersist) diff --git a/public/vendor_toolbox.te b/public/vendor_toolbox.te index 39462f8e776de512fb6b5ea6dc7e075b8bed8579..eb292cafb3645847e5f04afe78f198c9eb019e11 100644 --- a/public/vendor_toolbox.te +++ b/public/vendor_toolbox.te @@ -7,6 +7,10 @@ type vendor_toolbox_exec, exec_type, vendor_file_type, file_type; # or read, execute the vendor_toolbox file. full_treble_only(` # Do not allow non-vendor domains to transition - # to vendor toolbox - neverallow coredomain vendor_toolbox_exec:file { entrypoint execute execute_no_trans }; + # to vendor toolbox except for the whitelisted domains. + neverallow { + coredomain + -init + -modprobe + } vendor_toolbox_exec:file { entrypoint execute execute_no_trans }; ')