Skip to content
Snippets Groups Projects
Commit 93166cef authored by Robert Benea's avatar Robert Benea
Browse files

resolve merge conflicts of 0040d6f0 to master

Test: I solemnly swear I tested this conflict resolution.
Change-Id: Icf1e8ad95c40f497c731fa03dfd09d8b2c132aca
parents 148de9f5 0040d6f0
No related branches found
No related tags found
No related merge requests found
......@@ -78,7 +78,7 @@
/dev/cam u:object_r:camera_device:s0
/dev/console u:object_r:console_device:s0
/dev/cpuctl(/.*)? u:object_r:cpuctl_device:s0
/dev/memcg(/.*)? u:object_r:memcg_device:s0
/dev/memcg(/.*)? u:object_r:cgroup:s0
/dev/device-mapper u:object_r:dm_device:s0
/dev/eac u:object_r:audio_device:s0
/dev/event-log-tags u:object_r:runtime_event_log_tags_file:s0
......
......@@ -21,7 +21,6 @@ type rtc_device, dev_type;
type vold_device, dev_type;
type console_device, dev_type;
type cpuctl_device, dev_type;
type memcg_device, dev_type;
type fscklogs, dev_type;
type full_device, dev_type;
# GPU (used by most UI apps)
......
......@@ -226,10 +226,6 @@ with_asan(`allow domain system_data_file:dir getattr;')
### neverallow rules
###
# Don't allow others to access memcg.
neverallow { domain -init -lmkd -shell -ueventd } memcg_device:dir *;
neverallow { domain -init -lmkd -ueventd } memcg_device:file *;
# All socket ioctls must be restricted to a whitelist.
neverallowxperm domain domain:socket_class_set ioctl { 0 };
......
......@@ -81,7 +81,6 @@ allow init tmpfs:dir mounton;
allow init cgroup:dir create_dir_perms;
r_dir_file(init, cgroup)
allow init cpuctl_device:dir { create mounton };
allow init memcg_device:dir { create mounton };
# /config
allow init configfs:dir mounton;
......
......@@ -21,9 +21,6 @@ allow lmkd system_server:file write;
r_dir_file(lmkd, sysfs_type)
allow lmkd sysfs_lowmemorykiller:file w_file_perms;
allow lmkd memcg_device:dir search;
allow lmkd memcg_device:file rw_file_perms;
# Send kill signals
allow lmkd appdomain:process sigkill;
......@@ -35,8 +32,6 @@ allow lmkd self:capability sys_nice;
allow lmkd proc_zoneinfo:file r_file_perms;
r_dir_file(lmkd, cgroup)
### neverallow rules
# never honor LD_PRELOAD
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment