diff --git a/dumpstate.te b/dumpstate.te index 584b1406f1c08f4b2804751aac947ac8e7bb85cd..f2aab81b46640756ab3f34c9b744c3d278a08159 100644 --- a/dumpstate.te +++ b/dumpstate.te @@ -24,9 +24,8 @@ allow dumpstate system_file:file execute_no_trans; # Create and write into /data/anr/ allow dumpstate self:capability { dac_override chown fowner fsetid }; -allow dumpstate anr_data_file:dir { rw_dir_perms relabelto }; +allow dumpstate anr_data_file:dir rw_dir_perms; allow dumpstate anr_data_file:file create_file_perms; -allow dumpstate system_data_file:dir { create_dir_perms relabelfrom }; # Allow reading /data/system/uiderrors.txt # TODO: scope this down. diff --git a/system_server.te b/system_server.te index 4b16d46d54365b8446b62291a5684a16b109eee2..269d6ee0529995e1b85ba7c7e77b7f0d5890363f 100644 --- a/system_server.te +++ b/system_server.te @@ -269,9 +269,10 @@ allow system_server system_data_file:file relabelfrom; allow system_server wallpaper_file:file relabelto; allow system_server wallpaper_file:file { rw_file_perms unlink }; -# Relabel /data/anr. +# This was originally required for relabeling /data/anr, +# but should not be used anymore. TODO: remove it. allow system_server system_data_file:dir relabelfrom; -allow system_server anr_data_file:dir relabelto; +auditallow system_server system_data_file:dir relabelfrom; # Property Service write set_prop(system_server, system_prop)