Skip to content
Snippets Groups Projects
Commit 9de62d6f authored by Robert Sesek's avatar Robert Sesek Committed by Nick Kralevich
Browse files

isolated_app: Do not allow access to the gpu_device.

Bug: 17471434

(cherry picked from commit 7f4a8a72)

Change-Id: I7d70fd4d8b8ecdd42024345d74fa36233fb76fb5
parent a8b651bf
No related branches found
No related tags found
No related merge requests found
......@@ -84,7 +84,7 @@ allow appdomain qtaguid_device:chr_file r_file_perms;
# Grant GPU access to all processes started by Zygote.
# They need that to render the standard UI.
allow appdomain gpu_device:chr_file { rw_file_perms execute };
allow { appdomain -isolated_app } gpu_device:chr_file { rw_file_perms execute };
# Use the Binder.
binder_use(appdomain)
......
......@@ -13,6 +13,9 @@ type isolated_app, domain;
app_domain(isolated_app)
net_domain(isolated_app)
# Isolated apps shouldn't be able to access the driver directly.
neverallow isolated_app gpu_device:file { rw_file_perms execute };
# read and write access to app_data_file is already
# granted via app.te. Allow execute.
# Needed to allow dlopen() from Chrome renderer processes.
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment