Skip to content
Snippets Groups Projects
Commit 9e6effa1 authored by Nick Kralevich's avatar Nick Kralevich
Browse files

delete procrank SELinux domain.

Simplify SELinux policy by deleting the procrank SELinux domain.
procrank only exists on userdebug/eng builds, and anyone wanting
to run procrank can just su to root.

Bug: 18342188
Change-Id: I71adc86a137c21f170d983e320ab55be79457c16
parent de53051a
No related branches found
No related tags found
No related merge requests found
......@@ -179,7 +179,6 @@ neverallow {
-vold
-dumpstate
-system_server
userdebug_or_eng(`-procrank')
userdebug_or_eng(`-perfprofd')
} self:capability sys_ptrace;
......@@ -524,7 +523,7 @@ neverallow {
-appdomain
-dumpstate
-installd
userdebug_or_eng(`-uncrypt -procrank')
userdebug_or_eng(`-uncrypt')
} shell_data_file:file open;
# servicemanager is the only process which handles list request
......
......@@ -179,7 +179,6 @@
/system/bin/tf_daemon u:object_r:tee_exec:s0
/system/bin/racoon u:object_r:racoon_exec:s0
/system/xbin/su u:object_r:su_exec:s0
/system/xbin/procrank u:object_r:procrank_exec:s0
/system/xbin/perfprofd u:object_r:perfprofd_exec:s0
/system/vendor/bin/gpsd u:object_r:gpsd_exec:s0
/system/bin/dnsmasq u:object_r:dnsmasq_exec:s0
......
# File types must be defined for file_contexts.
type procrank_exec, exec_type, file_type;
userdebug_or_eng(`
type procrank, domain, mlstrustedsubject;
domain_auto_trans(shell, procrank_exec, procrank)
domain_auto_trans(dumpstate, procrank_exec, procrank)
allow procrank self:capability sys_ptrace;
allow procrank devpts:chr_file { read write getattr ioctl };
allow procrank dumpstate:unix_stream_socket { read write getattr };
r_dir_file(procrank, domain)
allow procrank { shell dumpstate }:fd use;
allow procrank adbd:process sigchld;
# allow procrank write to bugreport.
allow procrank shell_data_file:file w_file_perms;
')
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment