From 9e8b8d9fdfcdb6b3e8af3349df186c2ab81a9733 Mon Sep 17 00:00:00 2001
From: Nick Kralevich <nnk@google.com>
Date: Fri, 6 Dec 2013 16:52:30 +0000
Subject: [PATCH] Revert "Allow kernel domain, not init domain, to set SELinux
enforcing mode."
The build is broken. Reverting temporarily to fix breakage.
libsepol.check_assertion_helper: neverallow on line 4758 violated by allow init kernel:security { setenforce };
Error while expanding policy
make: *** [out/target/product/mako/obj/ETC/sepolicy_intermediates/sepolicy] Error 1
make: *** Waiting for unfinished jobs....
This reverts commit bf12e2251422cc8470de21dd882872b7b6f960f6.
Change-Id: I78a05756d8ce3c7d06e1d9d27e6135f4b352bb85
---
domain.te | 13 ++-----------
init.te | 1 -
kernel.te | 3 ---
3 files changed, 2 insertions(+), 15 deletions(-)
diff --git a/domain.te b/domain.te
index 2b7c0a676..4297badcb 100644
--- a/domain.te
+++ b/domain.te
@@ -130,17 +130,8 @@ neverallow { domain -relabeltodomain } *:dir_file_class_set relabelto;
### neverallow rules
###
-# Only init should be able to load SELinux policies.
-# The first load technically occurs while still in the kernel domain,
-# but this does not trigger a denial since there is no policy yet.
-# Policy reload requires allowing this to the init domain.
-neverallow { domain -init } kernel:security load_policy;
-
-# Only init prior to switching context should be able to set enforcing mode.
-# init starts in kernel domain and switches to init domain via setcon in
-# the init.rc, so the setenforce occurs while still in kernel. After
-# switching domains, there is never any need to setenforce again by init.
-neverallow { domain -kernel } kernel:security setenforce;
+# Only init should be able to load SELinux policies and set enforcing mode.
+neverallow { domain -init } kernel:security { load_policy setenforce };
# Only init, ueventd and system_server should be able to access HW RNG
neverallow { domain -init -system_server -ueventd -unconfineddomain } hw_random_device:chr_file *;
diff --git a/init.te b/init.te
index 1c76e72cd..b2d99fbce 100644
--- a/init.te
+++ b/init.te
@@ -11,4 +11,3 @@ allow init {fs_type dev_type file_type}:dir_file_class_set relabelto;
allow init kernel:security { load_policy setenforce };
allow init usermodehelper:file rw_file_perms;
allow init proc_security:file rw_file_perms;
-allow init kernel:security load_policy;
diff --git a/kernel.te b/kernel.te
index 089786bff..d1c1b7f82 100644
--- a/kernel.te
+++ b/kernel.te
@@ -6,6 +6,3 @@ relabelto_domain(kernel)
allow kernel {fs_type dev_type file_type}:dir_file_class_set relabelto;
allow kernel unlabeled:filesystem mount;
-
-# Initial setenforce by init prior to switching to init domain.
-allow kernel self:security setenforce;
--
GitLab