diff --git a/public/attributes b/public/attributes index 2a8a40ada20732b34e48382c4e6efa427e14486d..c25f1ebc899ebfedbef86c0cb14ebed4624e4c9e 100644 --- a/public/attributes +++ b/public/attributes @@ -154,12 +154,6 @@ expandattribute vendor_executes_system_violators false; attribute data_between_core_and_vendor_violators; expandattribute data_between_core_and_vendor_violators false; -# All system domains which violate the requirement of not executing vendor -# binaries/libraries. -# TODO(b/62041836) -attribute system_executes_vendor_violators; -expandattribute system_executes_vendor_violators false; - # hwservices that are accessible from untrusted applications # WARNING: Use of this attribute should be avoided unless # absolutely necessary. It is a temporary allowance to aid the diff --git a/public/domain.te b/public/domain.te index 2a8c8438f65104baa37e7abdd0a55470e4d739d8..e64b6446435a2d92b512849460a923abe1e41711 100644 --- a/public/domain.te +++ b/public/domain.te @@ -891,20 +891,6 @@ full_treble_only(` -crash_dump_exec -netutils_wrapper_exec }:file { entrypoint execute execute_no_trans }; - - # Do not allow system components to execute files from vendor - # except for the ones whitelist here. - neverallow { - coredomain - -init - -system_executes_vendor_violators - -vendor_init - } { - vendor_file_type - -same_process_hal_file - -vndk_sp_file - -vendor_app_file - }:file { execute execute_no_trans }; ') # Only authorized processes should be writing to files in /data/dalvik-cache