diff --git a/domain.te b/domain.te index 2b7c0a676f3d626578ecd973a455b8e601f502cf..4297badcbf16e5416dc4ece9e5b2e1ce290c62d5 100644 --- a/domain.te +++ b/domain.te @@ -130,17 +130,8 @@ neverallow { domain -relabeltodomain } *:dir_file_class_set relabelto; ### neverallow rules ### -# Only init should be able to load SELinux policies. -# The first load technically occurs while still in the kernel domain, -# but this does not trigger a denial since there is no policy yet. -# Policy reload requires allowing this to the init domain. -neverallow { domain -init } kernel:security load_policy; - -# Only init prior to switching context should be able to set enforcing mode. -# init starts in kernel domain and switches to init domain via setcon in -# the init.rc, so the setenforce occurs while still in kernel. After -# switching domains, there is never any need to setenforce again by init. -neverallow { domain -kernel } kernel:security setenforce; +# Only init should be able to load SELinux policies and set enforcing mode. +neverallow { domain -init } kernel:security { load_policy setenforce }; # Only init, ueventd and system_server should be able to access HW RNG neverallow { domain -init -system_server -ueventd -unconfineddomain } hw_random_device:chr_file *; diff --git a/init.te b/init.te index 1c76e72cd27ca66f770934b85adfbe52a10021b0..b2d99fbcef58d0b6c0cba8fd19e71dadb239f88f 100644 --- a/init.te +++ b/init.te @@ -11,4 +11,3 @@ allow init {fs_type dev_type file_type}:dir_file_class_set relabelto; allow init kernel:security { load_policy setenforce }; allow init usermodehelper:file rw_file_perms; allow init proc_security:file rw_file_perms; -allow init kernel:security load_policy; diff --git a/kernel.te b/kernel.te index 089786bff834cdd689e5f997c5fdbf451ef164bb..d1c1b7f823ba3ef645fbeaea412dfe516a7eb52b 100644 --- a/kernel.te +++ b/kernel.te @@ -6,6 +6,3 @@ relabelto_domain(kernel) allow kernel {fs_type dev_type file_type}:dir_file_class_set relabelto; allow kernel unlabeled:filesystem mount; - -# Initial setenforce by init prior to switching to init domain. -allow kernel self:security setenforce;