From af47ebb67aa64d699615693bf4603ec173417175 Mon Sep 17 00:00:00 2001
From: Stephen Smalley <sds@tycho.nsa.gov>
Date: Mon, 4 Nov 2013 09:47:29 -0500
Subject: [PATCH] Label /dev/fscklogs and allow system_server access to it.
Otherwise you get denials such as:
type=1400 audit(1383590310.430:623): avc: denied { getattr } for pid=1629 comm="Thread-78" path="/dev/fscklogs/log" dev="tmpfs" ino=1642 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=file
type=1400 audit(1383590310.430:624): avc: denied { open } for pid=1629 comm="Thread-78" name="log" dev="tmpfs" ino=1642 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=file
type=1400 audit(1383590310.430:625): avc: denied { write } for pid=1629 comm="Thread-78" name="fscklogs" dev="tmpfs" ino=1628 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=dir
type=1400 audit(1383590310.430:625): avc: denied { remove_name } for pid=1629 comm="Thread-78" name="log" dev="tmpfs" ino=1642 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=dir
type=1400 audit(1383590310.430:625): avc: denied { unlink } for pid=1629 comm="Thread-78" name="log" dev="tmpfs" ino=1642 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=file
Change-Id: Ia7ae06a6d4cc5d2a59b8b85a5fb93cc31074fd37
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
device.te | 1 +
file_contexts | 1 +
system_server.te | 5 +++++
3 files changed, 7 insertions(+)
diff --git a/device.te b/device.te
index 508c0ebff..76302cdb9 100644
--- a/device.te
+++ b/device.te
@@ -15,6 +15,7 @@ type radio_device, dev_type;
type ram_device, dev_type;
type console_device, dev_type;
type cpuctl_device, dev_type;
+type fscklogs, dev_type;
type full_device, dev_type;
type graphics_device, dev_type;
type hw_random_device, dev_type;
diff --git a/file_contexts b/file_contexts
index d8315a1f6..41f9b1c71 100644
--- a/file_contexts
+++ b/file_contexts
@@ -45,6 +45,7 @@
/dev/cpuctl(/.*)? u:object_r:cpuctl_device:s0
/dev/device-mapper u:object_r:dm_device:s0
/dev/eac u:object_r:audio_device:s0
+/dev/fscklogs(/.*)? u:object_r:fscklogs:s0
/dev/full u:object_r:full_device:s0
/dev/fuse u:object_r:fuse_device:s0
/dev/graphics(/.*)? u:object_r:graphics_device:s0
diff --git a/system_server.te b/system_server.te
index 1ffa34d2b..4d79c1afb 100644
--- a/system_server.te
+++ b/system_server.te
@@ -212,3 +212,8 @@ allow system_server hw_random_device:chr_file r_file_perms;
# Access to wake locks
allow system_server sysfs_wake_lock:file rw_file_perms;
+
+# Read and delete files under /dev/fscklogs.
+r_dir_file(system_server, fscklogs)
+allow system_server fscklogs:dir { write remove_name };
+allow system_server fscklogs:file unlink;
--
GitLab