Skip to content
Snippets Groups Projects
Commit b23d2876 authored by Nick Kralevich's avatar Nick Kralevich
Browse files

Allow keystore to talk to the tee

On manta, the keystore CTS tests are failing, because
keystore isn't allowed to talk to the tee. Allow it.

I've only seen this bug on manta, but it seems appropriate
for all domains.

Fixes the following denial:

<5>[  286.249563] type=1400 audit(1389210059.924:6): avc:  denied  { connectto } for  pid=126 comm="keystore" path=006D636461656D6F6E scontext=u:r:keystore:s0 tcontext=u:r:tee:s0 tclass=unix_stream_socket

Bug: 12450710
Change-Id: I07133d9abeaf967392118ba478a5a391cf0c5fa5
parent d362cdf8
No related branches found
No related tags found
No related merge requests found
......@@ -10,3 +10,4 @@ allow keystore keystore_data_file:dir create_dir_perms;
allow keystore keystore_data_file:notdevfile_class_set create_file_perms;
allow keystore keystore_exec:file { getattr };
allow keystore tee_device:chr_file rw_file_perms;
allow keystore tee:unix_stream_socket connectto;
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment