From bc4d36305dce85a8fd83aec87496e1010c11f56b Mon Sep 17 00:00:00 2001
From: Tom Cherry <tomcherry@google.com>
Date: Wed, 29 Mar 2017 16:52:19 -0700
Subject: [PATCH] Grant vdc access to kmsg

Init is no longer calling vdc with logwrapper, so it must take care of
logging to kmsg directly.

Change-Id: I529f5a95e19c08ef75e0da9a02bae1cb7187eec0
avc: denied { write } for pid=367 comm="vdc" name="kmsg" dev="tmpfs" ino=11056 scontext=u:r:vdc:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0

Test: observe vdc logging in kmsg on boot and stderr on normal usage

Change-Id: Ie3678509d360f19b95cb03aeea75f29843728203
---
 public/vdc.te | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/public/vdc.te b/public/vdc.te
index 67fb7a3a0..53d7bbe2c 100644
--- a/public/vdc.te
+++ b/public/vdc.te
@@ -22,3 +22,6 @@ allow vdc dumpstate:unix_dgram_socket { read write };
 
 # vdc can be invoked with logwrapper, so let it write to pty
 allow vdc devpts:chr_file rw_file_perms;
+
+# vdc writes directly to kmsg during the boot process
+allow vdc kmsg_device:chr_file w_file_perms;
-- 
GitLab