diff --git a/adbd.te b/adbd.te index 3b654a152d9aae89605d94befb23970064a1303c..58fdead680ac7800f55b288e5011c58c53021070 100644 --- a/adbd.te +++ b/adbd.te @@ -68,9 +68,3 @@ allow adbd appdomain:unix_stream_socket connectto; # ndk-gdb invokes adb pull of app_process, linker, and libc.so. allow adbd zygote_exec:file r_file_perms; allow adbd system_file:file r_file_perms; - -service_manager_local_audit_domain(adbd) -auditallow adbd { - service_manager_type - -surfaceflinger_service -}:service_manager find; diff --git a/attributes b/attributes index d40217aed9e08c404e188958aa69b9dffe71ceb4..613ed8f35e2bd7c35318a66a22d40da4bd6e7a39 100644 --- a/attributes +++ b/attributes @@ -67,6 +67,3 @@ attribute bluetoothdomain; # All domains used for binder service domains. attribute binderservicedomain; - -# All domains that are excluded from the domain.te auditallow. -attribute service_manager_local_audit; diff --git a/bluetooth.te b/bluetooth.te index 56fe17058c4cc95a6c417016eda2a68bc669cc60..2b108a9e8ae99e87f9c738e9d03c2aa9637bfc17 100644 --- a/bluetooth.te +++ b/bluetooth.te @@ -49,15 +49,6 @@ allow bluetooth bluetooth_prop:property_service set; allow bluetooth pan_result_prop:property_service set; allow bluetooth ctl_dhcp_pan_prop:property_service set; -# Audited locally. -service_manager_local_audit_domain(bluetooth) -auditallow bluetooth { - service_manager_type - -bluetooth_service - -radio_service - -system_server_service -}:service_manager find; - ### ### Neverallow rules ### diff --git a/bootanim.te b/bootanim.te index 759229553aa2e9ca335f63be94b81a2a406595a7..3a0a76f0f737666b251a185def0c40cbd0f7e15e 100644 --- a/bootanim.te +++ b/bootanim.te @@ -11,7 +11,3 @@ allow bootanim gpu_device:chr_file rw_file_perms; # /oem access allow bootanim oemfs:dir search; - -# Audited locally. -service_manager_local_audit_domain(bootanim) -auditallow bootanim { service_manager_type -surfaceflinger_service }:service_manager find; diff --git a/domain.te b/domain.te index 09134539868fd9e767f2525692df566107769d2e..2ed20bb506dd64516a622cf1a6f1ea53f7638c13 100644 --- a/domain.te +++ b/domain.te @@ -159,9 +159,7 @@ allow domain asec_public_file:file r_file_perms; allow domain { asec_public_file asec_apk_file }:dir r_dir_perms; allow domain servicemanager:service_manager list; -auditallow domain servicemanager:service_manager list; allow domain service_manager_type:service_manager find; -auditallow { domain -service_manager_local_audit } service_manager_type:service_manager find; ### ### neverallow rules diff --git a/drmserver.te b/drmserver.te index 14b2f49366fd66652c17e0b55fe3d50aaff21760..19931766ebe29f59c223cdcb4c7f40258168e29a 100644 --- a/drmserver.te +++ b/drmserver.te @@ -46,11 +46,3 @@ allow drmserver asec_apk_file:file { read getattr }; allow drmserver radio_data_file:file { read getattr }; allow drmserver drmserver_service:service_manager add; - -# Audited locally. -service_manager_local_audit_domain(drmserver) -auditallow drmserver { - service_manager_type - -drmserver_service - -system_server_service -}:service_manager find; diff --git a/dumpstate.te b/dumpstate.te index 242cb932655f9768dd4daa4af72e4462e08168bd..279fd98fb71bdbc5d2b6c65c9d9aad2bfb8fb364 100644 --- a/dumpstate.te +++ b/dumpstate.te @@ -96,18 +96,3 @@ control_logd(dumpstate) # Read network state info files. allow dumpstate net_data_file:dir search; allow dumpstate net_data_file:file r_file_perms; - -service_manager_local_audit_domain(dumpstate) -auditallow dumpstate { - service_manager_type - -drmserver_service - -healthd_service - -inputflinger_service - -keystore_service - -mediaserver_service - -nfc_service - -radio_service - -surfaceflinger_service - -system_app_service - -system_server_service -}:service_manager find; diff --git a/healthd.te b/healthd.te index 940f7c4138d840b485f511dffa42090501d7949d..a788236cf4b00e35d3e7dc947f3f21c041f39339 100644 --- a/healthd.te +++ b/healthd.te @@ -34,10 +34,6 @@ allow healthd self:capability sys_boot; allow healthd healthd_service:service_manager add; -# Audited locally. -service_manager_local_audit_domain(healthd) -auditallow healthd { service_manager_type -healthd_service }:service_manager find; - # Healthd needs to tell init to continue the boot # process when running in charger mode. unix_socket_connect(healthd, property, init) diff --git a/inputflinger.te b/inputflinger.te index 4377a104f833fff9bddcae4ffdbf26f5b0496bde..283bbbaf37e0140d8dbb9525380985259d187ec0 100644 --- a/inputflinger.te +++ b/inputflinger.te @@ -9,7 +9,3 @@ binder_service(inputflinger) binder_call(inputflinger, system_server) allow inputflinger inputflinger_service:service_manager add; - -# Audited locally. -service_manager_local_audit_domain(inputflinger) -auditallow inputflinger { service_manager_type -inputflinger_service }:service_manager find; diff --git a/isolated_app.te b/isolated_app.te index 5929b259324bd2d6b6dfe67f0e439eb5b6a9e596..a156838bbdb0c91392c252016409e1732851faaf 100644 --- a/isolated_app.te +++ b/isolated_app.te @@ -18,12 +18,3 @@ net_domain(isolated_app) # Needed to allow dlopen() from Chrome renderer processes. # See b/15902433 for details. allow isolated_app app_data_file:file execute; - -# Audited locally. -service_manager_local_audit_domain(isolated_app) -auditallow isolated_app { - service_manager_type - -radio_service - -surfaceflinger_service - -system_server_service -}:service_manager find; diff --git a/keystore.te b/keystore.te index f2c5039b00ba5a1742399b93e924a4bc6201a799..afa701c7ee46b8eb3255c49ccc945dcbee7d9040 100644 --- a/keystore.te +++ b/keystore.te @@ -28,9 +28,5 @@ neverallow domain keystore:process ptrace; allow keystore keystore_service:service_manager add; -# Audited locally. -service_manager_local_audit_domain(keystore) -auditallow keystore { service_manager_type -keystore_service }:service_manager find; - # Check SELinux permissions. selinux_check_access(keystore) diff --git a/mediaserver.te b/mediaserver.te index 52c593e6e2b226de7765fa1f51ffbcd6fa9e2c41..55d1f20531e05060078d7cc401f34da48d9ea5ae 100644 --- a/mediaserver.te +++ b/mediaserver.te @@ -79,13 +79,3 @@ unix_socket_connect(mediaserver, bluetooth, bluetooth) allow mediaserver tee:unix_stream_socket connectto; allow mediaserver mediaserver_service:service_manager add; - -# Audited locally. -service_manager_local_audit_domain(mediaserver) -auditallow mediaserver { - service_manager_type - -drmserver_service - -mediaserver_service - -system_server_service - -surfaceflinger_service -}:service_manager find; diff --git a/nfc.te b/nfc.te index 2b851a276fd1e2865bea86aa9093eead3620d3f8..65aaef76cbca14b6225259991ca27f9dfc1e88d7 100644 --- a/nfc.te +++ b/nfc.te @@ -15,12 +15,3 @@ allow nfc sysfs_nfc_power_writable:file rw_file_perms; allow nfc sysfs:file write; allow nfc nfc_service:service_manager add; - -# Audited locally. -service_manager_local_audit_domain(nfc) -auditallow nfc { - service_manager_type - -mediaserver_service - -surfaceflinger_service - -system_server_service -}:service_manager find; diff --git a/platform_app.te b/platform_app.te index a44e35d8acb8c87403f05b7ddcdede7d97100d42..7ff8d62e23b20e8c61e0893837113958c152a3a9 100644 --- a/platform_app.te +++ b/platform_app.te @@ -27,13 +27,3 @@ allow platform_app media_rw_data_file:file create_file_perms; # Write to /cache. allow platform_app cache_file:dir create_dir_perms; allow platform_app cache_file:file create_file_perms; - -# Audited locally. -service_manager_local_audit_domain(platform_app) -auditallow platform_app { - service_manager_type - -mediaserver_service - -radio_service - -surfaceflinger_service - -system_server_service -}:service_manager find; diff --git a/radio.te b/radio.te index 5f45df33c6741c23c2becc1988206661a13d092a..d0018eac209daf5dab3fe238460d8fe447931417 100644 --- a/radio.te +++ b/radio.te @@ -28,13 +28,3 @@ auditallow radio system_radio_prop:property_service set; allow radio ctl_rildaemon_prop:property_service set; allow radio radio_service:service_manager add; - -# Audited locally. -service_manager_local_audit_domain(radio) -auditallow radio { - service_manager_type - -mediaserver_service - -radio_service - -surfaceflinger_service - -system_server_service -}:service_manager find; diff --git a/surfaceflinger.te b/surfaceflinger.te index ff91993ec4d3c14be974ae63850a8a483e094a1c..c5086120996b0ab444c463c4e5f8ab115f907600 100644 --- a/surfaceflinger.te +++ b/surfaceflinger.te @@ -59,14 +59,6 @@ allow surfaceflinger tee_device:chr_file rw_file_perms; allow surfaceflinger surfaceflinger_service:service_manager add; -# Audited locally. -service_manager_local_audit_domain(surfaceflinger) -auditallow surfaceflinger { - service_manager_type - -surfaceflinger_service - -system_server_service -}:service_manager find; - ### ### Neverallow rules ### diff --git a/system_app.te b/system_app.te index 5a5888f2ff1522b441421064bed4f6fd1efec73e..2a7421b39f76a6b08d75f8334b30b28affe987b1 100644 --- a/system_app.te +++ b/system_app.te @@ -64,14 +64,3 @@ allow system_app keystore:keystore_key { }; control_logd(system_app) - -# Audited locally. -service_manager_local_audit_domain(system_app) -auditallow system_app { - service_manager_type - -keystore_service - -nfc_service - -radio_service - -surfaceflinger_service - -system_server_service -}:service_manager find; diff --git a/system_server.te b/system_server.te index 9d973dbbcd956f59d07770879351ff3495863db3..9afd8afb8d26753f452b5fb47fcc5e90352f76e9 100644 --- a/system_server.te +++ b/system_server.te @@ -362,9 +362,6 @@ allow system_server pstorefs:file r_file_perms; allow system_server system_server_service:service_manager add; -# Audited locally. -service_manager_local_audit_domain(system_server) - allow system_server keystore:keystore_key { test get diff --git a/te_macros b/te_macros index b2913f3cdcf300920a7f488cd47bf90e8ee3db8d..7c1f6e5d87c9d07544fa7590e58db049ceed5b4b 100644 --- a/te_macros +++ b/te_macros @@ -109,7 +109,6 @@ typeattribute $1 appdomain; tmpfs_domain($1) # Map with PROT_EXEC. allow $1 $1_tmpfs:file execute; -service_manager_local_audit_domain($1) ') ##################################### @@ -359,11 +358,3 @@ define(`use_keystore', ` allow keystore $1:process getattr; binder_call($1, keystore) ') - -########################################### -# service_manager_local_audit_domain(domain) -# Has its own auditallow rule on service_manager -# and should be excluded from the domain.te auditallow. -define(`service_manager_local_audit_domain', ` - typeattribute $1 service_manager_local_audit; -') diff --git a/untrusted_app.te b/untrusted_app.te index c97b4513b8212c429aa286f23ce88d106fb3489d..f29149e3d2f8d39fc69cd3abcbbac1042599ecc1 100644 --- a/untrusted_app.te +++ b/untrusted_app.te @@ -64,19 +64,6 @@ allow untrusted_app media_rw_data_file:file create_file_perms; allow untrusted_app cache_file:dir create_dir_perms; allow untrusted_app cache_file:file create_file_perms; -# Audited locally. -service_manager_local_audit_domain(untrusted_app) -auditallow untrusted_app { - service_manager_type - -drmserver_service - -keystore_service - -mediaserver_service - -nfc_service - -radio_service - -surfaceflinger_service - -system_server_service -}:service_manager find; - ### ### neverallow rules ###