From c29b2fc4236873d6addb67d12c109390d03e2590 Mon Sep 17 00:00:00 2001
From: Nick Kralevich <nnk@google.com>
Date: Wed, 13 Jan 2016 16:37:20 -0800
Subject: [PATCH] drop dhcp auditallow
toolbox_exec is executed by dhcpcd-run-hooks.
Addresses the following auditallow log spam:
avc: granted { read open } for comm="dhcpcd-run-hook" path="/system/bin/toybox" dev="dm-0" ino=650 scontext=u:r:dhcp:s0 tcontext=u:object_r:toolbox_exec:s0 tclass=file
avc: granted { read } for comm="setprop" name="toybox" dev="dm-0" ino=650 scontext=u:r:dhcp:s0 tcontext=u:object_r:toolbox_exec:s0 tclass=file
avc: granted { execute } for comm="dhcpcd-run-hook" name="toybox" dev="dm-0" ino=650 scontext=u:r:dhcp:s0 tcontext=u:object_r:toolbox_exec:s0 tclass=file
avc: granted { execute_no_trans } for comm="dhcpcd-run-hook" path="/system/bin/toybox" dev="dm-0" ino=650 scontext=u:r:dhcp:s0 tcontext=u:object_r:toolbox_exec:s0 tclass=file
avc: granted { read execute } for comm="setprop" path="/system/bin/toybox" dev="dm-0" ino=639 scontext=u:r:dhcp:s0 tcontext=u:object_r:toolbox_exec:s0 tclass=file
Change-Id: Ib83c291961a5573397830032a67a2f6861ae2e71
---
dhcp.te | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/dhcp.te b/dhcp.te
index 548a37c2d..a858e080f 100644
--- a/dhcp.te
+++ b/dhcp.te
@@ -11,9 +11,10 @@ allow dhcp self:packet_socket create_socket_perms;
allow dhcp self:netlink_route_socket nlmsg_write;
allow dhcp shell_exec:file rx_file_perms;
allow dhcp system_file:file rx_file_perms;
-# XXX Run toolbox. Might not be needed.
+
+# dhcpcd runs dhcpcd-hooks/*, which runs getprop / setprop (toolbox_exec)
allow dhcp toolbox_exec:file rx_file_perms;
-auditallow dhcp toolbox_exec:file rx_file_perms;
+
# For /proc/sys/net/ipv4/conf/*/promote_secondaries
allow dhcp proc_net:file write;
--
GitLab