From d41ad551189c1b7be26a1807980418858b2a132e Mon Sep 17 00:00:00 2001
From: Mihai Serban <mihai.serban@intel.com>
Date: Mon, 25 Apr 2016 18:20:26 +0300
Subject: [PATCH] Allow ueventd to relabel block devices
There is a race in ueventd's coldboot procedure that permits creation
of device block nodes before platform devices are registered. In this case
the device node links used to compute the SELinux context are not known
and the node is created under the generic context: u:object_r:block_device:s0.
Ueventd has been patched to relabel the nodes on subsequent add events but
it needs permissions to be allowed to do it.
BUG=28388946
Change-Id: Ic836309527a2b81accc50df38bd753d54fa5e318
Signed-off-by: Mihai Serban <mihai.serban@intel.com>
---
domain.te | 1 +
ueventd.te | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/domain.te b/domain.te
index c575bdf57..11dd58c56 100644
--- a/domain.te
+++ b/domain.te
@@ -332,6 +332,7 @@ neverallow {
-update_engine
-vold
-recovery
+ -ueventd
} misc_block_device:blk_file { append link relabelfrom rename write open read ioctl lock };
# Only servicemanager should be able to register with binder as the context manager
diff --git a/ueventd.te b/ueventd.te
index e44620728..3c4ba20b8 100644
--- a/ueventd.te
+++ b/ueventd.te
@@ -21,7 +21,7 @@ allow ueventd tmpfs:chr_file rw_file_perms;
allow ueventd dev_type:dir create_dir_perms;
allow ueventd dev_type:lnk_file { create unlink };
allow ueventd dev_type:chr_file { create setattr unlink };
-allow ueventd dev_type:blk_file { create setattr unlink };
+allow ueventd dev_type:blk_file { relabelfrom relabelto create setattr unlink };
allow ueventd self:netlink_kobject_uevent_socket create_socket_perms;
allow ueventd efs_file:dir search;
allow ueventd efs_file:file r_file_perms;
--
GitLab