From f14f73545552564c813da865533b1be29893131f Mon Sep 17 00:00:00 2001
From: Mark Salyzyn <salyzyn@google.com>
Date: Tue, 17 Apr 2018 10:55:41 -0700
Subject: [PATCH] init: lock down access to keychord_device
The out-of-tree keychord driver is only intended for use by init.
Test: build
Bug: 64114943
Bug: 78174219
Change-Id: I96a7fbcd9a54a38625063606f5c4ab6d40d701f6
---
public/domain.te | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/public/domain.te b/public/domain.te
index 2856f2c6a..0e815b607 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -363,6 +363,14 @@ neverallow {
-system_server
-ueventd
} hw_random_device:chr_file *;
+# b/78174219 b/64114943
+neverallow {
+ domain
+ -init
+ -shell # stat of /dev, getattr only
+ -vendor_init
+ -ueventd
+} keychord_device:chr_file *;
# Ensure that all entrypoint executables are in exec_type or postinstall_file.
neverallow * { file_type -exec_type -postinstall_file }:file entrypoint;
--
GitLab