Skip to content
Snippets Groups Projects
  1. Jan 22, 2016
    • Jeff Vander Stoep's avatar
      Remove domain_deprecated from sdcard domains · 0c7bc58e
      Jeff Vander Stoep authored
      Remove from blkid, blkid_untrusted, fsck, fsck_untrusted, sdcardd and
      sgdisk.
      
      Tested by adding external sdcard with and without
      "adb shell sm set-force-adoptable true" command.
      
      Address the following denials:
      avc: denied { read } for name="swaps" dev="proc" ino=4026536590 scontext=u:r:fsck:s0 tcontext=u:object_r:proc:s0 tclass=file
      avc: denied { open } for path="/proc/swaps" dev="proc" ino=4026536590 scontext=u:r:fsck:s0 tcontext=u:object_r:proc:s0 tclass=file
      avc: denied { getattr } for path="/proc/swaps" dev="proc" ino=4026536590 scontext=u:r:fsck:s0 tcontext=u:object_r:proc:s0 tclass=file
      avc: denied { read } for name="filesystems" dev="proc" ino=4026536591 scontext=u:r:blkid:s0 tcontext=u:object_r:proc:s0 tclass=file
      avc: denied { open } for path="/proc/filesystems" dev="proc" ino=4026536591 scontext=u:r:blkid:s0 tcontext=u:object_r:proc:s0 tclass=file
      avc: denied { getattr } for path="/proc/filesystems" dev="proc" ino=4026536591 scontext=u:r:blkid:s0 tcontext=u:object_r:proc:s0 tclass=file
      
      Change-Id: I097e2ba5205e43f8ee613dae063f773a35ce3d73
      0c7bc58e
  2. Nov 03, 2015
    • Jeff Vander Stoep's avatar
      Create attribute for moving perms out of domain · d22987b4
      Jeff Vander Stoep authored
      Motivation: Domain is overly permissive. Start removing permissions
      from domain and assign them to the domain_deprecated attribute.
      Domain_deprecated and domain can initially be assigned to all
      domains. The goal is to not assign domain_deprecated to new domains
      and to start removing domain_deprecated where it is not required or
      reassigning the appropriate permissions to the inheriting domain
      when necessary.
      
      Bug: 25433265
      Change-Id: I8b11cb137df7bdd382629c98d916a73fe276413c
      d22987b4
  3. Apr 01, 2015
    • Jeff Sharkey's avatar
      Different blkid and fsck execution domains. · 84e1c611
      Jeff Sharkey authored
      vold works with two broad classes of block devices: untrusted devices
      that come in from the wild, and trusted devices.
      
      When running blkid and fsck, we pick which SELinux execution domain
      to use based on which class the device belongs to.
      
      Bug: 19993667
      Change-Id: I44f5bac5dd94f0f76f3e4ef50ddbde5a32bd17a5
      84e1c611
Loading