kernel: remove domain_deprecated attribute
No "granted" messages for the removed permissions observed in three months of log audits. Bug: 28760354 Change-Id: I6bd9525b663a2bdad4f5b2d4a85d3dd46d5fd106
This commit is contained in:
parent
bff9801521
commit
108677ceba
@ -29,9 +29,9 @@ auditallow { domain_deprecated -appdomain -system_server } adbd:unix_stream_sock
|
||||
allow domain_deprecated rootfs:dir r_dir_perms;
|
||||
allow domain_deprecated rootfs:file r_file_perms;
|
||||
allow domain_deprecated rootfs:lnk_file r_file_perms;
|
||||
auditallow { domain_deprecated -healthd -init -installd -kernel -priv_app -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:dir { open getattr read ioctl lock }; # search granted in domain
|
||||
auditallow { domain_deprecated -healthd -init -installd -kernel -priv_app -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:file r_file_perms;
|
||||
auditallow { domain_deprecated -appdomain -healthd -init -installd -kernel -priv_app -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:lnk_file { getattr open ioctl lock }; # read granted in domain
|
||||
auditallow { domain_deprecated -healthd -init -installd -priv_app -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:dir { open getattr read ioctl lock }; # search granted in domain
|
||||
auditallow { domain_deprecated -healthd -init -installd -priv_app -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:file r_file_perms;
|
||||
auditallow { domain_deprecated -appdomain -healthd -init -installd -priv_app -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:lnk_file { getattr open ioctl lock }; # read granted in domain
|
||||
|
||||
# Device accesses.
|
||||
allow domain_deprecated device:file read;
|
||||
@ -89,8 +89,8 @@ r_dir_file(domain_deprecated, cgroup)
|
||||
allow domain_deprecated proc_meminfo:file r_file_perms;
|
||||
r_dir_file(domain_deprecated, proc_net)
|
||||
#auditallow domain_deprecated proc:dir r_dir_perms; # r_dir_perms granted in domain
|
||||
auditallow { domain_deprecated -fsck -fsck_untrusted -init -kernel -logd -priv_app -rild -system_server -vold } proc:file r_file_perms;
|
||||
auditallow { domain_deprecated -fsck -fsck_untrusted -init -kernel -logd -priv_app -rild -system_server -vold } proc:lnk_file { open ioctl lock }; # getattr read granted in domain
|
||||
auditallow { domain_deprecated -fsck -fsck_untrusted -init -logd -priv_app -rild -system_server -vold } proc:file r_file_perms;
|
||||
auditallow { domain_deprecated -fsck -fsck_untrusted -init -logd -priv_app -rild -system_server -vold } proc:lnk_file { open ioctl lock }; # getattr read granted in domain
|
||||
auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -priv_app -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:dir { open getattr read ioctl lock }; # search granted in domain
|
||||
auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -priv_app -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:file r_file_perms;
|
||||
auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -priv_app -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:lnk_file { getattr open ioctl lock }; # read granted in domain
|
||||
@ -105,8 +105,8 @@ auditallow { domain_deprecated -appdomain -clatd -init -logd -netd -system_serve
|
||||
# Get SELinux enforcing status.
|
||||
allow domain_deprecated selinuxfs:dir r_dir_perms;
|
||||
allow domain_deprecated selinuxfs:file r_file_perms;
|
||||
auditallow { domain_deprecated -appdomain -debuggerd -drmserver -init -installd -kernel -keystore -postinstall_dexopt -runas -servicemanager -system_server -ueventd -zygote } selinuxfs:dir { open getattr read ioctl lock }; # search granted in domain
|
||||
auditallow { domain_deprecated -appdomain -debuggerd -drmserver -init -installd -kernel -keystore -postinstall_dexopt -runas -servicemanager -system_server -ueventd -zygote } selinuxfs:file { open read ioctl lock }; # getattr granted in domain
|
||||
auditallow { domain_deprecated -appdomain -debuggerd -drmserver -init -installd -keystore -postinstall_dexopt -runas -servicemanager -system_server -ueventd -zygote } selinuxfs:dir { open getattr read ioctl lock }; # search granted in domain
|
||||
auditallow { domain_deprecated -appdomain -debuggerd -drmserver -init -installd -keystore -postinstall_dexopt -runas -servicemanager -system_server -ueventd -zygote } selinuxfs:file { open read ioctl lock }; # getattr granted in domain
|
||||
|
||||
# World readable asec image contents
|
||||
allow domain_deprecated asec_public_file:file r_file_perms;
|
||||
|
Loading…
Reference in New Issue
Block a user