From 108677ceba599e0f47d52f73e8886ceb2a80d1e5 Mon Sep 17 00:00:00 2001 From: Jeff Vander Stoep Date: Sun, 11 Sep 2016 21:18:05 -0700 Subject: [PATCH] kernel: remove domain_deprecated attribute No "granted" messages for the removed permissions observed in three months of log audits. Bug: 28760354 Change-Id: I6bd9525b663a2bdad4f5b2d4a85d3dd46d5fd106 --- domain_deprecated.te | 14 +++++++------- kernel.te | 2 +- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/domain_deprecated.te b/domain_deprecated.te index b0a6addd6..6943ffd5c 100644 --- a/domain_deprecated.te +++ b/domain_deprecated.te @@ -29,9 +29,9 @@ auditallow { domain_deprecated -appdomain -system_server } adbd:unix_stream_sock allow domain_deprecated rootfs:dir r_dir_perms; allow domain_deprecated rootfs:file r_file_perms; allow domain_deprecated rootfs:lnk_file r_file_perms; -auditallow { domain_deprecated -healthd -init -installd -kernel -priv_app -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:dir { open getattr read ioctl lock }; # search granted in domain -auditallow { domain_deprecated -healthd -init -installd -kernel -priv_app -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:file r_file_perms; -auditallow { domain_deprecated -appdomain -healthd -init -installd -kernel -priv_app -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:lnk_file { getattr open ioctl lock }; # read granted in domain +auditallow { domain_deprecated -healthd -init -installd -priv_app -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:dir { open getattr read ioctl lock }; # search granted in domain +auditallow { domain_deprecated -healthd -init -installd -priv_app -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:file r_file_perms; +auditallow { domain_deprecated -appdomain -healthd -init -installd -priv_app -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:lnk_file { getattr open ioctl lock }; # read granted in domain # Device accesses. allow domain_deprecated device:file read; @@ -89,8 +89,8 @@ r_dir_file(domain_deprecated, cgroup) allow domain_deprecated proc_meminfo:file r_file_perms; r_dir_file(domain_deprecated, proc_net) #auditallow domain_deprecated proc:dir r_dir_perms; # r_dir_perms granted in domain -auditallow { domain_deprecated -fsck -fsck_untrusted -init -kernel -logd -priv_app -rild -system_server -vold } proc:file r_file_perms; -auditallow { domain_deprecated -fsck -fsck_untrusted -init -kernel -logd -priv_app -rild -system_server -vold } proc:lnk_file { open ioctl lock }; # getattr read granted in domain +auditallow { domain_deprecated -fsck -fsck_untrusted -init -logd -priv_app -rild -system_server -vold } proc:file r_file_perms; +auditallow { domain_deprecated -fsck -fsck_untrusted -init -logd -priv_app -rild -system_server -vold } proc:lnk_file { open ioctl lock }; # getattr read granted in domain auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -priv_app -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:dir { open getattr read ioctl lock }; # search granted in domain auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -priv_app -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:file r_file_perms; auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -priv_app -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:lnk_file { getattr open ioctl lock }; # read granted in domain @@ -105,8 +105,8 @@ auditallow { domain_deprecated -appdomain -clatd -init -logd -netd -system_serve # Get SELinux enforcing status. allow domain_deprecated selinuxfs:dir r_dir_perms; allow domain_deprecated selinuxfs:file r_file_perms; -auditallow { domain_deprecated -appdomain -debuggerd -drmserver -init -installd -kernel -keystore -postinstall_dexopt -runas -servicemanager -system_server -ueventd -zygote } selinuxfs:dir { open getattr read ioctl lock }; # search granted in domain -auditallow { domain_deprecated -appdomain -debuggerd -drmserver -init -installd -kernel -keystore -postinstall_dexopt -runas -servicemanager -system_server -ueventd -zygote } selinuxfs:file { open read ioctl lock }; # getattr granted in domain +auditallow { domain_deprecated -appdomain -debuggerd -drmserver -init -installd -keystore -postinstall_dexopt -runas -servicemanager -system_server -ueventd -zygote } selinuxfs:dir { open getattr read ioctl lock }; # search granted in domain +auditallow { domain_deprecated -appdomain -debuggerd -drmserver -init -installd -keystore -postinstall_dexopt -runas -servicemanager -system_server -ueventd -zygote } selinuxfs:file { open read ioctl lock }; # getattr granted in domain # World readable asec image contents allow domain_deprecated asec_public_file:file r_file_perms; diff --git a/kernel.te b/kernel.te index 3b7794709..3608a1020 100644 --- a/kernel.te +++ b/kernel.te @@ -1,5 +1,5 @@ # Life begins with the kernel. -type kernel, domain, domain_deprecated, mlstrustedsubject; +type kernel, domain, mlstrustedsubject; allow kernel self:capability sys_nice;