Label and allow access to /data/system/ndebugsocket.
Otherwise it defaults to the label of /data/system and cannot be distinguished from any other socket in that directory. Also adds allow rule required for pre-existing wpa_socket transition to function without unconfined_domain. Change-Id: I57179aa18786bd56d247f397347e546cca978e41 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
This commit is contained in:
parent
189558f64a
commit
45ba665cfc
@ -7,3 +7,6 @@ init_daemon_domain(debuggerd)
|
||||
unconfined_domain(debuggerd)
|
||||
relabelto_domain(debuggerd)
|
||||
allow debuggerd tombstone_data_file:dir relabelto;
|
||||
|
||||
# Connect to system_server via /data/system/ndebugsocket.
|
||||
unix_socket_connect(debuggerd, system_ndebug, system_server)
|
||||
|
1
file.te
1
file.te
@ -98,6 +98,7 @@ type racoon_socket, file_type;
|
||||
type rild_socket, file_type;
|
||||
type rild_debug_socket, file_type;
|
||||
type system_wpa_socket, file_type;
|
||||
type system_ndebug_socket, file_type;
|
||||
type vold_socket, file_type;
|
||||
type wpa_socket, file_type;
|
||||
type zygote_socket, file_type;
|
||||
|
@ -25,6 +25,12 @@ allow system_server self:capability {
|
||||
|
||||
# Create a socket for receiving info from wpa.
|
||||
type_transition system_server wifi_data_file:sock_file system_wpa_socket;
|
||||
allow system_server system_wpa_socket:sock_file create_file_perms;
|
||||
|
||||
# Create a socket for connections from debuggerd.
|
||||
type_transition system_server system_data_file:sock_file system_ndebug_socket "ndebugsocket";
|
||||
allow system_server system_ndebug_socket:sock_file create_file_perms;
|
||||
|
||||
allow system_server self:zygote { specifyids specifyrlimits specifyseinfo };
|
||||
|
||||
allow system_server backup_data_file:dir relabelto;
|
||||
|
Loading…
Reference in New Issue
Block a user