PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add dontaudit dnsmasq kernel:system module_request

Browse Source 
This was originally added due to:
  avc: denied { module_request } for comm="dnsmasq" kmod="netdev-bt-pan" scontext=u:r:dnsmasq:s0 tcontext=u:r:kernel:s0 tclass=system permissive=0
in wahoo specific selinux policy in commit cd761300c1cc67cb2be3e001b95317e8a865c5fe 'Allow some denials we have seen.'

This is most likely simply triggered by a race condition on attempting
to access a non existent network device 'bt-pan'.

While we've never seen this anywhere else, it could potentially happen
on any device so we might as well make this global...

Test: N/A
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: I00f61a5fc2bfce604badf3b96f6ed808157eb78c
This commit is contained in:
Maciej Żenczykowski 2020-01-18 18:22:03 -08:00
parent 7eca7d1e9b
commit 4a865b3089
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
public/dnsmasq.te
View File

@ -23,3 +23,6 @@ allow dnsmasq netd:netlink_route_socket { read write };
allow dnsmasq netd:unix_stream_socket { getattr read write }; allow dnsmasq netd:unix_stream_socket { getattr read write };
allow dnsmasq netd:unix_dgram_socket { read write }; allow dnsmasq netd:unix_dgram_socket { read write };
allow dnsmasq netd:udp_socket { read write }; allow dnsmasq netd:udp_socket { read write };
# sometimes a network device vanishes and we try to load module netdev-{devicename}
dontaudit dnsmasq kernel:system module_request;