PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add neverallow rule for set_context_mgr.

Browse Source 
Change-Id: Ie7c2bf623dcfe246fa5e60b0775b6bb38869d8cb
This commit is contained in:
dcashman 2014-12-05 14:30:30 -08:00
parent 0be02b360f
commit 76f3fe33d7
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
domain.te
View File

@ -329,3 +329,6 @@ neverallow { domain -recovery } system_block_device:blk_file write;
# No domains other than install_recovery or recovery can write to recovery.
neverallow { domain -install_recovery -recovery } recovery_block_device:blk_file write;
# Only servicemanager should be able to register with binder as the context manager
neverallow { domain -servicemanager } *:binder set_context_mgr;