Allow ueventd to relabel block devices
There is a race in ueventd's coldboot procedure that permits creation of device block nodes before platform devices are registered. In this case the device node links used to compute the SELinux context are not known and the node is created under the generic context: u:object_r:block_device:s0. Ueventd has been patched to relabel the nodes on subsequent add events but it needs permissions to be allowed to do it. BUG=28388946 Change-Id: Ic836309527a2b81accc50df38bd753d54fa5e318 Signed-off-by: Mihai Serban <mihai.serban@intel.com>
This commit is contained in:
parent
30ad239d09
commit
d41ad55118
@ -332,6 +332,7 @@ neverallow {
|
||||
-update_engine
|
||||
-vold
|
||||
-recovery
|
||||
-ueventd
|
||||
} misc_block_device:blk_file { append link relabelfrom rename write open read ioctl lock };
|
||||
|
||||
# Only servicemanager should be able to register with binder as the context manager
|
||||
|
@ -21,7 +21,7 @@ allow ueventd tmpfs:chr_file rw_file_perms;
|
||||
allow ueventd dev_type:dir create_dir_perms;
|
||||
allow ueventd dev_type:lnk_file { create unlink };
|
||||
allow ueventd dev_type:chr_file { create setattr unlink };
|
||||
allow ueventd dev_type:blk_file { create setattr unlink };
|
||||
allow ueventd dev_type:blk_file { relabelfrom relabelto create setattr unlink };
|
||||
allow ueventd self:netlink_kobject_uevent_socket create_socket_perms;
|
||||
allow ueventd efs_file:dir search;
|
||||
allow ueventd efs_file:file r_file_perms;
|
||||
|
Loading…
Reference in New Issue
Block a user