PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Abolish calls to shell in vold

Browse Source 
Never use popen, just execvp directly

Test: Two tests
- Ensure Marlin device boots and vold_prepare_subdirs is called
successfully
- Try adb shell sm set-virtual-disk true, see that eg sgdisk output is
logged.
Bug: 26735063
Bug: 113796163

Change-Id: Icb34140429db85098a0118a2b833772e3620e7ac
This commit is contained in:
Paul Crowley 2018-11-30 15:58:26 -08:00
parent 2725edc658
commit f9f7539430
2 changed files with 2 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
private/vold.te
View File

@ -8,8 +8,8 @@ domain_auto_trans(vold, sdcardd_exec, sdcardd);
# For a handful of probing tools, we choose an even more restrictive
# domain when working with untrusted block devices
domain_trans(vold, shell_exec, blkid);
domain_trans(vold, shell_exec, blkid_untrusted);
domain_trans(vold, blkid_exec, blkid);
domain_trans(vold, blkid_exec, blkid_untrusted);
domain_trans(vold, fsck_exec, fsck);
domain_trans(vold, fsck_exec, fsck_untrusted);

3
public/vold.te
View File

@ -31,9 +31,6 @@ allow vold file_contexts_file:file r_file_perms;
# Allow us to jump into execution domains of above tools
allow vold self:process setexec;
# For sgdisk launched through popen()
allow vold shell_exec:file rx_file_perms;
# For formatting adoptable storage devices
allow vold e2fs_exec:file rx_file_perms;