d419ed8fb7
CAP_SYS_PTRACE is no longer used by crash_dump. There's no reason to exclude it from the neverallow compile time assertion. Test: policy compiles. Change-Id: Ib2dced19091406553c16e6ce538cfb68bbc1e5aa
16 lines
463 B
Plaintext
16 lines
463 B
Plaintext
# Transition to crash_dump when /system/bin/crash_dump* is executed.
|
|
# This occurs when the process crashes.
|
|
domain_auto_trans(domain, crash_dump_exec, crash_dump);
|
|
allow domain crash_dump:process sigchld;
|
|
|
|
# Limit ability to ptrace or read sensitive /proc/pid files of processes
|
|
# with other UIDs to these whitelisted domains.
|
|
neverallow {
|
|
domain
|
|
-vold
|
|
-dumpstate
|
|
-storaged
|
|
-system_server
|
|
userdebug_or_eng(`-perfprofd')
|
|
} self:capability sys_ptrace;
|