acc0842c4b
With the exception of the factory reset protection block device, don't allow system_server to read or write to any other block devices. This helps protect against a system->root escalation when system_server has the ability to directly minipulate raw block devices / partitions / partition tables. This change adds a neverallow rule, which is a compile time assertion that no SELinux policy is written which allows this access. No new rules are added or removed. Change-Id: I388408423097ef7cf4950197b79d4be9d666362c
7 lines
369 B
Plaintext
7 lines
369 B
Plaintext
#
|
|
# Common neverallow permissions
|
|
define(`no_w_file_perms', `{ append create link unlink relabelfrom rename setattr write }')
|
|
define(`no_rw_file_perms', `{ no_w_file_perms open read ioctl lock }')
|
|
define(`no_x_file_perms', `{ execute execute_no_trans }')
|
|
define(`no_w_dir_perms', `{ add_name create link relabelfrom remove_name rename reparent rmdir setattr write }')
|