d46b5d3519
vendor implementations need to be able to run modprobe as part of init.rc scripts. They cannot do so because of the strict neverallow currently in place that disallows all coredomains (including init) to execute vendor toybox. Fix this by adding init to the exception list for the neverallow so vendors can then run modprobe from .rc scripts and also add the rule to allow init to transition to modprobe domain using vendor_toolbox. Bug: b/38212864 Test: Boot sailfish Change-Id: Ib839246954e9002859f3ba986094f206bfead137 Signed-off-by: Sandeep Patil <sspatil@google.com>
17 lines
599 B
Plaintext
17 lines
599 B
Plaintext
# Toolbox installation for vendor binaries / scripts
|
|
# Non-vendor processes are not allowed to execute the binary
|
|
# and is always executed without transition.
|
|
type vendor_toolbox_exec, exec_type, vendor_file_type, file_type;
|
|
|
|
# Do not allow domains to transition to vendor toolbox
|
|
# or read, execute the vendor_toolbox file.
|
|
full_treble_only(`
|
|
# Do not allow non-vendor domains to transition
|
|
# to vendor toolbox except for the whitelisted domains.
|
|
neverallow {
|
|
coredomain
|
|
-init
|
|
-modprobe
|
|
} vendor_toolbox_exec:file { entrypoint execute execute_no_trans };
|
|
')
|