bf254b46ad
The su domain is always permissive, and will always be permissive.
It never makes sense to show su related denials, as they just cause
a false sense of alarm.
Suppress service_manager related denials. For example:
SELinux : avc: denied { find } for service=SurfaceFlinger scontext=u:r:su:s0 tcontext=u:object_r:surfaceflinger_service:s0 tclass=service_manager
SELinux : avc: denied { find } for service=activity scontext=u:r:su:s0 tcontext=u:object_r:system_server_service:s0 tclass=service_manager
While I'm here, suppress other recent additionsl to security_classes as
well (keystore_key, debuggerd, drmservice)
Change-Id: I844ad8da5ada09775646b5f32c9405e7b73797f9
49 lines
1.7 KiB
Plaintext
49 lines
1.7 KiB
Plaintext
# File types must be defined for file_contexts.
|
|
type su_exec, exec_type, file_type;
|
|
|
|
userdebug_or_eng(`
|
|
# Domain used for su processes, as well as for adbd and adb shell
|
|
# after performing an adb root command. The domain definition is
|
|
# wrapped to ensure that it does not exist at all on -user builds.
|
|
type su, domain, mlstrustedsubject;
|
|
domain_auto_trans(shell, su_exec, su)
|
|
|
|
# Allow dumpstate to call su on userdebug / eng builds to collect
|
|
# additional information.
|
|
domain_auto_trans(dumpstate, su_exec, su)
|
|
|
|
# su is also permissive to permit setenforce.
|
|
permissive su;
|
|
|
|
# Add su to various domains
|
|
net_domain(su)
|
|
app_domain(su)
|
|
|
|
dontaudit su self:capability_class_set *;
|
|
dontaudit su kernel:security *;
|
|
dontaudit su kernel:system *;
|
|
dontaudit su self:memprotect *;
|
|
dontaudit su domain:process *;
|
|
dontaudit su domain:fd *;
|
|
dontaudit su domain:dir *;
|
|
dontaudit su domain:lnk_file *;
|
|
dontaudit su domain:{ fifo_file file } *;
|
|
dontaudit su domain:socket_class_set *;
|
|
dontaudit su domain:ipc_class_set *;
|
|
dontaudit su domain:key *;
|
|
dontaudit su fs_type:filesystem *;
|
|
dontaudit su {fs_type dev_type file_type}:dir_file_class_set *;
|
|
dontaudit su node_type:node *;
|
|
dontaudit su node_type:{ tcp_socket udp_socket rawip_socket } *;
|
|
dontaudit su netif_type:netif *;
|
|
dontaudit su port_type:socket_class_set *;
|
|
dontaudit su port_type:{ tcp_socket dccp_socket } *;
|
|
dontaudit su domain:peer *;
|
|
dontaudit su domain:binder *;
|
|
dontaudit su property_type:property_service *;
|
|
dontaudit su service_manager_type:service_manager *;
|
|
dontaudit su keystore:keystore_key *;
|
|
dontaudit su domain:debuggerd *;
|
|
dontaudit su domain:drmservice *;
|
|
')
|