Evolution-X-Devices/device_google_gs101
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Start tracking vendor seapp coredomain violations

Browse Source 
As part of Treble, enforce that vendor's seapp_contexts can't label apps
using coredomains. Apps installed to system/system_ext/product should be
labeled with platform side sepolicy.

This change marks violating domains that need to be fixed.

Bug: 296512193
Test: build oriole and see build log
Change-Id: I7d5b91014362a64f3d66b3913d4d1bc773d922c8
This commit is contained in:
Inseob Kim
2023-08-21 17:31:29 +09:00
parent 2556ac667e
commit 80c26d2524
3 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
ambient/exo_app.te
View File

@@ -1,5 +1,8 @@
type exo_app, coredomain, domain;
# TODO(b/296512193): move exo_app out of vendor sepolicy
typeattribute exo_app vendor_seapp_assigns_coredomain_violators;
app_domain(exo_app)
net_domain(exo_app)

3
whitechapel/vendor/google/con_monitor.te vendored
View File

@@ -1,6 +1,9 @@
# ConnectivityMonitor app
type con_monitor_app, domain, coredomain;
# TODO(b/296512193): move con_monitor_app out of vendor sepolicy
typeattribute con_monitor_app vendor_seapp_assigns_coredomain_violators;
app_domain(con_monitor_app)
set_prop(con_monitor_app, radio_prop)

3
whitechapel/vendor/google/hbmsvmanager_app.te vendored
View File

@@ -1,5 +1,8 @@
type hbmsvmanager_app, domain, coredomain;
# TODO(b/296512193): move hbmsvmanager_app out of vendor sepolicy
typeattribute hbmsvmanager_app vendor_seapp_assigns_coredomain_violators;
app_domain(hbmsvmanager_app);
allow hbmsvmanager_app proc_vendor_sched:dir r_dir_perms;