Evolution-X-Tensor/device_google_gs-common
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ban hal_dumpstate_default from execute_no_trans

Browse source 
It keeps people from using my domain to do random things,
which causes VTS failure like b/364989823.

Bug: 371497180
Test: build pass and adb bugreport
build fail when ag/28359861 is around.

Change-Id: I438bf2b026718a46bb841ab5e656d11eec630960
This commit is contained in:
Adam Shih 2024-10-07 03:48:06 +00:00
parent 4923764120
commit f24bfe8ca3
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
gear/dumpstate/sepolicy/hal_dumpstate_default.te
View file

@ -5,3 +5,8 @@ allow hal_dumpstate_default radio_vendor_data_file:file create_file_perms;
allow hal_dumpstate_default shell_data_file:file getattr;
set_prop(hal_dumpstate_default, vendor_logger_prop)
# All dumps that are executed via hal_dumpstate_default should use their
# own domain to request their permissions to achieve compartmentalization.
# go/pixel-bugreport has examples on how to do that.
neverallow hal_dumpstate_default { vendor_file_type -vendor_toolbox_exec }:file execute_no_trans;