Evolution-X-Tensor/device_google_gs-common
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge "ban hal_dumpstate_default from execute_no_trans" into main

Browse source
This commit is contained in:
Adam Shih 2024-10-08 03:13:54 +00:00 • committed by Android (Google) Code Review
commit fa448be01f
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
gear/dumpstate/sepolicy/hal_dumpstate_default.te
View file

@ -5,3 +5,8 @@ allow hal_dumpstate_default radio_vendor_data_file:file create_file_perms;
allow hal_dumpstate_default shell_data_file:file getattr;
set_prop(hal_dumpstate_default, vendor_logger_prop)
# All dumps that are executed via hal_dumpstate_default should use their
# own domain to request their permissions to achieve compartmentalization.
# go/pixel-bugreport has examples on how to do that.
neverallow hal_dumpstate_default { vendor_file_type -vendor_toolbox_exec }:file execute_no_trans;