Evolution-X-Tensor/device_google_gs101
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix denials for ril_config_service_app

Browse source 
- RilConfigService is a common google project in vendor/google/tools,
  sync related rules from the previous project(ag/6697240, ag/7153946)
  to allow it to:
  (1) receive intents
  (2) update database files under /data/vendor/radio
  (3) update RIL properties
- Two new denials found in this project only:
  avc: denied { search } for name="data" dev="dm-7" ino=93
      scontext=u:r:ril_config_service_app:s0
      tcontext=u:object_r:system_data_file:s0:c512,c768 tclass=dir permissive=1
  avc: denied { search } for name="0" dev="dm-7" ino=192
      scontext=u:r:ril_config_service_app:s0
      tcontext=u:object_r:user_profile_root_file:s0:c512,c768 tclass=dir permissive=1

Bug: 182715439
Test: apply these rules and check there is no denial for
      RilConfigService finally
Change-Id: Icfb0e121d0d11600bda900dff0511187518105ab
This commit is contained in:
Hongbo Zeng 2021-03-23 16:26:28 +08:00
parent fd45b5ef27
commit 4211025746
2 changed files with 12 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
whitechapel/vendor/google/ril_config_service.te vendored Normal file
View file

@ -0,0 +1,9 @@
type ril_config_service_app, domain;
app_domain(ril_config_service_app)
set_prop(ril_config_service_app, vendor_rild_prop)
allow ril_config_service_app app_api_service:service_manager find;
allow ril_config_service_app radio_vendor_data_file:dir rw_dir_perms;
allow ril_config_service_app radio_vendor_data_file:file create_file_perms;
dontaudit ril_config_service_app system_data_file:dir search;
dontaudit ril_config_service_app user_profile_root_file:dir search;

3
whitechapel/vendor/google/seapp_contexts vendored
View file

@ -37,3 +37,6 @@ user=_app isPrivApp=true seinfo=mds name=com.google.mds domain=modem_diagnostic_
# Domain for connectivity monitor
user=_app isPrivApp=true seinfo=platform name=com.google.android.connectivitymonitor domain=con_monitor_app type=app_data_file levelFrom=all
# RIL Config Service
user=radio isPrivApp=true seinfo=platform name=com.google.RilConfigService domain=ril_config_service_app type=app_data_file