Evolution-X-Tensor/device_google_gs201
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Grant init_citadel access

Browse source 
Test: boot to home under enforcing mode
Bug: 205655298
Bug: 205779736
Bug: 205904401
Change-Id: Ia7c1033240970122f3af79428bdb9012dcbc9d45
This commit is contained in:
Adam Shih 2022-01-03 10:34:49 +08:00 • committed by TreeHugger Robot
parent b627a2f18b
commit 70d78900fd
2 changed files with 10 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

10
dauntless/init_citadel.te
View file

@ -2,4 +2,14 @@ type init_citadel, domain;
type init_citadel_exec, exec_type, vendor_file_type, file_type;
init_daemon_domain(init_citadel)
# Citadel communication must be via citadeld
vndbinder_use(init_citadel)
binder_call(init_citadel, citadeld)
allow init_citadel citadeld_service:service_manager find;
# Many standard utils are actually vendor_toolbox (like xxd)
allow init_citadel vendor_toolbox_exec:file rx_file_perms;
# init_citadel needs to invoke citadel_updater
allow init_citadel citadel_updater:file rx_file_perms;

12
tracking_denials/init_citadel.te
View file

@ -1,12 +0,0 @@
# b/205655298
dontaudit init_citadel vndbinder_device:chr_file { ioctl };
dontaudit init_citadel vndbinder_device:chr_file { map };
dontaudit init_citadel vndbinder_device:chr_file { open };
dontaudit init_citadel vndbinder_device:chr_file { read };
dontaudit init_citadel vndbinder_device:chr_file { write };
# b/205779736
dontaudit init_citadel citadel_updater:file { execute_no_trans };
dontaudit init_citadel vendor_toolbox_exec:file { execute_no_trans };
# b/205904401
dontaudit init_citadel citadeld:binder { call };
dontaudit init_citadel vndservicemanager:binder { call };