diff options
| author | Narayan Kamath <narayan@google.com> | 2016-08-23 17:02:57 +0100 |
|---|---|---|
| committer | gitbuildkicker <android-build@google.com> | 2016-09-27 15:56:25 -0700 |
| commit | 21658af93cc6f83902a6d883957a353ed4700b13 (patch) | |
| tree | 3025b35a9e7755338157c7d311e78d26354d3bb5 | |
| parent | f2b123a5a31ac9ee7abfe1ebb4fffe1c846120bc (diff) | |
| download | android_external_sepolicy-21658af93cc6f83902a6d883957a353ed4700b13.tar.gz android_external_sepolicy-21658af93cc6f83902a6d883957a353ed4700b13.tar.bz2 android_external_sepolicy-21658af93cc6f83902a6d883957a353ed4700b13.zip | |
Allow the zygote to stat all files it opens.
bug: 30963384
Change-Id: I62b5ffd43469dbb0bba67e1bb1d3416e7354f9e5
(cherry picked from commit 3ff0b0282688c3776904b8e5409a4dfb7f231e73)
| -rw-r--r-- | zygote.te | 7 |
1 files changed, 7 insertions, 0 deletions
@@ -37,6 +37,13 @@ allow zygote dex2oat_exec:file rx_file_perms; # Control cgroups. allow zygote cgroup:dir create_dir_perms; allow zygote self:capability sys_admin; +# Allow zygote to stat the files that it opens. The zygote must +# be able to inspect them so that it can reopen them on fork +# if necessary: b/30963384 +# allow zygote pmsg_device:chr_file { getattr }; +allow zygote debugfs:dir search; +allow zygote debugfs:file { getattr }; + # Check validity of SELinux context before use. selinux_check_context(zygote) # Check SELinux permissions. |