diff options
| author | Nick Kralevich <nnk@google.com> | 2014-06-25 12:30:11 -0700 |
|---|---|---|
| committer | Nick Kralevich <nnk@google.com> | 2014-06-25 14:18:51 -0700 |
| commit | c0d14767e68f90138c8b017bf47e8b3e4fd1c01e (patch) | |
| tree | a9d4dc3be24fc6cd8ca4719077df8c76bf51b13a /dumpstate.te | |
| parent | 8c6552acfba677442d565a0c7f8e44f5f2af57f2 (diff) | |
| download | android_external_sepolicy-c0d14767e68f90138c8b017bf47e8b3e4fd1c01e.tar.gz android_external_sepolicy-c0d14767e68f90138c8b017bf47e8b3e4fd1c01e.tar.bz2 android_external_sepolicy-c0d14767e68f90138c8b017bf47e8b3e4fd1c01e.zip | |
dumpstate: transition into vdc domain
dumpstate uses vdc to collect asec lists and do a vold dump.
Force a transition into the vdc domain when this occurs.
Addresses the following denial:
<4>[ 1099.623572] type=1400 audit(1403716545.565:7): avc: denied { execute } for pid=6987 comm="dumpstate" name="vdc" dev="mmcblk0p8" ino=222 scontext=u:r:dumpstate:s0 tcontext=u:object_r:vdc_exec:s0 tclass=file permissive=0
Change-Id: I4bd9f3ad83480f8c9f9843ffe136295c582f96fe
Diffstat (limited to 'dumpstate.te')
| -rw-r--r-- | dumpstate.te | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/dumpstate.te b/dumpstate.te index e4d6dc9..2221222 100644 --- a/dumpstate.te +++ b/dumpstate.te @@ -49,8 +49,8 @@ allow dumpstate { appdomain system_server }:process signal; # This list comes from native_processes_to_dump in dumpstate/utils.c allow dumpstate { drmserver mediaserver sdcardd surfaceflinger }:process signal; -# The vdc command needs to talk to the vold socket. -unix_socket_connect(dumpstate, vold, vold) +# Execute and transition to the vdc domain +domain_auto_trans(dumpstate, vdc_exec, vdc) # Vibrate the device after we're done collecting the bugreport # /sys/class/timed_output/vibrator/enable |