diff options
| author | Nick Kralevich <nnk@google.com> | 2015-02-25 13:28:40 -0800 |
|---|---|---|
| committer | Nick Kralevich <nnk@google.com> | 2015-02-25 13:35:17 -0800 |
| commit | 5cf3994d8ab039f9ba47164ef9d13e2ddb5e7acd (patch) | |
| tree | 14e351aa17d1b96caf5cf0dae396d42b14d223a9 /netd.te | |
| parent | 28ddd1042a2064f02cb55844180b9cafbce9e1c6 (diff) | |
| download | android_external_sepolicy-5cf3994d8ab039f9ba47164ef9d13e2ddb5e7acd.tar.gz android_external_sepolicy-5cf3994d8ab039f9ba47164ef9d13e2ddb5e7acd.tar.bz2 android_external_sepolicy-5cf3994d8ab039f9ba47164ef9d13e2ddb5e7acd.zip | |
Revert /proc/net related changes
Revert the tightening of /proc/net access. These changes
are causing a lot of denials, and I want additional time to
figure out a better solution.
Addresses the following denials (and many more):
avc: denied { read } for comm="SyncAdapterThre" name="stats" dev="proc" ino=X scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:proc_net:s0 tclass=file
avc: denied { read } for comm="facebook.katana" name="iface_stat_fmt" dev="proc" ino=X scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:proc_net:s0 tclass=file
avc: denied { read } for comm="IntentService[C" name="if_inet6" dev="proc" ino=X scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:proc_net:s0 tclass=file
avc: denied { read } for comm="dumpstate" name="iface_stat_all" dev="proc" ino=X scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file
This reverts commit 0f0324cc826afb9beefda802d496befe823a081e
and commit 99940d1af5719f1622fa2a17f8daf6cb21de3ad1
Bug: 9496886
Bug: 19034637
Change-Id: I436a6e3638ac9ed49afbee214e752fe2b0112868
Diffstat (limited to 'netd.te')
| -rw-r--r-- | netd.te | 3 |
1 files changed, 1 insertions, 2 deletions
@@ -24,8 +24,7 @@ allow netd system_file:file x_file_perms; allow netd devpts:chr_file rw_file_perms; # For /proc/sys/net/ipv[46]/route/flush. -allow netd proc_net:file rw_file_perms; -allow netd proc_net:dir r_dir_perms; +allow netd proc_net:file write; # For /sys/modules/bcmdhd/parameters/firmware_path # XXX Split into its own type. |