diff options
| author | Nick Kralevich <nnk@google.com> | 2014-10-23 12:12:58 -0700 |
|---|---|---|
| committer | Nick Kralevich <nnk@google.com> | 2014-10-23 12:12:58 -0700 |
| commit | 683ac49d9d2f7dafcc4204f737747117a5d72e4e (patch) | |
| tree | 5e60a9125130edb3fd42208ee4237fbafd7a0823 /recovery.te | |
| parent | 2c38b3b8099a26d4da1dead2d1f87f616f4df6fd (diff) | |
| download | android_external_sepolicy-683ac49d9d2f7dafcc4204f737747117a5d72e4e.tar.gz android_external_sepolicy-683ac49d9d2f7dafcc4204f737747117a5d72e4e.tar.bz2 android_external_sepolicy-683ac49d9d2f7dafcc4204f737747117a5d72e4e.zip | |
recovery: allow changing unlabeled symbolic links
Currently, recovery is allowed write access to the following three
file labels:
* system_file (directories, files, and symbolic links)
* exec_type (directories, files, and symbolic links)
* unlabeled (directory and files)
system_file is the default label on all files in /system. exec_type
is the attribute used to mark executables on /system.
The third file type, "unlabeled", refers to filesystem objects where
the label hasn't been set, or a label is set but isn't defined by the
currently loaded policy.
The current policy only allows unlabeled files or directories to
be modified. Symbolic links were accidentally excluded. This causes
problems when trying to fix up labels/permissions on unlabeled
symbolic links.
Allow unlabeled symbolic link modifications.
Bug: 18079773
Change-Id: I8e5c33602cdc38ec9a95b4e83f9ccbb06fe9da7c
Diffstat (limited to 'recovery.te')
| -rw-r--r-- | recovery.te | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/recovery.te b/recovery.te index 75a024c..204c096 100644 --- a/recovery.te +++ b/recovery.te @@ -29,7 +29,7 @@ recovery_only(` # We may be asked to set an SELinux label for a type not known to the # currently loaded policy. Allow it. - allow recovery unlabeled:file { create_file_perms relabelfrom relabelto }; + allow recovery unlabeled:{ file lnk_file } { create_file_perms relabelfrom relabelto }; allow recovery unlabeled:dir { create_dir_perms relabelfrom relabelto }; # 0eb17d944704b3eb140bb9dded299d3be3aed77e in build/ added SELinux |