diff options
author | repo sync <gcondra@google.com> | 2013-05-17 17:11:29 -0700 |
---|---|---|
committer | repo sync <gcondra@google.com> | 2013-05-20 11:08:05 -0700 |
commit | 77d4731e9d30c8971e076e2469d6957619019921 (patch) | |
tree | a09ca764a3474bfaf20c0aafee0bf3a907d382fe /rild.te | |
parent | 42cabf341c8a600a218023ec69b3518e3d3d482c (diff) | |
download | android_external_sepolicy-77d4731e9d30c8971e076e2469d6957619019921.tar.gz android_external_sepolicy-77d4731e9d30c8971e076e2469d6957619019921.tar.bz2 android_external_sepolicy-77d4731e9d30c8971e076e2469d6957619019921.zip |
Make all domains unconfined.
This prevents denials from being generated by the base policy.
Over time, these rules will be incrementally tightened to improve
security.
Change-Id: I4be1c987a5d69ac784a56d42fc2c9063c402de11
Diffstat (limited to 'rild.te')
-rw-r--r-- | rild.te | 40 |
1 files changed, 1 insertions, 39 deletions
@@ -5,42 +5,4 @@ type rild_exec, exec_type, file_type; init_daemon_domain(rild) net_domain(rild) -allow rild self:netlink_route_socket { setopt write }; -allow rild kernel:system module_request; -unix_socket_connect(rild, property, init) -unix_socket_connect(rild, qemud, qemud) -allow rild self:capability { setuid net_admin net_raw }; -allow rild alarm_device:chr_file rw_file_perms; -allow rild cgroup:dir create_dir_perms; -allow rild radio_device:chr_file rw_file_perms; -allow rild radio_device:blk_file r_file_perms; -allow rild qemu_device:chr_file rw_file_perms; -allow rild mtd_device:dir search; -allow rild efs_file:dir create_dir_perms; -allow rild efs_file:file create_file_perms; -allow rild shell_exec:file rx_file_perms; -allow rild bluetooth_efs_file:file r_file_perms; -allow rild bluetooth_efs_file:dir r_dir_perms; -allow rild radio_data_file:dir rw_dir_perms; -allow rild radio_data_file:file create_file_perms; -allow rild sdcard_type:dir r_dir_perms; -allow rild system_data_file:dir create_dir_perms; -allow rild system_data_file:file create_file_perms; -allow rild system_file:file x_file_perms; -dontaudit rild self:capability sys_admin; -# XXX Label sysfs files with a specific type? -allow rild sysfs:file rw_file_perms; - -# property service -allow rild rild_prop:property_service set; -allow rild radio_prop:property_service set; - -# Read/Write to uart driver (for GPS) -allow rild gps_device:chr_file rw_file_perms; - -allow rild tty_device:chr_file rw_file_perms; - -# Allow rild to create, bind, read, write to itself through a netlink socket -allow rild self:netlink_socket { create bind read write }; - -allow rild self:netlink_kobject_uevent_socket { bind create getopt read setopt }; +unconfined_domain(rild) |