diff options
| author | dcashman <dcashman@google.com> | 2015-01-23 15:55:42 -0800 |
|---|---|---|
| committer | dcashman <dcashman@google.com> | 2015-01-23 16:06:13 -0800 |
| commit | 5fef2de32079337d99f4515fa3a70cb2faed1305 (patch) | |
| tree | 6d987a67e7763ef00c1b46a4ad21dfc0dbfc171a /shell.te | |
| parent | 0f0324cc826afb9beefda802d496befe823a081e (diff) | |
| download | android_external_sepolicy-5fef2de32079337d99f4515fa3a70cb2faed1305.tar.gz android_external_sepolicy-5fef2de32079337d99f4515fa3a70cb2faed1305.tar.bz2 android_external_sepolicy-5fef2de32079337d99f4515fa3a70cb2faed1305.zip | |
Allow shell to find all services.
dumpsys from shell results in many denials:
11-08 02:52:13.087 171 171 E SELinux : avc: denied { find } for service=SurfaceFlinger scontext=u:r:shell:s0 tcontext=u:object_r:surfaceflinger_service:s0 tclass=service_manager
11-08 02:52:13.089 171 171 E SELinux : avc: denied { find } for service=android.security.keystore scontext=u:r:shell:s0 tcontext=u:object_r:keystore_service:s0 tclass=service_manager
11-08 02:52:13.093 171 171 E SELinux : avc: denied { find } for service=batteryproperties scontext=u:r:shell:s0 tcontext=u:object_r:healthd_service:s0 tclass=service_manager
11-08 02:52:13.103 171 171 E SELinux : avc: denied { find } for service=display.qservice scontext=u:r:shell:s0 tcontext=u:object_r:surfaceflinger_service:s0 tclass=service_manager
11-08 02:52:13.104 171 171 E SELinux : avc: denied { find } for service=drm.drmManager scontext=u:r:shell:s0 tcontext=u:object_r:drmserver_service:s0 tclass=service_manager
11-08 02:52:13.113 171 171 E SELinux : avc: denied { find } for service=media.audio_flinger scontext=u:r:shell:s0 tcontext=u:object_r:mediaserver_service:s0 tclass=service_manager
11-08 02:52:13.113 171 171 E SELinux : avc: denied { find } for service=media.audio_policy scontext=u:r:shell:s0 tcontext=u:object_r:mediaserver_service:s0 tclass=service_manager
11-08 02:52:13.113 171 171 E SELinux : avc: denied { find } for service=media.camera scontext=u:r:shell:s0 tcontext=u:object_r:mediaserver_service:s0 tclass=service_manager
11-08 02:52:13.114 171 171 E SELinux : avc: denied { find } for service=media.player scontext=u:r:shell:s0 tcontext=u:object_r:mediaserver_service:s0 tclass=service_manager
11-08 02:52:13.114 171 171 E SELinux : avc: denied { find } for service=media.sound_trigger_hw scontext=u:r:shell:s0 tcontext=u:object_r:mediaserver_service:s0 tclass=service_manager
11-08 02:52:13.118 171 171 E SELinux : avc: denied { find } for service=nfc scontext=u:r:shell:s0 tcontext=u:object_r:nfc_service:s0 tclass=service_manager
11-08 02:52:13.130 171 171 E SELinux : avc: denied { find } for service=SurfaceFlinger scontext=u:r:shell:s0 tcontext=u:object_r:surfaceflinger_service:s0 tclass=service_manager
11-08 02:52:13.379 171 171 E SELinux : avc: denied { find } for service=android.security.keystore scontext=u:r:shell:s0 tcontext=u:object_r:keystore_service:s0 tclass=service_manager
11-08 02:52:13.388 171 171 E SELinux : avc: denied { find } for service=batteryproperties scontext=u:r:shell:s0 tcontext=u:object_r:healthd_service:s0 tclass=service_manager
11-08 02:52:13.574 171 171 E SELinux : avc: denied { find } for service=display.qservice scontext=u:r:shell:s0 tcontext=u:object_r:surfaceflinger_service:s0 tclass=service_manager
11-08 02:52:13.576 171 171 E SELinux : avc: denied { find } for service=drm.drmManager scontext=u:r:shell:s0 tcontext=u:object_r:drmserver_service:s0 tclass=service_manager
11-08 02:52:13.712 171 171 E SELinux : avc: denied { find } for service=media.audio_flinger scontext=u:r:shell:s0 tcontext=u:object_r:mediaserver_service:s0 tclass=service_manager
11-08 02:52:13.712 171 171 E SELinux : avc: denied { find } for service=media.audio_policy scontext=u:r:shell:s0 tcontext=u:object_r:mediaserver_service:s0 tclass=service_manager
11-08 02:52:13.713 171 171 E SELinux : avc: denied { find } for service=media.camera scontext=u:r:shell:s0 tcontext=u:object_r:mediaserver_service:s0 tclass=service_manager
11-08 02:52:13.713 171 171 E SELinux : avc: denied { find } for service=media.player scontext=u:r:shell:s0 tcontext=u:object_r:mediaserver_service:s0 tclass=service_manager
11-08 02:52:13.713 171 171 E SELinux : avc: denied { find } for service=media.sound_trigger_hw scontext=u:r:shell:s0 tcontext=u:object_r:mediaserver_service:s0 tclass=service_manager
Bug: 18799966
Change-Id: Id2bf69230338ac9dd45dc5d70f419fa41056e4fc
Diffstat (limited to 'shell.te')
| -rw-r--r-- | shell.te | 6 |
1 files changed, 2 insertions, 4 deletions
@@ -47,9 +47,6 @@ allow shell ctl_dumpstate_prop:property_service set; allow shell debug_prop:property_service set; allow shell powerctl_prop:property_service set; -allow shell system_server_service:service_manager find; -allow shell tmp_system_server_service:service_manager find; - # systrace support - allow atrace to run # debugfs doesn't support labeling individual files, so we have # to grant read access to all of /sys/kernel/debug. @@ -60,8 +57,9 @@ allow shell debugfs:file r_file_perms; # allow shell to run dmesg allow shell kernel:system syslog_read; -# allow shell to list services +# allow shell access to services allow shell servicemanager:service_manager list; +allow shell service_manager_type:service_manager find; # allow shell to look through /proc/ for ps, top allow shell domain:dir { search open read getattr }; |