diff options
| author | Nick Kralevich <nnk@google.com> | 2015-03-12 13:50:48 -0700 |
|---|---|---|
| committer | Nick Kralevich <nnk@google.com> | 2015-03-12 13:55:29 -0700 |
| commit | cd14eb443e18d94f3248da77089155c888d8720e (patch) | |
| tree | d6f5bc5c96cb3e1a62a597aba3793755e6e33553 /system_server.te | |
| parent | 2e0cd5ad36321fd7a8f21768dac080d09b658920 (diff) | |
| download | android_external_sepolicy-cd14eb443e18d94f3248da77089155c888d8720e.tar.gz android_external_sepolicy-cd14eb443e18d94f3248da77089155c888d8720e.tar.bz2 android_external_sepolicy-cd14eb443e18d94f3248da77089155c888d8720e.zip | |
Revert "allow system_server to set kernel scheduling priority"
Periodically, SELinux denials of the form:
type=1400 audit(0.0:8574): avc: denied { setsched } for comm="system_server" scontext=u:r:system_server:s0 tcontext=u:r:kernel:s0 tclass=process permissive=0
are being generated. These denials come from system_server and other
processes. There's no reason why system_server should be calling
sched_setscheduler() on a kernel thread.
Current belief is that these SELinux denials are a bug in the kernel,
and are being inappropriately triggered.
Revert 2d1650f4075db4f4f458de4c1a4cb5869c44b936. The original reason
for accepting this change was to see if it would fix bug 18085992.
Unfortunately, even after the commit, the bug was still present.
The change had no impact on the bug.
Don't inappropriately grant system_server the ability to minipulate
the scheduling priority of kernel threads.
This reverts commit 2d1650f4075db4f4f458de4c1a4cb5869c44b936.
Change-Id: I59bdf26ad247a02b741af2fa58a18e7e83ef44d8
Diffstat (limited to 'system_server.te')
| -rw-r--r-- | system_server.te | 4 |
1 files changed, 0 insertions, 4 deletions
diff --git a/system_server.te b/system_server.te index 6630615..9079acb 100644 --- a/system_server.te +++ b/system_server.te @@ -75,10 +75,6 @@ allow system_server self:netlink_route_socket nlmsg_write; # Kill apps. allow system_server appdomain:process { sigkill signal }; -# This line seems suspect, as it should not really need to -# set scheduling parameters for a kernel domain task. -allow system_server kernel:process setsched; - # Set scheduling info for apps. allow system_server appdomain:process { getsched setsched }; allow system_server mediaserver:process { getsched setsched }; |