Make all domains unconfined.

This prevents denials from being generated by the base policy.
Over time, these rules will be incrementally tightened to improve
security.

Change-Id: I4be1c987a5d69ac784a56d42fc2c9063c402de11

1 files changed, 2 insertions, 6 deletions

diff --git a/tee.te b/tee.te
index dad3505..79f8d13 100644
--- a/tee.te
+++ b/tee.te
@@ -2,14 +2,10 @@
 # trusted execution environment (tee) daemon
 #
 type tee, domain;
-permissive tee;
 type tee_exec, exec_type, file_type;
 type tee_device, dev_type;
 type tee_data_file, file_type, data_file_type;
 
+permissive tee;
+unconfined_domain(netd)
 init_daemon_domain(tee)
-allow tee self:capability { dac_override };
-allow tee tee_device:chr_file rw_file_perms;
-allow tee tee_data_file:dir { getattr write add_name };
-allow tee tee_data_file:file create_file_perms;
-allow tee self:netlink_socket { create bind read };