diff options
| author | Stephen Smalley <sds@tycho.nsa.gov> | 2013-02-19 13:17:38 -0500 |
|---|---|---|
| committer | Stephen Smalley <sds@tycho.nsa.gov> | 2013-02-19 13:20:55 -0500 |
| commit | e468016b1bd79b505e62fd410f59a03bad8bbe06 (patch) | |
| tree | 93219d27935923ff1c3154926f0ecda32d17ab8f /zygote.te | |
| parent | 58b0fb6ddee7257a6a27f31ba97d47fa23efac15 (diff) | |
| download | android_external_sepolicy-e468016b1bd79b505e62fd410f59a03bad8bbe06.tar.gz android_external_sepolicy-e468016b1bd79b505e62fd410f59a03bad8bbe06.tar.bz2 android_external_sepolicy-e468016b1bd79b505e62fd410f59a03bad8bbe06.zip | |
zygote requires setpcap in order to drop from its bounding set.
I8560fa5ad125bf31f0d13be513431697bc7d22bb changed the zygote
to limit the bounding capability set to CAP_NET_RAW. This triggers
a CAP_SETPCAP check by the kernel, which requires SELinux setpcap permission.
Change-Id: Ib910d97dcf708273e2806e2824f4abe9fc239d6d
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Diffstat (limited to 'zygote.te')
| -rw-r--r-- | zygote.te | 2 |
1 files changed, 2 insertions, 0 deletions
@@ -6,6 +6,8 @@ init_daemon_domain(zygote) typeattribute zygote mlstrustedsubject; # Override DAC on files and switch uid/gid. allow zygote self:capability { dac_override setgid setuid }; +# Drop capabilities from bounding set. +allow zygote self:capability setpcap; # Switch SELinux context to app domains. allow zygote system:process dyntransition; allow zygote appdomain:process dyntransition; |