drgreen/android_device_google_gs-common
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix aocx selinux dumpstate permissions

Browse Source 
After switching aocxd to stable AIDL, we encountered some permissions
issues associated with dumpstate:

dumpstate: type=1400 audit(0.0:548): avc:  denied  { call } for  scontext=u:r:dumpstate:s0 tcontext=u:r:aocxd:s0 tclass=binder permissive=0

dumpstate: type=1400 audit(0.0:17): avc:  denied  { use } for  path="pipe:[214567]" dev="pipefs" ino=214567 scontext=u:r:aocxd:s0 tcontext=u:r:dumpstate:s0 tclass=fd permissive=0

dumpstate: type=1400 audit(0.0:15): avc:  denied  { write } for  path="pipe:[212933]" dev="pipefs" ino=212933 scontext=u:r:aocxd:s0 tcontext=u:r:dumpstate:s0 tclass=fifo_file permissive=0

TEST:
make selinux_policy -j128
adb push $ANDROID_PRODUCT_OUT/vendor/etc/selinux/* /vendor/etc/selinux
adb reboot
adb root
adb bugreport

BUG: 347156752
Change-Id: I188263ee9b186736a48fd3a0cfa83745e2e54108
This commit is contained in:
Bruce Po 2024-06-14 15:26:53 -07:00
parent 094c853eac
commit e15af041dd
2 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
aoc/sepolicy/aocxd.te
View File

@ -26,3 +26,6 @@ add_service(aocxd, aocx);
# allow managing thread priority
allow aocxd self:global_capability_class_set sys_nice;
allow aocxd dumpstate:fd use;
allow aocxd dumpstate:fifo_file write;

2
aoc/sepolicy/dumpstate.te Normal file
View File

@ -0,0 +1,2 @@
# Allow dumpstate to talk to aocxd over binder
binder_call(dumpstate, aocxd)