diff options
| author | Jeff Sharkey <jsharkey@android.com> | 2015-06-09 23:30:04 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2015-06-09 23:30:08 +0000 |
| commit | 86987a016b7b930e4f11b3fedf3031b7fcb5412d (patch) | |
| tree | b6e33e4541b3ded23d6216c2ce5b5bb15ca38cf6 | |
| parent | ba8821b0cbe9c94ea7223b2bcb78403bfdfdb4ba (diff) | |
| parent | 7617cd48b7b67bfacab5f574064a1f3d2a4f82e1 (diff) | |
| download | sepolicy-86987a016b7b930e4f11b3fedf3031b7fcb5412d.tar.gz | |
Merge "New "selinux.restorecon" control property." into mnc-dev
| -rw-r--r-- | property.te | 1 | ||||
| -rw-r--r-- | property_contexts | 3 | ||||
| -rw-r--r-- | vold.te | 2 |
3 files changed, 5 insertions, 1 deletions
diff --git a/property.te b/property.te index 94ae714..e046f42 100644 --- a/property.te +++ b/property.te @@ -21,6 +21,7 @@ type ctl_bugreport_prop, property_type; type ctl_console_prop, property_type; type audio_prop, property_type; type logd_prop, property_type; +type restorecon_prop, property_type; type security_prop, property_type; type bluetooth_prop, property_type; type pan_result_prop, property_type; diff --git a/property_contexts b/property_contexts index 1844910..5bdb3c3 100644 --- a/property_contexts +++ b/property_contexts @@ -41,7 +41,8 @@ persist.service.bdroid. u:object_r:bluetooth_prop:s0 persist.security. u:object_r:system_prop:s0 # selinux non-persistent properties -selinux. u:object_r:security_prop:s0 +selinux.restorecon_recursive u:object_r:restorecon_prop:s0 +selinux. u:object_r:security_prop:s0 # default property context * u:object_r:default_prop:s0 @@ -111,6 +111,7 @@ allow vold kernel:process setsched; set_prop(vold, vold_prop) set_prop(vold, powerctl_prop) set_prop(vold, ctl_fuse_prop) +set_prop(vold, restorecon_prop) # ASEC allow vold asec_image_file:file create_file_perms; @@ -159,3 +160,4 @@ neverallow { domain -vold } vold_data_file:dir ~{ open create read getattr setat neverallow { domain -vold } vold_data_file:notdevfile_class_set ~{ relabelto getattr }; neverallow { domain -vold -init } vold_data_file:dir *; neverallow { domain -vold -init } vold_data_file:notdevfile_class_set *; +neverallow { domain -vold -init } restorecon_prop:property_service set; |