system_server: allow appendable file descriptors
system_server is currently allowed write (but not open) access to
various app file descriptor types, to allow it to perform write
operations on file descriptors passed to it from Android processes.
However, system_server was not allowed to handle file descriptors
open only for append operations.
Write operations are a superset of that allowed by appendable
operations, so it makes no sense to deny system_server the use of
appendable file descriptors. Allow it for app data types, as well as a
few other types (for robustness).
Addresses the following denial generated when adb bugreport is run:
type=1400 audit(0.0:12): avc: denied { append } for
path="/data/user_de/0/com.android.shell/files/bugreports/bugreport-MASTER-2016-10-29-08-13-50-dumpstate_log-6214.txt"
dev="dm-2" ino=384984 scontext=u:r:system_server:s0
tcontext=u:object_r:shell_data_file:s0 tclass=file permissive=0
Bug: 32246161
Test: policy compiles
Test: No more append denials when running adb shell am bug-report --progress
Change-Id: Ia4e81cb0b3c3580fa9130952eedaed9cab3e8487
1 file changed