Merge "add /odm to file_contexts"
diff --git a/domain.te b/domain.te
index 32aa900..12633c8 100644
--- a/domain.te
+++ b/domain.te
@@ -381,3 +381,18 @@
# On userdebug/eng builds, only dumpstate, shell, and
# su itself execute su.
neverallow { domain userdebug_or_eng(`-dumpstate -shell -su') } su_exec:file no_x_file_perms;
+
+# Do not allow the introduction of new execmod rules. Text relocations
+# and modification of executable pages are unsafe.
+# The only exceptions are for NDK text relocations associated with
+# https://code.google.com/p/android/issues/detail?id=23203
+# which, long term, need to go away.
+neverallow domain {
+ file_type
+ -system_data_file
+ -apk_data_file
+ -app_data_file
+ -asec_public_file
+}:file execmod;
+
+neverallow { domain -appdomain } file_type:file execmod;
diff --git a/fsck.te b/fsck.te
index 22ff7b1..ab4ee31 100644
--- a/fsck.te
+++ b/fsck.te
@@ -16,6 +16,21 @@
allow fsck userdata_block_device:blk_file rw_file_perms;
allow fsck cache_block_device:blk_file rw_file_perms;
+###
+### neverallow rules
+###
+
+# fsck should never be run on these block devices
+neverallow fsck {
+ boot_block_device
+ frp_block_device
+ metadata_block_device
+ recovery_block_device
+ root_block_device
+ swap_block_device
+ system_block_device
+}:blk_file no_rw_file_perms;
+
# Only allow entry from init via the e2fsck binary.
neverallow { domain -init } fsck:process transition;
neverallow domain fsck:process dyntransition;
diff --git a/gpsd.te b/gpsd.te
index 33b1df6..2e05092 100644
--- a/gpsd.te
+++ b/gpsd.te
@@ -18,3 +18,11 @@
# Execute the shell or system commands.
allow gpsd shell_exec:file rx_file_perms;
allow gpsd system_file:file rx_file_perms;
+
+###
+### neverallow
+###
+
+# gpsd can never have capabilities other than block_suspend
+neverallow gpsd self:capability *;
+neverallow gpsd self:capability2 ~block_suspend;
diff --git a/procrank.te b/procrank.te
index 06b33f8..680d549 100644
--- a/procrank.te
+++ b/procrank.te
@@ -5,9 +5,11 @@
type procrank, domain, mlstrustedsubject;
domain_auto_trans(shell, procrank_exec, procrank)
+ domain_auto_trans(dumpstate, procrank_exec, procrank)
allow procrank self:capability sys_ptrace;
allow procrank devpts:chr_file { read write getattr ioctl };
+ allow procrank dumpstate:unix_stream_socket { read write getattr };
r_dir_file(procrank, domain)
- allow procrank shell:fd use;
+ allow procrank { shell dumpstate }:fd use;
allow procrank adbd:process sigchld;
')