commit 342362ae3e1afa577a73dc7f154a9de7da96edc4
author Benjamin Gordon <bmgordon@google.com> Thu Sep 06 16:19:40 2018 -0600
committer Benjamin Gordon <bmgordon@google.com> Wed Sep 19 15:54:37 2018 -0600
tree 42542e8ffd6aefdf3d3e0b5728359840b84cdd93
parent 51dc7cb1d411215a7361feebfeaf1f976ce6cf30

sepolicy: grant dac_read_search to domains with dac_override

kernel commit 2a4c22426955d4fc04069811997b7390c0fb858e (fs: switch order
of CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH checks) swapped the order of
dac_override and dac_read_search checks.  Domains that have dac_override
will now generate spurious denials for dac_read_search unless they also
have that permission.  Since dac_override is a strict superset of
dac_read_search, grant dac_read_search to all domains that already have
dac_override to get rid of the denials.

Bug: 114280985
Bug: crbug.com/877588
Test: Booted on a device running 4.14.
Change-Id: I5c1c136b775cceeb7f170e139e8d4279e73267a4

private/llkd.te

diff --git a/private/llkd.te b/private/llkd.te
index 900d403..3f84eb6 100644
--- a/private/llkd.te
+++ b/private/llkd.te
@@ -8,7 +8,7 @@
 allow llkd self:global_capability_class_set kill;
 userdebug_or_eng(`
   allow llkd self:global_capability_class_set sys_ptrace;
-  allow llkd self:global_capability_class_set dac_override;
+  allow llkd self:global_capability_class_set { dac_override dac_read_search };
 ')
 
 # llkd optionally locks itself in memory, to prevent it from being

private/storaged.te

diff --git a/private/storaged.te b/private/storaged.te
index b7321fd..8f70531 100644
--- a/private/storaged.te
+++ b/private/storaged.te
@@ -48,7 +48,7 @@
 
 # Kernel does extra check on CAP_DAC_OVERRIDE for libbinder when storaged is
 # running as root. See b/35323867 #3.
-dontaudit storaged self:global_capability_class_set dac_override;
+dontaudit storaged self:global_capability_class_set { dac_override dac_read_search };
 
 # For collecting bugreports.
 allow storaged dumpstate:fifo_file write;

private/vold_prepare_subdirs.te

diff --git a/private/vold_prepare_subdirs.te b/private/vold_prepare_subdirs.te
index 0a11558..0d062e9 100644
--- a/private/vold_prepare_subdirs.te
+++ b/private/vold_prepare_subdirs.te
@@ -7,7 +7,7 @@
 allow vold_prepare_subdirs vold:fd use;
 allow vold_prepare_subdirs vold:fifo_file { read write };
 allow vold_prepare_subdirs file_contexts_file:file r_file_perms;
-allow vold_prepare_subdirs self:global_capability_class_set { chown dac_override fowner };
+allow vold_prepare_subdirs self:global_capability_class_set { chown dac_override dac_read_search fowner };
 allow vold_prepare_subdirs self:process setfscreate;
 allow vold_prepare_subdirs {
   system_data_file

private/zygote.te

diff --git a/private/zygote.te b/private/zygote.te
index 610916e..91c9230 100644
--- a/private/zygote.te
+++ b/private/zygote.te
@@ -7,7 +7,7 @@
 read_runtime_log_tags(zygote)
 
 # Override DAC on files and switch uid/gid.
-allow zygote self:global_capability_class_set { dac_override setgid setuid fowner chown };
+allow zygote self:global_capability_class_set { dac_override dac_read_search setgid setuid fowner chown };
 
 # Drop capabilities from bounding set.
 allow zygote self:global_capability_class_set setpcap;