Merge "init: restrict setattr perms to /proc."
diff --git a/public/init.te b/public/init.te
index 35a98fe..bcff07f 100644
--- a/public/init.te
+++ b/public/init.te
@@ -227,7 +227,7 @@
allow init {
fs_type
-contextmount_type
- -proc
+ -proc_type
-sdcard_type
-sysfs_type
-rootfs
@@ -311,6 +311,17 @@
proc_security
}:file rw_file_perms;
+# init chmod/chown access to /proc files.
+allow init {
+ proc_cmdline
+ proc_kmsg
+ proc_net
+ proc_qtaguid_stat
+ proc_sysrq
+ proc_qtaguid_ctrl
+ proc_vmallocinfo
+}:file setattr;
+
# init access to /sys files.
allow init {
sysfs_android_usb