commit 4c2e89baf83a2475605f61ed1e996cacfb00eb61
author TreeHugger Robot <treehugger-gerrit@google.com> Wed May 16 16:36:26 2018 +0000
committer Android (Google) Code Review <android-gerrit@google.com> Wed May 16 16:36:26 2018 +0000
tree 27e52d5b0801e9b32f196afc018d5eb1366e87cd
parent 52fd4141b878489689cc04ee9d4bf9ae02d3bed4
parent 8c3a74ad6467b9117594563a51f8160c63a61983

Merge "domain.te & kernel.te: allow kernel to write nativetest_data_file" into pi-dev

prebuilts/api/28.0/public/domain.te

diff --git a/prebuilts/api/28.0/public/domain.te b/prebuilts/api/28.0/public/domain.te
index cccc651..e9337b6 100644
--- a/prebuilts/api/28.0/public/domain.te
+++ b/prebuilts/api/28.0/public/domain.te
@@ -466,7 +466,7 @@
 }:file no_x_file_perms;
 
 # The test files and executables MUST not be accessible to any domain
-neverallow domain nativetest_data_file:file_class_set no_w_file_perms;
+neverallow { domain userdebug_or_eng(`-kernel') } nativetest_data_file:file_class_set no_w_file_perms;
 neverallow domain nativetest_data_file:dir no_w_dir_perms;
 neverallow { domain userdebug_or_eng(`-shell') } nativetest_data_file:file no_x_file_perms;
 

prebuilts/api/28.0/public/kernel.te

diff --git a/prebuilts/api/28.0/public/kernel.te b/prebuilts/api/28.0/public/kernel.te
index c8521e3..b7a351c 100644
--- a/prebuilts/api/28.0/public/kernel.te
+++ b/prebuilts/api/28.0/public/kernel.te
@@ -69,7 +69,7 @@
 # and for LTP kernel tests (b/73220071)
 userdebug_or_eng(`
   allow kernel update_engine_data_file:file read;
-  allow kernel nativetest_data_file:file read;
+  allow kernel nativetest_data_file:file { read write };
 ')
 
 # Access to /data/media.

public/domain.te

diff --git a/public/domain.te b/public/domain.te
index cccc651..e9337b6 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -466,7 +466,7 @@
 }:file no_x_file_perms;
 
 # The test files and executables MUST not be accessible to any domain
-neverallow domain nativetest_data_file:file_class_set no_w_file_perms;
+neverallow { domain userdebug_or_eng(`-kernel') } nativetest_data_file:file_class_set no_w_file_perms;
 neverallow domain nativetest_data_file:dir no_w_dir_perms;
 neverallow { domain userdebug_or_eng(`-shell') } nativetest_data_file:file no_x_file_perms;
 

public/kernel.te

diff --git a/public/kernel.te b/public/kernel.te
index c8521e3..b7a351c 100644
--- a/public/kernel.te
+++ b/public/kernel.te
@@ -69,7 +69,7 @@
 # and for LTP kernel tests (b/73220071)
 userdebug_or_eng(`
   allow kernel update_engine_data_file:file read;
-  allow kernel nativetest_data_file:file read;
+  allow kernel nativetest_data_file:file { read write };
 ')
 
 # Access to /data/media.