Allow surfaceflinger to read /proc/pid/cmdline of dumpstate.
Resolves denials such as:
avc: denied { open } for pid=3772 comm="Binder_4" name="cmdline" dev="proc" ino=26103 scontext=u:r:surfaceflinger:s0 tcontext=u:r:dumpstate:s0 tclass=file
This seems harmless, although I am unclear as to why/where it occurs.
Likely just for logging/debugging.
Change-Id: I7be38deabb117668b069ebdf086a9ace88dd8dd1
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
diff --git a/surfaceflinger.te b/surfaceflinger.te
index cb67855..5ecfd18 100644
--- a/surfaceflinger.te
+++ b/surfaceflinger.te
@@ -50,6 +50,7 @@
# Allow a dumpstate triggered screenshot
binder_call(surfaceflinger, dumpstate)
binder_call(surfaceflinger, shell)
+r_dir_file(surfaceflinger, dumpstate)
# Needed on some devices for playing DRM protected content,
# but seems expected and appropriate for all devices.