Add sepolicy for the securityfs mount type.
See discussion in aosp/1233645. There was a concern about this
filesystem automounting when enabled, so this change adds sepolicy to
preemptively lock it down.
I'm not confident it actually automounts. If it does, it'll land in
/sys/kernel/security, which is also protected with the sysfs policy.
Test: Builds
Bug: 148102533
Change-Id: I78a246a5c18953f2471f84367ab383afb2742908
diff --git a/private/compat/29.0/29.0.ignore.cil b/private/compat/29.0/29.0.ignore.cil
index 9c5deb0..e373726 100644
--- a/private/compat/29.0/29.0.ignore.cil
+++ b/private/compat/29.0/29.0.ignore.cil
@@ -81,6 +81,7 @@
prereboot_data_file
art_apex_dir
rebootescrow_hal_prop
+ securityfs
service_manager_service
service_manager_vndservice
simpleperf
diff --git a/private/genfs_contexts b/private/genfs_contexts
index ccf6784..828929f 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -291,6 +291,8 @@
genfscon debugfs /kcov u:object_r:debugfs_kcov:s0
+genfscon securityfs / u:object_r:securityfs:s0
+
genfscon binder /binder u:object_r:binder_device:s0
genfscon binder /hwbinder u:object_r:hwbinder_device:s0
genfscon binder /vndbinder u:object_r:vndbinder_device:s0