Don't allow ptrace on keystore
keystore may hold sensitive information in it's memory. Don't
allow anyone to ptrace keystore.
Change-Id: I4e3717e482b9fd128d38ce687c03122d41678b6f
diff --git a/debuggerd.te b/debuggerd.te
index 30204f2..6bbeac4 100644
--- a/debuggerd.te
+++ b/debuggerd.te
@@ -9,7 +9,7 @@
allow debuggerd domain:dir r_dir_perms;
allow debuggerd domain:file r_file_perms;
allow debuggerd domain:lnk_file read;
-allow debuggerd { domain -init -ueventd -watchdogd -healthd -adbd }:process ptrace;
+allow debuggerd { domain -init -ueventd -watchdogd -healthd -adbd -keystore }:process ptrace;
security_access_policy(debuggerd)
allow debuggerd system_data_file:dir create_dir_perms;
allow debuggerd system_data_file:dir relabelfrom;
diff --git a/keystore.te b/keystore.te
index e92efaa..8aa1d7d 100644
--- a/keystore.te
+++ b/keystore.te
@@ -15,7 +15,7 @@
###
### Neverallow rules
###
-### Protect our files from others
+### Protect ourself from others
###
neverallow { domain -keystore } keystore_data_file:dir ~{ open create read getattr setattr search relabelto };
@@ -23,3 +23,5 @@
neverallow { domain -keystore -init -kernel -recovery } keystore_data_file:dir *;
neverallow { domain -keystore -init -kernel -recovery } keystore_data_file:notdevfile_class_set *;
+
+neverallow domain keystore:process ptrace;