Allow system_server to create files on configfs
A change in the "open" syscall between kernel 4.4 and 4.9 means that
the "create" action is now checked and makes system_server trigger
an SELinux denial when PackageSettings is removing a user ID from
Settings.java/writeKernelRemoveUserLPr() in PackageManager.
Bug: 70150770
Test: Manual
- Add a new user on the device, no need to perform setup.
- Wait 30s
- Remove the added user
- While running, check the result of:
adb logcat -v time -b events | grep audit | grep system_server
Change-Id: I1f490ea95d5bcb2adc76cba041bffbea131b447a
diff --git a/private/system_server.te b/private/system_server.te
index e9942ed..752dee7 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -678,7 +678,7 @@
# For configuring sdcardfs
allow system_server configfs:dir { create_dir_perms };
-allow system_server configfs:file { getattr open unlink write };
+allow system_server configfs:file { getattr open create unlink write };
# Connect to adbd and use a socket transferred from it.
# Used for e.g. jdwp.