Eliminate CAP_SYS_MODULE from system_server
Right now, the system_server has the CAP_SYS_MODULE capability. This allows the
system server to install kernel modules. Effectively, system_server is one
kernel module load away from full root access.
Most devices don't need this capability. Remove this capability from
the core SELinux policy. For devices which require this capability,
they can add it to their device-specific SELinux policy without making
any framework code changes.
In particular, most Nexus devices ship with monolithic kernels, so this
capability isn't needed on those devices.
Bug: 7118228
Change-Id: I7f96cc61da8b2476f45ba9570762145778d68cb3
diff --git a/system_server.te b/system_server.te
index 191c446..41036b6 100644
--- a/system_server.te
+++ b/system_server.te
@@ -49,7 +49,6 @@
net_broadcast
net_raw
sys_boot
- sys_module
sys_nice
sys_resource
sys_time