Fix denial of /debug_ramdisk/adb_debug.prop
This CL fix the following SELinux denial, by allowing init to getatter
for tmpfs:file.
audit: type=1400 audit(15464939.926:4): avc: denied { getattr } for
pid=1 comm="init" path="/debug_ramdisk/adb_debug.prop" dev="tmpfs"
ino=25480 scontext=u:r:init:s0 tcontext=u:object_r:tmpfs:s0 tclass=file
permissive=0
Note: the current sepolicy (before this change) has the following rules
for tmpfs:file:
$ sesearch --allow -t tmpfs -c file $OUT/vendor/etc/selinux/precompiled_sepolicy
allow dex2oat tmpfs:file { read map getattr };
allow init tmpfs:file { read unlink open setattr };
allow postinstall_dexopt tmpfs:file read;
allow profman tmpfs:file { read map };
allow vendor_init tmpfs:file { read map open setattr };
Bug: 126493225
Test: boot a device with debug ramdisk, checks related files are loaded
Change-Id: I6dd356de989d597828a6e04846b793d611c477fa
1 file changed