Merge "Suppress harmless denials for file creation in cgroupfs."
diff --git a/private/init.te b/private/init.te
index 5464865..50b1c94 100644
--- a/private/init.te
+++ b/private/init.te
@@ -25,3 +25,8 @@
# Sometimes we have to write to non-existent files to avoid conditional
# init behavior. See b/35303861 for an example.
dontaudit init sysfs:dir write;
+
+# Suppress false positives when using O_CREAT
+# to open a file that already exists.
+# There's a neverallow rule for this in domain.te
+dontaudit init cgroup:file create;
diff --git a/private/zygote.te b/private/zygote.te
index 4ea401d..ab707f1 100644
--- a/private/zygote.te
+++ b/private/zygote.te
@@ -134,3 +134,8 @@
# Do not allow access to Bluetooth-related system properties and files
neverallow zygote bluetooth_prop:file create_file_perms;
+
+# Suppress false positives when using O_CREAT
+# to open a file that already exists.
+# There's a neverallow rule for this in domain.te
+dontaudit zygote cgroup:file create;
diff --git a/public/domain.te b/public/domain.te
index 0027efa..0652648 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -1331,6 +1331,13 @@
sysfs_type
}:dir { add_name create link remove_name rename reparent rmdir write };
+# cgroupfs directories can be created, but not files within them
+# TODO(b/74182216): Remove the installd allow when we're sure it's not used
+neverallow {
+ domain
+ -installd
+} cgroup:file create;
+
dontaudit domain proc_type:dir write;
dontaudit domain sysfs_type:dir write;