Merge "Move MmsService into phone process (2/2)" into lmp-dev
diff --git a/domain.te b/domain.te
index 2ed20bb..ba4c65a 100644
--- a/domain.te
+++ b/domain.te
@@ -263,7 +263,7 @@
#
# Assert that, to the extent possible, we're not loading executable content from
-# outside the /system partition except for a few whitelisted domains.
+# outside the rootfs or /system partition except for a few whitelisted domains.
#
neverallow {
domain
@@ -274,6 +274,11 @@
-system_server
-zygote
} { file_type -system_file -exec_type }:file execute;
+neverallow {
+ domain
+ -appdomain # for oemfs
+ -recovery # for /tmp/update_binary in tmpfs
+} { fs_type -rootfs }:file execute;
# Only the init property service should write to /data/property.
neverallow { domain -init } property_data_file:dir { create setattr relabelfrom rename write add_name remove_name rmdir };
diff --git a/healthd.te b/healthd.te
index a788236..e7e165a 100644
--- a/healthd.te
+++ b/healthd.te
@@ -22,6 +22,12 @@
### healthd: charger mode
###
+# Read /sys/fs/pstore/console-ramoops
+# Don't worry about overly broad permissions for now, as there's
+# only one file in /sys/fs/pstore
+allow healthd pstorefs:dir r_dir_perms;
+allow healthd pstorefs:file r_file_perms;
+
allow healthd graphics_device:dir r_dir_perms;
allow healthd graphics_device:chr_file rw_file_perms;
allow healthd input_device:dir r_dir_perms;