commit 1c3d898d8702b311634a037f04719f476c519032
author Hridya Valsaraju <hridya@google.com> Wed Mar 24 15:13:49 2021 -0700
committer Hridya Valsaraju <hridya@google.com> Wed Apr 21 14:13:02 2021 -0700
tree 39b0334048b68737cdc49c151749d779246ababf
parent 753476286140c5b80112d5e4f22fd48e45c2c5ff

Add a neverallow for debugfs mounting

Android R launching devices and newer must not ship with debugfs
mounted. For Android S launching devices and newer, debugfs must only be
mounted in userdebug/eng builds by init(for boot time initializations)
and dumpstate(for grabbing debug information from debugfs). This patch
adds a neverallow statement that prevents processes other than init
from being provided access to mount debugfs in non-user builds
when the flag PRODUCT_SET_DEBUGFS_RESTRICTIONS is set to true.

Test: make with/without PRODUCT_SET_DEBUGFS_RESTRICTIONS
Bug: 184381659
Change-Id: I289f2d25662a78678929e29f83cb31cebd8ca737