Merge "Fix selinux denials during bugreport"
diff --git a/private/domain_deprecated.te b/private/domain_deprecated.te
deleted file mode 100644
index a440bfe..0000000
--- a/private/domain_deprecated.te
+++ /dev/null
@@ -1,46 +0,0 @@
-# rules removed from the domain attribute
-
-# Read access to pseudo filesystems.
-r_dir_file(domain_deprecated, sysfs)
-
-userdebug_or_eng(`
-auditallow {
- domain_deprecated
- -fingerprintd
- -healthd
- -netd
- -recovery
- -system_app
- -surfaceflinger
- -system_server
- -tee
- -ueventd
- -vold
-} sysfs:dir { open getattr read ioctl lock }; # search granted in domain
-auditallow {
- domain_deprecated
- -fingerprintd
- -healthd
- -netd
- -recovery
- -system_app
- -surfaceflinger
- -system_server
- -tee
- -ueventd
- -vold
-} sysfs:file r_file_perms;
-auditallow {
- domain_deprecated
- -fingerprintd
- -healthd
- -netd
- -recovery
- -system_app
- -surfaceflinger
- -system_server
- -tee
- -ueventd
- -vold
-} sysfs:lnk_file { getattr open ioctl lock }; # read granted in domain
-')
diff --git a/public/uncrypt.te b/public/uncrypt.te
index 59f7da3..67189ae 100644
--- a/public/uncrypt.te
+++ b/public/uncrypt.te
@@ -40,3 +40,6 @@
# uncrypt reads /proc/cmdline
allow uncrypt proc:file r_file_perms;
+
+# Read files in /sys
+r_dir_file(uncrypt, sysfs)
diff --git a/public/update_engine_common.te b/public/update_engine_common.te
index 2a0266e..7680e07 100644
--- a/public/update_engine_common.te
+++ b/public/update_engine_common.te
@@ -44,3 +44,6 @@
# read directories on /system and /vendor
allow update_engine system_file:dir r_dir_perms;
+
+# Read files in /sys
+r_dir_file(uncrypt, sysfs)