Don't emit audit logs for dumpstate->keystore
aosp/1696825 added the ability for dumpstate to signal Keystore on
debuggable builds, but this means that there will be an audit denial
message on non-debuggable builds. Suppress this, in particular so that
the test mentioned below can pass on -user builds.
Bug: 269672964
Test: CtsSecurityHostTestCases:android.security.cts.SELinuxHostTest#testNoBugreportDenial
Change-Id: I68a41f6b94d615f80e4d1490ec4159436693dce2
diff --git a/private/dumpstate.te b/private/dumpstate.te
index 850b0d8..b369797 100644
--- a/private/dumpstate.te
+++ b/private/dumpstate.te
@@ -66,9 +66,11 @@
netd
}:process signal;
+# Only allow dumpstate to dump Keystore on debuggable builds.
userdebug_or_eng(`
allow dumpstate keystore:process signal;
')
+dontaudit dumpstate keystore:process { signal };
# For collecting bugreports.
no_debugfs_restriction(`