commit e5667b30d54ebca6375fe2cd51cc000806dec7fc
author Treehugger Robot <treehugger-gerrit@google.com> Wed Mar 13 17:30:22 2019 +0000
committer Gerrit Code Review <noreply-gerritcodereview@google.com> Wed Mar 13 17:30:22 2019 +0000
tree 02473b686db51e930e251f08c0d9baa5968dadde
parent 20fe557ec57c057fef4bc96394ca6aff9571c587
parent f7bf277313ae9a26da44f3901f5a3333e919e305

Merge "Allow mini-keyctl to setattr for restricting keyring"

private/mini_keyctl.te

diff --git a/private/mini_keyctl.te b/private/mini_keyctl.te
index c81a17c..53dbfce 100644
--- a/private/mini_keyctl.te
+++ b/private/mini_keyctl.te
@@ -8,7 +8,7 @@
 # Kernel only prints the keys that can be accessed and only kernel keyring is needed here.
 dontaudit mini-keyctl init:key view;
 dontaudit mini-keyctl vold:key view;
-allow mini-keyctl kernel:key { view search write };
+allow mini-keyctl kernel:key { view search write setattr };
 allow mini-keyctl mini-keyctl:key { view search write };
 
 # When kernel requests an algorithm, the crypto API first looks for an