Jeff Vander Stoep | d22987b | 2015-11-03 09:54:39 -0800 | [diff] [blame] | 1 | # rules removed from the domain attribute |
Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 2 | |
Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 3 | # Read access to pseudo filesystems. |
Jeff Vander Stoep | a2c4055 | 2016-09-13 11:03:36 -0700 | [diff] [blame] | 4 | r_dir_file(domain_deprecated, sysfs) |
Nick Kralevich | 596dd09 | 2017-02-10 12:58:41 -0800 | [diff] [blame] | 5 | |
| 6 | userdebug_or_eng(` |
Jeff Vander Stoep | a1b4560 | 2017-02-10 09:39:37 -0800 | [diff] [blame] | 7 | auditallow { |
| 8 | domain_deprecated |
Nick Kralevich | b59c201 | 2017-02-10 12:06:46 -0800 | [diff] [blame] | 9 | -fingerprintd |
| 10 | -healthd |
| 11 | -netd |
Jeff Vander Stoep | 9bbe420 | 2017-06-14 10:11:12 -0700 | [diff] [blame] | 12 | -recovery |
Nick Kralevich | b59c201 | 2017-02-10 12:06:46 -0800 | [diff] [blame] | 13 | -system_app |
| 14 | -surfaceflinger |
| 15 | -system_server |
| 16 | -tee |
| 17 | -ueventd |
| 18 | -vold |
Nick Kralevich | b59c201 | 2017-02-10 12:06:46 -0800 | [diff] [blame] | 19 | } sysfs:dir { open getattr read ioctl lock }; # search granted in domain |
| 20 | auditallow { |
| 21 | domain_deprecated |
Nick Kralevich | b59c201 | 2017-02-10 12:06:46 -0800 | [diff] [blame] | 22 | -fingerprintd |
| 23 | -healthd |
| 24 | -netd |
Jeff Vander Stoep | 9bbe420 | 2017-06-14 10:11:12 -0700 | [diff] [blame] | 25 | -recovery |
Nick Kralevich | b59c201 | 2017-02-10 12:06:46 -0800 | [diff] [blame] | 26 | -system_app |
| 27 | -surfaceflinger |
| 28 | -system_server |
| 29 | -tee |
| 30 | -ueventd |
| 31 | -vold |
Nick Kralevich | b59c201 | 2017-02-10 12:06:46 -0800 | [diff] [blame] | 32 | } sysfs:file r_file_perms; |
| 33 | auditallow { |
| 34 | domain_deprecated |
Nick Kralevich | b59c201 | 2017-02-10 12:06:46 -0800 | [diff] [blame] | 35 | -fingerprintd |
| 36 | -healthd |
| 37 | -netd |
Jeff Vander Stoep | 9bbe420 | 2017-06-14 10:11:12 -0700 | [diff] [blame] | 38 | -recovery |
Nick Kralevich | b59c201 | 2017-02-10 12:06:46 -0800 | [diff] [blame] | 39 | -system_app |
| 40 | -surfaceflinger |
| 41 | -system_server |
| 42 | -tee |
| 43 | -ueventd |
| 44 | -vold |
Nick Kralevich | b59c201 | 2017-02-10 12:06:46 -0800 | [diff] [blame] | 45 | } sysfs:lnk_file { getattr open ioctl lock }; # read granted in domain |
Nick Kralevich | 596dd09 | 2017-02-10 12:58:41 -0800 | [diff] [blame] | 46 | ') |