NekoSakura/android_device_mediatek_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[ALPS04701006] mrdump: fix avc denied condition

Browse Source 
1. fix some avc denied condition caused by mrdump_tool.
2. merge the rule about mrdump in one area.

MTK-Commit-Id: c0d93f9196903a772ff1b318f153701714d28d80

Change-Id: I23082aac2d7b522a9f78426796b94de145374ed5
Signed-off-by: MY Chuang <my.chuang@mediatek.com>
CR-Id: ALPS04701006
Feature: Memory RAM Dump (MRDUMP)
This commit is contained in:
MY Chuang 2020-01-18 10:18:16 +08:00
parent 8d8e513025
commit 57a8f660be
1 changed files with 10 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
non_plat/aee_aedv.te
View File

@ -307,11 +307,18 @@ allow aee_aedv selinuxfs:file r_file_perms;
# Purpose: Allow aee_aedv to read /proc/pid/exe
#allow aee_aedv exec_type:file r_file_perms;
# Purpose: mrdump pre-allocation: immutable and userdata
# - avc: denied { linux_immutable } for capability=9 scontext=u:r:aee_aedv:s0
# tcontext=u:r:aee_aedv:s0 tclass=capability permissive=0
# Purpose: mrdump db flow and pre-allocation
# mrdump db flow
allow aee_aedv sysfs_dt_firmware_android:dir search;
allow aee_aedv sysfs_dt_firmware_android:file r_file_perms;
allow aee_aedv kernel:system module_request;
allow aee_aedv metadata_file:dir search;
# pre-allocation
allow aee_aedv self:capability linux_immutable;
allow aee_aedv userdata_block_device:blk_file { read write open };
allow aee_aedv para_block_device:blk_file rw_file_perms;
allowxperm aee_aedv aee_dumpsys_vendor_file:file ioctl FS_IOC_FIEMAP;
allow aee_aedv mrdump_device:blk_file rw_file_perms;
# Purpose: allow vendor aee read lowmemorykiller logs
# file path: /sys/module/lowmemorykiller/parameters/
@ -405,12 +412,6 @@ allow aee_aedv proc_cmdq_debug:file r_file_perms;
# temp solution
get_prop(aee_aedv, vendor_default_prop)
# mrdump
allow aee_aedv para_block_device:blk_file rw_file_perms;
allow aee_aedv aee_dumpsys_vendor_file:file ioctl;
allowxperm aee_aedv aee_dumpsys_vendor_file:file ioctl FS_IOC_FIEMAP;
allow aee_aedv mrdump_device:blk_file rw_file_perms;
#data/dipdebug
allow aee_aedv aee_dipdebug_vendor_file:dir r_dir_perms;
allow aee_aedv aee_dipdebug_vendor_file:file r_file_perms;