Evolution-x-devices/device_google_wahoo
2
0
Fork 0
mirror of https://github.com/Evolution-X-Devices/device_google_wahoo synced 2026-02-01 07:50:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix sepolicy issue for cnss-diag and cnss-daemon

Browse Source 
1) denial message for cnss-daemon
[  185.251957] type=1400 audit(1492021938.121:423): avc: denied { create } 
for pid=781 comm="cnss_diag" name="local_buffer" scontext=u:r:wcnss_service:s0
tcontext=u:object_r:cnss_vendor_data_file:s0 
tclass=dir permissive=1
[  185.258602] type=1400 audit(1492021938.121:424): avc: denied { setattr }
for pid=781 comm="cnss_diag" name="local_buffer" dev="sda45" ino=2179097
scontext=u:r:wcnss_service:s0 tcontext=u:object_r:cnss_vendor_data_file:s0
tclass=dir permissive=1

2) remove unused cnss_diag.te (instead, we use wcnss_service.te)

Bug: 36734870

Change-Id: Ie0d1a99adf0cde2616eaf099e2757407f43eb77d
Signed-off-by: Ecco Park <eccopark@google.com>
This commit is contained in:
Ecco Park
2017-04-12 13:16:48 -07:00
parent 93bfba0b34
commit 87a1142b73
2 changed files with 1 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
sepolicy/cnss_diag.te
View File

@@ -1,19 +0,0 @@
# Policy for /vendor/bin/cnss_diag
type cnss_diag, domain;
type cnss_diag_exec, exec_type, file_type;
init_daemon_domain(cnss_diag)
allow cnss_diag self:capability { setgid setuid };
allow cnss_diag self:netlink_socket create_socket_perms_no_ioctl;
allow cnss_diag sysfs:file r_file_perms;
# b/35877764 suppress the udp_socket denial message temproarily
dontaudit cnss_diag self:udp_socket create;
userdebug_or_eng(`
allow cnss_diag diag_device:chr_file rw_file_perms;
allow cnss_diag cnss_vendor_data_file:dir create_dir_perms;
allow cnss_diag cnss_vendor_data_file:file create_file_perms;
')

2
sepolicy/wcnss_service.te
View File

@@ -22,7 +22,7 @@ allowxperm wcnss_service self:udp_socket ioctl { SIOCIWFIRSTPRIV_05 SIOCSIFFLAGS
allow wcnss_service self:netlink_generic_socket create_socket_perms_no_ioctl;
allow wcnss_service self:netlink_socket create_socket_perms_no_ioctl;
allow wcnss_service cnss_vendor_data_file:dir rw_dir_perms;
allow wcnss_service cnss_vendor_data_file:dir create_dir_perms;
allow wcnss_service cnss_vendor_data_file:file create_file_perms;
allow wcnss_service proc_net:file getattr;