From 75770de7019da0d3c6bbed1597414390bbaef266 Mon Sep 17 00:00:00 2001 From: Stephen Smalley Date: Tue, 25 Aug 2015 11:42:17 -0400 Subject: [PATCH] Only allow toolbox exec where /system exec was already allowed. When the toolbox domain was introduced, we allowed all domains to exec it to avoid breakage. However, only domains that were previously allowed the ability to exec /system files would have been able to do this prior to the introduction of the toolbox domain. Remove the rule from domain.te and add rules to all domains that are already allowed execute_no_trans to system_file. Requires coordination with device-specific policy changes with the same Change-Id. Change-Id: Ie46209f0412f9914857dc3d7c6b0917b7031aae5 Signed-off-by: Stephen Smalley --- target/board/generic/sepolicy/goldfish_setup.te | 1 + 1 file changed, 1 insertion(+) diff --git a/target/board/generic/sepolicy/goldfish_setup.te b/target/board/generic/sepolicy/goldfish_setup.te index 3fb79e77f..85d5c8cf6 100644 --- a/target/board/generic/sepolicy/goldfish_setup.te +++ b/target/board/generic/sepolicy/goldfish_setup.te @@ -9,6 +9,7 @@ allow goldfish_setup shell_exec:file read; # Run ifconfig, route commands to configure interfaces and routes. allow goldfish_setup system_file:file execute_no_trans; +allow goldfish_setup toolbox_exec:file rx_file_perms; allow goldfish_setup self:capability { net_admin net_raw }; allow goldfish_setup self:udp_socket create_socket_perms; -- 2.11.0