summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorVishal Mahaveer2016-09-21 11:15:55 -0500
committerVishal Mahaveer2016-09-21 11:15:55 -0500
commit2dd272de0f358ee20ee9076af4fd282b6bc48435 (patch)
treeffac9387de0085a34bc6a1f44231ff66ef656a49
parent2f654fc1d6a580658ec5a53184bd9738ffdca60f (diff)
downloaddevice-ti-jacinto6evm-2dd272de0f358ee20ee9076af4fd282b6bc48435.tar.gz
device-ti-jacinto6evm-2dd272de0f358ee20ee9076af4fd282b6bc48435.tar.xz
device-ti-jacinto6evm-2dd272de0f358ee20ee9076af4fd282b6bc48435.zip
jacinto6evm: sepolicy: add rules for cpuset script
Fix below denials generated for the script we added to support both J6 and J6 Eco cpuset configuration. [ 5.956998] init: Warning! Service exec 1 (/system/bin/init.jacinto6evmboard.cpuset.sh) needs a SELinux domain defined; please fix! [ 5.978447] type=1400 audit(5.969:3): avc: denied { execute_no_trans } for pid=177 comm="init" path="/system/bin/init.jacinto6evmboard.cpuset.sh" dev="mmcblk0p10" ino=206 scontext=u:r:init:s0 tcontext=u:object_r:system_file:s0 Change-Id: I36c482e052fc60c9c2d82c7daceae604fcf242d5 Signed-off-by: Vishal Mahaveer <vishalm@ti.com>
-rw-r--r--sepolicy/file_contexts3
-rw-r--r--sepolicy/init-cpuset-sh.te7
2 files changed, 10 insertions, 0 deletions
diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts
index 666c7e1..6ac1f73 100644
--- a/sepolicy/file_contexts
+++ b/sepolicy/file_contexts
@@ -22,6 +22,9 @@
22#Real Time Clock 22#Real Time Clock
23/dev/rtc0 u:object_r:rtc:s0 23/dev/rtc0 u:object_r:rtc:s0
24 24
25#cpuset script
26/system/bin/init.jacinto6evmboard.cpuset.sh u:object_r:init-cpuset-sh_exec:s0
27
25#Block devices 28#Block devices
26/dev/block/platform/44000000.ocp/480b4000.mmc/by-name/system u:object_r:system_block_device:s0 29/dev/block/platform/44000000.ocp/480b4000.mmc/by-name/system u:object_r:system_block_device:s0
27/dev/block/platform/44000000.ocp/480b4000.mmc/by-name/recovery u:object_r:recovery_block_device:s0 30/dev/block/platform/44000000.ocp/480b4000.mmc/by-name/recovery u:object_r:recovery_block_device:s0
diff --git a/sepolicy/init-cpuset-sh.te b/sepolicy/init-cpuset-sh.te
new file mode 100644
index 0000000..4547c45
--- /dev/null
+++ b/sepolicy/init-cpuset-sh.te
@@ -0,0 +1,7 @@
1type init-cpuset-sh, domain;
2type init-cpuset-sh_exec, exec_type, file_type;
3
4init_daemon_domain(init-cpuset-sh)
5
6allow init-cpuset-sh system_file:file execute_no_trans;
7allow init-cpuset-sh shell_exec:file read;