diff options
author | Joel Galenson | 2018-04-16 16:50:38 -0500 |
---|---|---|
committer | Joel Galenson | 2018-04-16 18:39:43 -0500 |
commit | 254a872cab855b01433cdd5a30239ef888452003 (patch) | |
tree | 04d780d8244ba7695b70e19a0a3c3abf9ef1a474 /private | |
parent | e96766dc42dd1889c5ccfdb37acac20ed75200cc (diff) | |
download | system-sepolicy-254a872cab855b01433cdd5a30239ef888452003.tar.gz system-sepolicy-254a872cab855b01433cdd5a30239ef888452003.tar.xz system-sepolicy-254a872cab855b01433cdd5a30239ef888452003.zip |
Let vold_prepare_subdirs completely clean deleted user data.
After adding a new user, deleting it, and rebooting, some of the user's data still remained. This adds the SELinux permissions necessary to remove all of the data. It fixes the followign denials:
avc: denied { rmdir } for scontext=u:r:vold_prepare_subdirs:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir
avc: denied { unlink } for scontext=u:r:vold_prepare_subdirs:s0 tcontext=u:object_r:system_data_file:s0 tclass=file
Bug: 74866238
Test: Create user, delete user, reboot user, see no denials or
leftover data.
Change-Id: Ibc43bd2552b388a9708bf781b5ad206f21df62dc
Diffstat (limited to 'private')
-rw-r--r-- | private/vold_prepare_subdirs.te | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/private/vold_prepare_subdirs.te b/private/vold_prepare_subdirs.te index badbb71f..89b15280 100644 --- a/private/vold_prepare_subdirs.te +++ b/private/vold_prepare_subdirs.te | |||
@@ -12,8 +12,8 @@ allow vold_prepare_subdirs self:process setfscreate; | |||
12 | allow vold_prepare_subdirs { | 12 | allow vold_prepare_subdirs { |
13 | system_data_file | 13 | system_data_file |
14 | vendor_data_file | 14 | vendor_data_file |
15 | }:dir { open read write add_name remove_name relabelfrom }; | 15 | }:dir { open read write add_name remove_name rmdir relabelfrom }; |
16 | allow vold_prepare_subdirs system_data_file:file getattr; | 16 | allow vold_prepare_subdirs system_data_file:file { getattr unlink }; |
17 | allow vold_prepare_subdirs vold_data_file:dir { create open read write search getattr setattr remove_name rmdir relabelto }; | 17 | allow vold_prepare_subdirs vold_data_file:dir { create open read write search getattr setattr remove_name rmdir relabelto }; |
18 | allow vold_prepare_subdirs vold_data_file:file { getattr unlink }; | 18 | allow vold_prepare_subdirs vold_data_file:file { getattr unlink }; |
19 | allow vold_prepare_subdirs storaged_data_file:dir { create_dir_perms relabelto }; | 19 | allow vold_prepare_subdirs storaged_data_file:dir { create_dir_perms relabelto }; |