From 77576c8311c159525cbdb4456b8b4f7b6228e61e Mon Sep 17 00:00:00 2001 From: roynatech2544 Date: Fri, 1 Dec 2023 22:45:37 +0900 Subject: [PATCH] universal7885: sepolicy: Address/Slience some denials --- universal7885-common/sepolicy/vendor/domain.te | 1 + universal7885-common/sepolicy/vendor/init.te | 4 ++++ 2 files changed, 5 insertions(+) create mode 100644 universal7885-common/sepolicy/vendor/domain.te diff --git a/universal7885-common/sepolicy/vendor/domain.te b/universal7885-common/sepolicy/vendor/domain.te new file mode 100644 index 0000000..a2d3fc7 --- /dev/null +++ b/universal7885-common/sepolicy/vendor/domain.te @@ -0,0 +1 @@ +dontaudit domain self:capability sys_admin; diff --git a/universal7885-common/sepolicy/vendor/init.te b/universal7885-common/sepolicy/vendor/init.te index 6fd25eb..a9afc9c 100644 --- a/universal7885-common/sepolicy/vendor/init.te +++ b/universal7885-common/sepolicy/vendor/init.te @@ -3,3 +3,7 @@ allow init sysfs_battery_writable:file setattr; allow init { sec_efs_file efs_file }:dir mounton; allow init sysfs_mmc:file w_file_perms; allow init socket_device:sock_file create_file_perms; + +# dirty_background_bytes, dirty_bytes +# Better than sperately labeling it? +allow init proc:file write;