* [PATCH] android/init: Update init script with proper selinux domain label
@ 2014-11-21 13:58 Jakub Tyszkowski
2014-11-25 13:16 ` Szymon Janc
0 siblings, 1 reply; 2+ messages in thread
From: Jakub Tyszkowski @ 2014-11-21 13:58 UTC (permalink / raw)
To: linux-bluetooth; +Cc: Jakub Tyszkowski
This is to get rid of SEPolicy complain about service running without
defined policies.
---
android/init.bluetooth.rc | 2 ++
1 file changed, 2 insertions(+)
diff --git a/android/init.bluetooth.rc b/android/init.bluetooth.rc
index af62121..1815fac 100644
--- a/android/init.bluetooth.rc
+++ b/android/init.bluetooth.rc
@@ -25,6 +25,7 @@ service bluetoothd /system/bin/logwrapper /system/bin/bluetoothd
class main
# init does not yet support setting capabilities so run as root,
# bluetoothd drop uid to bluetooth with the right linux capabilities
+ seclabel u:r:bluetoothd:s0
group bluetooth
disabled
oneshot
@@ -33,6 +34,7 @@ service bluetoothd-snoop /system/bin/logwrapper /system/bin/bluetoothd-snoop
class main
# init does not yet support setting capabilities so run as root,
# bluetoothd-snoop drops unneeded linux capabilities
+ seclabel u:r:bluetoothd:s0
group nobody
disabled
oneshot
--
1.9.1
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] android/init: Update init script with proper selinux domain label
2014-11-21 13:58 [PATCH] android/init: Update init script with proper selinux domain label Jakub Tyszkowski
@ 2014-11-25 13:16 ` Szymon Janc
0 siblings, 0 replies; 2+ messages in thread
From: Szymon Janc @ 2014-11-25 13:16 UTC (permalink / raw)
To: Jakub Tyszkowski; +Cc: linux-bluetooth
Hi Jakub,
On Friday 21 of November 2014 14:58:21 Jakub Tyszkowski wrote:
> This is to get rid of SEPolicy complain about service running without
> defined policies.
> ---
> android/init.bluetooth.rc | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/android/init.bluetooth.rc b/android/init.bluetooth.rc
> index af62121..1815fac 100644
> --- a/android/init.bluetooth.rc
> +++ b/android/init.bluetooth.rc
> @@ -25,6 +25,7 @@ service bluetoothd /system/bin/logwrapper
> /system/bin/bluetoothd class main
> # init does not yet support setting capabilities so run as root,
> # bluetoothd drop uid to bluetooth with the right linux capabilities
> + seclabel u:r:bluetoothd:s0
> group bluetooth
> disabled
> oneshot
> @@ -33,6 +34,7 @@ service bluetoothd-snoop /system/bin/logwrapper
> /system/bin/bluetoothd-snoop class main
> # init does not yet support setting capabilities so run as root,
> # bluetoothd-snoop drops unneeded linux capabilities
> + seclabel u:r:bluetoothd:s0
> group nobody
> disabled
> oneshot
I think we should have separate policy for snoop service as it requires far
less permissions to run.
--
BR
Szymon Janc
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-11-25 13:16 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-11-21 13:58 [PATCH] android/init: Update init script with proper selinux domain label Jakub Tyszkowski
2014-11-25 13:16 ` Szymon Janc
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).