Commit 9e968241 authored by topjohnwu's avatar topjohnwu

Add pre-init rules

parent 3c6a1701
......@@ -163,6 +163,14 @@ void sepol_min_rules() {
sepol_attradd("su", "mlstrustedsubject");
sepol_attradd("su_device", "mlstrustedobject");
// Let pre-init do stuffs
sepol_allow("kernel", "kernel", "security", "load_policy");
sepol_allow("kernel", "device", "dir", "write");
sepol_allow("kernel", "device", "dir", "add_name");
sepol_allow("kernel", "device", "file", "create");
sepol_allow("kernel", "device", "file", "open");
sepol_allow("kernel", "device", "file", "read");
// Let init run stuffs in su context
sepol_allow("kernel", "su", "fd", "use");
sepol_allow("init", "su", "process", ALL);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment