Allow thermald dac_override.
Addresses denials such as:
avc: denied { dac_override } for comm="thermald" capability=1 scontext=u:r:thermald:s0 tcontext=u:r:thermald:s0 tclass=capability
Also add an auditallow rule to track this permission for further analysis.
We already allow this on hammerhead.
Change-Id: I02b15e9725f42d4c9d9f829982a5a00175160af2
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
diff --git a/sepolicy/thermald.te b/sepolicy/thermald.te
index e28eb19..6f93a3e 100644
--- a/sepolicy/thermald.te
+++ b/sepolicy/thermald.te
@@ -5,6 +5,10 @@
# Started by init
init_daemon_domain(thermald)
+# DAC overrides
+allow thermald self:capability dac_override;
+auditallow thermald self:capability dac_override;
+
allow thermald self:socket create_socket_perms;
# CPU hotplug uevent
