commit 0e53d8a8c05caae71352afe233f59b2b6fd752d9
author Roman Kiryanov <rkir@google.com> Mon Oct 01 13:27:36 2018 -0700
committer Roman Kiryanov <rkir@google.com> Fri Oct 05 12:04:45 2018 -0700
tree a3e169cfbda184fedf1e62eb14a93059707067b6
parent 0821aa6853d62b2a51dc04aa50b05c249ab8996b

Drop { module_request } for comm="ipv6proxy" selinux compains

This change drops these selinux complains:
{ module_request } for comm="ipv6proxy" kmod="eth0" scontext=u:r:ipv6proxy:s0 tcontext=u:r:kernel:s0 tclass=system permissive=0
{ module_request } for comm="ipv6proxy" kmod="netdev-eth0" scontext=u:r:ipv6proxy:s0 tcontext=u:r:kernel:s0 tclass=system permissive=0
because they are not interesting.

Bug: 116663979
Test: run emulator
Change-Id: Ib714a36327390e30bb2fb482a0ec7bfd6dd9c532
Signed-off-by: Roman Kiryanov <rkir@google.com>

sepolicy/common/ipv6proxy.te

diff --git a/sepolicy/common/ipv6proxy.te b/sepolicy/common/ipv6proxy.te
index 1defe10..a631501 100644
--- a/sepolicy/common/ipv6proxy.te
+++ b/sepolicy/common/ipv6proxy.te
@@ -10,6 +10,7 @@
 allow ipv6proxy execns:fd use;
 
 set_prop(ipv6proxy, net_eth0_prop);
+dontaudit ipv6proxy kernel:system module_request;
 allow ipv6proxy self:capability { sys_admin sys_module net_admin net_raw };
 allow ipv6proxy self:packet_socket { bind create read };
 allow ipv6proxy self:netlink_route_socket nlmsg_write;