commit e3dfd4019c11718b3d9026ad989f5470c258d5af
author Tri Vo <trong@google.com> Tue Apr 16 12:02:44 2019 -0700
committer Tri Vo <trong@google.com> Tue Apr 16 12:11:06 2019 -0700
tree 11b5e5ae4143d77f16a41abdefe920dbc8f67a1c
parent 3f84caf090ea81df166a358f32a3d630cbf9aba6

vsoc_guest_region_e2e_test suppress /data/local/tmp denial

avc: denied { dac_override } for capability=1
scontext=u:r:vsoc_guest_region_e2e_test:s0
tcontext=u:r:vsoc_guest_region_e2e_test:s0 tclass=capability
permissive=0

Fixes: 130577243
Test: boot cuttlefish without above denial
Change-Id: I5b8eb65c3400d73107281a9befb7f0a6acb2b884

shared/sepolicy/vsoc_guest_region_e2e_test.te

diff --git a/shared/sepolicy/vsoc_guest_region_e2e_test.te b/shared/sepolicy/vsoc_guest_region_e2e_test.te
index d4ab68f..db5749f 100644
--- a/shared/sepolicy/vsoc_guest_region_e2e_test.te
+++ b/shared/sepolicy/vsoc_guest_region_e2e_test.te
@@ -7,3 +7,7 @@
 allow vsoc_guest_region_e2e_test region_e2e_test_device:chr_file rw_file_perms;
 allow vsoc_guest_region_e2e_test vendor_data_file:file { create_file_perms };
 allow vsoc_guest_region_e2e_test vendor_data_file:dir { create_file_perms create_dir_perms };
+
+# gtest checks access() on /data/local/tmp. However, vendor processes are
+# neverallow'ed /data access outside of /data/vendor.
+dontaudit vsoc_guest_region_e2e_test self:capability dac_override;