fix build
Read access to selinuxfs was neverallowed to app domains in
system/sepolicy commit 14e2e9261fec015ab6fa66f2bc67439f13c45b8d.
However, a dragon app_domain uses device_domain_deprecated.te, which is
triggering the neverallow assertion and breaking the build.
Remove selinuxfs read from device_domain_deprecated to fix the build.
Fixes:
neverallow check failed at
out/target/product/dragon/obj/ETC/sepolicy.recovery_intermediates/plat_policy_nvr.recovery.cil:7880
from system/sepolicy/private/app.te:440
(neverallow base_typeattr_148 selinuxfs (file (ioctl read write create setattr lock relabelfrom append unlink link rename open)))
<root>
allow at out/target/product/dragon/obj/ETC/sepolicy.recovery_intermediates/nonplat_policy_nvr.recovery.cil:5151
(allow device_domain_deprecated selinuxfs_10000_0 (file (ioctl read getattr lock open)))
Failed to generate binary
Failed to build policydb
Change-Id: I56b892fc8109c669b07a952671389a64d19cab75
Test: code compiles.
Bug: 27756382
Bug: 28760354
diff --git a/sepolicy/device_domain_deprecated.te b/sepolicy/device_domain_deprecated.te
index bbe0b71..8a17408 100644
--- a/sepolicy/device_domain_deprecated.te
+++ b/sepolicy/device_domain_deprecated.te
@@ -30,7 +30,5 @@
allow device_domain_deprecated proc_meminfo:file r_file_perms;
allow device_domain_deprecated proc_net:dir r_dir_perms;
allow device_domain_deprecated proc_net:{ file lnk_file } r_file_perms;
-allow device_domain_deprecated selinuxfs:dir r_dir_perms;
-allow device_domain_deprecated selinuxfs:file r_file_perms;
allow device_domain_deprecated asec_public_file:file r_file_perms;
allow device_domain_deprecated { asec_public_file asec_apk_file }:dir r_dir_perms;
