commit 50f433731d6d31e5b5d3008ba8a81228f10a2bdd
author Yi-Yo Chiang <yochiang@google.com> Thu Jan 09 18:41:03 2025 +0800
committer Yi-Yo Chiang <yochiang@google.com> Mon Jan 20 01:37:20 2025 -0800
tree 11db9e29f99fbec47b698ee990d634b01aff4033
parent 7374ccc1b61152c779072f3296e9bc75ddc4fa4f

init-display-sh: Don't audit writing to kmsg

modprobe would log errors to /dev/kmsg, need to explicit allow this.


```
avc:  denied  { write } for  comm="modprobe" name="kmsg" dev="tmpfs" ino=5 scontext=u:r:init-display-sh:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0
```

Bug: 388717752
Test: DeviceBootTest#SELinuxUncheckedDenialBootTest
Change-Id: Iaf1157a925e480ec3c8cdd00573f3d0a4ead355b

whitechapel_pro/init-display-sh.te

diff --git a/whitechapel_pro/init-display-sh.te b/whitechapel_pro/init-display-sh.te
index 54ff7d6..7f64b78 100644
--- a/whitechapel_pro/init-display-sh.te
+++ b/whitechapel_pro/init-display-sh.te
@@ -8,3 +8,5 @@
 
 dontaudit init-display-sh proc_cmdline:file r_file_perms;
 
+# Allow modprobe to log to kmsg.
+allow init-display-sh kmsg_device:chr_file w_file_perms;