Suppressing boot time denial
This denial is generated by whichever process first attempts to access
the filesystem, triggering the kernel to go through module loading to
find the correct crypto module to use to decrypt the FS. This dontaudit
will suppress the denial until the underlying problem is fixed
denied { module_request } for comm="BootAnimation"
kmod="crypto-heh(aes)-all" scontext=u:r:bootanim:s0
tcontext=u:r:kernel:s0 tclass=system
Bug: 37205419
Test: bootanim doesn't spawn a module_load denial
Change-Id: Iceebe582cc6573ecea739494b424da99f1ce4a0e
diff --git a/sepolicy/bootanim.te b/sepolicy/bootanim.te
index b5d00b9..4d229a6 100644
--- a/sepolicy/bootanim.te
+++ b/sepolicy/bootanim.te
@@ -3,3 +3,6 @@
# in /data/system. This should be moved. In the meantime, suppress
# this denial on Marlin since this functionality is not used.
dontaudit bootanim system_data_file:dir read;
+
+# TODO(b/37205419): Remove upon resolution
+dontaudit bootanim kernel:system module_request;
