commit 036ef1ebc23b6a2d05317f397125f598c042fe52
author Tri Vo <trong@google.com> Mon Oct 16 15:01:45 2017 -0700
committer Tri Vo <trong@google.com> Wed Oct 18 12:33:45 2017 -0700
tree 5ab86b6642d6f051ed0f3664cf131b3b46bc0e16
parent e6334a77896f1e3e22e30114b06107ade193311e

Remove obdm_app access to proc label.

Instead give obdm_app read access to /proc/stat.

Bug: 65643247
Test: can login to obdm app without selinux denials

Change-Id: I368c018f883610364cd026da68085935aefd69c1

sepolicy/verizon/obdm_app.te

diff --git a/sepolicy/verizon/obdm_app.te b/sepolicy/verizon/obdm_app.te
index c8abf8b..f24baad 100644
--- a/sepolicy/verizon/obdm_app.te
+++ b/sepolicy/verizon/obdm_app.te
@@ -3,7 +3,7 @@
 app_domain(obdm_app)
 net_domain(obdm_app)
 
-r_dir_file(obdm_app, proc)
+allow obdm_app proc_stat:file r_file_perms;
 
 # talk to /dev/diag
 allow obdm_app diag_device:chr_file rw_file_perms;