commit e33584c39bd7384d27f01c05edb96039b6272612
author Jeff Vander Stoep <jeffv@google.com> Mon Sep 19 14:20:47 2016 -0700
committer Jeff Vander Stoep <jeffv@google.com> Mon Sep 19 14:22:16 2016 -0700
tree d3b54cc288bf05d2105d87608441bf98f0586c2d
parent fc37444836e15610ba72140b1d22f569b06556f7

system_server: whitelist MSM ipc router ioctls

avc: denied { ioctl } for pid=3112 path="socket:[29649]" dev="sockfs" ino=29649 ioctlcmd=c302 scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=socket
avc: denied { ioctl } for pid=3112 path="socket:[29647]" dev="sockfs" ino=29647 ioctlcmd=c304 scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=socket

Change-Id: I5018a24464b1160a496e6782284dc8a844b8a114

sepolicy/system_server.te

diff --git a/sepolicy/system_server.te b/sepolicy/system_server.te
index 07cc3da..d1346ad 100644
--- a/sepolicy/system_server.te
+++ b/sepolicy/system_server.te
@@ -39,4 +39,7 @@
 allow system_server zygote:process setsched;
 
 allowxperm system_server self:udp_socket ioctl { SIOCSIFFLAGS SIOCDEVPRIVATE_D };
+
+# use MSM ipc router ioctls
+allow system_server self:socket ioctl;
 allowxperm system_server self:socket ioctl msm_sock_ipc_ioctls;