Rewrite mediaserver socket rule using macro.
Addresses denials such as:
avc: denied { ioctl } for pid=31771 comm="mediaserver" path="socket:[217520]" dev="sockfs" ino=217520 scontext=u:r:mediaserver:s0 tcontext=u:r:mediaserver:s0 tclass=socket
Change-Id: Iecae88d88b5fbc1ff348077b8bb926b835fda2e5
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
diff --git a/sepolicy/mediaserver.te b/sepolicy/mediaserver.te
index 2183efb..61d68d6 100644
--- a/sepolicy/mediaserver.te
+++ b/sepolicy/mediaserver.te
@@ -3,5 +3,6 @@
unix_socket_send(mediaserver, camera, camera)
-# Permit mediaserver to create sockets
-allow mediaserver self:socket create;
+# Permit mediaserver to create sockets with no specific SELinux class.
+# TODO: Investigate the specific type of socket.
+allow mediaserver self:socket create_socket_perms;
