make /data/diag_logs an mlstrustedobject
QXDM logger runs as a platform app, and is now subject to
SELinux multi-user restrictions. Mark /data/diag_logs as being
safe to access from multiple Android users.
Addresses the following denial:
05-18 17:27:40.163 319 319 W roid.qxdmlogger: type=1400 audit(0.0:2731): avc: denied { write } for name="rundiag" dev="dm-1" ino=1798722 scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:diag_logs:s0 tclass=file permissive=0
05-18 17:27:40.193 335 335 W chmod : type=1400 audit(0.0:2732): avc: denied { setattr } for name="rundiag" dev="dm-1" ino=1798722 scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:diag_logs:s0 tclass=file permissive=0
Bug: 21280070
Change-Id: Iad56825d52fd64ff418ebde72354fccff24e6509
diff --git a/sepolicy/file.te b/sepolicy/file.te
index e8d2bff..adf1126 100644
--- a/sepolicy/file.te
+++ b/sepolicy/file.te
@@ -13,7 +13,7 @@
# Socket node needed by ims_data daemon
type ims_socket, file_type;
-type diag_logs, file_type, data_file_type;
+type diag_logs, file_type, data_file_type, mlstrustedobject;
type ram_dump_logs, file_type, data_file_type;
type time_data_file, file_type, data_file_type;
type gsiffd_data_file, data_file_type, file_type;
