commit 121f5bfd80298266d293fa5c0a30fed66f4facfa
author Mark Salyzyn <salyzyn@google.com> Fri Mar 25 09:59:18 2016 -0700
committer Mark Salyzyn <salyzyn@google.com> Fri Mar 25 13:05:07 2016 -0700
tree 1d7104769649cc164b2a5a7a0e32028d22d150a9
parent f2d07904f7754a066c7e15a072cf57126ff348d3

init: logpersist access on debug

03-25 09:31:22.996     1     1 W init    : type=1400 audit(0.0:8): \
  avc: denied { getattr } for path="/data/misc/logd/logcat.052" \
  dev="dm-2" ino=124778 scontext=u:r:init:s0 \
  tcontext=u:object_r:misc_logd_file:s0 tclass=file permissive=0
. . .

Introduced a new macro not_userdebug_nor_eng()

Change-Id: I9c3a952c265cac096342493598fff7d41604ca45

domain.te

diff --git a/domain.te b/domain.te
index 5d5f7a2..da2206e 100644
--- a/domain.te
+++ b/domain.te
@@ -491,7 +491,7 @@
 neverallow * ~service_manager_type:service_manager { add find };
 
 # logpersist is only allowed on userdebug/eng builds
-neverallow { domain userdebug_or_eng(`-logd -shell') } misc_logd_file:file rw_file_perms;
+neverallow { domain userdebug_or_eng(`-logd -shell -init') } misc_logd_file:file rw_file_perms;
 
 # Prevent assigning non property types to properties
 neverallow * ~property_type:property_service set;

init.te

diff --git a/init.te b/init.te
index 2d070de..315e25a 100644
--- a/init.te
+++ b/init.te
@@ -100,7 +100,7 @@
 allow init self:capability { chown fowner fsetid };
 allow init {file_type -system_file -exec_type -app_data_file}:dir { create search getattr open read setattr ioctl };
 allow init {file_type -system_file -exec_type -keystore_data_file -app_data_file -shell_data_file -vold_data_file}:dir { write add_name remove_name rmdir relabelfrom };
-allow init {file_type -system_file -exec_type -keystore_data_file -app_data_file -shell_data_file -vold_data_file -misc_logd_file }:file { create getattr open read write setattr relabelfrom unlink };
+allow init {file_type -system_file -exec_type -keystore_data_file -app_data_file -shell_data_file -vold_data_file not_userdebug_nor_eng(`-misc_logd_file') }:file { create getattr open read write setattr relabelfrom unlink };
 allow init {file_type -system_file -exec_type -keystore_data_file -app_data_file -shell_data_file -vold_data_file}:{ sock_file fifo_file } { create getattr open read setattr relabelfrom unlink };
 allow init {file_type -system_file -exec_type -keystore_data_file -app_data_file -shell_data_file -vold_data_file}:lnk_file { create getattr setattr relabelfrom unlink };
 allow init {file_type -system_file -exec_type}:dir_file_class_set relabelto;

te_macros

diff --git a/te_macros b/te_macros
index 84af301..f4d9482 100644
--- a/te_macros
+++ b/te_macros
@@ -278,6 +278,7 @@
 # SELinux rules which apply only to userdebug or eng builds
 #
 define(`userdebug_or_eng', ifelse(target_build_variant, `eng', $1, ifelse(target_build_variant, `userdebug', $1)))
+define(`not_userdebug_nor_eng', ifelse(target_build_variant, `eng', , ifelse(target_build_variant, `userdebug', , $1)))
 define(`eng', ifelse(target_build_variant, `eng', $1))
 
 #####################################