neverallow service_manager / service_manager_type
Init never uses / add service manager services. It doesn't make
sense to allow these rules to init. Adding a rule of this type
is typically caused by a process inappropriately running in init's
SELinux domain, and the warning message:
Warning! Service %s needs a SELinux domain defined; please fix!
In addition, add neverallow rules to domain.te which prevent
nonsense SELinux service_manager rules from being added.
2 files changed