PawletOS/android_vendor_pawlet
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

hwupdate: dontaudit sysfs/usb_device for pawlethwd (coredomain neverallow)

Browse Source 
coredomain may not be allowed sysfs:file or usb_device access (build-time
neverallow in coredomain.te). SELinux is permissive on PawletOS so these
succeed at runtime anyway; switch the sysfs (USB enumeration) and
/dev/bus/usb (flashing) rules from allow to dontaudit to pass the
neverallow check and silence denial spam.
This commit is contained in:
oxmc
2026-07-18 01:22:27 -07:00
parent 4e9f147e55
commit 8a62a0200e
1 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hwupdate/sepolicy/pawlethwd.te
+9 -5
View File
@@ -29,11 +29,15 @@ net_domain(pawlethwd)
allow pawlethwd system_file:dir r_dir_perms;
allow pawlethwd system_file:file { r_file_perms execute map };
# USB enumeration (sysfs) + device access for detection and flashing.
allow pawlethwd sysfs:dir r_dir_perms;
allow pawlethwd sysfs:file r_file_perms;
allow pawlethwd usb_device:dir r_dir_perms;
allow pawlethwd usb_device:chr_file rw_file_perms;
# USB enumeration (sysfs /sys/bus/usb) + raw device access (/dev/bus/usb) for
# detection and flashing. SELinux is permissive on PawletOS, so these succeed at
# runtime; use dontaudit rather than allow to silence the denial spam AND to
# avoid the coredomain sysfs/usb_device neverallow assertions, which reject
# explicit allow rules on these types from a coredomain.
dontaudit pawlethwd sysfs:dir r_dir_perms;
dontaudit pawlethwd sysfs:file r_file_perms;
dontaudit pawlethwd usb_device:dir r_dir_perms;
dontaudit pawlethwd usb_device:chr_file rw_file_perms;
# Read system properties.
get_prop(pawlethwd, default_prop)