Address SELinux denials for vnc_server
denied { net_raw } for comm="vnc_server" capability=13 scontext=u:r:vnc_server:s0 tcontext=u:r:vnc_server:s0 tclass=capability
denied { dac_override } for comm="vnc_server" capability=1 scontext=u:r:vnc_server:s0 tcontext=u:r:vnc_server:s0 tclass=capability
denied { write } for comm="vnc_server" name="uinput" dev="tmpfs" scontext=u:r:vnc_server:s0 tcontext=u:object_r:uhid_device:s0 tclass=chr_file
denied { open } for comm="vnc_server" path="/dev/uinput" dev="tmpfs" scontext=u:r:vnc_server:s0 tcontext=u:object_r:uhid_device:s0 tclass=chr_file
denied { ioctl } for comm="vnc_server" path="/dev/uinput" dev="tmpfs" ioctlcmd=5564 scontext=u:r:vnc_server:s0 tcontext=u:object_r:uhid_device:s0 tclass=chr_file
denied { open } for comm="vnc_server" path="/initial.metadata" dev="rootfs" scontext=u:r:vnc_server:s0 tcontext=u:object_r:rootfs:s0 tclass=file
denied { read } for comm="vnc_server" name="initial.metadata" dev="rootfs" scontext=u:r:vnc_server:s0 tcontext=u:object_r:rootfs:s0 tclass=file
denied { getattr } for comm="vnc_server" path="/initial.metadata" dev="rootfs" scontext=u:r:vnc_server:s0 tcontext=u:object_r:rootfs:s0 tclass=file
denied { open } for comm="vnc_server" path="/dev/framebuffer_control" dev="tmpfs" scontext=u:r:vnc_server:s0 tcontext=u:object_r:device:s0 tclass=file
denied { read write } for comm="vnc_server" name="framebuffer_control" dev="tmpfs" scontext=u:r:vnc_server:s0 tcontext=u:object_r:device:s0 tclass=file
denied { open } for comm="vnc_server" path="/dev/userspace_framebuffer" dev="tmpfs" scontext=u:r:vnc_server:s0 tcontext=u:object_r:device:s0 tclass=file
denied { read write } for comm="vnc_server" name="userspace_framebuffer" dev="tmpfs" scontext=u:r:vnc_server:s0 tcontext=u:object_r:device:s0 tclass=file
Test: Can interact with device over VNC. No SELinux denials for
vnc_server
Bug: 28053261
Change-Id: Ie83a319d13177ead6510b5dfa26a036a5f993972
4 files changed