tree 8ecdd9e5b77bd94b3346aa0ed96202315b9302f7
parent 0a7b2a4cce91aa51a085691b61406691bc6aaf89
author Alex Klyubin <klyubin@google.com> 1503544269 -0700
committer Alex Klyubin <klyubin@google.com> 1503544437 -0700

Address SELinux denials for vnc_server

denied { net_raw } for comm="vnc_server" capability=13 scontext=u:r:vnc_server:s0 tcontext=u:r:vnc_server:s0 tclass=capability
denied { dac_override } for comm="vnc_server" capability=1 scontext=u:r:vnc_server:s0 tcontext=u:r:vnc_server:s0 tclass=capability
denied { write } for comm="vnc_server" name="uinput" dev="tmpfs" scontext=u:r:vnc_server:s0 tcontext=u:object_r:uhid_device:s0 tclass=chr_file
denied { open } for comm="vnc_server" path="/dev/uinput" dev="tmpfs" scontext=u:r:vnc_server:s0 tcontext=u:object_r:uhid_device:s0 tclass=chr_file
denied { ioctl } for comm="vnc_server" path="/dev/uinput" dev="tmpfs" ioctlcmd=5564 scontext=u:r:vnc_server:s0 tcontext=u:object_r:uhid_device:s0 tclass=chr_file
denied { open } for comm="vnc_server" path="/initial.metadata" dev="rootfs" scontext=u:r:vnc_server:s0 tcontext=u:object_r:rootfs:s0 tclass=file
denied { read } for comm="vnc_server" name="initial.metadata" dev="rootfs" scontext=u:r:vnc_server:s0 tcontext=u:object_r:rootfs:s0 tclass=file
denied { getattr } for comm="vnc_server" path="/initial.metadata" dev="rootfs" scontext=u:r:vnc_server:s0 tcontext=u:object_r:rootfs:s0 tclass=file
denied { open } for comm="vnc_server" path="/dev/framebuffer_control" dev="tmpfs" scontext=u:r:vnc_server:s0 tcontext=u:object_r:device:s0 tclass=file
denied { read write } for comm="vnc_server" name="framebuffer_control" dev="tmpfs" scontext=u:r:vnc_server:s0 tcontext=u:object_r:device:s0 tclass=file
denied { open } for comm="vnc_server" path="/dev/userspace_framebuffer" dev="tmpfs" scontext=u:r:vnc_server:s0 tcontext=u:object_r:device:s0 tclass=file
denied { read write } for comm="vnc_server" name="userspace_framebuffer" dev="tmpfs" scontext=u:r:vnc_server:s0 tcontext=u:object_r:device:s0 tclass=file

Test: Can interact with device over VNC. No SELinux denials for
      vnc_server
Bug: 28053261

Change-Id: Ie83a319d13177ead6510b5dfa26a036a5f993972