b88423d59152a17f026e8656135b81d6907aba24 - platform/system/sepolicy

commit	b88423d59152a17f026e8656135b81d6907aba24	[log] [tgz]
author	Marco Ballesio <balejs@google.com>	Tue Sep 01 17:24:55 2020 -0700
committer	Marco Ballesio <balejs@google.com>	Thu Sep 03 14:00:37 2020 -0700
tree	0e247d333b5717349a1c0d4e61f02244aee07000
parent	e756e983bb6481359038509d4a0efbcab45dacb9 [diff]

sepolicy: restrict BINDER_FREEZE to system_server

BINDER_FREEZE is used to block ipc transactions to frozen processes, so
only system_server must be allowed to use it.

Bug: 143717177
Test: manually verified that attempts to use BINDER_FREEZE by processes other
than system_server receive a sepolicy denial
Test: verified that system_server can enable/disable the freezer in
binder

Change-Id: I0fae3585c6ec409809e8085c1cc9862be4755889
Merged-In: I0fae3585c6ec409809e8085c1cc9862be4755889

prebuilts/api/30.0/private/system_server.te[diff]
prebuilts/api/30.0/public/domain.te[diff]
prebuilts/api/30.0/public/ioctl_defines[diff]
prebuilts/api/30.0/public/ioctl_macros[diff]
private/system_server.te[diff]
public/domain.te[diff]
public/ioctl_defines[diff]
public/ioctl_macros[diff]

8 files changed