diff --git a/sepolicy/auditd.te b/sepolicy/auditd.te new file mode 100644 index 00000000..01d5a069 --- /dev/null +++ b/sepolicy/auditd.te @@ -0,0 +1,3 @@ +allow logd auditd_log:dir rw_dir_perms; +allow logd auditd_log:file create_file_perms; + diff --git a/sepolicy/file.te b/sepolicy/file.te index 95a9c384..3a20199c 100644 --- a/sepolicy/file.te +++ b/sepolicy/file.te @@ -1,2 +1,4 @@ # Support asec containers getting mounted allow file_type rootfs:filesystem associate; + +type auditd_log, file_type; diff --git a/sepolicy/file_contexts b/sepolicy/file_contexts index e23df31f..9e7f998f 100644 --- a/sepolicy/file_contexts +++ b/sepolicy/file_contexts @@ -1,5 +1,9 @@ /cache/dalvik-cache(/.*)? u:object_r:dalvikcache_data_file:s0 +# Auditd is a logging daemon. Put it into logd's context +/system/bin/auditd u:object_r:logd_exec:s0 +/data/misc/audit(/.*)? u:object_r:auditd_log:s0 + ############################# # performance-related sysfs files (CM) /sys/kernel/mm/ksm(/.*)? -- u:object_r:sysfs_writable:s0 diff --git a/sepolicy/sepolicy.mk b/sepolicy/sepolicy.mk index 45792a19..c58ce146 100644 --- a/sepolicy/sepolicy.mk +++ b/sepolicy/sepolicy.mk @@ -11,6 +11,7 @@ BOARD_SEPOLICY_UNION += \ file_contexts \ genfs_contexts \ seapp_contexts \ + auditd.te \ installd.te \ netd.te \ system.te \