diff --git a/sepolicy/base/public/init.te b/sepolicy/base/public/init.te index e5181aa524ffa261b7f810cadd81e93ee9c81bcc..fb3999f9c91a225025dff47ba1106be862ee671b 100644 --- a/sepolicy/base/public/init.te +++ b/sepolicy/base/public/init.te @@ -35,7 +35,7 @@ neverallow init domain:udp_socket ~{ ioctl create }; #todo # system_bin_file need to fix -neverallow init { file_attr fs_attr -system_bin_file -param_exec -begetctl_exec -toybox_exec -sdc_exec -hnp_exec updater_only(`-rootfs') -system_bin_file_quickfix -rgm_violator_system_bin_file -init_module_system_bin_file -bootanimation_exec -violator_bin_file_updater_sa -system_bin_module_update_exec}:file execute_no_trans; +neverallow init { file_attr fs_attr -system_bin_file -param_exec -begetctl_exec -toybox_exec -sdc_exec -hnp_exec updater_only(`-rootfs') -system_bin_file_quickfix -rgm_violator_system_bin_file -init_module_system_bin_file -bootanimation_exec -violator_bin_file_updater_sa -system_bin_module_update_exec }:file execute_no_trans; #todo #neverallow init sys_file:file { open read write };