ANDROID: exec_domains: Disable request_module() call for personalities
(cherry pick from commit a9ac1262ce80c287562e604f3bb24f232fcb686e) With Android M, Android environments use a separate execution domain for 32bit processes. See: https://android-review.googlesource.com/#/c/122131/ This results in systems that use kernel modules to see selinux audit noise like: type=1400 audit(28.989:15): avc: denied { module_request } for pid=1622 comm="app_process32" kmod="personality-8" scontext=u:r:zygote:s0 tcontext=u:r:kernel:s0 tclass=system While using kernel modules is unadvised, some systems do require them. Thus to avoid developers adding sepolicy exceptions to allow for request_module calls, this patch disables the logic which tries to call request_module for the 32bit personality (ie: personality-8), which doesn't actually exist. Signed-off-by:John Stultz <john.stultz@linaro.org> Change-Id: I32774083340e0f928d0e3bb4295517218e23c66c
Loading
Please register or sign in to comment