Skip to content

Commit

Permalink
Allow 'vdc' to be invoked with logwrapper.
Browse files Browse the repository at this point in the history
Currently vdc emits logs to stderr, which makes sense for command
line invocations, but when exec'ed they're silently dropped unless
the caller uses logwrapper.

avc: denied { read write } for path="/dev/pts/2" dev="devpts" ino=5 scontext=u:r:vdc:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=0

Bug: 25796509
Change-Id: Ib92e0a7f580b1934a9853a83684f95b24bdc355c
  • Loading branch information
jsharkey committed Feb 4, 2016
1 parent 613f451 commit 3ade7ce
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions vdc.te
Expand Up @@ -21,3 +21,6 @@ allow vdc shell_data_file:file { write getattr };

# Why?
allow vdc dumpstate:unix_dgram_socket { read write };

# vdc can be invoked with logwrapper, so let it write to pty
allow vdc devpts:chr_file rw_file_perms;

0 comments on commit 3ade7ce

Please sign in to comment.