sepolicy: debugfs guarded and disabled on user builds

Following LineageOS/android_device_qcom_sepolicy@fc9b1c6, debugfs is now guarded by PRODUCT_SET_DEBUGFS_RESTRICTIONS and disabled on user builds.
whatawurst · Jul 29, 2023 · bde1cc1 · bde1cc1
1 parent 834a6cb
commit bde1cc1
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/sepolicy/vendor/kernel.te b/sepolicy/vendor/kernel.te
@@ -4,4 +4,8 @@
 allow kernel proc_cmdline:file r_file_perms;
 
 # /sys/kernel/debug/ipc_logging
-allow kernel qti_debugfs:dir r_dir_perms;
+no_debugfs_restriction(`
+  userdebug_or_eng(`
+    allow kernel qti_debugfs:dir r_dir_perms;
+  ')
+')