| commit | 04b8a75c2f7532821a2a098a95d884931a91807c | [log] [tgz] |
|---|---|---|
| author | Stephen Smalley <sds@tycho.nsa.gov> | Thu Jun 19 11:26:22 2014 -0400 |
| committer | Nick Kralevich <nnk@google.com> | Thu Jun 19 23:11:04 2014 +0000 |
| tree | 51add4cf8631d7547fffce606e17768a589e58e5 | |
| parent | f3c3a1aa33bc3a34a5bef94d3643c3702cf925c6 [diff] |
Remove write access to rootfs files. Remove write access to rootfs files from unconfineddomain and prevent adding it back via neverallow. This is only applied to regular files, as we are primarily concerned with preventing writing to a file that can be exec'd and because creation of directories or symlinks in the rootfs may be required for mount point directories. Change-Id: If2c96da03f5dd6f56de97131f6ba9eceea328721 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>