commit e24abefa8e2e54bd458f03c96dbdff4f1a08af95
author Alex Klyubin <klyubin@google.com> Mon Feb 27 12:41:50 2017 -0800
committer Alex Klyubin <klyubin@google.com> Mon Feb 27 13:27:58 2017 -0800
tree 8d0e6db7c04552a874a07fbacf7efb0f909d346b
parent 8d669feb9f94635448aedfd209c26ecff9451843

Make secilc accessible by root only

There's no reason for SELinux policy compiler to be accessible by
anybode other than root.

Test: Device boots -- secilc isn't used yet anyway
Bug: 31363362
Change-Id: I26cf34f1412b8dd471f79271c491b473617a6df6

libcutils/fs_config.c

diff --git a/libcutils/fs_config.c b/libcutils/fs_config.c
index 7e27c3e..75e2492 100644
--- a/libcutils/fs_config.c
+++ b/libcutils/fs_config.c
@@ -180,6 +180,7 @@
     { 00755, AID_ROOT,      AID_SHELL,     0, "system/bin/crash_dump32" },
     { 00755, AID_ROOT,      AID_SHELL,     0, "system/bin/crash_dump64" },
     { 00755, AID_ROOT,      AID_SHELL,     0, "system/bin/debuggerd" },
+    { 00700, AID_ROOT,      AID_ROOT,      0, "system/bin/secilc" },
     { 00750, AID_ROOT,      AID_ROOT,      0, "system/bin/uncrypt" },
     { 00750, AID_ROOT,      AID_ROOT,      0, "system/bin/install-recovery.sh" },
     { 00755, AID_ROOT,      AID_SHELL,     0, "system/bin/*" },