tree 3d35cfd4daca7b82aadd851fa629c5e9fade3e3d
parent 7cd698341ffe2e58570a2448b033d3e78d3b5250
author Ricardo Cerqueira <ricardo@cyngn.com> 1418243337 +0000
committer Ricardo Cerqueira <ricardo@cyngn.com> 1418243914 +0000

selinux: Workaround for devices with PR_SET_NO_NEW_PRIVS enforcement

PR_SET_NO_NEW_PRIVS blocks domain transitions from within app_process,
unless the new domain is bounded by the app's context. So we can't
switch to a domain that has perms not available to untrusted_app :(

This means any app can talk to the daemon, bypassing the su executable
client. That's not a good thing, and needs to be resolved.

Change-Id: I85b74f90b8737caaa193a0555b5262e7392519b2