Update vendor/cm patches

diff --git a/patches/vendor/cm/0001-Remove-custom-CMTE-rules.patch b/patches/vendor/cm/0001-Remove-custom-CMTE-rules.patch
index dc4a7af8de5836bbd0f4301936de55408a326939..d614edf2f415850e57b743821395b5365fbb383b 100644 (file)
--- a/patches/vendor/cm/0001-Remove-custom-CMTE-rules.patch
+++ b/patches/vendor/cm/0001-Remove-custom-CMTE-rules.patch
@@ -1,7 +1,7 @@
-From a43a125904e00740761f3ac5cc4aa564e8f8fd10 Mon Sep 17 00:00:00 2001
+From 05ae09ad06b42f3120a7f490c7cfe648419248ec Mon Sep 17 00:00:00 2001
 From: LuK1337 <priv.luk@gmail.com>
 Date: Thu, 16 Feb 2017 17:05:43 +0100
-Subject: [PATCH] Remove custom CMTE rules
+Subject: [PATCH 1/2] Remove custom CMTE rules
 
 Change-Id: Ie7829f38fbb3af3eef19c1a73c27d500797ce43f
 ---

diff --git a/patches/vendor/cm/0002-Allow-platform_app-to-use-su.patch b/patches/vendor/cm/0002-Allow-platform_app-to-use-su.patch
new file mode 100644 (file)
index 0000000..d3acb10
--- /dev/null
+++ b/patches/vendor/cm/0002-Allow-platform_app-to-use-su.patch
@@ -0,0 +1,38 @@
+From db5b730a9960338811712f17e1cdca9238386ce8 Mon Sep 17 00:00:00 2001
+From: LuK1337 <priv.luk@gmail.com>
+Date: Sat, 18 Feb 2017 18:43:20 +0100
+Subject: [PATCH 2/2] Allow platform_app to use su
+
+Change-Id: Ib9c2f4000e3b9e9ad812d85838e0bc584964c9ff
+---
+ sepolicy/su.te | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+diff --git a/sepolicy/su.te b/sepolicy/su.te
+index 1a2a2b3d..8552fd3e 100644
+--- a/sepolicy/su.te
++++ b/sepolicy/su.te
+@@ -54,10 +54,10 @@ userdebug_or_eng(`
+   # typealias shell alias suclient;
+   # domain_auto_trans(untrusted_app, su_exec, suclient)
+ 
+-  allow untrusted_app su_exec:file { execute_no_trans getattr open read execute };
+-  allow untrusted_app sudaemon:unix_stream_socket { connectto read write setopt ioctl };
+-  allow untrusted_app superuser_device:dir { r_dir_perms };
+-  allow untrusted_app superuser_device:sock_file { write };
++  allow { untrusted_app platform_app } su_exec:file { execute_no_trans getattr open read execute };
++  allow { untrusted_app platform_app } sudaemon:unix_stream_socket { connectto read write setopt ioctl };
++  allow { untrusted_app platform_app } superuser_device:dir { r_dir_perms };
++  allow { untrusted_app platform_app } superuser_device:sock_file { write };
+ 
+ 
+   # For Settings control of access
+@@ -69,4 +69,4 @@ userdebug_or_eng(`
+ 
+ ')
+ 
+-neverallow { domain userdebug_or_eng(`-dumpstate -shell -su -untrusted_app -init -sudaemon') } su_exec:file no_x_file_perms;
++neverallow { domain userdebug_or_eng(`-dumpstate -shell -su -untrusted_app -platform_app -init -sudaemon') } su_exec:file no_x_file_perms;
+-- 
+2.11.1
+