Revert "isolated_app: Do not allow access to the gpu_device."

Chrome team recommends reverting this patch and introducing it into a future version of Android, to avoid potential compatibility issues. This reverts commit 9de62d6. Bug: 17471434 Bug: 18609318 Change-Id: I3086cb8a8d7142b1eadce622f7e87a4c3426b6bf
TeslaOS · Jan 16, 2015 · 7ef348b · 7ef348b
1 parent 350535e
commit 7ef348b
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 4 deletions.
diff --git a/app.te b/app.te
@@ -90,7 +90,7 @@ allow appdomain qtaguid_device:chr_file r_file_perms;
 
 # Grant GPU access to all processes started by Zygote.
 # They need that to render the standard UI.
-allow { appdomain -isolated_app } gpu_device:chr_file { rw_file_perms execute };
+allow appdomain gpu_device:chr_file { rw_file_perms execute };
 
 # Use the Binder.
 binder_use(appdomain)

diff --git a/isolated_app.te b/isolated_app.te
@@ -13,9 +13,6 @@ type isolated_app, domain;
 app_domain(isolated_app)
 net_domain(isolated_app)
 
-# Isolated apps shouldn't be able to access the driver directly.
-neverallow isolated_app gpu_device:file { rw_file_perms execute };
-
 # read and write access to app_data_file is already
 # granted via app.te. Allow execute.
 # Needed to allow dlopen() from Chrome renderer processes.