tequilaOS/platform_build
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
22248 commits 1 branch 0 tags 119 MiB
Commit graph

19 commits

Author SHA1 Message Date
Ying Wang
58aeaed9ce Merge "goldfish_logcat: remove permissive_or_unconfined()" 2015-02-23 17:30:50 +00:00
Ying Wang
aa67c0ce9a Merge "qemud: remove permissive_or_unconfined()" 2015-02-23 17:30:43 +00:00
Ying Wang
4be75b3733 Merge "qemu_props: remove permissive_or_unconfined()" 2015-02-23 17:30:28 +00:00
Stephen Smalley
7b4a69adf4 qemud: remove permissive_or_unconfined() 
Change-Id: Ia15cf87de1d03364f80d3d0cbc546475abfef448
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
 2015-02-10 17:29:01 -05:00
Stephen Smalley
25a150c5e1 qemu_props: remove permissive_or_unconfined() 
Change-Id: I29f37822ccac22dd884d88f9dcd23237b5a3e2de
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
 2015-02-10 17:28:41 -05:00
Stephen Smalley
063b6b85d6 goldfish_setup: remove permissive_or_unconfined() 
Change-Id: I3b44f24554f288f4fb1e18a53fa68e8a7cd8c8c7
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
 2015-02-10 17:28:11 -05:00
Stephen Smalley
de78c2776a goldfish_logcat: remove permissive_or_unconfined() 
Change-Id: I1a26b07bf723c944c7dcb8beec96537500a3bc60
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
 2015-02-10 17:27:41 -05:00
Stephen Smalley
82b6f21be3 Switch qemud to permissive_or_unconfined(). 
Switch the qemud domain from unconfined_domain() to
permissive_or_unconfined() so that we can start collecting and
addressing denials in -userdebug/-eng builds.

Also allow access to the serial device.

Change-Id: I9c7a6ddc8c2e64bfc6c5bb896eed1729ab205d60
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
 2014-11-06 09:36:40 -05:00
Stephen Smalley
2ef5bf74fa Label goldfish block devices with their own types. 
This assigns block device types as per device/generic/goldfish/fstab.goldfish.
Eliminates (permissive) avc:  denied messages for fsck.

Change-Id: Ia72bdfb16975f051548b6b2c0636e4f907295789
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
 2014-10-31 14:19:55 -04:00
Stephen Smalley
968ce565f7 Mark qemu_device as a mlstrustedobject. 
Allow apps running with any level to write to it.

Change-Id: I8fca1f377e14c624db5273bdacf8400addc6210d
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
 2014-10-31 13:28:09 -04:00
Stephen Smalley
704744ad81 Add domains for goldfish services. 
goldfish-setup, goldfish-logcat, and qemu-props are goldfish-specific
oneshot services that lacked domain definitions and thus were left in init's
domain.

This depends on a change to external/sepolicy with the same Change-Id
to define non-goldfish-specific types for properties and logcat.

Change-Id: Idce1fb5ed9680af84788ae69a5ace684c6663974
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
 2014-09-22 14:41:56 -04:00
dcashman
38a261a82b Allow all domains access to /dev/qemu_trace. 
/dev/qemu_trace is used by memcheck on qemu to get memory allocation events
from all processes on the system.  Allow all domains to access this device, and
other qemu-specific devices.

Addresses the following denials:
type=1400 audit(1402674828.500:3): avc:  denied  { read write } for  pid=44 comm="servicemanager" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:servicemanager:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674828.500:4): avc:  denied  { open } for  pid=44 comm="servicemanager" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:servicemanager:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674828.520:5): avc:  denied  { read write } for  pid=42 comm="logd" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:logd:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674828.520:6): avc:  denied  { open } for  pid=42 comm="logd" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:logd:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674828.610:7): avc:  denied  { read write } for  pid=48 comm="debuggerd" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:debuggerd:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674828.610:8): avc:  denied  { open } for  pid=48 comm="debuggerd" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:debuggerd:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674829.000:9): avc: denied { read write } for pid=47 comm="netd" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:netd:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674829.000:10): avc: denied { open } for pid=47 comm="netd" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:netd:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674829.180:11): avc: denied { read write } for pid=53 comm="installd" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:installd:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674829.200:12): avc: denied { read write } for pid=45 comm="vold" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:vold:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674829.200:13): avc: denied { open } for pid=53 comm="installd" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:installd:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674829.200:14): avc: denied { open } for pid=45 comm="vold" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:vold:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674829.280:15): avc: denied { read write } for pid=54 comm="keystore" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:keystore:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674829.280:16): avc: denied { open } for pid=54 comm="keystore" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:keystore:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674830.580:17): avc: denied { read write } for pid=51 comm="drmserver" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:drmserver:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674830.580:18): avc: denied { open } for pid=51 comm="drmserver" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:drmserver:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674930.860:22): avc: denied { read write } for pid=655 comm="iptables" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:netd:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674930.870:23): avc: denied { open } for pid=655 comm="iptables" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:netd:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file

Bug: 15570479
Change-Id: I87d0976800557d73064e2da038315b0d019d7a60
 2014-06-16 14:17:05 -07:00
dcashman
097e840b06 Revert "Allow all domains access to /dev/qemu_trace." 
This reverts commit b1b12f8ad4.
 2014-06-16 10:45:16 -07:00
dcashman
b1b12f8ad4 Allow all domains access to /dev/qemu_trace. 
/dev/qemu_trace is used by memcheck on qemu to get memory allocation events
from all processes on the system.  Allow all domains to access this device, and
other qemu-specific devices..

Addresses the following denials:
type=1400 audit(1402674828.500:3): avc:  denied  { read write } for  pid=44 comm="servicemanager" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:servicemanager:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674828.500:4): avc:  denied  { open } for  pid=44 comm="servicemanager" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:servicemanager:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674828.520:5): avc:  denied  { read write } for  pid=42 comm="logd" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:logd:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674828.520:6): avc:  denied  { open } for  pid=42 comm="logd" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:logd:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674828.610:7): avc:  denied  { read write } for  pid=48 comm="debuggerd" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:debuggerd:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674828.610:8): avc:  denied  { open } for  pid=48 comm="debuggerd" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:debuggerd:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674829.000:9): avc: denied { read write } for pid=47 comm="netd" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:netd:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674829.000:10): avc: denied { open } for pid=47 comm="netd" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:netd:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674829.180:11): avc: denied { read write } for pid=53 comm="installd" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:installd:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674829.200:12): avc: denied { read write } for pid=45 comm="vold" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:vold:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674829.200:13): avc: denied { open } for pid=53 comm="installd" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:installd:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674829.200:14): avc: denied { open } for pid=45 comm="vold" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:vold:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674829.280:15): avc: denied { read write } for pid=54 comm="keystore" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:keystore:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674829.280:16): avc: denied { open } for pid=54 comm="keystore" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:keystore:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674830.580:17): avc: denied { read write } for pid=51 comm="drmserver" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:drmserver:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674830.580:18): avc: denied { open } for pid=51 comm="drmserver" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:drmserver:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674930.860:22): avc: denied { read write } for pid=655 comm="iptables" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:netd:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file
type=1400 audit(1402674930.870:23): avc: denied { open } for pid=655 comm="iptables" name="qemu_trace" dev="tmpfs" ino=1494 scontext=u:r:netd:s0 tcontext=u:object_r:qemu_device:s0 tclass=chr_file

Bug: 15570479
Change-Id: I4999a1eb5c25b4238c53fe1e989bcf5fed1ae355
 2014-06-16 10:10:38 -07:00
Ji-Hwan Lee
93e450767f Allow qemu_device read-write access to various processes 
Basically, allow access of qemu_device where gpu_device is allowed, for the
case when the emulator runs with OpenGL/ES emulation.  Most noticably,
surfaceflinger crashes without qemu_device access.

Bug: 15052949
Change-Id: Ib891365a6d503309bced64e2512c4d8f29d9a07e
 2014-05-19 20:49:17 +09:00
Nick Kralevich
b20966f803 Allow shell serial_device read-write access 
When starting the emulator, the system console writes entries
to /dev/ttyS2. We need to allow the writes, otherwise this generates
denials when you run "emulator -verbose -logcat '*:v' -show-kernel"

Addresses the following denial:
type=1400 audit(1395076594.320:446): avc:  denied  { read write } for  pid=5600 comm="sh" path="/dev/ttyS2" dev="tmpfs" ino=1487 scontext=u:r:shell:s0 tcontext=u:object_r:serial_device:s0 tclass=chr_file

Bug: 13506702
Change-Id: I3729537cabb0bf8e8b2905d3def43a293bb1081f
 2014-03-18 15:17:35 -07:00
Stephen Smalley
768ff518f0 Move qemud and /dev/qemu policy bits to emulator-specific sepolicy. 
Change-Id: I620d4aef84a5d4565abb1695db54ce1653612bce
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
 2014-02-25 13:49:57 -05:00
Stephen Smalley
61c7107df3 Allow execmem and ashmem_device execute as required. 
bootanim requires execmem.
bootanim and surfaceflinger requires execute to ashmem_device.

Change-Id: I3b4964c5acd31a44ce81672077c70353a375c072
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
 2013-12-24 11:43:25 -05:00
Stephen Smalley
1d5352eaa3 Move goldfish-specific policy rules to their own directory. 
Change-Id: I1bdd80f641db05fef4714654515c1e1fbb259794
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
 2013-11-06 10:24:14 -05:00