tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/ppp.te

20 lines
644 B
Text
Raw Normal View History

Add ppp/mtp policy. Initial policy for Point-to-Point tunneling and tunneling manager services.
2012-08-20 12:13:28 +02:00
# Point to Point Protocol daemon
Create attribute for moving perms out of domain Motivation: Domain is overly permissive. Start removing permissions from domain and assign them to the domain_deprecated attribute. Domain_deprecated and domain can initially be assigned to all domains. The goal is to not assign domain_deprecated to new domains and to start removing domain_deprecated where it is not required or reassigning the appropriate permissions to the inheriting domain when necessary. Bug: 25433265 Change-Id: I8b11cb137df7bdd382629c98d916a73fe276413c
2015-11-03 18:54:39 +01:00
type ppp, domain, domain_deprecated;
Add ppp/mtp policy. Initial policy for Point-to-Point tunneling and tunneling manager services.
2012-08-20 12:13:28 +02:00
type ppp_device, dev_type;
type ppp_exec, exec_type, file_type;
domain_auto_trans(mtp, ppp_exec, ppp)
Make ppp permissive or unconfined. Also add rules from our policy. Change-Id: I6f552538cc4f6b28b2883aa74832230944cbdb7a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:38 +01:00
Clean up socket rules. Replace * or any permission set containing create with create_socket_perms or create_stream_socket_perms. Add net_domain() to all domains using network sockets and delete rules already covered by domain.te or net.te. For netlink_route_socket, only nlmsg_write needs to be separately granted to specific domains that are permitted to modify the routing table. Clarification: read/write permissions are just ability to perform read/recv() or write/send() on the socket, whereas nlmsg_read/ nlmsg_write permissions control ability to observe or modify the underlying kernel state accessed via the socket. See security/selinux/nlmsgtab.c in the kernel for the mapping of netlink message types to nlmsg_read or nlmsg_write. Delete legacy rule for b/12061011. This change does not touch any rules where only read/write were allowed to a socket created by another domain (inherited across exec or received across socket or binder IPC). We may wish to rewrite some or all of those rules with the rw_socket_perms macro but that is a separate change. Change-Id: Ib0637ab86f6d388043eff928e5d96beb02e5450e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 21:06:11 +01:00
net_domain(ppp)
Make ppp permissive or unconfined. Also add rules from our policy. Change-Id: I6f552538cc4f6b28b2883aa74832230944cbdb7a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:38 +01:00
allow ppp mtp:socket rw_socket_perms;
Allow ppp to inherit/use mtp unix datagram socket. Resolves denials such as: avc: denied { read write } for path="socket:[33571]" dev="sockfs" ino=33571 scontext=u:r:ppp:s0 tcontext=u:r:mtp:s0 tclass=unix_dgram_socket Change-Id: Icb1ee00d8513179039bfb738647f49480e836f25 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-13 14:24:38 +02:00
allow ppp mtp:unix_dgram_socket rw_socket_perms;
Make ppp permissive or unconfined. Also add rules from our policy. Change-Id: I6f552538cc4f6b28b2883aa74832230944cbdb7a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:38 +01:00
allow ppp ppp_device:chr_file rw_file_perms;
allow ppp self:capability net_admin;
allow ppp system_file:file rx_file_perms;
Only allow toolbox exec where /system exec was already allowed. When the toolbox domain was introduced, we allowed all domains to exec it to avoid breakage. However, only domains that were previously allowed the ability to exec /system files would have been able to do this prior to the introduction of the toolbox domain. Remove the rule from domain.te and add rules to all domains that are already allowed execute_no_trans to system_file. Requires coordination with device-specific policy changes with the same Change-Id. Change-Id: Ie46209f0412f9914857dc3d7c6b0917b7031aae5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-08-25 17:38:29 +02:00
# XXX Run toolbox. Might not be needed.
allow ppp toolbox_exec:file rx_file_perms;
auditallow ppp toolbox_exec:file rx_file_perms;
Make ppp permissive or unconfined. Also add rules from our policy. Change-Id: I6f552538cc4f6b28b2883aa74832230944cbdb7a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:38 +01:00
allow ppp vpn_data_file:dir w_dir_perms;
allow ppp vpn_data_file:file create_file_perms;
allow ppp mtp:fd use;
Reference in a new issue Copy permalink