tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/sdcardd.te

24 lines
814 B
Text
Raw Normal View History

sdcard policy and fuse device label.
2012-05-31 15:44:51 +02:00
type sdcardd, domain;
type sdcardd_exec, exec_type, file_type;
init_daemon_domain(sdcardd)
Confine sdcardd, but leave it permissive for now. Change-Id: I1eba1535d650a09ee7640cb7f3664202be4a0a55 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:39 +01:00
allow sdcardd cgroup:dir create_dir_perms;
allow sdcardd fuse_device:chr_file rw_file_perms;
allow sdcardd rootfs:dir mounton;
sdcardd: grant unmount If the sdcard daemon is restarted (crash or otherwise), one of the first things it attempts to do is umount the previously mounted /mnt/shell/emulated fuse filesystem, which is denied by SELinux with the following denial: sdcard : type=1400 audit(0.0:6997): avc: denied { unmount } for scontext=u:r:sdcardd:s0 tcontext=u:object_r:fuse:s0 tclass=filesystem permissive=0 Allow the operation. Steps to reproduce: 1) adb shell into the device and su to root 2) run "kill -9 [PID OF SDCARD] Expected: sdcard daemon successfully restarts without error message. Actual: SELinux denial above, plus attempts to mount a new filesystem on top of the existing filesystem. (cherrypicked from commit abfd427a3226a8bb696e5e5b9239f5445a680f6c) Bug: 17383009 Change-Id: I386bfc98e2b5b32b1d11408f7cfbd6e3c1af68f4
2014-09-04 20:04:23 +02:00
allow sdcardd sdcard_type:filesystem { mount unmount };
Confine sdcardd, but leave it permissive for now. Change-Id: I1eba1535d650a09ee7640cb7f3664202be4a0a55 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:39 +01:00
allow sdcardd self:capability { setuid setgid dac_override sys_admin sys_resource };
Label /data/media with its own type and allow access. /data/media presently is left in system_data_file, which requires anything that wants to write to it to be able to write to system_data_file. Introduce a new type for /data/media, media_rw_data_file (to match the media_rw UID assigned to it and distinguish it from /data/misc/media which has media UID and media_data_file type), and allow access to it. We allow this for all platform app domains as WRITE_MEDIA_STORAGE permission is granted to signature|system. We should not have to allow it to untrusted_app. Set up type transitions in sdcardd to automatically label any directories or files it creates with the new type. Change-Id: I5c7e6245b854a9213099e40a41d9583755d37d42 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-17 20:39:35 +01:00
Allow sdcardd to write to sdcard directory and file. Should resolve b/13060688 - emulator writes to /storage/sdcard failing. Change-Id: I9f00d9dfcd1c4f84c2320628257beca71abf170b Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-18 15:19:28 +01:00
allow sdcardd sdcard_type:dir create_dir_perms;
allow sdcardd sdcard_type:file create_file_perms;
Label /data/media with its own type and allow access. /data/media presently is left in system_data_file, which requires anything that wants to write to it to be able to write to system_data_file. Introduce a new type for /data/media, media_rw_data_file (to match the media_rw UID assigned to it and distinguish it from /data/misc/media which has media UID and media_data_file type), and allow access to it. We allow this for all platform app domains as WRITE_MEDIA_STORAGE permission is granted to signature|system. We should not have to allow it to untrusted_app. Set up type transitions in sdcardd to automatically label any directories or files it creates with the new type. Change-Id: I5c7e6245b854a9213099e40a41d9583755d37d42 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-17 20:39:35 +01:00
type_transition sdcardd system_data_file:{ dir file } media_rw_data_file;
allow sdcardd media_rw_data_file:dir create_dir_perms;
allow sdcardd media_rw_data_file:file create_file_perms;
Confine sdcardd, but leave it permissive for now. Change-Id: I1eba1535d650a09ee7640cb7f3664202be4a0a55 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:39 +01:00
# Read /data/system/packages.list.
allow sdcardd system_data_file:file r_file_perms;
Allow sdcardd to read /data/.layout_version As described in the system/core commit with the same Change-Id, there's a race condition between installd and sdcard when it comes to accessing /data/media. Resolve the race by checking /data/.layout_version to make sure the filesystem has been upgraded. Maybe indirectly fixes the following SELinux denial: sdcard : type=1400 audit(0.0:3): avc: denied { write } for name="media" dev="mmcblk0p17" ino=102753 scontext=u:r:sdcardd:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir (cherrypicked from commit 792d8650d3dd5e0362a2a04a0af77f751a84b1de) Bug: 16329437 Change-Id: I5e164f08009c1036469f8734ec07cbae9c5e262b
2014-07-25 02:07:27 +02:00
# Read /data/.layout_version
allow sdcardd install_data_file:file r_file_perms;
Reference in a new issue Copy permalink