tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/keystore.te

45 lines
1.6 KiB
Text
Raw Normal View History

Add libselinux keystore_key backend. We add a new back end for SELinux based keystore2_key namespaces. This patch adds the rump policy and build system infrastructure for installing keystore2_key context files on the target devices. Bug: 158500146 Bug: 159466840 Test: None Change-Id: I423c9e68ad259926e4a315d052dfda97fa502106 Merged-In: I423c9e68ad259926e4a315d052dfda97fa502106
2020-07-25 22:02:29 +02:00
type keystore, domain, keystore2_key_type;
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type keystore_exec, system_file_type, exec_type, file_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
# keystore daemon
Confine keystore, but leave it permissive for now. Change-Id: Ia92165478764b062e7e33e7741742f5ec8762ad9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:37 +01:00
typeattribute keystore mlstrustedsubject;
binder_use(keystore)
binder_service(keystore)
Allow keystore to access KeyAttestationApplicationIDProviderService (cherry picked from commit 58b079a25961d15e8ff24342a7ba51bf125e7469) Bug: 22914603 Change-Id: I8ae1a786702694ca2bb8707a4c142b8a233042ee
2016-06-03 20:36:41 +02:00
binder_call(keystore, system_server)
sepolicy(wifi): Allow keystore-wificond communication Denial log: 1. 10-30 11:02:50.279 wifi 1119 1119 W HwBinder:1119_1: type=1400 audit(0.0:113): avc: denied { transfer } for scontext=u:r:wificond:s0 tcontext=u:r:keystore:s0 tclass=binder permissive=0 2. 01-15 16:24:04.214 W/keystore( 1007): type=1400 audit(0.0:109): avc: denied { call } for scontext=u:r:keystore:s0 tcontext=u:r:wificond:s0 tclass=binder permissive=0 3. 01-16 12:11:19.704 W/keystore( 1021): type=1400 audit(0.0:163): avc: denied { transfer } for scontext=u:r:keystore:s0 tcontext=u:r:wificond:s0 tclass=binder permissive=0 Bug: 143638513 Bug: 145310496 Test: Installed CA and wifi certificates and connects to enterprise network. No selinux denial seen from wificond and keystore. Change-Id: I9727add13844b1ff1875e493b777e3a294e00ffa
2020-01-16 19:17:20 +01:00
binder_call(keystore, wificond)
Preliminary policy for hal_keymaster (TREBLE) This adds the premissions required for android.hardware.keymaster@2.0-service to access the keymaster TA as well as for keystore and vold to lookup and use android.hardware.keymaster@2.0-service. IT DOES NOT remove the privileges from keystore and vold to access the keymaster TA directly. Test: Run keystore CTS tests Bug: 32020919 (cherry picked from commit 5090d6f3241ffbd96f5a0b24df602bd2559f3cf4) Change-Id: Ib02682da26e2dbcabd81bc23169f9bd0e832eb19
2017-01-28 00:00:27 +01:00
Confine keystore, but leave it permissive for now. Change-Id: Ia92165478764b062e7e33e7741742f5ec8762ad9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:37 +01:00
allow keystore keystore_data_file:dir create_dir_perms;
allow keystore keystore_data_file:notdevfile_class_set create_file_perms;
allow keystore keystore_exec:file { getattr };
Protect keystore's files. Only keystore itself should be reading / writing it's files. Remove keystore file access from other SELinux domains, including unconfined. Add neverallow rules to protect against regressions. Allow init limited access to recurse into keystore's directory. Change-Id: I0bb5de7804f4314997c16fac18507933014bcadf
2014-05-09 08:28:52 +02:00
te_macros: introduce add_service() macro Introduce the add_service() macro which wraps up add/find permissions for the source domain with a neverallow preventing others from adding it. Only a particular domain should add a particular service. Use the add_service() macro to automatically add a neverallow that prevents other domains from adding the service. mediadrmserver was adding services labeled mediaserver_service. Drop the add permission as it should just need the find permission. Additionally, the macro adds the { add find } permission which causes some existing neverallow's to assert. Adjust those neverallow's so "self" can always find. Test: compile and run on hikey and emulator. No new denials were found, and all services, where applicable, seem to be running OK. Change-Id: Ibbd2a5304edd5f8b877bc86852b0694732be993c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2017-01-19 22:23:52 +01:00
add_service(keystore, keystore_service)
SEPolicy for RemoteProvisioning App This change adds the SEPolicy changes required to support the remote provisioning flow. The notable additions are specifically labeling the remote provisioning app and giving it access to find the remote provisioning service which is added in keystore. It also requires network access in order to communicate to the provisioning servers. This functionality is extremely narrow to the point that it seems worth it to define a separate domain for this app, rather than add this in to the priv_app or platform_app permission files. Since this app also communicates with the network, it also seems advantageous to limit its permissions only to what is absolutely necessary to perform its function. Test: No denials! Change-Id: I602c12365a575d914afc91f55e6a9b6aa2e14189
2020-12-24 06:53:08 +01:00
add_service(keystore, remoteprovisioning_service)
Allow keystore to access KeyAttestationApplicationIDProviderService (cherry picked from commit 58b079a25961d15e8ff24342a7ba51bf125e7469) Bug: 22914603 Change-Id: I8ae1a786702694ca2bb8707a4c142b8a233042ee
2016-06-03 20:36:41 +02:00
allow keystore sec_key_att_app_id_provider_service:service_manager find;
Adding ability for keystore to find dropbox This will allow the logging in keystore to actually work. Bug: 36549319 Test: keystore dropbox logging is successful Change-Id: Ic135fa9624c289c54187e946affbd0caacef13c1 (cherry picked from commit 2e69afc079a175070279674be78aacbe4434c367)
2018-04-05 04:00:40 +02:00
allow keystore dropbox_service:service_manager find;
Add policy for the android protected confirmation service. This is the service offered by Keystore 2.0 to provide APC service to application. It was formerly part of the IKeystoreService interface. Not it is an interface in ints own right. Test: Keystore 2.0 can register the apc service interface. Apps can lookup and call this interface. Bug: 159341464 Change-Id: I058adf0021d9b89f4eac7534e366c29071f0f98b
2020-12-02 03:55:11 +01:00
add_service(keystore, apc_service)
Add policy for the security compatibility hal service. This service manager is registered by Keystore 2.0 to lookup legacy wrapper services. Keystore 2.0 is now written in rust. We have AIDL binding for rust but no HIDL binding. Keystore 2.0 has to support legacy HIDL based interfaces. So we implement the AIDL KeyMint interface in terms of the legacy HIDL Keymaster <= V4.1 devices in C++. This wrapper is linked into the Keystore 2.0 process but it cannot be called directly but must be treated like a remote binder instead. However, we cannot register these wrappers directly, because a) we are not a vendor component, and b) it would conflict with genuine KeyMint devices on newer devices. So Instead we register Keystore 2.0 itself as a legacy service provider. Which it can query itself for the legacy wrappers if it does not find a genuine KeyMint implementation to connect to. Bug: 171351607 Test: Keystore 2.0 can register this Service and lookup legacy wrapper services. Change-Id: I935f23837721ce126531236f4920dba469a47be4
2020-12-02 18:52:42 +01:00
add_service(keystore, keystore_compat_hal_service)
Add policy for IKeystoreAuthorization AIDL service. The interaface now provided by IKeystoreAuthorization AIDL interface was previously provided by Keystore AIDL interface. This CL adds policy to allow Keystore2 to register IKeystoreAuthorization aidl service and to allow service manager to look up and connect to the service. Bug: 159475191 Test: Needs to be tested in runtime Change-Id: I56829a8764e0efe55efdc92b75d7a3d918a20dae
2020-12-17 02:36:21 +01:00
add_service(keystore, authorization_service)
Keystore 2.0: Rename KeystoreUserManager to KeystoreMaintenance Test: N/A Change-Id: I40c07e40cb0a852814058fe89d57c44ea85f1994
2021-03-08 18:19:38 +01:00
add_service(keystore, keystore_maintenance_service)
Keystore 2.0: Add policy for vpnprofilestore Test: N/A Change-Id: Iba6ca7be95dfcead8ce8ee17d6a6d78a5441d58f
2021-01-28 20:21:22 +01:00
add_service(keystore, vpnprofilestore_service)
Move allow rules before neverallow rules. There were a few instances where allow rules were appended after the neverallow rules stanza in the .te file. Also there were some regular allow rules inserted into the CTS-specific rules section of app.te. Just move the rules as appropriate. Should be no change in policy. Change-Id: Iec76f32d4b531d245bbf5dd9f621a71ff5c71f3e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-13 21:42:42 +01:00
# Check SELinux permissions.
selinux_check_access(keystore)
audit domain_deprecated perms for removal Grant permissions observed. Bug: 28760354 Change-Id: Ie63cda709319bbf635ef7bffbba3477c2cccc11b
2016-09-10 01:27:17 +02:00
r_dir_file(keystore, cgroup)
sepolicy: rules for uid/pid cgroups v2 hierarchy Bug: 168907513 Test: verified the correct working of the v2 uid/pid hierarchy in normal and recovery modes This reverts commit aa8bb3a29b92a342c42c802edac269da5984d1df. Change-Id: Ib344d500ea49b86e862e223ab58a16601eebef47
2021-02-12 00:18:11 +01:00
r_dir_file(keystore, cgroup_v2)
audit domain_deprecated perms for removal Grant permissions observed. Bug: 28760354 Change-Id: Ie63cda709319bbf635ef7bffbba3477c2cccc11b
2016-09-10 01:27:17 +02:00
Protect keystore's files. Only keystore itself should be reading / writing it's files. Remove keystore file access from other SELinux domains, including unconfined. Add neverallow rules to protect against regressions. Allow init limited access to recurse into keystore's directory. Change-Id: I0bb5de7804f4314997c16fac18507933014bcadf
2014-05-09 08:28:52 +02:00
###
### Neverallow rules
###
Don't allow ptrace on keystore keystore may hold sensitive information in it's memory. Don't allow anyone to ptrace keystore. Change-Id: I4e3717e482b9fd128d38ce687c03122d41678b6f
2014-05-20 06:49:50 +02:00
### Protect ourself from others
Protect keystore's files. Only keystore itself should be reading / writing it's files. Remove keystore file access from other SELinux domains, including unconfined. Add neverallow rules to protect against regressions. Allow init limited access to recurse into keystore's directory. Change-Id: I0bb5de7804f4314997c16fac18507933014bcadf
2014-05-09 08:28:52 +02:00
###
New ext4enc kernel switching from xattrs to ioctl This is one of three changes to enable this functionality: https://android-review.googlesource.com/#/c/146259/ https://android-review.googlesource.com/#/c/146264/ https://android-review.googlesource.com/#/c/146265/ Bug: 18151196 Change-Id: I6ce4bc977a548df93ea5c09430f93eef5ee1f9fa
2015-04-10 16:42:32 +02:00
neverallow { domain -keystore } keystore_data_file:dir ~{ open create read getattr setattr search relabelto ioctl };
Protect keystore's files. Only keystore itself should be reading / writing it's files. Remove keystore file access from other SELinux domains, including unconfined. Add neverallow rules to protect against regressions. Allow init limited access to recurse into keystore's directory. Change-Id: I0bb5de7804f4314997c16fac18507933014bcadf
2014-05-09 08:28:52 +02:00
neverallow { domain -keystore } keystore_data_file:notdevfile_class_set ~{ relabelto getattr };
Remove -kernel -recovery from keystore_data_file neverallow. Aside from the keystore daemon itself, only init needs any access to keystore_data_file (in order to create and potentially restorecon /data/misc/keystore). The exceptions for the kernel and recovery domains are unnecessary; no allow rule permits this access in current policy. Change-Id: I5cf6f29ec08174017ac8f5fb36fef166ce360ca0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-10-22 17:13:17 +02:00
neverallow { domain -keystore -init } keystore_data_file:dir *;
neverallow { domain -keystore -init } keystore_data_file:notdevfile_class_set *;
Don't allow ptrace on keystore keystore may hold sensitive information in it's memory. Don't allow anyone to ptrace keystore. Change-Id: I4e3717e482b9fd128d38ce687c03122d41678b6f
2014-05-20 06:49:50 +02:00
Allowing userdebug/eng builds crash dump access to ks This will make debugging of keystore issues in dogfood populations much easier than it previously was, as developers will have detailed crash dump reporting on any issues that do occur. Bug: 186868271 Bug: 184006658 Test: crash dumps appear if keystore2 explodes Change-Id: Ifb36cbf96eb063c9290905178b2fdc5934050b99
2021-04-30 20:08:07 +02:00
# TODO(b/186868271): Remove the crash dump exception soon-ish (maybe by May 14, 2021?)
neverallow { domain userdebug_or_eng(`-crash_dump') } keystore:process ptrace;
Reference in a new issue Copy permalink