tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/hostapd.te

33 lines
1.2 KiB
Text
Raw Normal View History

Confine hostapd, but leave it permissive for now. Change-Id: I23a2c568e9fdd51c6c09c6c80a7ce9f2b5bd4966 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:36 +01:00
# userspace wifi access points
SEPolicy to start hostapd via init While here, remove a lot of extra permissions that we apparently had because hostapd was inheriting fds from netd. Bug: 30041118 Test: netd can request init to start/stop hostapd without denials. Change-Id: Ia777497443a4226a201030eccb9dfc5a40f015dd (cherry picked from commit 8a6c5f8553f6cc78237111daf22e59c572dde30c)
2016-07-11 20:20:33 +02:00
type hostapd, domain;
Enable SELinux protections for netd. This change does several things: 1) Restore domain.te to the version present at cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version currently being distributed in AOSP. 2) Add "allow domain properties_device:file r_file_perms;" to domain.te, to allow all domains to read /dev/__properties__ . This change was missing from AOSP. 3) Restore netd.te to the version present at 80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version currently being distributed in AOSP. 4) Remove anything involving module loading from netd.te. CTS enforces that Android kernels can't have module loading enabled. 5) Add several new capabilities, plus data file rules, to netd.te, since netd needs to write to files owned by wifi. 6) Add a new unconfined domain called dnsmasq.te, and allow transitions from netd to that domain. Over time, we'll tighten up the dnsmasq.te domain. 7) Add a new unconfined domain called hostapd.te, and allow transitions from netd to that domain. Over time, we'll tighten up the hostapd.te domain. The net effect of these changes is to re-enable SELinux protections for netd. The policy is FAR from perfect, and allows a lot of wiggle room, but we can improve it over time. Testing: as much as possible, I've exercised networking related functionality, including turning on and off wifi, entering airplane mode, and enabling tethering and portable wifi hotspots. It's quite possible I've missed something, and if we experience problems, I can roll back this change. Bug: 9618347 Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
type hostapd_exec, exec_type, file_type;
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
Clean up socket rules. Replace * or any permission set containing create with create_socket_perms or create_stream_socket_perms. Add net_domain() to all domains using network sockets and delete rules already covered by domain.te or net.te. For netlink_route_socket, only nlmsg_write needs to be separately granted to specific domains that are permitted to modify the routing table. Clarification: read/write permissions are just ability to perform read/recv() or write/send() on the socket, whereas nlmsg_read/ nlmsg_write permissions control ability to observe or modify the underlying kernel state accessed via the socket. See security/selinux/nlmsgtab.c in the kernel for the mapping of netlink message types to nlmsg_read or nlmsg_write. Delete legacy rule for b/12061011. This change does not touch any rules where only read/write were allowed to a socket created by another domain (inherited across exec or received across socket or binder IPC). We may wish to rewrite some or all of those rules with the rw_socket_perms macro but that is a separate change. Change-Id: Ib0637ab86f6d388043eff928e5d96beb02e5450e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 21:06:11 +01:00
net_domain(hostapd)
SEPolicy to start hostapd via init While here, remove a lot of extra permissions that we apparently had because hostapd was inheriting fds from netd. Bug: 30041118 Test: netd can request init to start/stop hostapd without denials. Change-Id: Ia777497443a4226a201030eccb9dfc5a40f015dd (cherry picked from commit 8a6c5f8553f6cc78237111daf22e59c572dde30c)
2016-07-11 20:20:33 +02:00
allow hostapd self:capability { net_admin net_raw };
Clean up socket rules. Replace * or any permission set containing create with create_socket_perms or create_stream_socket_perms. Add net_domain() to all domains using network sockets and delete rules already covered by domain.te or net.te. For netlink_route_socket, only nlmsg_write needs to be separately granted to specific domains that are permitted to modify the routing table. Clarification: read/write permissions are just ability to perform read/recv() or write/send() on the socket, whereas nlmsg_read/ nlmsg_write permissions control ability to observe or modify the underlying kernel state accessed via the socket. See security/selinux/nlmsgtab.c in the kernel for the mapping of netlink message types to nlmsg_read or nlmsg_write. Delete legacy rule for b/12061011. This change does not touch any rules where only read/write were allowed to a socket created by another domain (inherited across exec or received across socket or binder IPC). We may wish to rewrite some or all of those rules with the rw_socket_perms macro but that is a separate change. Change-Id: Ib0637ab86f6d388043eff928e5d96beb02e5450e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 21:06:11 +01:00
SEPolicy to start hostapd via init While here, remove a lot of extra permissions that we apparently had because hostapd was inheriting fds from netd. Bug: 30041118 Test: netd can request init to start/stop hostapd without denials. Change-Id: Ia777497443a4226a201030eccb9dfc5a40f015dd (cherry picked from commit 8a6c5f8553f6cc78237111daf22e59c572dde30c)
2016-07-11 20:20:33 +02:00
# hostapd learns about its network interface via sysfs.
allow hostapd sysfs:file r_file_perms;
# hostapd follows the /sys/class/net/wlan0 link to the PCI device.
allow hostapd sysfs:lnk_file r_file_perms;
# Allow hostapd to access /proc/net/psched
allow hostapd proc_net:file { getattr open read };
# Various socket permissions.
Enforce ioctl command whitelisting on all sockets Remove the ioctl permission for most socket types. For others, such as tcp/udp/rawip/unix_dgram/unix_stream set a default unprivileged whitelist that individual domains may extend (except where neverallowed like untrusted_app). Enforce via a neverallowxperm rule. Change-Id: I15548d830f8eff1fd4d64005c5769ca2be8d4ffe
2016-05-17 06:12:17 +02:00
allowxperm hostapd self:udp_socket ioctl priv_sock_ioctls;
allow hostapd self:netlink_socket create_socket_perms_no_ioctl;
allow hostapd self:netlink_generic_socket create_socket_perms_no_ioctl;
allow hostapd self:packet_socket create_socket_perms_no_ioctl;
Clean up socket rules. Replace * or any permission set containing create with create_socket_perms or create_stream_socket_perms. Add net_domain() to all domains using network sockets and delete rules already covered by domain.te or net.te. For netlink_route_socket, only nlmsg_write needs to be separately granted to specific domains that are permitted to modify the routing table. Clarification: read/write permissions are just ability to perform read/recv() or write/send() on the socket, whereas nlmsg_read/ nlmsg_write permissions control ability to observe or modify the underlying kernel state accessed via the socket. See security/selinux/nlmsgtab.c in the kernel for the mapping of netlink message types to nlmsg_read or nlmsg_write. Delete legacy rule for b/12061011. This change does not touch any rules where only read/write were allowed to a socket created by another domain (inherited across exec or received across socket or binder IPC). We may wish to rewrite some or all of those rules with the rw_socket_perms macro but that is a separate change. Change-Id: Ib0637ab86f6d388043eff928e5d96beb02e5450e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 21:06:11 +01:00
allow hostapd self:netlink_route_socket nlmsg_write;
Confine hostapd, but leave it permissive for now. Change-Id: I23a2c568e9fdd51c6c09c6c80a7ce9f2b5bd4966 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:36 +01:00
SEPolicy to start hostapd via init While here, remove a lot of extra permissions that we apparently had because hostapd was inheriting fds from netd. Bug: 30041118 Test: netd can request init to start/stop hostapd without denials. Change-Id: Ia777497443a4226a201030eccb9dfc5a40f015dd (cherry picked from commit 8a6c5f8553f6cc78237111daf22e59c572dde30c)
2016-07-11 20:20:33 +02:00
# hostapd can read and write WiFi related data and configuration.
# For example, the entropy file is periodically updated.
Confine hostapd, but leave it permissive for now. Change-Id: I23a2c568e9fdd51c6c09c6c80a7ce9f2b5bd4966 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:36 +01:00
allow hostapd wifi_data_file:file rw_file_perms;
SEPolicy to start hostapd via init While here, remove a lot of extra permissions that we apparently had because hostapd was inheriting fds from netd. Bug: 30041118 Test: netd can request init to start/stop hostapd without denials. Change-Id: Ia777497443a4226a201030eccb9dfc5a40f015dd (cherry picked from commit 8a6c5f8553f6cc78237111daf22e59c572dde30c)
2016-07-11 20:20:33 +02:00
r_dir_file(hostapd, wifi_data_file)
Give hostapd permissions to use its control socket Bug: 30311493 Test: hostapd starts and stops reliably without complaining about permission to create the control directory, the control socket, or write to the control socket. Change-Id: If8cf57cce5df2c6af06c8b7f28708e40876e948c (cherry picked from commit cbabe363a555a952b71d432df6008410e00fa9b8)
2016-07-22 23:32:38 +02:00
# hostapd wants to create the directory holding its control socket.
allow hostapd hostapd_socket:dir create_dir_perms;
# hostapd needs to create, bind to, read, and write its control socket.
SEPolicy to start hostapd via init While here, remove a lot of extra permissions that we apparently had because hostapd was inheriting fds from netd. Bug: 30041118 Test: netd can request init to start/stop hostapd without denials. Change-Id: Ia777497443a4226a201030eccb9dfc5a40f015dd (cherry picked from commit 8a6c5f8553f6cc78237111daf22e59c572dde30c)
2016-07-11 20:20:33 +02:00
allow hostapd hostapd_socket:sock_file create_file_perms;
Reference in a new issue Copy permalink