tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/property.te

47 lines
2.1 KiB
Text
Raw Normal View History

Remove property read access for non-core properties Instead of allowing global read access to all properties, only allow read access to the properties which are part of core SELinux policy. Device-specific policies are no longer readable by default and need to be granted in device-specific policy. Grant read-access to any property where the person has write access. In most cases, anyone who wants to write a property needs read access to that property. Change-Id: I2bd24583067b79f31b3bb0940b4c07fc33d09918
2015-12-08 23:45:50 +01:00
type default_prop, property_type, core_property_type;
type shell_prop, property_type, core_property_type;
type debug_prop, property_type, core_property_type;
type dumpstate_prop, property_type, core_property_type;
Let system_server writes to dumpstate.options property. Currently, we define 4 hardcoded init services to launch dumpstate with different command-line options (since dumpstate must be launched by root): - bugreport - bugreportplus - bugreportwear - bugreportremote This approach does not scale well; a better option is to have just one service, and let the framework pass the extra arguments through a system property. BUG: 31649719 Test: manual Change-Id: I7ebbb7ce6a0fd3588baca6fd76653f87367ed0e5
2016-09-21 19:44:11 +02:00
type dumpstate_options_prop, property_type;
Remove property read access for non-core properties Instead of allowing global read access to all properties, only allow read access to the properties which are part of core SELinux policy. Device-specific policies are no longer readable by default and need to be granted in device-specific policy. Grant read-access to any property where the person has write access. In most cases, anyone who wants to write a property needs read access to that property. Change-Id: I2bd24583067b79f31b3bb0940b4c07fc33d09918
2015-12-08 23:45:50 +01:00
type persist_debug_prop, property_type, core_property_type;
type debuggerd_prop, property_type, core_property_type;
type dhcp_prop, property_type, core_property_type;
type fingerprint_prop, property_type, core_property_type;
type ffs_prop, property_type, core_property_type;
type radio_prop, property_type, core_property_type;
type net_radio_prop, property_type, core_property_type;
type system_radio_prop, property_type, core_property_type;
type system_prop, property_type, core_property_type;
type vold_prop, property_type, core_property_type;
allow system server to set log.tag.WifiHAL On eng and userdebug builds (only), allow system server to change the value of log.tag.WifiHAL. WifiStateMachine will set this property to 'D' by default. If/when a user enables "Developer options -> Enable Wi-Fi Verbose Logging", WifiStateMachine change log.tag.WifiHAL to 'V'. BUG=27857554 TEST=manual (see below) Test detail 1. on user build: $ adb shell setprop log.tag.WifiHAL V $ adb shell getprop log.tag.WifiHAL <blank line> $ adb bugreport | grep log.tag.WifiHAL <11>[ 141.918517] init: avc: denied { set } for property=log.tag.WifiHAL pid=4583 uid=2000 gid=2000 scontext=u:r:shell:s0 tcontext=u:object_r:wifi_log_prop:s0 tclass=property_service permissive=0 <11>[ 141.918566] init: sys_prop: permission denied uid:2000 name:log.tag.WifiHAL 2. on userdebug build: $ adb shell getprop log.tag.WifiHAL $ <blank line> $ adb shell setprop log.tag.WifiHAL V $ adb shell getprop log.tag.WifiHAL V 3. on userdebug build with modified WifiStateMachine: $ adb shell getprop log.tag.WifiHAL D Change-Id: I9cdd52a2b47a3dd1065262ea8c329130b7b044db
2016-04-15 20:10:39 +02:00
type wifi_log_prop, property_type, log_property_type;
Separate permissions to set WiFi related properties wificond would like to be able to set WiFi related properties without access to the rest of the system properties. Today, this only involves marking the driver as loaded or unloaded. avc: denied { write } for name="property_service" dev="tmpfs" ino=10100 scontext=u:r:wificond:s0 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=0 Bug: 29579539 Test: No avc denials related to system properties across various WiFi events. Change-Id: I6d9f1de3fbef04cb7750cc3753634f9e02fdb71f (cherry picked from commit 1ebfdd6a14fb21705664c8e144f151b39c3d73f8)
2016-06-29 20:28:20 +02:00
type wifi_prop, property_type;
Remove core_property_type from ctl_* properties Per https://android-review.googlesource.com/185392 , ctl.* properties are not represented as files in the filesystem. So there's no need to grant read access to them, since it's pointless. Remove core_property_type from these properties, which has the net effect of removing read access to these non-existent files. Change-Id: Ic1ca574668a3511c335a7036a2bb7993ff02c1e3
2015-12-09 17:47:02 +01:00
type ctl_bootanim_prop, property_type;
type ctl_default_prop, property_type;
type ctl_dumpstate_prop, property_type;
type ctl_fuse_prop, property_type;
type ctl_mdnsd_prop, property_type;
type ctl_rildaemon_prop, property_type;
type ctl_bugreport_prop, property_type;
type ctl_console_prop, property_type;
Remove property read access for non-core properties Instead of allowing global read access to all properties, only allow read access to the properties which are part of core SELinux policy. Device-specific policies are no longer readable by default and need to be granted in device-specific policy. Grant read-access to any property where the person has write access. In most cases, anyone who wants to write a property needs read access to that property. Change-Id: I2bd24583067b79f31b3bb0940b4c07fc33d09918
2015-12-08 23:45:50 +01:00
type audio_prop, property_type, core_property_type;
limit shell's access to log.* properties Restrict the ability of the shell to set the log.* properties. Namely: only allow the shell to set such properities on eng and userdebug builds. The shell (and other domains) can continue to read log.* properties on all builds. While there: harmonize permissions for log.* and persist.log.tag. Doing so introduces two changes: - log.* is now writable from from |system_app|. This mirrors the behavior of persist.log.tag, which is writable to support "Developer options" -> "Logger buffer sizes" -> "Off". (Since this option is visible on user builds, the permission is enabled for all builds.) - persist.log.tag can now be set from |shell| on userdebug_or_eng(). BUG=28221972 TEST=manual (see below) Testing details - user build (log.tag) $ adb shell setprop log.tag.foo V $ adb shell getprop log.tag <blank line> $ adb bugreport | grep log.tag.foo [ 146.525836] init: avc: denied { set } for property=log.tag.foo pid=4644 uid=2000 gid=2000 scontext=u:r:shell:s0 tcontext=u:object_r:log_prop:s0 tclass=property_service permissive=0 [ 146.525878] init: sys_prop: permission denied uid:2000 name:log.tag.foo - userdebug build (log.tag) $ adb shell getprop log.tag.foo <blank line> $ adb shell setprop log.tag.foo V $ adb shell getprop log.tag.foo V - user build (persist.log.tag) $ adb shell getprop | grep log.tag <no match> - Developer options -> Logger buffer sizes -> Off $ adb shell getprop | grep log.tag [persist.log.tag]: [Settings] [persist.log.tag.snet_event_log]: [I] Change-Id: Idf00e7a623723a7c46bf6d01e386aeca92b2ad75
2016-04-15 20:10:06 +02:00
type log_prop, property_type, log_property_type;
Allow shell to set log.tag.* properties Also allow shell to set persist.log.tag.* Bug: 28942894 Change-Id: Ifdb2c87871f159dd15338db372921297aea3bc6b
2016-06-01 20:14:14 +02:00
type log_tag_prop, property_type, log_property_type;
Remove property read access for non-core properties Instead of allowing global read access to all properties, only allow read access to the properties which are part of core SELinux policy. Device-specific policies are no longer readable by default and need to be granted in device-specific policy. Grant read-access to any property where the person has write access. In most cases, anyone who wants to write a property needs read access to that property. Change-Id: I2bd24583067b79f31b3bb0940b4c07fc33d09918
2015-12-08 23:45:50 +01:00
type logd_prop, property_type, core_property_type;
logpersist: reserve persist.logd.logpersistd shell, system_app and logd access granted on debug builds only Bug: 28936216 Change-Id: Ib9648e8565cc0ea0077cf0950b0e4ac6fe0a3135
2016-06-06 21:18:46 +02:00
type logpersistd_logging_prop, property_type;
persist.mmc.* only set in init Bug: 26976972 Change-Id: I0e44bfc6774807a3bd2ba05637a432675d855118
2016-02-04 19:55:43 +01:00
type mmc_prop, property_type;
Remove property read access for non-core properties Instead of allowing global read access to all properties, only allow read access to the properties which are part of core SELinux policy. Device-specific policies are no longer readable by default and need to be granted in device-specific policy. Grant read-access to any property where the person has write access. In most cases, anyone who wants to write a property needs read access to that property. Change-Id: I2bd24583067b79f31b3bb0940b4c07fc33d09918
2015-12-08 23:45:50 +01:00
type restorecon_prop, property_type, core_property_type;
type security_prop, property_type, core_property_type;
type bluetooth_prop, property_type, core_property_type;
type pan_result_prop, property_type, core_property_type;
type powerctl_prop, property_type, core_property_type;
Allow cppreopts to work with selinux (cherry picked from commit d3edd6b577c1e40834af69420bd77b60c359ef8e) Bug: 29278988 Change-Id: I199572377a6b5c33116c718a545159ddcf50df30
2016-06-23 00:47:09 +02:00
type cppreopt_prop, property_type, core_property_type;
Remove property read access for non-core properties Instead of allowing global read access to all properties, only allow read access to the properties which are part of core SELinux policy. Device-specific policies are no longer readable by default and need to be granted in device-specific policy. Grant read-access to any property where the person has write access. In most cases, anyone who wants to write a property needs read access to that property. Change-Id: I2bd24583067b79f31b3bb0940b4c07fc33d09918
2015-12-08 23:45:50 +01:00
type nfc_prop, property_type, core_property_type;
type dalvik_prop, property_type, core_property_type;
type config_prop, property_type, core_property_type;
SELinux rule for ro.device_owner and persist.logd.security They are introduced for the device owner process logging feature. That is, for enterprise-owned devices with device owner app provisioned, the device owner may choose to turn on additional device-wide logging for auditing and intrusion detection purposes. Logging includes histories of app process startup, commands issued over ADB and lockscreen unlocking attempts. These logs will available to the device owner for analysis, potentially shipped to a remote server if it chooses to. ro.device_owner will be a master switch to turn off logging, if the device has no device owner provisioned. persist.logd.security is a switch that device owner can toggle (via DevicePoliyManager) to enable/disable logging. Writing to both properties should be only allowed by the system server. Bug: 22860162 Change-Id: Iabfe2347b094914813b9d6e0c808877c25ccd038
2016-01-04 16:20:45 +01:00
type device_logging_prop, property_type;
Allow logd.auditd to reboot to safe mode Bug: 26902605 Change-Id: Ica825cf2af74f5624cf4091544bd24bb5482dbe7 (cherry picked from commit 9c168711d5f79642a5357cd4c58ad5e88a9795ba)
2016-02-06 00:42:32 +01:00
type safemode_prop, property_type;
sepolicy: allow hwservicemanager to set properties Allow hwservicemanager to set properties starting with the prefix "hwservicemanager." b/31458381 b/31240290 Test: passing build and runtime tests Change-Id: Id92e2170f52893bbf236987ee59383df2264952f Signed-off-by: Iliyan Malchev <malchev@google.com>
2016-09-20 00:23:41 +02:00
type hwservicemanager_prop, property_type;
Add persist.vendor.overlay. to properties Allow the system_server to change. Allow the zygote to read it as well. Test: Have system_server set a property Change-Id: Ie90eec8b733fa7193861026a3a6e0fb0ba5d5318
2016-11-09 21:19:05 +01:00
type overlay_prop, property_type;
Support fine grain read access control for properties Properties are now broken up from a single /dev/__properties__ file into multiple files, one per property label. This commit provides the mechanism to control read access to each of these files and therefore sets of properties. This allows full access for all domains to each of these new property files to match the current permissions of /dev/__properties__. Future commits will restrict the access. Bug: 21852512 Change-Id: Ie9e43968acc7ac3b88e354a0bdfac75b8a710094
2015-12-02 01:58:27 +01:00
allow property_type tmpfs:filesystem associate;
Reference in a new issue Copy permalink