tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/racoon.te

36 lines
1.1 KiB
Text
Raw Normal View History

racoon policy. Initial policy for racoon (IKE key management). Signed-off-by: Robert Craig <rpcraig@tycho.ncsc.mil> Change-Id: If1e344f39ea914e42afbaa021b272ba1b7113479
2013-01-07 15:21:18 +01:00
# IKE key management daemon
racoon: remove domain_deprecated attribute Test: builds/boots on Angler. No "granted" messages for the removed permissions observed in three months of log audits. Bug: 28760354 Change-Id: Ib6da57f6249a5571015b649bae843590229be714
2016-10-16 02:15:25 +02:00
type racoon, domain;
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type racoon_exec, system_file_type, exec_type, file_type;
racoon policy. Initial policy for racoon (IKE key management). Signed-off-by: Robert Craig <rpcraig@tycho.ncsc.mil> Change-Id: If1e344f39ea914e42afbaa021b272ba1b7113479
2013-01-07 15:21:18 +01:00
Make racoon permissive or unconfined. Also add allow rules from our policy. Change-Id: Id480eb7c8cd4e5544a1ec46cb39a55abc653ddb9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:38 +01:00
typeattribute racoon mlstrustedsubject;
Clean up socket rules. Replace * or any permission set containing create with create_socket_perms or create_stream_socket_perms. Add net_domain() to all domains using network sockets and delete rules already covered by domain.te or net.te. For netlink_route_socket, only nlmsg_write needs to be separately granted to specific domains that are permitted to modify the routing table. Clarification: read/write permissions are just ability to perform read/recv() or write/send() on the socket, whereas nlmsg_read/ nlmsg_write permissions control ability to observe or modify the underlying kernel state accessed via the socket. See security/selinux/nlmsgtab.c in the kernel for the mapping of netlink message types to nlmsg_read or nlmsg_write. Delete legacy rule for b/12061011. This change does not touch any rules where only read/write were allowed to a socket created by another domain (inherited across exec or received across socket or binder IPC). We may wish to rewrite some or all of those rules with the rw_socket_perms macro but that is a separate change. Change-Id: Ib0637ab86f6d388043eff928e5d96beb02e5450e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 21:06:11 +01:00
net_domain(racoon)
racoon: Add SIOCSIFNETMASK XAUTH based VPNs 1. IPSec XAUTH PSK 2. IPSec XAUTH RSA fail with the following error from racoon 01-24 16:46:05.583 18712 18712 W ip-up-vpn: type=1400 audit(0.0:390): avc: denied { ioctl } for path="socket:[954683]" dev="sockfs" ino=954683 ioctlcmd=891c scontext=u:r:racoon:s0 tcontext=u:r:racoon:s0 tclass=udp_socket permissive=0 "setenforce 0" on the device fixed the issue. Bug: 34690009 Test: Policy compiles Change-Id: Idc0d156ec32e7a9be3825c380c3cb0359fe4fabe
2017-01-25 02:12:58 +01:00
allowxperm racoon self:udp_socket ioctl { SIOCSIFFLAGS SIOCSIFADDR SIOCSIFNETMASK };
Clean up socket rules. Replace * or any permission set containing create with create_socket_perms or create_stream_socket_perms. Add net_domain() to all domains using network sockets and delete rules already covered by domain.te or net.te. For netlink_route_socket, only nlmsg_write needs to be separately granted to specific domains that are permitted to modify the routing table. Clarification: read/write permissions are just ability to perform read/recv() or write/send() on the socket, whereas nlmsg_read/ nlmsg_write permissions control ability to observe or modify the underlying kernel state accessed via the socket. See security/selinux/nlmsgtab.c in the kernel for the mapping of netlink message types to nlmsg_read or nlmsg_write. Delete legacy rule for b/12061011. This change does not touch any rules where only read/write were allowed to a socket created by another domain (inherited across exec or received across socket or binder IPC). We may wish to rewrite some or all of those rules with the rw_socket_perms macro but that is a separate change. Change-Id: Ib0637ab86f6d388043eff928e5d96beb02e5450e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 21:06:11 +01:00
Deduplicate binder_call rules. A number of binder_call rules are duplicated by other rules written in terms of attributes/sets (e.g. appdomain, binderservicedomain). Get rid of the duplicates. Also use binder_use() in racoon.te rather than manually writing the base rule for communicating with the servicemanager. Change-Id: I5a459cc2154b1466bcde6eccef253dfcdcb44e0a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-26 22:46:33 +01:00
binder_use(racoon)
Make racoon permissive or unconfined. Also add allow rules from our policy. Change-Id: Id480eb7c8cd4e5544a1ec46cb39a55abc653ddb9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:38 +01:00
allow racoon tun_device:chr_file r_file_perms;
racoon: allow ioctl TUNSETIFF Used by https://android.googlesource.com/platform/external/ipsec-tools/+/bf16586a33b1432a11526754523fceb62944dc1c/main.c#116 Addresses the following denial: audit(0.0:8126): avc: denied { ioctl } for comm="racoon" path="/dev/tun" dev="tmpfs" ino=25329 ioctlcmd=0x54ca scontext=u:r:racoon:s0 tcontext=u:object_r:tun_device:s0 tclass=chr_file permissive=0 Test: policy compiles. Change-Id: Ia26077d4a9e810c7006d4b979d6b7e9ca154b485
2018-11-15 19:32:45 +01:00
allowxperm racoon tun_device:chr_file ioctl TUNSETIFF;
Make racoon permissive or unconfined. Also add allow rules from our policy. Change-Id: Id480eb7c8cd4e5544a1ec46cb39a55abc653ddb9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:38 +01:00
allow racoon cgroup:dir { add_name create };
sepolicy: rules for uid/pid cgroups v2 hierarchy Bug: 168907513 Test: verified the correct working of the v2 uid/pid hierarchy in normal and recovery modes This reverts commit aa8bb3a29b92a342c42c802edac269da5984d1df. Change-Id: Ib344d500ea49b86e862e223ab58a16601eebef47
2021-02-12 00:18:11 +01:00
allow racoon cgroup_v2:dir { add_name create };
Make racoon permissive or unconfined. Also add allow rules from our policy. Change-Id: Id480eb7c8cd4e5544a1ec46cb39a55abc653ddb9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:38 +01:00
allow racoon kernel:system module_request;
Enforce ioctl command whitelisting on all sockets Remove the ioctl permission for most socket types. For others, such as tcp/udp/rawip/unix_dgram/unix_stream set a default unprivileged whitelist that individual domains may extend (except where neverallowed like untrusted_app). Enforce via a neverallowxperm rule. Change-Id: I15548d830f8eff1fd4d64005c5769ca2be8d4ffe
2016-05-17 06:12:17 +02:00
allow racoon self:key_socket create_socket_perms_no_ioctl;
allow racoon self:tun_socket create_socket_perms_no_ioctl;
sepolicy: Add rules for non-init namespaces In kernel 4.7, the capability and capability2 classes were split apart from cap_userns and cap2_userns (see kernel commit 8e4ff6f228e4722cac74db716e308d1da33d744f). Since then, Android cannot be run in a container with SELinux in enforcing mode. This change applies the existing capability rules to user namespaces as well as the root namespace so that Android running in a container behaves the same on pre- and post-4.7 kernels. This is essentially: 1. New global_capability_class_set and global_capability2_class_set that match capability+cap_userns and capability2+cap2_userns, respectively. 2. s/self:capability/self:global_capability_class_set/g 3. s/self:capability2/self:global_capability2_class_set/g 4. Add cap_userns and cap2_userns to the existing capability_class_set so that it covers all capabilities. This set was used by several neverallow and dontaudit rules, and I confirmed that the new classes are still appropriate. Test: diff new policy against old and confirm that all new rules add only cap_userns or cap2_userns; Boot ARC++ on a device with the 4.12 kernel. Bug: crbug.com/754831 Change-Id: I4007eb3a2ecd01b062c4c78d9afee71c530df95f
2017-11-09 23:51:26 +01:00
allow racoon self:global_capability_class_set { net_admin net_bind_service net_raw };
Make racoon permissive or unconfined. Also add allow rules from our policy. Change-Id: Id480eb7c8cd4e5544a1ec46cb39a55abc653ddb9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:38 +01:00
# XXX: should we give ip-up-vpn its own label (currently racoon domain)
allow racoon system_file:file rx_file_perms;
restore permissions to /vendor for non-treble devices Relabeling /vendor and /system/vendor to vendor_file removed previously granted permissions. Restore these for non-treble devices. Addresses: avc: denied { execute_no_trans } for pid=2944 comm="dumpstate" path="/system/vendor/bin/wpa_cli" dev="mmcblk0p10" ino=1929 scontext=u:r:dumpstate:s0 tcontext=u:object_r:vendor_file:s0 tclass=file And potentially some other bugs that have yet to surface. Bug: 37105075 Test: build Fugu Change-Id: I8e7bd9c33819bf8206f7c110cbce72366afbcef8
2017-04-14 06:58:12 +02:00
not_full_treble(`allow racoon vendor_file:file rx_file_perms;')
Make racoon permissive or unconfined. Also add allow rules from our policy. Change-Id: Id480eb7c8cd4e5544a1ec46cb39a55abc653ddb9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:38 +01:00
allow racoon vpn_data_file:file create_file_perms;
allow racoon vpn_data_file:dir w_dir_perms;
Adding policies for KeyStore MAC. Add keystore_key class and an action for each action supported by keystore. Add policies that replicate the access control that already exists in keystore. Add auditallow rules for actions not known to be used frequently. Add macro for those domains wishing to access keystore. Change-Id: Iddd8672b9e9b72b45ee208e6eda608cc9dc61edc
2014-06-17 23:58:52 +02:00
use_keystore(racoon)
# Racoon (VPN) has a restricted set of permissions from the default.
allow racoon keystore:keystore_key {
get
sign
verify
};
Reference in a new issue Copy permalink