tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/file_contexts

709 lines
36 KiB
Text
Raw Normal View History

SE Android policy.
2012-01-04 18:33:27 +01:00
###########################################
# Root
Add support for building without ramdisk Change-Id: I9496af008aa3ad1bf33fb5911c8dd711af219440
2015-07-24 06:08:32 +02:00
/ u:object_r:rootfs:s0
add file_contexts entries for root filesystem It may be useful to generate an ext4 image of the root filesystem instead of using a ramdisk. Whitelist entries in file_contexts to support selinux labeling a root filesystem image. Change-Id: I91a38d0aee4408c46cbfe5dc5e6eda198572e90f
2012-12-21 00:26:02 +01:00
# Data files
Add support for building without ramdisk Change-Id: I9496af008aa3ad1bf33fb5911c8dd711af219440
2015-07-24 06:08:32 +02:00
/adb_keys u:object_r:adb_keys_file:s0
/build\.prop u:object_r:rootfs:s0
/default\.prop u:object_r:rootfs:s0
/fstab\..* u:object_r:rootfs:s0
/init\..* u:object_r:rootfs:s0
/res(/.*)? u:object_r:rootfs:s0
/selinux_version u:object_r:rootfs:s0
/ueventd\..* u:object_r:rootfs:s0
/verity_key u:object_r:rootfs:s0
add file_contexts entries for root filesystem It may be useful to generate an ext4 image of the root filesystem instead of using a ramdisk. Whitelist entries in file_contexts to support selinux labeling a root filesystem image. Change-Id: I91a38d0aee4408c46cbfe5dc5e6eda198572e90f
2012-12-21 00:26:02 +01:00
# Executables
Add support for building without ramdisk Change-Id: I9496af008aa3ad1bf33fb5911c8dd711af219440
2015-07-24 06:08:32 +02:00
/init u:object_r:init_exec:s0
/sbin(/.*)? u:object_r:rootfs:s0
add file_contexts entries for root filesystem It may be useful to generate an ext4 image of the root filesystem instead of using a ramdisk. Whitelist entries in file_contexts to support selinux labeling a root filesystem image. Change-Id: I91a38d0aee4408c46cbfe5dc5e6eda198572e90f
2012-12-21 00:26:02 +01:00
enabled /sbin/modprobe for recovery mode This change defines new policy for modprobe (/sbin/modprobe) that should be used in both recovery and android mode. Denials: [ 16.986440] c0 437 audit: type=1400 audit(6138546.943:5): avc: denied { read } for pid=437 comm="modprobe" name="modules" dev="proc" ino=4026532405 scontext=u:object_r:modprobe:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 [ 16.986521] c0 437 audit: type=1400 audit(6138546.943:6): avc: denied { open } for pid=437 comm="modprobe" path="/proc/modules" dev="proc" ino=4026532405 scontext=u:object_r:modprobe:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 [ 16.986544] c0 437 audit: type=1400 audit(6138546.943:7): avc: denied { getattr } for pid=437 comm="modprobe" path="/proc/modules" dev="proc" ino=4026532405 scontext=u:object_r:modprobe:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 Bug: 35633646 Test: Build and tested it works in sailfish recovery. The modprobe is invoked in init.rc (at the end of 'on init') with following command line exec u:r:modprobe:s0 -- /sbin/modprobe -a nilfs2 ftl Change-Id: Ie70be6f918bea6059f806e2eb38cd48229facafa
2017-03-02 09:02:29 +01:00
# For kernel modules
/lib(/.*)? u:object_r:rootfs:s0
add file_contexts entries for root filesystem It may be useful to generate an ext4 image of the root filesystem instead of using a ramdisk. Whitelist entries in file_contexts to support selinux labeling a root filesystem image. Change-Id: I91a38d0aee4408c46cbfe5dc5e6eda198572e90f
2012-12-21 00:26:02 +01:00
# Empty directories
Add support for building without ramdisk Change-Id: I9496af008aa3ad1bf33fb5911c8dd711af219440
2015-07-24 06:08:32 +02:00
/lost\+found u:object_r:rootfs:s0
/acct u:object_r:cgroup:s0
/config u:object_r:rootfs:s0
Allow Zygote and Installd to remount directories in /data/data Zygote/Installd now can do the following operations in app data directory: - Mount on it - Create directories in it - Mount directory for each app data, and get/set attributes Bug: 143937733 Test: No denials at boot Test: No denials seen when creating mounts Change-Id: I6e852a5f5182f1abcb3136a3b23ccea69c3328db
2019-12-13 13:30:26 +01:00
/data_mirror u:object_r:mirror_data_file:s0
Adding /debug_ramdisk mount point This change allows first-stage init to mount a tmpfs under /debug_ramdisk to preserve files from the debug ramdisk, for second-stage init to load sepolicy and property files. This is to allow adb root on a USER build if the device is unlocked. Bug: 126493225 Test: boot a device with debug ramdisk, checks related files are loaded Change-Id: Iad3b84d9bdf5d8e789219126c88701bf969253ef
2019-04-16 09:13:22 +02:00
/debug_ramdisk u:object_r:tmpfs:s0
Add support for building without ramdisk Change-Id: I9496af008aa3ad1bf33fb5911c8dd711af219440
2015-07-24 06:08:32 +02:00
/mnt u:object_r:tmpfs:s0
New postinstall domain and rules to run post-install program. When using the A/B updater, a device specific hook is sometimes needed to run after the new partitions are updated but before rebooting into the new image. This hook is referred to throughout the code as the "postinstall" step. This patch creates a new execution domain "postinstall" which update_engine will use to run said hook. Since the hook needs to run from the new image (namelly, slot "B"), update_engine needs to temporarly mount this B partition into /postinstall and then run a program from there. Since the new program in B runs from the old execution context in A, we can't rely on the labels set in the xattr in the new filesystem to enforce the policies baked into the old running image. Instead, when temporarily mounting the new filesystem in update_engine, we override all the new file attributes with the new postinstall_file type by passing "context=u:object_r:postinstall_file:s0" to the mount syscall. This allows us to set new rules specific to the postinstall environment that are consistent with the rules in the old system. Bug: 27177071 TEST=Deployed a payload with a trivial postinstall script to edison-eng. (cherry picked from commit 6cb2c893b12db00c73009f6ab1f6c69426b0cc05) Change-Id: I49a529eecf1ef0524819470876ef7c8c2659c7ef
2016-03-02 01:14:45 +01:00
/postinstall u:object_r:postinstall_mnt_dir:s0
Introduce a `postinstall_apex_mnt_dir` label for `/postinstall/apex`. Directory `/postinstall/apex` is used as a mount point for a tmpfs filesystem during A/B OTA updates. APEX packages from the new system partition are mounted ("activated") in subdirectories of `/postinstall/apex`, so that they are available when `otapreopt` is running. Directory `/postinstall/apex` used to be of type `tmpfs` for SELinux purposes. The new `postinstall_apex_mnt_dir` label is more restrictive, and tightens permissions granted to `otapreopt_chroot`, `otapreopt` (running as `postinstall_dexopt`), and `dex2oat`, regarding the apexd logic recently added to `otapreopt_chroot`. Test: A/B OTA update test (asit/dexoptota/self_full). Bug: 113373927 Bug: 120796514 Change-Id: I03f0b0433d9c066a0c607f864d60ca62fc68c990
2019-01-24 15:32:17 +01:00
/postinstall/apex u:object_r:postinstall_apex_mnt_dir:s0
Add support for building without ramdisk Change-Id: I9496af008aa3ad1bf33fb5911c8dd711af219440
2015-07-24 06:08:32 +02:00
/proc u:object_r:rootfs:s0
/sys u:object_r:sysfs:s0
Add policy for apexd. apexd is a new daemon for managing APEX packages installed on the device. It hosts a single binder service, "apexservice". Bug: 112455435 Test: builds, binder service can be registered, apexes can be accessed, verified and mounted Change-Id: I634ad100f10b2edcd9a9c0df0d33896fa5d4ed97
2018-08-17 09:35:42 +02:00
/apex u:object_r:apex_mnt_dir:s0
Add support for building without ramdisk Change-Id: I9496af008aa3ad1bf33fb5911c8dd711af219440
2015-07-24 06:08:32 +02:00
# Symlinks
Add a /bin symlink for convenience. Bug: http://b/63142920 Test: `make dist` Change-Id: Iae363fd5e7181941408d3d75cbf248e651bc8b49
2017-12-06 21:03:45 +01:00
/bin u:object_r:rootfs:s0
label /bugreports /data/bugreports is moving to /bugreports Bug: 27262109 Bug: 27204904 Bug: 32799236 Test: new symlink is in /bugreports and is labeled correctly Change-Id: Ib6a492fba8388bf43debad28cfc851679f8c6151
2016-11-19 21:13:02 +01:00
/bugreports u:object_r:rootfs:s0
Move /sbin/charger to /system/bin/charger. With the CLs in the same topic, it's being built as a dynamically linked executable. And this applies to normal boot (including charger mode) and recovery mode both. /system/bin/charger under normal boot will be labeled as charger_exec, which has the attribute of system_file_type. The file in recovery image will still be labeled as rootfs. So we keep the domain_trans rule for rootfs file, but allowing for recovery mode only. Bug: 73660730 Test: Boot into charger mode on taimen. Check that charger UI works. Test: Boot into recovery mode. Check that charger process works. Change-Id: I062d81c346578cdfce1cc2dce18c829387a1fdbc
2018-09-08 00:05:33 +02:00
/charger u:object_r:rootfs:s0
Add support for building without ramdisk Change-Id: I9496af008aa3ad1bf33fb5911c8dd711af219440
2015-07-24 06:08:32 +02:00
/d u:object_r:rootfs:s0
/etc u:object_r:rootfs:s0
/sdcard u:object_r:rootfs:s0
add file_contexts entries for root filesystem It may be useful to generate an ext4 image of the root filesystem instead of using a ramdisk. Whitelist entries in file_contexts to support selinux labeling a root filesystem image. Change-Id: I91a38d0aee4408c46cbfe5dc5e6eda198572e90f
2012-12-21 00:26:02 +01:00
# SELinux policy files
Label /vendor_file_contexts as file_contexts_file vendor_init doesn't have permissions to read rootfs labeled files, but needs to read /vendor_file_contexts to do restorecon correctly. This file is a file_contexts file, so labeling it as such seems appropriate. Test: bullhead + vendor_init doesn't hit this audit Change-Id: I1f2cf7dd7de17806ac0f1dfe2483fb6d6659939b
2018-01-22 23:31:50 +01:00
/vendor_file_contexts u:object_r:file_contexts_file:s0
file_context: explicitly label all file context files file_context files need to be explicitly labeled as they are now split across system and vendor and won't have the generic world readable 'system_file' label. Bug: 36002414 Test: no new 'file_context' denials at boot complete on sailfish Test: successfully booted into recovery without denials and sideloaded OTA update. Test: ./cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi \ arm64-v8a --module CtsSecurityHostTestCases -t \ android.security.cts.SELinuxHostTest#testAospFileContexts Change-Id: I603157e9fa7d1de3679d41e343de397631666273 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-24 23:02:13 +01:00
/nonplat_file_contexts u:object_r:file_contexts_file:s0
/plat_file_contexts u:object_r:file_contexts_file:s0
Separate product_file_contexts out of system sepolicy. Bug: 119305624 Test: boot blueline Change-Id: I3ecdeab3bb33c3cb5e80dc10ba1079c9853048f8
2018-12-19 04:51:19 +01:00
/product_file_contexts u:object_r:file_contexts_file:s0
sepolicy: explicitly label all sepolicy files sepolicy files need to be explicitly labeled as they are now split cross system and vendor and won't have the generic world readable 'system_file' or 'rootfs' label. Bug: 36527360 Test: no new 'sepolicy_file' denials at boot complete on sailfish Test: successfully booted into recovery without denials and sideloaded OTA update. Test: Launch 'chrome' and succesfully load a website. Test: Launch Camera and take a picture. Test: Launch Camera and record a video, succesfully playback recorded video Change-Id: I6fe8ba31588c2d75521c6e2b0bf7e6d6eaf80a19 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-27 20:39:16 +02:00
/mapping_sepolicy\.cil u:object_r:sepolicy_file:s0
/nonplat_sepolicy\.cil u:object_r:sepolicy_file:s0
/plat_sepolicy\.cil u:object_r:sepolicy_file:s0
prop_context: correctly label all property_context files split property context file in vendor and sytem were left untouched by the recent changes. This was working accidentally because they were still accessible to all domains as 'system_file'. Bug: 36002573 Test: Boot sailfish to observe no new denials. Test: 'adb sideload' OTA on sailfish successfully Change-Id: I5bec058b59db83d2a431e9f7e91c5a09af7d2942 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-24 18:22:14 +01:00
/plat_property_contexts u:object_r:property_contexts_file:s0
Separate product_property_contexts out of system sepolicy. Bug: 119305624 Test: normal/recovery boot aosp_taimen Change-Id: Ib7a29a9f8f23dd917cc25c23c7612f9e4ae36ea0
2018-12-21 04:31:42 +01:00
/product_property_contexts u:object_r:property_contexts_file:s0
prop_context: correctly label all property_context files split property context file in vendor and sytem were left untouched by the recent changes. This was working accidentally because they were still accessible to all domains as 'system_file'. Bug: 36002573 Test: Boot sailfish to observe no new denials. Test: 'adb sideload' OTA on sailfish successfully Change-Id: I5bec058b59db83d2a431e9f7e91c5a09af7d2942 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-24 18:22:14 +01:00
/nonplat_property_contexts u:object_r:property_contexts_file:s0
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
/vendor_property_contexts u:object_r:property_contexts_file:s0
seapp_context: explicitly label all seapp context files seapp_context files need to be explicitly labeled as they are now split cross system and vendor and won't have the generic world readable 'system_file' label. Bug: 36002414 Test: no new 'seapp_context' denials at boot complete on sailfish Test: successfully booted into recovery without denials and sideloaded OTA update. Test: ./cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi \ arm64-v8a --module CtsSecurityHostTestCases -t \ android.security.cts.SELinuxHostTest#testAospSeappContexts Test: Launch 'chrome' and succesfully load a website. Test: Launch Camera and take a picture. Test: Launch Camera and record a video, succesfully playback recorded video Change-Id: I19b3e50c6a7c292713d3e56ef0448acf6e4270f7 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-27 19:57:07 +02:00
/seapp_contexts u:object_r:seapp_contexts_file:s0
/nonplat_seapp_contexts u:object_r:seapp_contexts_file:s0
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
/vendor_seapp_contexts u:object_r:seapp_contexts_file:s0
seapp_context: explicitly label all seapp context files seapp_context files need to be explicitly labeled as they are now split cross system and vendor and won't have the generic world readable 'system_file' label. Bug: 36002414 Test: no new 'seapp_context' denials at boot complete on sailfish Test: successfully booted into recovery without denials and sideloaded OTA update. Test: ./cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi \ arm64-v8a --module CtsSecurityHostTestCases -t \ android.security.cts.SELinuxHostTest#testAospSeappContexts Test: Launch 'chrome' and succesfully load a website. Test: Launch Camera and take a picture. Test: Launch Camera and record a video, succesfully playback recorded video Change-Id: I19b3e50c6a7c292713d3e56ef0448acf6e4270f7 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-27 19:57:07 +02:00
/plat_seapp_contexts u:object_r:seapp_contexts_file:s0
sepolicy: explicitly label all sepolicy files sepolicy files need to be explicitly labeled as they are now split cross system and vendor and won't have the generic world readable 'system_file' or 'rootfs' label. Bug: 36527360 Test: no new 'sepolicy_file' denials at boot complete on sailfish Test: successfully booted into recovery without denials and sideloaded OTA update. Test: Launch 'chrome' and succesfully load a website. Test: Launch Camera and take a picture. Test: Launch Camera and record a video, succesfully playback recorded video Change-Id: I6fe8ba31588c2d75521c6e2b0bf7e6d6eaf80a19 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-27 20:39:16 +02:00
/sepolicy u:object_r:sepolicy_file:s0
service_contexts: label service_contexts explicitly The label applies to all service_contexts regardless of their location. This also lets us track the service_contexts usage and limit access to the files for the corresponding object manager alone. Bug: 36002427 Test: Boot sailfish and observe no denials for 'serice_contexts' Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check \ --abi arm64-v8a --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testAospServiceContexts Change-Id: I97fc8b24bc99ca5c00d010fb522cd39a35572858 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-24 20:24:43 +01:00
/plat_service_contexts u:object_r:service_contexts_file:s0
Add hwservice_contexts and support for querying it. hwservicemanager can check hwservice_contexts files both from the framework and vendor partitions. Initially, have a wildcard '*' in hwservice_contexts that maps to a label that can be added/found from domain. This needs to be removed when the proper policy is in place. Also, grant su/shell access to hwservicemanager list operations, so tools like 'lshal' continue to work. Bug: 34454312 Test: Marlin boots Change-Id: I3a02d97a82458692b528d85c1b8e78b6f82ea1bc
2017-04-08 01:14:43 +02:00
/plat_hwservice_contexts u:object_r:hwservice_contexts_file:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
/nonplat_service_contexts u:object_r:nonplat_service_contexts_file:s0
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
# Use nonplat_service_contexts_file to allow servicemanager to read it
# on non full-treble devices.
/vendor_service_contexts u:object_r:nonplat_service_contexts_file:s0
Add hwservice_contexts and support for querying it. hwservicemanager can check hwservice_contexts files both from the framework and vendor partitions. Initially, have a wildcard '*' in hwservice_contexts that maps to a label that can be added/found from domain. This needs to be removed when the proper policy is in place. Also, grant su/shell access to hwservicemanager list operations, so tools like 'lshal' continue to work. Bug: 34454312 Test: Marlin boots Change-Id: I3a02d97a82458692b528d85c1b8e78b6f82ea1bc
2017-04-08 01:14:43 +02:00
/nonplat_hwservice_contexts u:object_r:hwservice_contexts_file:s0
Renames nonplat_* to vendor_* This change renames the non-platform sepolicy files on a DUT from nonplat_* to vendor_*. It also splits the versioned platform sepolicy from vendor_sepolicy.cil to a new file /vendor/etc/selinux/plat_pub_versioned.cil. And only keeps vendor customizations in vendor_sepolicy.cil. Build variable BOARD_SEPOLICY_DIRS is also renamed to BOARD_VENDOR_SEPOLICY_DIRS. Bug: 64240127 Test: boot bullhead/taimen Change-Id: Iea2210c9c8ab30c9ecbcd8146f074e76e90e6943
2018-02-05 10:34:52 +01:00
/vendor_hwservice_contexts u:object_r:hwservice_contexts_file:s0
Add target for vndservice_contexts. So we can limit vndservicemanager access to just vndservice_contexts. Bug: 36052864 Test: servicemanager,vndservicemanager work Change-Id: I7b132d4f616ba1edd0daf7be750d4b7174c4e188
2017-04-01 02:29:53 +02:00
/vndservice_contexts u:object_r:vndservice_contexts_file:s0
add file_contexts entries for root filesystem It may be useful to generate an ext4 image of the root filesystem instead of using a ramdisk. Whitelist entries in file_contexts to support selinux labeling a root filesystem image. Change-Id: I91a38d0aee4408c46cbfe5dc5e6eda198572e90f
2012-12-21 00:26:02 +01:00
SE Android policy.
2012-01-04 18:33:27 +01:00
##########################
# Devices
#
/dev(/.*)? u:object_r:device:s0
Merge adf_device into graphics_device As of sepolicy commit a16a59e2c7f1e2f09bf7b750101973a974c972e8 (https://android-review.googlesource.com/94580), adf_device and graphics_device have the exact same security properties. Merge them into one type to avoid a proliferation of SELinux types. Change-Id: Ib1a24f5d880798600e103b9e14934e41abb1ef95
2014-06-04 02:01:10 +02:00
/dev/adf[0-9]* u:object_r:graphics_device:s0
/dev/adf-interface[0-9]*\.[0-9]* u:object_r:graphics_device:s0
/dev/adf-overlay-engine[0-9]*\.[0-9]* u:object_r:graphics_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/ashmem u:object_r:ashmem_device:s0
sepolicy: ashmem entry point for libcutils This duplicated ashmem device is intended to replace ashmemd. Ashmem fd has a label of the domain that opens it. Now with ashmemd removed, ashmem fds can have labels other than "ashmemd", e.g. "system_server". We add missing permissions to make ashmem fds usable. Bug: 139855428 Test: boot device Change-Id: Iec8352567f1e4f171f76db1272935eee59156954
2019-09-24 23:43:00 +02:00
/dev/ashmem(.*)? u:object_r:ashmem_libcutils_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/audio.* u:object_r:audio_device:s0
/dev/binder u:object_r:binder_device:s0
/dev/block(/.*)? u:object_r:block_device:s0
Label block devices created or accessed by vold with specific types. Assign a more specific type than block_device to all block devices created or accessed by vold. Allow vold to set the context on the device nodes it creates. vold can create extra loop devices (/dev/block/loopN) and block devices for volumes it manages (/dev/block/vold/M:N). vold can read/write device mapper block devices (/dev/block/dm-N) created for encrypted volumes. vold can read/write metadata partitions used to store encryption metadata. The metadata_block_device type should be assigned in device-specific policy to the partition specified by the encryptable= mount option for the userata entry in the fstab.<board> file. This change does not remove the ability to create or read/write generic block_device devices by vold, so it should not break anything. It does add an auditallow statement on such accesses so that we can track remaining cases where we need to label such device nodes so that we can ultimately remove this access. Change-Id: Id3bea28f5958086716cd3db055bea309b3b5fa5a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-30 17:37:51 +02:00
/dev/block/dm-[0-9]+ u:object_r:dm_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/block/loop[0-9]* u:object_r:loop_device:s0
Updated policy for external storage. An upcoming platform release is redesigning how external storage works. At a high level, vold is taking on a more active role in managing devices that dynamically appear. This change also creates further restricted domains for tools doing low-level access of external storage devices, including sgdisk and blkid. It also extends sdcardd to be launchable by vold, since launching by init will eventually go away. For compatibility, rules required to keep AOSP builds working are marked with "TODO" to eventually remove. Slightly relax system_server external storage rules to allow calls like statfs(). Still neverallow open file descriptors, since they can cause kernel to kill us. Here are the relevant violations that this CL is designed to allow: avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
/dev/block/vold/.+ u:object_r:vold_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/block/ram[0-9]* u:object_r:ram_device:s0
file_contexts: label zram devices Since ram devices are labeled in base contexts, also add a label for devices using zram. Change-Id: I002baebf40246e78c6f9fb367ac6fb019101cc86 Signed-off-by: William Roberts <william.c.roberts@intel.com>
2015-08-25 21:06:39 +02:00
/dev/block/zram[0-9]* u:object_r:ram_device:s0
SEPolicy for boringssl_self_test. This CL adds hand-written SELinux rules to: - define the boringssl_self_test security domain - label the corresponding files at type boringssl_self_test_marker and boringssl_self_test_exec. - define an automatic transition from init to boringssl_self_test domains, plus appropriate access permissions. Bug: 137267623 Test: When run together with the other changes from draft CL topic http://aosp/q/topic:bug137267623_bsslselftest, check that: - both /dev/boringssl/selftest/* marker files are present after the device boots. - Test: after the boringssl_self_test{32,64} binaries have run, no further SELinux denials occur for processes trying to write the marker file. Change-Id: I77de0bccdd8c1e22c354d8ea146e363f4af7e36f
2019-08-28 23:08:50 +02:00
/dev/boringssl/selftest(/.*)? u:object_r:boringssl_self_test_marker:s0
Various policy updates. Assortment of policy changes include: * Bluetooth domain to talk to init and procfs. * New device node domains. * Allow zygote to talk to its executable. * Update system domain access to new device node domains. * Create a post-process sepolicy with dontaudits removed. * Allow rild to use the tty device. Change-Id: Ibb96b590d0035b8f6d1606cd5e4393c174d10ffb Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2013-03-27 11:30:25 +01:00
/dev/bus/usb(.*)? u:object_r:usb_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/console u:object_r:console_device:s0
Add new cpu variant related rules to SELinux I added ro.bionic.(2nd_)?_(arch|cpu_variant) to vendor system properties. And have init to write them to files under dev/. This change set SELinux rules for these properties and files. For the system properties: vendor/default.prop will set them. init will read them. For the files /dev/cpu_variant:.*: init will write them. bionic libc will read them. (Basically world readable). This is to allow libc select the right optimized routine at runtime. Like memcpy / strcmp etc. Test: getprop to make sure the properties are set. Test: ls -laZ to make sure /dev/cpu_variant:.* are correctly labeled. Change-Id: I41662493dce30eae6d41bf0985709045c44247d3
2018-11-06 00:03:16 +01:00
/dev/cpu_variant:.* u:object_r:dev_cpu_variant:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/device-mapper u:object_r:dm_device:s0
Allow adbd to access the qemu device and label /dev/eac correctly.
2012-04-03 21:30:28 +02:00
/dev/eac u:object_r:audio_device:s0
logd: restrict access to /dev/event-log-tags Create an event_log_tags_file label and use it for /dev/event-log-tags. Only trusted system log readers are allowed direct read access to this file, no write access. Untrusted domain requests lack direct access, and are thus checked for credentials via the "plan b" long path socket to the event log tag service. Test: gTest logd-unit-tests, liblog-unit-tests and logcat-unit-tests Bug: 31456426 Bug: 30566487 Change-Id: Ib9b71ca225d4436d764c9bc340ff7b1c9c252a9e
2016-11-08 00:11:39 +01:00
/dev/event-log-tags u:object_r:runtime_event_log_tags_file:s0
sepolicy changes to configure cgroup.rc and task_profiles.json access cgroups.json file contains cgroup information required to mount cgroup controllers and is readable only by init process. cgroup.rc contains cgroup map information consisting of the list of cgroups available in the system and their mounting locations. It is created by init process and should be readable by any processes that uses cgroups and should be writable only by init process. task_profiles.json file contains task profiles used to operate on cgroups. This information should be readable by any process that uses cgroups and should be writable only by init process. Bug: 111307099 Test: builds, boots Change-Id: Ib2c87c0fc3663c7fc69628f05c846519b65948b5 Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2019-01-11 02:10:31 +01:00
/dev/cgroup_info(/.*)? u:object_r:cgroup_rc_file:s0
Label /dev/fscklogs and allow system_server access to it. Otherwise you get denials such as: type=1400 audit(1383590310.430:623): avc: denied { getattr } for pid=1629 comm="Thread-78" path="/dev/fscklogs/log" dev="tmpfs" ino=1642 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=file type=1400 audit(1383590310.430:624): avc: denied { open } for pid=1629 comm="Thread-78" name="log" dev="tmpfs" ino=1642 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=file type=1400 audit(1383590310.430:625): avc: denied { write } for pid=1629 comm="Thread-78" name="fscklogs" dev="tmpfs" ino=1628 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=dir type=1400 audit(1383590310.430:625): avc: denied { remove_name } for pid=1629 comm="Thread-78" name="log" dev="tmpfs" ino=1642 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=dir type=1400 audit(1383590310.430:625): avc: denied { unlink } for pid=1629 comm="Thread-78" name="log" dev="tmpfs" ino=1642 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=file Change-Id: Ia7ae06a6d4cc5d2a59b8b85a5fb93cc31074fd37 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-11-04 15:47:29 +01:00
/dev/fscklogs(/.*)? u:object_r:fscklogs:s0
sdcard policy and fuse device label.
2012-05-31 15:44:51 +02:00
/dev/fuse u:object_r:fuse_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/graphics(/.*)? u:object_r:graphics_device:s0
Restrict access to /dev/hw_random to system_server and init. /dev/hw_random is accessed only by init and by EntropyMixer (which runs inside system_server). Other domains are denied access because apps/services should be obtaining randomness from the Linux RNG. Change-Id: Ifde851004301ffd41b2189151a64a0c5989c630f
2013-10-03 22:35:56 +02:00
/dev/hw_random u:object_r:hw_random_device:s0
Initial hardware servicemanager sepolicy. Change-Id: I07d188e4dd8801a539db1e9f3edf82a1d662648e (cherry picked from commit 61a082a55dbc2798d50d0d4b766151d69334729a)
2016-05-24 15:15:23 +02:00
/dev/hwbinder u:object_r:hwbinder_device:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
/dev/input(/.*)? u:object_r:input_device:s0
Introduce security labels for 2 new device nodes. iio: Industrial I/O subsystem usb_accessory: accessory protocol for usb Allow system access in both cases. Change-Id: I02db9775ec2ddaaeda40fae6d5e56e320957b09c Signed-off-by: Robert Craig <rpcraig@tycho.ncsc.mil>
2013-01-30 19:17:14 +01:00
/dev/iio:device[0-9]+ u:object_r:iio_device:s0
ion fix
2012-06-20 03:46:16 +02:00
/dev/ion u:object_r:ion_device:s0
Auditing init and ueventd access to chr device files. It seems likely that there is no reason to keep around a number of devices that are configured to be included into the pixel kernels. Init and ueventd should be the only processes with r/w access to these devices, so auditallow rules have been added to ensure that they aren't actually used. /dev/keychord was given its own type since it's one of the few character devices that's actually legitimately used and would cause log spam in the auditallow otherwise. Bug: 33347297 Test: The phone boots without any apparent log spam. Change-Id: I3dd9557df8a9218b8c802e33ff549d15849216fb
2017-01-09 23:57:03 +01:00
/dev/keychord u:object_r:keychord_device:s0
Define policy for "loop-control" device. Per loop(4), this device is the preferred way of allocating new loop devices since Linux 3.1. avc: denied { read write } for name="loop-control" dev="tmpfs" ino=15221 scontext=u:r:vold:s0 tcontext=u:object_r:device:s0 tclass=chr_file permissive=0 Bug: 34903607 Change-Id: I1f5f62cf0a1c24c6f6453100004812af4b8e1503
2017-03-26 05:38:17 +02:00
/dev/loop-control u:object_r:loop_control_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/modem.* u:object_r:radio_device:s0
Further policy for Motorola Xoom.
2012-01-06 16:25:53 +01:00
/dev/mtp_usb u:object_r:mtp_device:s0
selinux: add pstore Used to record the Android log messages, then on reboot provide a means to triage user-space actitivies leading up to a panic. A companion to the pstore console logs. Change-Id: I9b94ee3d5e94e0c4590ba8453b4ac1ebdfc7603f
2014-12-15 21:01:35 +01:00
/dev/pmsg0 u:object_r:pmsg_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/pn544 u:object_r:nfc_device:s0
/dev/port does not seem to be used, adding in rules to confirm. Only init and ueventd have any access to /dev/port, and neither should have any use for it. As it stands, leaving port in just represents additional attack surface with no useful functionality, so it should be removed if possible, not only from Pixel devices, but from all Android devices. Test: The phone boots successfully Bug:33301618 Change-Id: Iedc51590f1ffda02444587d647889ead9bdece3f
2016-12-05 00:11:29 +01:00
/dev/port u:object_r:port_device:s0
Add ppp/mtp policy. Initial policy for Point-to-Point tunneling and tunneling manager services.
2012-08-20 12:13:28 +02:00
/dev/ppp u:object_r:ppp_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/ptmx u:object_r:ptmx_device:s0
Drop legacy device types. powervr_device is obsoleted by the more general gpu_device. akm_device and accelerometer_device are obsoleted by the more general sensors_device. We could also drop the file_contexts entries altogether and take them to device-specific policy (in this case, they all came from crespo, so that is obsolete for master). Change-Id: I63cef43b0d66bc99b80b64655416cc050f443e7d Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-01-16 14:47:34 +01:00
/dev/pvrsrvkm u:object_r:gpu_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/kmsg u:object_r:kmsg_device:s0
Add /dev/kmsg_debug. Add /dev/kmsg_debug on userdebug devices, to allow crash_dump to log crashes to dmesg when logd isn't up yet (or is the one crashing). Bug: http://b/36574794 Test: stop tombstoned; crasher; dmesg Change-Id: I6ffe11bc613e88198893e82712719522b74fe1be
2017-03-28 22:09:37 +02:00
/dev/kmsg_debug u:object_r:kmsg_debug_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/null u:object_r:null_device:s0
/dev/nvhdcp1 u:object_r:video_device:s0
/dev/random u:object_r:random_device:s0
Correct denies of rpmsg device when accessing to remote processors.
2012-07-11 20:21:05 +02:00
/dev/rpmsg-omx[0-9] u:object_r:rpmsg_device:s0
/dev/rproc_user u:object_r:rpmsg_device:s0
Expand rtc_device label to match all rtc class drivers. /dev/rtc0 is not the only possible rtc device node, make sure all are given the rtc_device label. Change-Id: I50d15aa62e87509e940acd168474433803b2115d
2015-05-21 19:03:16 +02:00
/dev/rtc[0-9] u:object_r:rtc_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/snd(/.*)? u:object_r:audio_device:s0
Default to socket_device for anything under /dev/socket. Otherwise sockets that have no specific entry match the /dev(/.*) entry instead, leaving them in device type rather than socket_device type. Every socket should get its own entry regardless, but this at least puts it into a more specific type by default. Change-Id: I97f7999af7f9f83484d3a51440dda791d3726f1a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-02 15:02:22 +01:00
/dev/socket(/.*)? u:object_r:socket_device:s0
Update policy for Android 4.2 / latest master. Update policy for Android 4.2 / latest master. Primarily this consists of changes around the bluetooth subsystem. The zygote also needs further permissions to set up /storage/emulated. adbd service now gets a socket under /dev/socket. keystore uses the binder. Change-Id: I8c5aeb8d100313c75169734a0fa614aa974b3bfc Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-11-16 15:06:47 +01:00
/dev/socket/adbd u:object_r:adbd_socket:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/socket/dnsproxyd u:object_r:dnsproxyd_socket:s0
initial dumpstate domain Add the necessary rules to support dumpstate. Start off initially in permissive until it has more testing. Dumpstate is triggered by running "adb bugreport" Change-Id: Ic17a60cca1f6f40daa4f2c51e9ad6009ef36cfbd
2013-12-14 07:19:45 +01:00
/dev/socket/dumpstate u:object_r:dumpstate_socket:s0
Introduce fwmarkd: a service to set the fwmark of sockets. (cherry picked from commit 7d51096d4106a441a15741592d9ccdd0bfaca907) Change-Id: Ib6198e19dbc306521a26fcecfdf6e8424d163fc9
2014-05-01 20:12:10 +02:00
/dev/socket/fwmarkd u:object_r:fwmarkd_socket:s0
Move lmkd into it's own domain. lmkd low memory killer daemon The kernel low memory killer logic has been moved to a new daemon called lmkd. ActivityManager communicates with this daemon over a named socket. This is just a placeholder policy, starting off in unconfined_domain. Change-Id: Ia3f9a18432c2ae37d4f5526850e11432fd633e10
2013-12-06 01:55:34 +01:00
/dev/socket/lmkd u:object_r:lmkd_socket:s0
sepolicy: Add write_logd, read_logd & control_logd - Add write_logd, read_logd and control_logd macros added along with contexts for user space logd. - Specify above on domain wide, or service-by-service basis - Add logd rules. - deprecate access_logcat as unused. - 'allow <domain> zygote:unix_dgram_socket write;' rule added to deal with fd inheritance. ToDo: investigate means to allow references to close, and reopen in context of application or call setsockcreatecon() to label them in child context. Change-Id: I35dbb9d5122c5ed9b8c8f128abf24a871d6b26d8
2013-11-13 00:34:52 +01:00
/dev/socket/logd u:object_r:logd_socket:s0
/dev/socket/logdr u:object_r:logdr_socket:s0
/dev/socket/logdw u:object_r:logdw_socket:s0
Setting up sepolicies for statsd planB of listening to its own socket Test: manual Bug: 78318738 Change-Id: I45c3511860fbe6a1de45c6930052a8865b38986a
2018-04-20 20:07:22 +02:00
/dev/socket/statsdw u:object_r:statsdw_socket:s0
Label /dev/socket/mdns with its own type. Otherwise it gets left in the general device type, and we get denials such as: type=1400 msg=audit(1379617262.940:102): avc: denied { write } for pid=579 comm="mDnsConnector" name="mdns" dev="tmpfs" ino=3213 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=sock_file This of course only shows up if using a confined system_server. Change-Id: I2456dd7aa4d72e6fd15b55c251245186eb54a80a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-09-19 21:09:38 +02:00
/dev/socket/mdns u:object_r:mdns_socket:s0
Add a domain for mdnsd and allow connecting to it. Change-Id: I0a06fa32a46e515671b4e9a6f68e1a3f8b2c21a8 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 19:04:49 +01:00
/dev/socket/mdnsd u:object_r:mdnsd_socket:s0
Address system_server denials. Label /proc/sysrq-trigger and allow access. Label /dev/socket/mtpd and allow access. Resolves denials such as: avc: denied { getattr } for pid=12114 comm="Binder_2" path="socket:[219779]" dev="sockfs" ino=219779 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket avc: denied { call } for pid=1007 comm="Binder_8" scontext=u:r:system_server:s0 tcontext=u:r:su:s0 tclass=binder avc: denied { write } for pid=1024 comm="watchdog" name="sysrq-trigger" dev="proc" ino=4026533682 scontext=u:r:system_server:s0 tcontext=u:object_r:proc:s0 tclass=file avc: denied { write } for pid=11567 comm="LegacyVpnRunner" name="mtpd" dev="tmpfs" ino=36627 scontext=u:r:system_server:s0 tcontext=u:object_r:socket_device:s0 tclass=sock_file avc: denied { ptrace } for pid=10924 comm=5369676E616C2043617463686572 scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=process avc: denied { sigkill } for pid=26077 comm="NativeCrashRepo" scontext=u:r:system_server:s0 tcontext=u:r:zygote:s0 tclass=process avc: denied { write } for pid=1024 comm="android.bg" scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=netlink_socket avc: denied { getattr } for pid=473 comm="FinalizerDaemon" path="socket:[11467]" dev="sockfs" ino=11467 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=tcp_socket avc: denied { getattr } for pid=473 comm="FinalizerDaemon" path="socket:[12076]" dev="sockfs" ino=12076 scontext=u:r:system_server:s0 tcontext=u:r:mediaserv er:s0 tclass=udp_socket avc: denied { getopt } for pid=473 comm="FinalizerDaemon" laddr=192.168.159.172 lport=51576 faddr=93.127.173.40 fport=554 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=tcp_socket avc: denied { getopt } for pid=473 comm="FinalizerDaemon" lport=15658 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=udp_socket avc: denied { read write } for pid=21384 comm="rtsp" path="socket:[443742]" dev="sockfs" ino=443742 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s 0 tclass=tcp_socket avc: denied { read write } for pid=21384 comm="rtsp" path="socket:[444842]" dev="sockfs" ino=444842 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=udp_socket avc: denied { setopt } for pid=1326 comm="Binder_9" lport=16216 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=udp_socket avc: denied { setopt } for pid=1676 comm="Binder_6" laddr=192.168.156.130 lport=51044 faddr=74.125.214.81 fport=554 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=tcp_socket avc: denied { getattr } for pid=10915 comm="system_server" path="/dev/mdm" dev="tmpfs" ino=7484 scontext=u:r:system_server:s0 tcontext=u:object_r:radio_device:s0 tclass=chr_file avc: denied { read } for pid=10915 comm="system_server" name="mdm" dev="tmpfs" ino=7484 scontext=u:r:system_server:s0 tcontext=u:object_r:radio_device:s0 tclass=chr_file avc: denied { unlink } for pid=14866 comm="system_server" name="wallpaper" dev="mmcblk0p9" ino=285715 scontext=u:r:system_server:s0 tcontext=u:object_r:wallpaper_file:s0 tclass=file avc: denied { getattr } for pid=12114 comm="Binder_2" path="socket:[219779]" dev="sockfs" ino=219779 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket avc: denied { getopt } for pid=32300 comm="Binder_1" laddr=::ffff:127.0.0.1 lport=4939 faddr=::ffff:127.0.0.1 fport=53318 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket avc: denied { read write } for pid=10840 comm="pool-17-thread-" path="socket:[205990]" dev="sockfs" ino=205990 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket avc: denied { write } for pid=20817 comm="dumpsys" path="/mnt/shell/emulated/0/aupt-output/bugreport-2014-02-22-11-17-16.txt.tmp" dev="fuse" ino=3100784040 scontext=u:r:system_server:s0 tcontext=u:object_r:sdcard_internal:s0 tclass=file Change-Id: I481ac26667b487031a5d3317b0a028a027a8e641 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-03-05 15:50:08 +01:00
/dev/socket/mtpd u:object_r:mtpd_socket:s0
SELinux policies for PDX services Specify per-service rules for PDX transport. Now being able to grant permissions to individual services provided by processes, not all services of a process. Also tighter control over which permissions are required for client and server for individual components of IPC (endpoints, channels, etc). Bug: 37646189 Change-Id: I78eb8ae8b6e08105666445a66bfcbd2f1d69d0ea
2017-05-01 22:01:44 +02:00
/dev/socket/pdx/system/buffer_hub u:object_r:pdx_bufferhub_dir:s0
/dev/socket/pdx/system/buffer_hub/client u:object_r:pdx_bufferhub_client_endpoint_socket:s0
/dev/socket/pdx/system/performance u:object_r:pdx_performance_dir:s0
/dev/socket/pdx/system/performance/client u:object_r:pdx_performance_client_endpoint_socket:s0
/dev/socket/pdx/system/vr/display u:object_r:pdx_display_dir:s0
/dev/socket/pdx/system/vr/display/client u:object_r:pdx_display_client_endpoint_socket:s0
/dev/socket/pdx/system/vr/display/manager u:object_r:pdx_display_manager_endpoint_socket:s0
/dev/socket/pdx/system/vr/display/screenshot u:object_r:pdx_display_screenshot_endpoint_socket:s0
/dev/socket/pdx/system/vr/display/vsync u:object_r:pdx_display_vsync_endpoint_socket:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/socket/property_service u:object_r:property_socket:s0
racoon policy. Initial policy for racoon (IKE key management). Signed-off-by: Robert Craig <rpcraig@tycho.ncsc.mil> Change-Id: If1e344f39ea914e42afbaa021b272ba1b7113479
2013-01-07 15:21:18 +01:00
/dev/socket/racoon u:object_r:racoon_socket:s0
Add sepolicy for fastbootd Also allow adb and fastboot to talk to recovery through recovery_socket. This enables changing between modes with usb commands. Test: No selinux denials Bug: 78793464 Change-Id: I80c54d4eaf3b94a1fe26d2280af4e57cb1593790
2018-05-29 19:54:16 +02:00
/dev/socket/recovery u:object_r:recovery_socket:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/socket/rild u:object_r:rild_socket:s0
/dev/socket/rild-debug u:object_r:rild_debug_socket:s0
Introduce crash_dump debugging helper. Replace the global debuggerd with a per-process debugging helper that gets exec'ed by the process that crashed. Bug: http://b/30705528 Test: crasher/crasher64, `debuggerd <pid>`, `kill -ABRT <pid>` Change-Id: Iad1b7478f7a4e2690720db4b066417d8b66834ed
2016-10-19 23:39:30 +02:00
/dev/socket/tombstoned_crash u:object_r:tombstoned_crash_socket:s0
SEPolicy: Changes for new stack dumping scheme. Applications connect to tombstoned via a unix domain socket and request an open FD to which they can write their traces. This socket has a new label (tombstoned_java_trace_socket) and appdomain and system_server are given permissions to connect and write to it. Apps no longer need permissions to open files under /data/anr/ and these permissions will be withdrawn in a future change. Bug: 32064548 Test: Manual (cherry picked from commit a8832dabc7f3b7b2381760d2b95f81abf78db709) (cherry picked from commit 11bfcc1e96d9ede3d5aaa586630d154e73a7214a) Change-Id: Icc60d227331c8eee70a9389ff1e7e78772f37e6f
2017-05-15 19:39:16 +02:00
/dev/socket/tombstoned_java_trace u:object_r:tombstoned_java_trace_socket:s0
Introduce crash_dump debugging helper. Replace the global debuggerd with a per-process debugging helper that gets exec'ed by the process that crashed. Bug: http://b/30705528 Test: crasher/crasher64, `debuggerd <pid>`, `kill -ABRT <pid>` Change-Id: Iad1b7478f7a4e2690720db4b066417d8b66834ed
2016-10-19 23:39:30 +02:00
/dev/socket/tombstoned_intercept u:object_r:tombstoned_intercept_socket:s0
Perfetto SELinux policies Perfetto is a performance instrumentation and logging framework, living in AOSP's /external/pefetto. Perfetto introduces in the system one binary and two daemons (the binary can specialize in either depending on the cmdline). 1) traced: unprivileged daemon. This is architecturally similar to logd. It exposes two UNIX sockets: - /dev/socket/traced_producer : world-accessible, allows to stream tracing data. A tmpfs file descriptor is sent via SCM_RIGHTS from traced to each client process, which needs to be able to mmap it R/W (but not X) - /dev/socket/traced_consumer : privilege-accessible (only from: shell, statsd). It allows to configure tracing and read the trace buffer. 2) traced_probes: privileged daemon. This needs to: - access tracingfs (/d/tracing) to turn tracing on and off. - exec atrace - connect to traced_producer to stream data to traced. init.rc file: https://android-review.googlesource.com/c/platform/external/perfetto/+/575382/14/perfetto.rc Bug: 70942310 Change-Id: Ia3b5fdacbd5a8e6e23b82f1d6fabfa07e4abc405
2017-12-21 03:51:15 +01:00
/dev/socket/traced_producer u:object_r:traced_producer_socket:s0
/dev/socket/traced_consumer u:object_r:traced_consumer_socket:s0
Add heapprofd selinux config. This does not actually grant any permissions but just adds the necessary boilerplate for a new service. Bug: 117762471 Bug: 117761873 Change-Id: I7cdd2ae368616cfd54fc685c15f775604bfc80d4
2018-10-15 19:02:02 +02:00
/dev/socket/heapprofd u:object_r:heapprofd_socket:s0
Add /dev/socket/uncrypt. system_server used to communicate with uncrypt via files (e.g. /cache/recovery/command and /cache/recovery/uncrypt_status). Since A/B devices may not have /cache partitions anymore, we switch to communicate via /dev/socket/uncrypt to allow things like factory reset to keep working. Bug: 27176738 Change-Id: I73b6d6f1ecdf16fd4f3600b5e524da06f35b5bca
2016-02-26 19:30:12 +01:00
/dev/socket/uncrypt u:object_r:uncrypt_socket:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/socket/wpa_eth[0-9] u:object_r:wpa_socket:s0
/dev/socket/wpa_wlan[0-9] u:object_r:wpa_socket:s0
/dev/socket/zygote u:object_r:zygote_socket:s0
Label /dev/socket/zygote_secondary zygote_secondary talks over a different socket named /dev/socket/zygote_secondary. Make sure it's properly labeled. See https://android-review.googlesource.com/89604 Addresses the following denial: <12>[ 48.442004] type=1400 audit(1400801842.179:5): avc: denied { write } for pid=1082 comm="main" name="zygote_secondary" dev="tmpfs" ino=9953 scontext=u:r:system_server:s0 tcontext=u:object_r:socket_device:s0 tclass=sock_file permissive=1 Bug: 13647418 Change-Id: I1ff5f1d614295a5870bb8a3992ad9167e1656c92
2014-05-23 01:48:20 +02:00
/dev/socket/zygote_secondary u:object_r:zygote_socket:s0
Renamed blastula to unspecialized app process (usap) Bug: 123017829 Test: make & boot & launch apps Change-Id: I48b067216f52773c128f72234e453c134b85b75a
2019-02-23 00:42:25 +01:00
/dev/socket/usap_pool_primary u:object_r:zygote_socket:s0
/dev/socket/usap_pool_secondary u:object_r:zygote_socket:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/spdif_out.* u:object_r:audio_device:s0
run-as policy fixes. - Remove dac_read_search as it is no longer required by run-as. - Introduce a separate type for /dev/tty so that we can allow use of own tty for for a run-as shell without allowing access to other /dev/tty[0-9]* nodes. - Allow sigchld notifications for death of run-as and its descendants by adbd. - Drop redundant rules for executing shell or system commands from untrusted_app; now covered by rules in app.te. Change-Id: Ic3bf7bee9eeabf9ad4a20f61fbb142a64bb37c6c
2013-04-05 20:22:27 +02:00
/dev/tty u:object_r:owntty_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/tty[0-9]* u:object_r:tty_device:s0
/dev/ttyS[0-9]* u:object_r:serial_device:s0
Modify SEPolicy to support SLCAN SLCAN setup requires certain ioctls and read/write operations to certain tty's. This change allows the HAL to set up SLCAN devices while complying with SEPolicy. In addition to adding support for SLCAN, I've also included permissions for using setsockopt. In order for the CAN HAL receive error frames from the CAN bus controller, we need to first set the error mask and filter via setsockopt. Test: manual Bug: 144458917 Bug: 144513919 Change-Id: I63a48ad6677a22f05d50d665a81868011c027898
2019-11-14 18:32:32 +01:00
/dev/ttyUSB[0-9]* u:object_r:usb_serial_device:s0
/dev/ttyACM[0-9]* u:object_r:usb_serial_device:s0
racoon policy. Initial policy for racoon (IKE key management). Signed-off-by: Robert Craig <rpcraig@tycho.ncsc.mil> Change-Id: If1e344f39ea914e42afbaa021b272ba1b7113479
2013-01-07 15:21:18 +01:00
/dev/tun u:object_r:tun_device:s0
/dev/uhid u:object_r:uhid_device:s0
Change the type on /dev/uinput to match /dev/uhid. /dev/uinput is accessed in the same way as /dev/uhid, and unlike /dev/input/*. bluetooth requires access to the former and not to the latter, while shell requires access to the latter and not the former. This is also consistent with their DAC group ownerships (net_bt_stack for /dev/uinput and /dev/uhid vs input for /dev/input/*). Change-Id: I0059d832a7fe036ed888c91e1fb96f3e6e0bd2d4 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-23 19:50:19 +02:00
/dev/uinput u:object_r:uhid_device:s0
Label /dev/uio[0-9]* with its own type. Change-Id: Ibeeec6637022ee8bc9868e102b3d55e3b0d4762c Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-03-26 20:37:54 +01:00
/dev/uio[0-9]* u:object_r:uio_device:s0
Collapse urandom_device into random_device urandom_device and random_device have the exact same security properties. Collapse them into one type. Test: device boots and /dev/urandom is labeled correctly. Change-Id: I12da30749291bc5e37d99bc9422bb86cb58cec41
2016-11-19 21:52:54 +01:00
/dev/urandom u:object_r:random_device:s0
Introduce security labels for 2 new device nodes. iio: Industrial I/O subsystem usb_accessory: accessory protocol for usb Allow system access in both cases. Change-Id: I02db9775ec2ddaaeda40fae6d5e56e320957b09c Signed-off-by: Robert Craig <rpcraig@tycho.ncsc.mil>
2013-01-30 19:17:14 +01:00
/dev/usb_accessory u:object_r:usbaccessory_device:s0
Allow input system access to /dev/v4l-touchX Bug: 62940136 Test: read /dev/v4l-touchX from inputflinger Change-Id: Ifcece4192c567e0cbaba1b7ad40d25c8f34f8e40
2017-12-23 02:17:06 +01:00
/dev/v4l-touch[0-9]* u:object_r:input_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/video[0-9]* u:object_r:video_device:s0
Initial sepolicy for vndservicemanager. vndservicemanager is the context manager for binder services that are solely registered and accessed from vendor processes. Bug: 36052864 Test: vendorservicemanager runs Change-Id: Ifbf536932678d0ff13d019635fe6347e185ef387
2017-03-22 00:01:52 +01:00
/dev/vndbinder u:object_r:vndbinder_device:s0
watchdog security policy. Initial policy for software watchdog daemon which is started by init. Change-Id: I042a5b1698bf53ce2e50ea06851c374e5123ee2c Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2012-12-03 12:07:45 +01:00
/dev/watchdog u:object_r:watchdog_device:s0
Target the denials/policies over qtaguid file and device: 1. Relabel /proc/net/xt_qtaguid/ctrl from "qtaguid" to "qtaguid_proc"; 2. Label /dev/xt_qtaguid with "qtaguid_device"; 3. Allow mediaserver read/[write] to qtaguid_proc and qtaguid_device; 4. Allow media apps read/[write] to qtaguid_proc and qtaguid_device; 5. Allow system read/[write] to qtaguid_proc and qtaguid_device. Actually, some of policies related to qtaguid have been there already, but we refind existing ones and add new ones.
2012-07-19 20:07:04 +02:00
/dev/xt_qtaguid u:object_r:qtaguid_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/zero u:object_r:zero_device:s0
Add policy for __properties__ device. Change-Id: Ie9b391283362fb6930f1ae858f0a879835c91e32
2013-03-01 02:33:16 +01:00
/dev/__properties__ u:object_r:properties_device:s0
Add /dev/__properties__/property_info Allow init to create a serialized property_info file and allow all processes to read it. Bug: 36001741 Test: boot bullhead, walleye using property_info Change-Id: Ie51d4c0f0221b128dd087029c811fda15b4d7093
2017-11-16 23:25:02 +01:00
/dev/__properties__/property_info u:object_r:property_info:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
#############################
Move linker config under /linkerconfig Currently linker config locates under /dev, but this makes some problem in case of using two system partitions using chroot. To match system image and configuration, linker config better stays under /linkerconfig Bug: 144966380 Test: m -j passed && tested from cuttlefish Change-Id: Iea67663442888c410f29f8dd0c44fe49e3fcef94
2019-11-22 06:56:10 +01:00
# Linker configuration
#
/linkerconfig(/.*)? u:object_r:linkerconfig_file:s0
#############################
SE Android policy.
2012-01-04 18:33:27 +01:00
# System files
#
/system(/.*)? u:object_r:system_file:s0
Rename the context for the ART APEX. Test: Boot (with default flattened APEXes) Bug: 135753770 Change-Id: I551e88a250d3bd891f63a6bccee0682d0d0de7cf
2019-07-17 16:48:30 +02:00
/system/apex/com.android.art u:object_r:art_apex_dir:s0
More granular vendor access to /system files. This change limits global access to /system files down to: /system/bin/linker* /system/lib[64]/* /system/etc/ld.config* /system/etc/seccomp_policy/* /system/etc/security/cacerts/* /system/usr/share/zoneinfo/* Bug: 111243627 Test: boot device, browse internet without denials to system_* types. Test: VtsHalDrmV1_{1, 0}TargetTest without denials Change-Id: I69894b29733979c2bc944ac80229e84de5d519f4
2018-08-12 00:34:49 +02:00
/system/lib(64)?(/.*)? u:object_r:system_lib_file:s0
Allow bootstrap bionic only to init, ueventd, and apexd The bootstrap bionic (/system/lib/bootstrap/*) are only to the early processes that are executed before the bionic libraries become available via the runtime APEX. Allowing them to other processes is not needed and sometimes causes a problem like b/123183824. Bug: 123183824 Test: device boots to the UI Test: atest CtsJniTestCases:android.jni.cts.JniStaticTest#test_linker_namespaces Change-Id: Id7bba2e8ed1c9faf6aa85dbbdd89add04826b160
2019-03-14 18:45:33 +01:00
/system/lib(64)?/bootstrap(/.*)? u:object_r:system_bootstrap_lib_file:s0
Add SELinux settings to support tracing during boot. This CL adds the SELinux settings required to support tracing during boot. https://android-review.googlesource.com/#/c/157163/ BUG: 21739901 Change-Id: Ib3a7107776141ac8cf4f1ca06674f47a0d4b6ae0
2015-06-24 08:24:17 +02:00
/system/bin/atrace u:object_r:atrace_exec:s0
Add policy for /system/bin/auditctl /system/bin/auditctl is executed by init to set the kernel audit throttling rate limit. Grant the rules necessary for this to happen. Test: compiles and boots Test: Perform an operation which generates lots of SELinux denials, and count how many occur before and after the time period. Bug: 118815957 Change-Id: Id9df65497d1172ab7c2e84ff6a43722f11c61620
2019-04-09 19:57:13 +02:00
/system/bin/auditctl u:object_r:auditctl_exec:s0
bless app created renderscript files When an app uses renderscript to compile a Script instance, renderscript compiles and links the script using /system/bin/bcc and /system/bin/ld.mc, then places the resulting shared library into the application's code_cache directory. The application then dlopen()s the resulting shared library. Currently, this executable code is writable to the application. This violates the W^X property (https://en.wikipedia.org/wiki/W%5EX), which requires any executable code be immutable. This change introduces a new label "rs_data_file". Files created by /system/bin/bcc and /system/bin/ld.mc in the application's home directory assume this label. This allows us to differentiate in security policy between app created files, and files created by renderscript on behalf of the application. Apps are allowed to delete these files, but cannot create or write these files. This is enforced through a neverallow compile time assertion. Several exceptions are added to Treble neverallow assertions to support this functionality. However, because renderscript was previously invoked from an application context, this is not a Treble separation regression. This change is needed to support blocking dlopen() for non-renderscript /data/data files, which will be submitted in a followup change. Bug: 112357170 Test: cts-tradefed run cts -m CtsRenderscriptTestCases Change-Id: Ie38bbd94d26db8a418c2a049c24500a5463698a3
2018-12-12 18:06:05 +01:00
/system/bin/bcc u:object_r:rs_exec:s0
Add policy for 'blank_screen'. This util allows init to turn off the screen without any binder dependencies. Bug: 70846424 Test: manual + init use Change-Id: I4f41a966d6398e959ea6baf36c2cfe6fcebc00de
2018-01-19 22:00:42 +01:00
/system/bin/blank_screen u:object_r:blank_screen_exec:s0
SEPolicy for boringssl_self_test. This CL adds hand-written SELinux rules to: - define the boringssl_self_test security domain - label the corresponding files at type boringssl_self_test_marker and boringssl_self_test_exec. - define an automatic transition from init to boringssl_self_test domains, plus appropriate access permissions. Bug: 137267623 Test: When run together with the other changes from draft CL topic http://aosp/q/topic:bug137267623_bsslselftest, check that: - both /dev/boringssl/selftest/* marker files are present after the device boots. - Test: after the boringssl_self_test{32,64} binaries have run, no further SELinux denials occur for processes trying to write the marker file. Change-Id: I77de0bccdd8c1e22c354d8ea146e363f4af7e36f
2019-08-28 23:08:50 +02:00
/system/bin/boringssl_self_test(32|64) u:object_r:boringssl_self_test_exec:s0
Move /sbin/charger to /system/bin/charger. With the CLs in the same topic, it's being built as a dynamically linked executable. And this applies to normal boot (including charger mode) and recovery mode both. /system/bin/charger under normal boot will be labeled as charger_exec, which has the attribute of system_file_type. The file in recovery image will still be labeled as rootfs. So we keep the domain_trans rule for rootfs file, but allowing for recovery mode only. Bug: 73660730 Test: Boot into charger mode on taimen. Check that charger UI works. Test: Boot into recovery mode. Check that charger process works. Change-Id: I062d81c346578cdfce1cc2dce18c829387a1fdbc
2018-09-08 00:05:33 +02:00
/system/bin/charger u:object_r:charger_exec:s0
move e2fs tools from /sbin to /system/bin Test: let fs_mgr format a damaged /data partition Bug: 35219933 Change-Id: I379567772c73e52f532a24acf640c21f2bab5c5b (cherry picked from commit 6d1ecdcb5a76dbcc0cb4c5ceb7aa089572a8df3e)
2017-06-07 02:27:44 +02:00
/system/bin/e2fsdroid u:object_r:e2fs_exec:s0
/system/bin/mke2fs u:object_r:e2fs_exec:s0
Do not allow init to execute anything without changing domains. Remove the ability of init to execute programs from / or /system without changing domains. This forces all helper programs and services invoked by init to be assigned their own domain. Introduce separate domains for running the helper programs executed from the fs_mgr library by init. This requires a domain for e2fsck (named fsck for generality) and a domain for running mkswap (named toolbox since mkswap is just a symlink to the toolbox binary and the domain transition occurs on executing the binary, not based on the symlink in any way). e2fsck is invoked on any partitions marked with the check mount option in the fstab file, typically userdata and cache but never system. We allow it to read/write the userdata_block_device and cache_block_device types but also allow it to read/write the default block_device type until we can get the more specific types assigned in all of the device-specific policies. mkswap is invoked on any swap partition defined in the fstab file. We introduce a new swap_block_device type for this purpose, to be assigned to any such block devices in the device-specific policies, and only allow it to read/write such block devices. As there seem to be no devices in AOSP with swap partitions in their fstab files, this does not appear to risk any breakage for existing devices. With the introduction of these domains, we can de-privilege init to only having read access to block devices for mounting filesystems; it no longer needs direct write access to such devices AFAICT. To avoid breaking execution of toolbox by system services, apps, or the shell, we allow all domains other than kernel and init the ability to run toolbox in their own domain. This is broader than strictly required; we could alternatively only add it to those domains that already had x_file_perms to system_file but this would require a coordinated change with device-specific policy. Change-Id: Ib05de2d2bc2781dad48b70ba385577cb855708e4 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-23 15:11:30 +02:00
/system/bin/e2fsck -- u:object_r:fsck_exec:s0
Add label for /system/bin/fsck.exfat Allow vold to run exFAT filesystem check. Test: build, mount exFAT volume Bug: 80202067 Change-Id: I68f3438de89246e806cebe483f37e31c68aaa3d7
2018-05-22 15:53:42 +02:00
/system/bin/fsck\.exfat -- u:object_r:fsck_exec:s0
add support for fsck.f2fs The Nexus 9 uses f2fs for /data. Make sure to properly label /system/bin/fsck.f2fs so that the appropriate domain transition occurs. Add support for getattr on devpts, required for fsck.f2fs. Addresses the following denials: avc: denied { execute_no_trans } for pid=172 comm="init" path="/system/bin/fsck.f2fs" dev="dm-0" ino=272 scontext=u:r:init:s0 tcontext=u:object_r:system_file:s0 tclass=file permissive=0 avc: denied { getattr } for pid=170 comm="fsck.f2fs" path="/dev/pts/0" dev="devpts" ino=3 scontext=u:r:fsck:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=1 Change-Id: I34b3f91374d1eb3fb4ba76abce14ff67db259f96
2014-10-20 19:36:49 +02:00
/system/bin/fsck\.f2fs -- u:object_r:fsck_exec:s0
Move /sbin/charger to /system/bin/charger. With the CLs in the same topic, it's being built as a dynamically linked executable. And this applies to normal boot (including charger mode) and recovery mode both. /system/bin/charger under normal boot will be labeled as charger_exec, which has the attribute of system_file_type. The file in recovery image will still be labeled as rootfs. So we keep the domain_trans rule for rootfs file, but allowing for recovery mode only. Bug: 73660730 Test: Boot into charger mode on taimen. Check that charger UI works. Test: Boot into recovery mode. Check that charger process works. Change-Id: I062d81c346578cdfce1cc2dce18c829387a1fdbc
2018-09-08 00:05:33 +02:00
/system/bin/init u:object_r:init_exec:s0
Move fs-verity key loading into fsverity_init domain fsverity_init is a new shell script that uses mini-keyctl for the actual key loading. Given the plan to implement keyctl in toybox, we label mini-keyctl as u:object_r:toolbox_exec:s0. This gives us two benefits: - Better compatibility to keyctl(1), which doesn't have "dadd" - Pave the way to specify key's security labels, since keyctl(1) doesn't support, and we want to avoid adding incompatible option. Test: Boot without SELinux denial Test: After boot, see the key in /product loaded Bug: 128607724 Change-Id: Iebd7c9b3c7aa99ad56f74f557700fd85ec58e9d0
2019-03-15 19:15:31 +01:00
# TODO(/123600489): merge mini-keyctl into toybox
/system/bin/mini-keyctl -- u:object_r:toolbox_exec:s0
/system/bin/fsverity_init u:object_r:fsverity_init_exec:s0
add sload_f2fs permission Change-Id: Icfcf02a21dace99ab3f466de495db24a88127ad7 Signed-off-by: Jaegeuk Kim <jaegeuk@google.com>
2017-11-29 04:39:10 +01:00
/system/bin/sload_f2fs -- u:object_r:e2fs_exec:s0
make_f2fs: grant rw to vold This allows to format sdcard for adoptable storage. Bug: 69641635 Change-Id: I8d471be657e2e8f4df56c94437239510ca65096e Signed-off-by: Jaegeuk Kim <jaegeuk@google.com>
2017-11-27 19:13:33 +01:00
/system/bin/make_f2fs -- u:object_r:e2fs_exec:s0
Updated policy for external storage. An upcoming platform release is redesigning how external storage works. At a high level, vold is taking on a more active role in managing devices that dynamically appear. This change also creates further restricted domains for tools doing low-level access of external storage devices, including sgdisk and blkid. It also extends sdcardd to be launchable by vold, since launching by init will eventually go away. For compatibility, rules required to keep AOSP builds working are marked with "TODO" to eventually remove. Slightly relax system_server external storage rules to allow calls like statfs(). Still neverallow open file descriptors, since they can cause kernel to kill us. Here are the relevant violations that this CL is designed to allow: avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
/system/bin/fsck_msdos -- u:object_r:fsck_exec:s0
Add type for /system/bin/tcpdump. We add this type with the intent to expose /system/bin/tcpdump to vendor on userdebug devices only. Bug: 111243627 Test: device boots /system/bin/tcpdump correctly labeled as tcpdump_exec, can browse internet, turn wifi on/off Change-Id: Icb35e84c87120d198fbb2b44edfa5edf6021d0f0
2018-10-11 19:49:59 +02:00
/system/bin/tcpdump -- u:object_r:tcpdump_exec:s0
sepolicy: add tune2fs file context. N/A Test: builds Change-Id: I10a53c07f5b56c362cc599a901a2d74d7e96e917 Signed-off-by: liminghao <liminghao@xiaomi.com>
2016-07-22 08:18:47 +02:00
/system/bin/tune2fs -- u:object_r:fsck_exec:s0
Do not allow init to execute anything without changing domains. Remove the ability of init to execute programs from / or /system without changing domains. This forces all helper programs and services invoked by init to be assigned their own domain. Introduce separate domains for running the helper programs executed from the fs_mgr library by init. This requires a domain for e2fsck (named fsck for generality) and a domain for running mkswap (named toolbox since mkswap is just a symlink to the toolbox binary and the domain transition occurs on executing the binary, not based on the symlink in any way). e2fsck is invoked on any partitions marked with the check mount option in the fstab file, typically userdata and cache but never system. We allow it to read/write the userdata_block_device and cache_block_device types but also allow it to read/write the default block_device type until we can get the more specific types assigned in all of the device-specific policies. mkswap is invoked on any swap partition defined in the fstab file. We introduce a new swap_block_device type for this purpose, to be assigned to any such block devices in the device-specific policies, and only allow it to read/write such block devices. As there seem to be no devices in AOSP with swap partitions in their fstab files, this does not appear to risk any breakage for existing devices. With the introduction of these domains, we can de-privilege init to only having read access to block devices for mounting filesystems; it no longer needs direct write access to such devices AFAICT. To avoid breaking execution of toolbox by system services, apps, or the shell, we allow all domains other than kernel and init the ability to run toolbox in their own domain. This is broader than strictly required; we could alternatively only add it to those domains that already had x_file_perms to system_file but this would require a coordinated change with device-specific policy. Change-Id: Ib05de2d2bc2781dad48b70ba385577cb855708e4 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-23 15:11:30 +02:00
/system/bin/toolbox -- u:object_r:toolbox_exec:s0
toybox and toolbox should be considered equivalent. When toolbox completely disappears, we can worry about whether we want to rename this context. Change-Id: I359b6b2b21bb9452352e700f6ac37c137200ac77
2014-12-18 01:03:01 +01:00
/system/bin/toybox -- u:object_r:toolbox_exec:s0
bless app created renderscript files When an app uses renderscript to compile a Script instance, renderscript compiles and links the script using /system/bin/bcc and /system/bin/ld.mc, then places the resulting shared library into the application's code_cache directory. The application then dlopen()s the resulting shared library. Currently, this executable code is writable to the application. This violates the W^X property (https://en.wikipedia.org/wiki/W%5EX), which requires any executable code be immutable. This change introduces a new label "rs_data_file". Files created by /system/bin/bcc and /system/bin/ld.mc in the application's home directory assume this label. This allows us to differentiate in security policy between app created files, and files created by renderscript on behalf of the application. Apps are allowed to delete these files, but cannot create or write these files. This is enforced through a neverallow compile time assertion. Several exceptions are added to Treble neverallow assertions to support this functionality. However, because renderscript was previously invoked from an application context, this is not a Treble separation regression. This change is needed to support blocking dlopen() for non-renderscript /data/data files, which will be submitted in a followup change. Bug: 112357170 Test: cts-tradefed run cts -m CtsRenderscriptTestCases Change-Id: Ie38bbd94d26db8a418c2a049c24500a5463698a3
2018-12-12 18:06:05 +01:00
/system/bin/ld\.mc u:object_r:rs_exec:s0
Dependencies for new goldfish service domains. In order to support the new goldfish service domains in a change with the same Change-Id for the build project, we need the following changes in external/sepolicy: - /system/bin/logcat needs its own type so that it can be used as an entrypoint for the goldfish-logcat service. A neverallow rule prevents us from allowing entrypoint to any type not in exec_type. - The config. and dalvik. property namespaces need to be labeled with something other than default_prop so that the qemu-props service can set them. A neverallow rule prevents us from allowing qemu-props to set default_prop. We allow rx_file_perms to logcat_exec for any domain that was previously allowed read_logd() as many programs will read the logs by running logcat. We do not do this for all domains as it would violate a neverallow rule on the kernel domain executing any file without transitioning to another domain, and as we ultimately want to apply the same restriction to the init domain (and possibly others). Change-Id: Idce1fb5ed9680af84788ae69a5ace684c6663974 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-04 14:44:49 +02:00
/system/bin/logcat -- u:object_r:logcat_exec:s0
logcatd: introduce logcatd executable logcatd is the same as logcat, except that the -L flag, if supplied, runs once, then the command re-runs itself without the -L flag with the same argument set. By introducing a logcatd daemon executable we can solve the problem of the longish reads from pstore that sometimes occur when the system is excessively busy spinning in a foreground task starving this daemon as we absorb the delay in an init service, rather than in an init exec. This would not have been efficiently possible without the introduction of liblogcat. Test: gTest logcat-unit-tests Test: Manual check logpersist operations Bug: 28788401 Bug: 30041146 Bug: 30612424 Bug: 35326290 Change-Id: I3454bad666c66663f59ae03bcd72e0fe8426bb0a
2017-04-03 21:38:30 +02:00
/system/bin/logcatd -- u:object_r:logcat_exec:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/system/bin/sh -- u:object_r:shell_exec:s0
Add policy for run-as program. Add policy for run-as program and label it in file_contexts. Drop MLS constraints on local socket checks other than create/relabel as this interferes with connections with services, in particular for adb forward. Change-Id: Ib0c4abeb7cbef559e150a620c45a7c31e0531114 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-11-13 19:00:05 +01:00
/system/bin/run-as -- u:object_r:runas_exec:s0
Define a domain for the bootanim service. Leave the domain permissive initially until it gets more testing. Change-Id: I9d88d76d1ffdc79a2eff4545d37a9e615482df50 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-11 21:17:53 +01:00
/system/bin/bootanimation u:object_r:bootanim_exec:s0
bootstat: Fix the SELinux policy after removing domain_deprecated. * Allow reading /proc. type=1400 audit(1453834004.239:7): avc: denied { read } for pid=1305 comm="bootstat" name="uptime" dev="proc" ino=4026536600 scontext=u:r:bootstat:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=0 * Define domain for the /system/bin/bootstat file. init: Service exec 4 (/system/bin/bootstat) does not have a SELinux domain defined. Bug: 21724738 Change-Id: I4baa2fa7466ac35a1ced79776943c07635ec9804
2016-01-26 01:23:10 +01:00
/system/bin/bootstat u:object_r:bootstat_exec:s0
app_process is now a symlink. app_process is now a symlink to app_process32 or app_process64, so we have to update the selinux rules to explicitly refer to them. See change 5a7ee9ad63d for context. Change-Id: I7f7a107d79a8f7a3c193f97809e1e737540258f1
2014-05-14 18:13:24 +02:00
/system/bin/app_process32 u:object_r:zygote_exec:s0
label app_process64 as zygote_exec ... otherwise zygote 64 won't run in the correct SELinux domain. Bug: 13647418 Change-Id: Iada2bf26623784535b70647c472f69b735b8f4fc
2014-04-04 18:45:57 +02:00
/system/bin/app_process64 u:object_r:zygote_exec:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/system/bin/servicemanager u:object_r:servicemanager_exec:s0
Initial hardware servicemanager sepolicy. Change-Id: I07d188e4dd8801a539db1e9f3edf82a1d662648e (cherry picked from commit 61a082a55dbc2798d50d0d4b766151d69334729a)
2016-05-24 15:15:23 +02:00
/system/bin/hwservicemanager u:object_r:hwservicemanager_exec:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/system/bin/surfaceflinger u:object_r:surfaceflinger_exec:s0
[SEPolicy] Configure policy for gpu service. Historically GPU service lives in SurfaceFlinger as a convenient hack. Howerver, SurfaceFlinger doesn't need to know about anything specific about GPU capability, and shouldn't know about anything about GPU. This patch moves GPU service out of SurfaceFlinger. GPU service is a service that accesses to GPU driver, queries GPU capabilities and reports back. Currently we use this information in CTS and some benchmarks. BUG: 118347356 Test: Build, flash and boot, use `adb shell cmd gpu vkjson` to verify Change-Id: I007989e0f3f73b5caf80277979986820dd127c32
2018-11-01 21:47:51 +01:00
/system/bin/gpuservice u:object_r:gpuservice_exec:s0
Add policies for new services. Bug: 30989383 Bug: 34731101 Test: manual Change-Id: Icf9d48568b505c6b788f2f5f456f2d709969fbeb
2017-02-10 00:15:11 +01:00
/system/bin/bufferhubd u:object_r:bufferhubd_exec:s0
/system/bin/performanced u:object_r:performanced_exec:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/system/bin/drmserver u:object_r:drmserver_exec:s0
initial dumpstate domain Add the necessary rules to support dumpstate. Start off initially in permissive until it has more testing. Dumpstate is triggered by running "adb bugreport" Change-Id: Ic17a60cca1f6f40daa4f2c51e9ad6009ef36cfbd
2013-12-14 07:19:45 +01:00
/system/bin/dumpstate u:object_r:dumpstate_exec:s0
Add incident command and incidentd daemon se policy. Test: adb shell incident Bug: 31122534 Change-Id: I4ac9c9ab86867f09b63550707673149fe60f1906
2016-11-21 08:23:04 +01:00
/system/bin/incident u:object_r:incident_exec:s0
/system/bin/incidentd u:object_r:incidentd_exec:s0
Selinux permissions for incidentd project Bug: 64222712 Test: manual Change-Id: Ica77ae3c9e535eddac9fccf11710b0bcb3254ab3
2018-01-22 23:00:46 +01:00
/system/bin/incident_helper u:object_r:incident_helper_exec:s0
Allow iw to be run at init phase. This enables native wireless interface configuration at boot. Bug: 36120314 Test: adb shell ifconfig -a | grep wlan Change-Id: I797c0c8a8645d690d311f42cec3998b2f4cee77b
2018-11-09 22:09:24 +01:00
/system/bin/iw u:object_r:iw_exec:s0
add netutils_wrappers Bug: 36463595 Test: Boot sailfish, make wifi call, internet over data and wifi Change-Id: I81259b6412d7197725afe2fe4976aa0a03b8df6e Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-15 04:06:56 +02:00
/system/bin/netutils-wrapper-1\.0 u:object_r:netutils_wrapper_exec:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/system/bin/vold u:object_r:vold_exec:s0
/system/bin/netd u:object_r:netd_exec:s0
Sepolicy files for wificond This sepolicy change allows wificond to run as a deamon. BUG=28865186 TEST=compile TEST=compile with ag/1059605 Add wificond to '/target/product/base.mk' Adb shell ps -A | grep 'wificond' Change-Id: If1e4a8542ac03e8ae42371d75aa46b90c3d8545d (cherry picked from commit 4ef44a616ee5888023e5c53bbc2c4df6549f748a)
2016-05-20 04:31:20 +02:00
/system/bin/wificond u:object_r:wificond_exec:s0
Add rules for running audio services in audioserver audioserver has the same rules as mediaserver so there is no loss of rights or permissions. media.log moves to audioserver. TBD: Pare down permissions. Bug: 24511453 Change-Id: I0fff24c14b712bb3d498f75e8fd66c2eb795171d
2015-09-09 19:48:04 +02:00
/system/bin/audioserver u:object_r:audioserver_exec:s0
Add mediadrm service Part of media security hardening This is an intermediate step toward moving mediadrm to a new service separate from mediaserver. This first step allows mediadrmservice to run based on the system property media.mediadrmservice.enable so it can be selectively enabled on devices that support using native_handles for secure buffers. bug: 22990512 Change-Id: I2208c1e87a6bd8d5bfaed06b1fdcb0509c11cff2
2016-02-12 18:05:42 +01:00
/system/bin/mediadrmserver u:object_r:mediadrmserver_exec:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/system/bin/mediaserver u:object_r:mediaserver_exec:s0
rename mediaanalytics->mediametrics, wider access reflect the change from "mediaanalytics" to "mediametrics" Also incorporates a broader access to the service -- e.g. anyone. This reflects that a number of metrics submissions come from application space and not only from our controlled, trusted media related processes. The metrics service (in another commit) checks on the source of any incoming metrics data and limits what is allowed from unprivileged clients. Bug: 34615027 Test: clean build, service running and accessible Change-Id: I657c343ea1faed536c3ee1940f1e7a178e813a42
2017-01-24 21:53:45 +01:00
/system/bin/mediametrics u:object_r:mediametrics_exec:s0
selinux: Update policies for cameraserver Update policies for cameraserver so it has the same permissions as mediaserver. Bug: 24511454 Change-Id: I1191e2ac36c00b942282f8dc3db9903551945adb
2015-12-04 01:10:05 +01:00
/system/bin/cameraserver u:object_r:cameraserver_exec:s0
Update selinux policies for mediaextractor process Change-Id: If761e0370bf9731a2856d0de2c6a6af1671143bd
2015-09-22 19:56:03 +02:00
/system/bin/mediaextractor u:object_r:mediaextractor_exec:s0
add mediaswcodec service Set up a new service for sw media codec services. Bug: 111407413 Test: cts-tradefed run cts-dev --module CtsMediaTestCases --compatibility:module-arg CtsMediaTestCases:include-annotation:android.platform.test.annotations.RequiresDevice Change-Id: Ia1c6a9ef3f0c1d84b2be8756eb1853ffa0597f8e
2018-09-20 21:07:44 +02:00
/system/bin/mediaswcodec u:object_r:mediaswcodec_exec:s0
MediaTranscodingService: Add sepolicy for MediaTranscodingService. Bug:145233472 Test: Build and flash the phone. "adb shell dumpsys -l | grep media" shows media.transcoding service. Change-Id: I48a42e7b595754989c92a8469eb91360ab6db7c6
2019-11-28 03:10:01 +01:00
/system/bin/mediatranscoding u:object_r:mediatranscoding_exec:s0
Add a domain for mdnsd and allow connecting to it. Change-Id: I0a06fa32a46e515671b4e9a6f68e1a3f8b2c21a8 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 19:04:49 +01:00
/system/bin/mdnsd u:object_r:mdnsd_exec:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/system/bin/installd u:object_r:installd_exec:s0
Selinux: Policies for otapreopt_chroot and postinstall_dexopt Give mount & chroot permissions to otapreopt_chroot related to postinstall. Add postinstall_dexopt for otapreopt in the B partition. Allow the things installd can do for dexopt. Give a few more rights to dex2oat for postinstall files. Allow postinstall files to call the system server. Bug: 25612095 Change-Id: If7407473d50c9414668ff6ef869c2aadd14264e7
2016-03-30 00:08:20 +02:00
/system/bin/otapreopt_chroot u:object_r:otapreopt_chroot_exec:s0
Sepolicy: Add otapreopt_slot (cherry picked from commit eb717421b1cf5993dd4ffbd15c01922b69a205a6) The new A/B OTA artifact naming scheme includes the target slot so that the system is robust with respect to unexpected reboots. This complicates the renaming code after reboot, so it is moved from the zygote into a simple script (otapreopt_slot) that is hooked into the startup sequence in init. Give the script the subset of the rights that the zygote had so that it can move the artifacts from /data/ota into /data/dalvik-cache. Relabeling will be done in the init rc component, so relabeling rights can be completely removed. Bug: 25612095 Bug: 28069686 Change-Id: Iad56dc3d78ac759f4f2cce65633cdaf1cab7631b
2016-07-09 20:57:13 +02:00
/system/bin/otapreopt_slot u:object_r:otapreopt_slot_exec:s0
Sepolicy: ART APEX boot integrity Add ART boot integrity check domain. Give it rights to run fsverity and delete boot classpath artifacts. Bug 125474642 Test: m Test: boot Change-Id: I933add9b1895ed85c43ec712ced6ffe8f820c7ec
2019-03-04 23:10:02 +01:00
/system/bin/art_apex_boot_integrity u:object_r:art_apex_boot_integrity_exec:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/system/bin/keystore u:object_r:keystore_exec:s0
Add selinux policy for fingerprintd Change-Id: Ibcb714248c28abf21272986facaade376dcbd7ef
2015-05-13 00:16:06 +02:00
/system/bin/fingerprintd u:object_r:fingerprintd_exec:s0
SELinux permissions for gatekeeper TEE proxy sets up: - execute permissions - binder permission (system_server->gatekeeper->keystore) - prevents dumpstate and shell from finding GK binder service - neverallow rules for prohibited clients Change-Id: I1817933a91de625db469a20c7a4c8e2ca46efa1e
2015-04-04 01:46:33 +02:00
/system/bin/gatekeeperd u:object_r:gatekeeperd_exec:s0
Introduce crash_dump debugging helper. Replace the global debuggerd with a per-process debugging helper that gets exec'ed by the process that crashed. Bug: http://b/30705528 Test: crasher/crasher64, `debuggerd <pid>`, `kill -ABRT <pid>` Change-Id: Iad1b7478f7a4e2690720db4b066417d8b66834ed
2016-10-19 23:39:30 +02:00
/system/bin/crash_dump32 u:object_r:crash_dump_exec:s0
/system/bin/crash_dump64 u:object_r:crash_dump_exec:s0
/system/bin/tombstoned u:object_r:tombstoned_exec:s0
Add recovery_persist & recovery_refresh One time executables. recovery_refresh can be used at any time to ensure recovery logs in pmsg are re-placed at the end of the FIFO. recovery_persist takes the recovery logs in pmsg and drops them into /data/misc/recovery/ directory. Bug: 27176738 Change-Id: Ife3cf323930fb7a6a5d1704667961f9d42bfc5ac
2016-03-16 16:11:49 +01:00
/system/bin/recovery-persist u:object_r:recovery_persist_exec:s0
/system/bin/recovery-refresh u:object_r:recovery_refresh_exec:s0
sdcard policy and fuse device label.
2012-05-31 15:44:51 +02:00
/system/bin/sdcard u:object_r:sdcardd_exec:s0
Add rules for snapshotctl snapshotctl is a shell interface for libsnapshot. After rebooting into an updated build, on sys.boot_completed, init calls snapshotctl to merge snapshots. In order to do that, it needs to: - Talk to gsid to mount and unmount COW images - read the current slot suffix to do checks (and avoid merging snapshots when it shouldn't). - read / write OTA metadata files to understand states of the snapshot - delete OTA metadata files once a snapshot is merged - collapse the snapshot device-mapper targets into a plain dm-linear target by re-mapping devices on device-mapper Test: reboot after OTA, see merge completed without denials Bug: 135752105 Change-Id: Idfe99d4004e24805d56cd0ab2479557f237c2448
2019-09-21 00:14:23 +02:00
/system/bin/snapshotctl u:object_r:snapshotctl_exec:s0
dhcp policy.
2012-08-15 12:25:14 +02:00
/system/bin/dhcpcd u:object_r:dhcp_exec:s0
Properly escape dots in file_contexts filenames I found these with the regex (?<!\\)\.(?!\*|\+) Test: make Change-Id: I1c2e817d164b1074cb359cdb6d46bcf71e220765
2018-10-24 15:50:22 +02:00
/system/bin/dhcpcd-6\.8\.2 u:object_r:dhcp_exec:s0
Add ppp/mtp policy. Initial policy for Point-to-Point tunneling and tunneling manager services.
2012-08-20 12:13:28 +02:00
/system/bin/mtpd u:object_r:mtp_exec:s0
/system/bin/pppd u:object_r:ppp_exec:s0
racoon policy. Initial policy for racoon (IKE key management). Signed-off-by: Robert Craig <rpcraig@tycho.ncsc.mil> Change-Id: If1e344f39ea914e42afbaa021b272ba1b7113479
2013-01-07 15:21:18 +01:00
/system/bin/racoon u:object_r:racoon_exec:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/system/xbin/su u:object_r:su_exec:s0
Enable SELinux protections for netd. This change does several things: 1) Restore domain.te to the version present at cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version currently being distributed in AOSP. 2) Add "allow domain properties_device:file r_file_perms;" to domain.te, to allow all domains to read /dev/__properties__ . This change was missing from AOSP. 3) Restore netd.te to the version present at 80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version currently being distributed in AOSP. 4) Remove anything involving module loading from netd.te. CTS enforces that Android kernels can't have module loading enabled. 5) Add several new capabilities, plus data file rules, to netd.te, since netd needs to write to files owned by wifi. 6) Add a new unconfined domain called dnsmasq.te, and allow transitions from netd to that domain. Over time, we'll tighten up the dnsmasq.te domain. 7) Add a new unconfined domain called hostapd.te, and allow transitions from netd to that domain. Over time, we'll tighten up the hostapd.te domain. The net effect of these changes is to re-enable SELinux protections for netd. The policy is FAR from perfect, and allows a lot of wiggle room, but we can improve it over time. Testing: as much as possible, I've exercised networking related functionality, including turning on and off wifi, entering airplane mode, and enabling tethering and portable wifi hotspots. It's quite possible I've missed something, and if we experience problems, I can roll back this change. Bug: 9618347 Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
/system/bin/dnsmasq u:object_r:dnsmasq_exec:s0
healthd: create SEPolicy for 'charger' and reduce healthd's scope healthd is being split into 'charger' and 'healthd' processes, that will never run together. 'charger' is to be run only in charge-only and recovery, while healthd runs with Android. While they both share much of battery monitoring code, they both now have reduced scope. E.g. 'charger', doesn't need to use binder anymore and healthd doesn't need to do charging ui animation. So, amend the SEPolicy for healthd to reduce it's scope and add a new one for charger. Test: Tested all modes {recovery, charger-only, android} with new policy Change-Id: If7f81875c605f7f07da4d23a313f308b9dde9ce8 Signed-off-by: Sandeep Patil <sspatil@google.com> (cherry picked from commit c73d0022ade4855ab72849e1fe97856c737fdcef)
2016-11-01 21:49:10 +01:00
/system/bin/healthd u:object_r:healthd_exec:s0
Fix clatd, broken by selinux policing /dev/tun Bug: 10175701 Change-Id: I185df22bdbaafd56725760ec6c71340b67455046
2013-08-05 08:32:56 +02:00
/system/bin/clatd u:object_r:clatd_exec:s0
Label /system/bin/linker* symlinks as system_file. Fixes: avc: denied { read } for comm="init" name="linker_asan64" dev="sda22" ino=1833 scontext=u:r:init:s0 tcontext=u:object_r:system_linker_exec:s0 tclass=lnk_file permissive=0 Bug: 116486312 Test: adb unroot && adb shell ls -l /system/bin/linker_asan Change-Id: I754daaf3576e83d516cc9189b8be04dcc41bbc5c
2018-09-25 01:12:23 +02:00
/system/bin/linker(64)? u:object_r:system_linker_exec:s0
Add linker config generator and output file to sepolicy Sepolicy for linkerconfig generator and ld.config.txt file from generator Bug: 135004088 Test: m -j & tested from device Change-Id: I2ea7653a33996dde67a84a2e7a0efa660886434a
2019-07-08 12:02:05 +02:00
/system/bin/linkerconfig u:object_r:linkerconfig_exec:s0
Label the bootstrap linker and bionic mount points Bootstap linker has been moved from /system/bin/linker[64] to /system/bin/bootstrap/linker[64]. Reflect the change in file_contexts. Existing paths are not removed since the bootstrap linker (or the linker from the rumtime APEX) will be bind-mounted to the old path by init. Also label the files under /bionic which serve as mount points for either of the bootstrap bionic or the bionic from the runtime APEX. In addition, read access for the symlinks in /system/lib/*.so and /system/bin/linker is granted. This is because Bionic files in the paths are now symlinks to the corresponding mountpoints at /bionic. Bug: 120266448 Test: device boots to the UI Change-Id: Iea4d76eb46754b435b6c5428481cd177da8d2ee1
2019-01-16 15:35:34 +01:00
/system/bin/bootstrap/linker(64)? u:object_r:system_linker_exec:s0
llkd: add live-lock daemon Introduce a standalone live-lock daemon (llkd), to catch kernel or native user space deadlocks and take mitigating actions. Test: llkd_unit_test Bug: 33808187 Bug: 72838192 Change-Id: If869ecd06e5ce7b04bba1dafd0a77971b71aa517
2018-02-20 20:02:39 +01:00
/system/bin/llkd u:object_r:llkd_exec:s0
Move lmkd into it's own domain. lmkd low memory killer daemon The kernel low memory killer logic has been moved to a new daemon called lmkd. ActivityManager communicates with this daemon over a named socket. This is just a placeholder policy, starting off in unconfined_domain. Change-Id: Ia3f9a18432c2ae37d4f5526850e11432fd633e10
2013-12-06 01:55:34 +01:00
/system/bin/lmkd u:object_r:lmkd_exec:s0
usbd sepolicy Sepolicy for the usb daemon. (ag/3373886/) Bug: 63669128 Test: Checked for avc denial messages. Change-Id: I6e2a4ccf597750c47e1ea90c4d43581de4afa4af
2017-12-03 23:23:16 +01:00
/system/bin/usbd u:object_r:usbd_exec:s0
initial inputflinger domain Add a placeholder domain for inputflinger. Mark it initially unconfined and enforcing. Change-Id: I433fd9e1954486136cb8abb084b4e19bb7fc2f19
2013-12-15 21:50:00 +01:00
/system/bin/inputflinger u:object_r:inputflinger_exec:s0
sepolicy: Add write_logd, read_logd & control_logd - Add write_logd, read_logd and control_logd macros added along with contexts for user space logd. - Specify above on domain wide, or service-by-service basis - Add logd rules. - deprecate access_logcat as unused. - 'allow <domain> zygote:unix_dgram_socket write;' rule added to deal with fd inheritance. ToDo: investigate means to allow references to close, and reopen in context of application or call setsockcreatecon() to label them in child context. Change-Id: I35dbb9d5122c5ed9b8c8f128abf24a871d6b26d8
2013-11-13 00:34:52 +01:00
/system/bin/logd u:object_r:logd_exec:s0
Add rules for lpdump and lpdumpd - lpdump is a binary on the device that talks to lpdumpd via binder. - lpdumpd is a daemon on the device that actually reads dynamic partition metadata. Only lpdump can talk to it. Bug: 126233777 Test: boots (sanity) Test: lpdump Change-Id: I0e21f35ac136bcbb0603940364e8117f2d6ac438
2019-03-14 23:45:03 +01:00
/system/bin/lpdumpd u:object_r:lpdumpd_exec:s0
SELinux policy for rss_hwm_reset rss_hwm_reset is binary that reset RSS high-water mark counters for all currently running processes. It runs in a separate process because it needs dac_override capability. Bug: 119603799 Test: no errors in logcat Change-Id: I6221a5eca3427bf532830575d8fba98eb3e65c29
2018-11-15 14:04:13 +01:00
/system/bin/rss_hwm_reset u:object_r:rss_hwm_reset_exec:s0
SELinux policies for Perfetto cmdline client (/system/bin/perfetto) Instead of having statsd linking the perfetto client library and talk directly to its socket, we let just statsd exec() the /system/bin/perfetto cmdline client. There are two reasons for this: 1) Simplify the interaction between statsd and perfetto, reduce dependencies, binary size bloat and isolate faults. 2) The cmdline client also takes care of handing the trace to Dropbox. This allows to expose the binder interaction surface to the short-lived cmdline client and avoid to grant binder access to the perfetto traced daemon. This cmdline client will be used by: - statsd - the shell user (for our UI and Studio) Bug: 70942310 Change-Id: I8cdde181481ad0a1a5cae5937ac446cedac54a1f
2018-01-24 17:07:09 +01:00
/system/bin/perfetto u:object_r:perfetto_exec:s0
Perfetto SELinux policies Perfetto is a performance instrumentation and logging framework, living in AOSP's /external/pefetto. Perfetto introduces in the system one binary and two daemons (the binary can specialize in either depending on the cmdline). 1) traced: unprivileged daemon. This is architecturally similar to logd. It exposes two UNIX sockets: - /dev/socket/traced_producer : world-accessible, allows to stream tracing data. A tmpfs file descriptor is sent via SCM_RIGHTS from traced to each client process, which needs to be able to mmap it R/W (but not X) - /dev/socket/traced_consumer : privilege-accessible (only from: shell, statsd). It allows to configure tracing and read the trace buffer. 2) traced_probes: privileged daemon. This needs to: - access tracingfs (/d/tracing) to turn tracing on and off. - exec atrace - connect to traced_producer to stream data to traced. init.rc file: https://android-review.googlesource.com/c/platform/external/perfetto/+/575382/14/perfetto.rc Bug: 70942310 Change-Id: Ia3b5fdacbd5a8e6e23b82f1d6fabfa07e4abc405
2017-12-21 03:51:15 +01:00
/system/bin/traced u:object_r:traced_exec:s0
/system/bin/traced_probes u:object_r:traced_probes_exec:s0
Add heapprofd selinux config. This does not actually grant any permissions but just adds the necessary boilerplate for a new service. Bug: 117762471 Bug: 117761873 Change-Id: I7cdd2ae368616cfd54fc685c15f775604bfc80d4
2018-10-15 19:02:02 +02:00
/system/bin/heapprofd u:object_r:heapprofd_exec:s0
initial policy for uncrypt. Add initial support for uncrypt, started via the pre-recovery service in init.rc. On an encrypted device, uncrypt reads an OTA zip file on /data, opens the underlying block device, and writes the unencrypted blocks on top of the encrypted blocks. This allows recovery, which can't normally read encrypted partitions, to reconstruct the OTA image and apply the update as normal. Add an exception to the neverallow rule for sys_rawio. This is needed to support writing to the raw block device. Add an exception to the neverallow rule for unlabeled block devices. The underlying block device for /data varies between devices within the same family (for example, "flo" vs "deb"), and the existing per-device file_context labeling isn't sufficient to cover these differences. Until I can resolve this problem, allow access to any block devices. Bug: 13083922 Change-Id: I7cd4c3493c151e682866fe4645c488b464322379
2014-02-19 22:33:32 +01:00
/system/bin/uncrypt u:object_r:uncrypt_exec:s0
Allow update_verifier to access bootctrl_block_device. Bug: 26039641 Change-Id: Ifd96b105f054b67f881529db3fe94718cab4a0f4 (cherry picked from commit 8eaf25856eab787d5226441b6f3032fdfef9cbb9)
2015-12-05 02:48:50 +01:00
/system/bin/update_verifier u:object_r:update_verifier_exec:s0
Force logwrapper to system_file Some device-specific policies are improperly creating a security domain for logwrapper, rather than removing the logwrapper lines from init.device.rc. Don't allow that. Explicitly add an entry for /system/bin/logwrapper to force it to a system_file. Attempting to override this will result in the following compile time error: obj/ETC/file_contexts_intermediates/file_contexts: Multiple different specifications for /system/bin/logwrapper (u:object_r:logwrapper_exec:s0 and u:object_r:system_file:s0). Bug: 15616899 Change-Id: Ia55394247a9fa16e00434d61091fff9d9d4ff125
2014-06-17 17:49:17 +02:00
/system/bin/logwrapper u:object_r:system_file:s0
Create vdc domain The init.rc one-shot services "defaultcrypto" and "encrypt" call out to the /system/bin/vdc command line to ask vold to perform encryption operations. Create a new domain for these one-shot services. Allow the vdc domain to talk to vold. Change-Id: I73dc2ee4cc265bc16056b27307c254254940fd9f
2014-06-21 03:11:11 +02:00
/system/bin/vdc u:object_r:vdc_exec:s0
Properly escape dots in file_contexts filenames I found these with the regex (?<!\\)\.(?!\*|\+) Test: make Change-Id: I1c2e817d164b1074cb359cdb6d46bcf71e220765
2018-10-24 15:50:22 +02:00
/system/bin/cppreopts\.sh u:object_r:cppreopts_exec:s0
/system/bin/preloads_copy\.sh u:object_r:preloads_copy_exec:s0
Allow cppreopts to work with selinux (cherry picked from commit d3edd6b577c1e40834af69420bd77b60c359ef8e) Bug: 29278988 Change-Id: I199572377a6b5c33116c718a545159ddcf50df30
2016-06-23 00:47:09 +02:00
/system/bin/preopt2cachename u:object_r:preopt2cachename_exec:s0
Sepolicy: allow dex2oatd and patchoatd Give debug versions the same rights as non-debug versions for ART. Change-Id: I9906d100c3857c3a87344ff37aabc53107562c61
2016-08-26 04:36:49 +02:00
/system/bin/dex2oat(d)? u:object_r:dex2oat_exec:s0
Sepolicy: Support profmand and dexoptanalyzerd To support libartd test runs. Bug: 15735795 Bug: 62087184 Test: m Test: manual tests with libartd Change-Id: I33a12198566f5d979207e1edd4460b839a0f55f1
2017-07-25 04:35:35 +02:00
/system/bin/dexoptanalyzer(d)? u:object_r:dexoptanalyzer_exec:s0
[layout compilation] Modify sepolicy to allow installd to run viewcompiler We will generate precompiled layouts as part of the package install or upgrade process. This means installd needs to be able to invoke viewcompiler. This change gives installd and viewcompiler the minimal set of permissions needed for this to work. Bug: 111895153 Test: manual Change-Id: Ic1fe60bd264c497b5f79d9e1d77c2da4e092377b
2019-01-11 17:13:01 +01:00
/system/bin/viewcompiler u:object_r:viewcompiler_exec:s0
Sepolicy: Support profmand and dexoptanalyzerd To support libartd test runs. Bug: 15735795 Bug: 62087184 Test: m Test: manual tests with libartd Change-Id: I33a12198566f5d979207e1edd4460b839a0f55f1
2017-07-25 04:35:35 +02:00
/system/bin/profman(d)? u:object_r:profman_exec:s0
iorapd: Add new binder service iorapd. This daemon is very locked down. Only system_server can access it. Bug: 72170747 Change-Id: I7b72b9191cb192be96001d84d067c28292c9688f
2018-10-05 23:48:29 +02:00
/system/bin/iorapd u:object_r:iorapd_exec:s0
sepolicy: Add iorap_prefetcherd rules /system/bin/iorapd fork+execs into /system/bin/iorap_prefetcherd during startup See also go/android-iorap-security for the design doc Bug: 137403231 Change-Id: Ie8949c7927a98e0ab757bc46230c589b5a496360
2019-09-19 20:04:20 +02:00
/system/bin/iorap\.prefetcherd u:object_r:iorap_prefetcherd_exec:s0
Updated policy for external storage. An upcoming platform release is redesigning how external storage works. At a high level, vold is taking on a more active role in managing devices that dynamically appear. This change also creates further restricted domains for tools doing low-level access of external storage devices, including sgdisk and blkid. It also extends sdcardd to be launchable by vold, since launching by init will eventually go away. For compatibility, rules required to keep AOSP builds working are marked with "TODO" to eventually remove. Slightly relax system_server external storage rules to allow calls like statfs(). Still neverallow open file descriptors, since they can cause kernel to kill us. Here are the relevant violations that this CL is designed to allow: avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
/system/bin/sgdisk u:object_r:sgdisk_exec:s0
/system/bin/blkid u:object_r:blkid_exec:s0
Add rules for /system/bin/tzdatacheck Bug: 19941636 Change-Id: I7cc61e058424c856da88f11ff9b259f34cb39dc7
2015-04-07 14:35:21 +02:00
/system/bin/tzdatacheck u:object_r:tzdatacheck_exec:s0
sepolicy for server configurable flags Test: manual on device Change-Id: Ibafe1b345489c88a49a7ed3e2e61e5cc5e1880a1
2018-10-26 05:09:55 +02:00
/system/bin/flags_health_check -- u:object_r:flags_health_check_exec:s0
Run idmap in its own domain. Run idmap in its own domain rather than leaving it in installd's domain. This prevents misuse of installd's permissions by idmap. zygote also needs to run idmap. For now, just run it in zygote's domain as it was previously since that is what is done for dex2oat invocation by zygote. zygote appears to run idmap with system uid while installd runs it with app UIDs, so using different domains seems appropriate. Remove system_file execute_no_trans from both installd and zygote; this should no longer be needed with explicit labels for dex2oat and idmap. Change-Id: If47e2c1326b84c20e94a20f5e699300dce12bdfe Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-06-19 19:47:26 +02:00
/system/bin/idmap u:object_r:idmap_exec:s0
Add idmap2 and idmap2d Bug: 78815803 Test: builds, boots Test: manual: adb shell idmap2 create ... Test: manual: adb shell ps | grep -e idmap2d Change-Id: I60852e15d99329896ff9de6559d1e7cd1c67e33d
2018-06-15 08:08:19 +02:00
/system/bin/idmap2(d)? u:object_r:idmap_exec:s0
Move update_engine policy to AOSP. The update_engine daemon from Brillo is expected to be used also in Android so move its selinux policy to AOSP. Put update_engine in the whitelist (currently only has the recovery there) allowing it to bypass the notallow for writing to partititions labeled as system_block_device. Also introduce the misc_block_device dev_type as update_engine in some configurations may need to read/write the misc partition. Start migrating uncrypt to use this instead of overly broad block_device:blk_file access. Bug: 23186405 Test: Manually tested with Brillo build. Change-Id: Icf8cdb4133d4bbdf14bacc6c0fa7418810ac307a
2015-10-05 23:04:39 +02:00
/system/bin/update_engine u:object_r:update_engine_exec:s0
Storaged permission setting Allowing storaged for reading from pseudo filesystems and debugfs. Bug: 32221677 Change-Id: I837cead9a68f0b399703b64d724cb9c4b205c335
2016-06-18 00:05:10 +02:00
/system/bin/storaged u:object_r:storaged_exec:s0
lowpan: Add wpantund to SEPolicy Bug: b/64399219 Test: Manual Change-Id: I4f6c7e4e3339ae95e43299bf364edff40d07c796 (cherry picked from commit c8bd93d7e86647ad6880d460f8aa9d24088fad58)
2017-08-04 23:51:36 +02:00
/system/bin/wpantund u:object_r:wpantund_exec:s0
Add policies for new services. Bug: 30989383 Bug: 34731101 Test: manual Change-Id: Icf9d48568b505c6b788f2f5f456f2d709969fbeb
2017-02-10 00:15:11 +01:00
/system/bin/virtual_touchpad u:object_r:virtual_touchpad_exec:s0
Sepolicy for bufferhub hwservice Bug: 118124442 Test: device can boot with android.frameworks.bufferhub@1.0-service running Change-Id: I1d186d5350671b0d2dd4e831429b8fba828316e0
2018-10-21 03:33:41 +02:00
/system/bin/hw/android\.frameworks\.bufferhub@1\.0-service u:object_r:fwk_bufferhub_exec:s0
Switch Allocator HAL policy to _client/_server This switches Allocator HAL policy to the design which enables us to identify all SELinux domains which host HALs and all domains which are clients of HALs. Allocator HAL is special in the sense that it's assumed to be always binderized. As a result, rules in Camera HAL target hal_allocator_server rather than hal_allocator (which would be the server and any client, if the Allocator HAL runs in passthrough mode). Test: Device boots up, no new denials Test: YouTube video plays back Test: Take photo using Google Camera app, recover a video, record a slow motion video Bug: 34170079 Change-Id: Ifbbca554ec221712361ee6cda94c82f254d84936
2017-03-18 00:51:56 +01:00
/system/bin/hw/android\.hidl\.allocator@1\.0-service u:object_r:hal_allocator_default_exec:s0
Decouple system_suspend from hal attributes. System suspend service is not a HAL, so avoid using HAL-specific macros and attributes. Use system_suspend_server attribute for ISystemSuspend.hal permissions. Use system_suspend type directly for internal .aidl interface permissions. Bug: 126259100 Test: m selinux_policy Test: blueline boots; wakelocks can still be acquired; device suspends if left alone. Change-Id: Ie811e7da46023705c93ff4d76d15709a56706714
2019-02-27 01:45:40 +01:00
/system/bin/hw/android\.system\.suspend@1\.0-service u:object_r:system_suspend_exec:s0
sepolicy changes to configure cgroup.rc and task_profiles.json access cgroups.json file contains cgroup information required to mount cgroup controllers and is readable only by init process. cgroup.rc contains cgroup map information consisting of the list of cgroups available in the system and their mounting locations. It is created by init process and should be readable by any processes that uses cgroups and should be writable only by init process. task_profiles.json file contains task profiles used to operate on cgroups. This information should be readable by any process that uses cgroups and should be writable only by init process. Bug: 111307099 Test: builds, boots Change-Id: Ib2c87c0fc3663c7fc69628f05c846519b65948b5 Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2019-01-11 02:10:31 +01:00
/system/etc/cgroups\.json u:object_r:cgroup_desc_file:s0
system/etc/event-log-tags available to all This was a regression in Q, and the file is an implementation of liblog. Bug: 113083310 Test: use tags from vendor and see no denials Change-Id: I726cc1fcfad39afc197b21e431a687a3e4c8ee4a
2019-01-10 22:59:37 +01:00
/system/etc/event-log-tags u:object_r:system_event_log_tags_file:s0
Allow domain access r_file_perms for passwd and group files In b/73062966, we add new AID ranges for each partition that doesn't yet have them (system, system_ext, odm, product). We also add group and passwd files to these partitions to be able to map these AIDs into human readable user and group names, and vice versa. All processes should be able to read all users and groups. We divide the ranges into non-overlapping regions for each partition and we namespace the names with the partition name as a prefix. Allow domain r_file_perms to /(system|product|system_ext)/etc/(group|passwd). Vendor and odm passwd and group files already have this access, since /(vendor|odm)/etc/* is already domain readable. Example contents: blueline:/ $ cat /system/etc/passwd system_tom::6050:6050::/:/bin/sh blueline:/ $ cat /product/etc/passwd product_tom::7013:7013::/:/bin/sh Bug: 73062966 Test: tree-hugger selinux denial during boot test Change-Id: Ib4dc31778e95e952174e1365497feaf93dca7156
2019-07-15 22:33:48 +02:00
/system/etc/group u:object_r:system_group_file:s0
More granular vendor access to /system files. This change limits global access to /system files down to: /system/bin/linker* /system/lib[64]/* /system/etc/ld.config* /system/etc/seccomp_policy/* /system/etc/security/cacerts/* /system/usr/share/zoneinfo/* Bug: 111243627 Test: boot device, browse internet without denials to system_* types. Test: VtsHalDrmV1_{1, 0}TargetTest without denials Change-Id: I69894b29733979c2bc944ac80229e84de5d519f4
2018-08-12 00:34:49 +02:00
/system/etc/ld\.config.* u:object_r:system_linker_config_file:s0
Allow domain access r_file_perms for passwd and group files In b/73062966, we add new AID ranges for each partition that doesn't yet have them (system, system_ext, odm, product). We also add group and passwd files to these partitions to be able to map these AIDs into human readable user and group names, and vice versa. All processes should be able to read all users and groups. We divide the ranges into non-overlapping regions for each partition and we namespace the names with the partition name as a prefix. Allow domain r_file_perms to /(system|product|system_ext)/etc/(group|passwd). Vendor and odm passwd and group files already have this access, since /(vendor|odm)/etc/* is already domain readable. Example contents: blueline:/ $ cat /system/etc/passwd system_tom::6050:6050::/:/bin/sh blueline:/ $ cat /product/etc/passwd product_tom::7013:7013::/:/bin/sh Bug: 73062966 Test: tree-hugger selinux denial during boot test Change-Id: Ib4dc31778e95e952174e1365497feaf93dca7156
2019-07-15 22:33:48 +02:00
/system/etc/passwd u:object_r:system_passwd_file:s0
More granular vendor access to /system files. This change limits global access to /system files down to: /system/bin/linker* /system/lib[64]/* /system/etc/ld.config* /system/etc/seccomp_policy/* /system/etc/security/cacerts/* /system/usr/share/zoneinfo/* Bug: 111243627 Test: boot device, browse internet without denials to system_* types. Test: VtsHalDrmV1_{1, 0}TargetTest without denials Change-Id: I69894b29733979c2bc944ac80229e84de5d519f4
2018-08-12 00:34:49 +02:00
/system/etc/seccomp_policy(/.*)? u:object_r:system_seccomp_policy_file:s0
/system/etc/security/cacerts(/.*)? u:object_r:system_security_cacerts_file:s0
Change mapping file name to reflect its platform version. As the platform progresses in the split SELinux world, the platform will need to maintain mapping files back to previous platform versions to maintain backwards compatibility with vendor images which have SELinux policy written based on the older versions. This requires shipping multiple mapping files with the system image so that the right one can be selected. Change the name and location of the mapping file to reflect this. Also add a file to the vendor partition indicating which version is being targeted that the platform can use to determine which mapping file to choose. Bug: 36783775 Test: Force compilation of sepolicy on-device with mapping file changed to new location and name, using the value reported on /vendor. Change-Id: I93ab3e52c2c80c493719dc3825bc731867ea76d4
2017-04-10 21:27:18 +02:00
/system/etc/selinux/mapping/[0-9]+\.[0-9]+\.cil u:object_r:sepolicy_file:s0
/system/etc/selinux/plat_mac_permissions\.xml u:object_r:mac_perms_file:s0
prop_context: correctly label all property_context files split property context file in vendor and sytem were left untouched by the recent changes. This was working accidentally because they were still accessible to all domains as 'system_file'. Bug: 36002573 Test: Boot sailfish to observe no new denials. Test: 'adb sideload' OTA on sailfish successfully Change-Id: I5bec058b59db83d2a431e9f7e91c5a09af7d2942 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-24 18:22:14 +01:00
/system/etc/selinux/plat_property_contexts u:object_r:property_contexts_file:s0
service_contexts: label service_contexts explicitly The label applies to all service_contexts regardless of their location. This also lets us track the service_contexts usage and limit access to the files for the corresponding object manager alone. Bug: 36002427 Test: Boot sailfish and observe no denials for 'serice_contexts' Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check \ --abi arm64-v8a --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testAospServiceContexts Change-Id: I97fc8b24bc99ca5c00d010fb522cd39a35572858 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-24 20:24:43 +01:00
/system/etc/selinux/plat_service_contexts u:object_r:service_contexts_file:s0
Add hwservice_contexts and support for querying it. hwservicemanager can check hwservice_contexts files both from the framework and vendor partitions. Initially, have a wildcard '*' in hwservice_contexts that maps to a label that can be added/found from domain. This needs to be removed when the proper policy is in place. Also, grant su/shell access to hwservicemanager list operations, so tools like 'lshal' continue to work. Bug: 34454312 Test: Marlin boots Change-Id: I3a02d97a82458692b528d85c1b8e78b6f82ea1bc
2017-04-08 01:14:43 +02:00
/system/etc/selinux/plat_hwservice_contexts u:object_r:hwservice_contexts_file:s0
file_context: explicitly label all file context files file_context files need to be explicitly labeled as they are now split across system and vendor and won't have the generic world readable 'system_file' label. Bug: 36002414 Test: no new 'file_context' denials at boot complete on sailfish Test: successfully booted into recovery without denials and sideloaded OTA update. Test: ./cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi \ arm64-v8a --module CtsSecurityHostTestCases -t \ android.security.cts.SELinuxHostTest#testAospFileContexts Change-Id: I603157e9fa7d1de3679d41e343de397631666273 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-24 23:02:13 +01:00
/system/etc/selinux/plat_file_contexts u:object_r:file_contexts_file:s0
seapp_context: explicitly label all seapp context files seapp_context files need to be explicitly labeled as they are now split cross system and vendor and won't have the generic world readable 'system_file' label. Bug: 36002414 Test: no new 'seapp_context' denials at boot complete on sailfish Test: successfully booted into recovery without denials and sideloaded OTA update. Test: ./cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi \ arm64-v8a --module CtsSecurityHostTestCases -t \ android.security.cts.SELinuxHostTest#testAospSeappContexts Test: Launch 'chrome' and succesfully load a website. Test: Launch Camera and take a picture. Test: Launch Camera and record a video, succesfully playback recorded video Change-Id: I19b3e50c6a7c292713d3e56ef0448acf6e4270f7 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-27 19:57:07 +02:00
/system/etc/selinux/plat_seapp_contexts u:object_r:seapp_contexts_file:s0
Properly escape dots in file_contexts filenames I found these with the regex (?<!\\)\.(?!\*|\+) Test: make Change-Id: I1c2e817d164b1074cb359cdb6d46bcf71e220765
2018-10-24 15:50:22 +02:00
/system/etc/selinux/plat_sepolicy\.cil u:object_r:sepolicy_file:s0
Change mapping file name to reflect its platform version. As the platform progresses in the split SELinux world, the platform will need to maintain mapping files back to previous platform versions to maintain backwards compatibility with vendor images which have SELinux policy written based on the older versions. This requires shipping multiple mapping files with the system image so that the right one can be selected. Change the name and location of the mapping file to reflect this. Also add a file to the vendor partition indicating which version is being targeted that the platform can use to determine which mapping file to choose. Bug: 36783775 Test: Force compilation of sepolicy on-device with mapping file changed to new location and name, using the value reported on /vendor. Change-Id: I93ab3e52c2c80c493719dc3825bc731867ea76d4
2017-04-10 21:27:18 +02:00
/system/etc/selinux/plat_and_mapping_sepolicy\.cil\.sha256 u:object_r:sepolicy_file:s0
sepolicy changes to configure cgroup.rc and task_profiles.json access cgroups.json file contains cgroup information required to mount cgroup controllers and is readable only by init process. cgroup.rc contains cgroup map information consisting of the list of cgroups available in the system and their mounting locations. It is created by init process and should be readable by any processes that uses cgroups and should be writable only by init process. task_profiles.json file contains task profiles used to operate on cgroups. This information should be readable by any process that uses cgroups and should be writable only by init process. Bug: 111307099 Test: builds, boots Change-Id: Ib2c87c0fc3663c7fc69628f05c846519b65948b5 Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2019-01-11 02:10:31 +01:00
/system/etc/task_profiles\.json u:object_r:task_profiles_file:s0
Label /system/usr/share/zoneinfo differently /system/usr/share/zoneinfo is currently labeled zoneinfo_data_file, a label shared with /data/misc/zoneinfo. However, each of these directory locations has different security characteristics. In particular, the files in /system/usr/share/zoneinfo must never be writable, whereas /data/misc/zoneinfo may be written to by system_server. Reusing the same label hides these different security characteristics. Create a separate label for /system/usr/share/zoneinfo. Test: Device boots and no obvious problems. Change-Id: I8cf16ff038b06b38f77388e546d9b7a6865f7879
2018-09-27 17:45:16 +02:00
/system/usr/share/zoneinfo(/.*)? u:object_r:system_zoneinfo_file:s0
VR: Add sepolicy for VR HWC service VR HWC is being split out of VR Window Manager. It creates a HW binder interface used by SurfaceFlinger which implements the HWComposer HAL and a regular binder interface which will be used by a system app to receive the SurfaceFlinger output. Bug: b/36051907 Test: Ran in permissive mode and ensured no permission errors show in logcat. Change-Id: If1360bc8fa339a80100124c4e89e69c64b29d2ae
2017-03-14 21:26:17 +01:00
/system/bin/vr_hwc u:object_r:vr_hwc_exec:s0
Moving adbd from rootdir to system/bin Bug: 63910933 Test: boot sailfish in normal mode, checks adbd is started Test: boot sailfish in recovery mode, checks adbd is started Test: boot bullhead in normal mode, checks adbd is started Test: boot bullhead in recovery mode, checks adbd is started Change-Id: I35ed78a15a34626fbd3c21d030e2bf51033f7b79 Merged-In: I35ed78a15a34626fbd3c21d030e2bf51033f7b79 (cherry picked from commit e2423d149b6a5b9119965c097a2a75cb8d052763)
2017-07-31 12:38:28 +02:00
/system/bin/adbd u:object_r:adbd_exec:s0
vold_prepare_subdirs sets policy in vold-created dirs. Bug: 25861755 Test: Boot device, observe logs Change-Id: I6c13430d42e9794003eb48e6ca219b874112b900 Merged-In: I6c13430d42e9794003eb48e6ca219b874112b900 (cherry picked from commit 47f3ed09d222ee126cf2fe23b5fe15cd0b64520e)
2017-10-13 23:54:32 +02:00
/system/bin/vold_prepare_subdirs u:object_r:vold_prepare_subdirs_exec:s0
Setting up SELinux policy for statsd and stats service Bug: 63757906 Test: manual testing conducted Change-Id: Id03413ce82b5646d4bceddc59e16c7d5ee5bc193
2017-12-19 00:14:33 +01:00
/system/bin/stats u:object_r:stats_exec:s0
/system/bin/statsd u:object_r:statsd_exec:s0
Add sepolicy to lock down bpf access Add a new set of sepolicy for the process that only netd use to load and run ebpf programs. It is the only process that can load eBPF programs into the kernel and is only used to do that. Add some neverallow rules regarding which processes have access to bpf objects. Test: program successfully loaded and pinned at sys/fs/bpf after device boot. No selinux violation for bpfloader Bug: 30950746 Change-Id: Ia6bb1afda29ae0749bdc368e2dfc5faa12e81b2f
2018-01-03 00:31:18 +01:00
/system/bin/bpfloader u:object_r:bpfloader_exec:s0
Add wait_for_keymaster Bug: 79228237 Test: audit2allow finds no relevant denials on boot Merged-In: Ia80b77ba9a1ec2354127cd0ef68d50ebcf593fb0 Change-Id: Ia80b77ba9a1ec2354127cd0ef68d50ebcf593fb0
2018-05-09 00:45:38 +02:00
/system/bin/wait_for_keymaster u:object_r:wait_for_keymaster_exec:s0
Move watchdogd out of init and into its own domain Bug: 73660730 Test: watchdogd still runs Change-Id: I31697c7c6fa2f7009731ff48c659af051838e42f
2018-08-02 00:48:20 +02:00
/system/bin/watchdogd u:object_r:watchdogd_exec:s0
Add policy for apexd. apexd is a new daemon for managing APEX packages installed on the device. It hosts a single binder service, "apexservice". Bug: 112455435 Test: builds, binder service can be registered, apexes can be accessed, verified and mounted Change-Id: I634ad100f10b2edcd9a9c0df0d33896fa5d4ed97
2018-08-17 09:35:42 +02:00
/system/bin/apexd u:object_r:apexd_exec:s0
sepolicy for gsid Bug: 122556707 Test: gsid starts Change-Id: Ib05ddb79051436f51cd236de04027a3b12ee87a9 Signed-off-by: Sandeep Patil <sspatil@google.com>
2019-01-14 23:38:17 +01:00
/system/bin/gsid u:object_r:gsid_exec:s0
perf_event: rules for system and simpleperf domain This patch adds the necessary rules to support the existing usage of perf_event_open by the system partition, which almost exclusively concerns the simpleperf profiler. A new domain is introduced for some (but not all) executions of the system image simpleperf. The following configurations are supported: * shell -> shell process (no domain transition) * shell -> debuggable app (through shell -> runas -> runas_app) * shell -> profileable app (through shell -> simpleperf_app_runner -> untrusted_app -> simpleperf) * debuggable/profile app -> self (through untrusted_app -> simpleperf) simpleperf_app_runner still enters the untrusted_app domain immediately before exec to properly inherit the categories related to MLS. My understanding is that a direct transition would require modifying external/selinux and seapp_contexts as with "fromRunAs", which seems unnecessarily complex for this case. runas_app can still run side-loaded binaries and use perf_event_open, but it checks that the target app is exactly "debuggable" (profileability is insufficient). system-wide profiling is effectively constrained to "su" on debug builds. See go/perf-event-open-security for a more detailed explanation of the scenarios covered here. Tested: "atest CtsSimpleperfTestCases" on crosshatch-user/userdebug Tested: manual simpleperf invocations on crosshatch-userdebug Bug: 137092007 Change-Id: I2100929bae6d81f336f72eff4235fd5a78b94066
2020-01-10 20:02:43 +01:00
/system/bin/simpleperf u:object_r:simpleperf_exec:s0
Add sepolicy for simpleperf_app_runner. Bug: 118835348 Test: build and boot pixel 3. Test: run simpleperf_app_runner manually. Change-Id: Ifb6c2ab78e075684bc197d06f761becced8281d1
2019-01-11 00:34:08 +01:00
/system/bin/simpleperf_app_runner u:object_r:simpleperf_app_runner_exec:s0
Allow the init process to execute the notify_traceur.sh script This sets up a selinux domain (notify_traceur) that can be called from init and has the permissions to run the activitymanager script. Bug: 116754134 Test: manual Change-Id: Ia371bafe5d3d354efdf8cd29365cd74ed3e5cdfd
2019-02-05 23:21:01 +01:00
/system/bin/notify_traceur\.sh u:object_r:notify_traceur_exec:s0
sepolicy: Add policy for migrate_legacy_obb_data.sh .. and let installd execute it. Required to migrate legacy obb contents Bug: 129167772 Test: make Change-Id: I35d35016680379e3a9363408704ee890a78a9748
2019-05-17 16:05:18 +02:00
/system/bin/migrate_legacy_obb_data\.sh u:object_r:migrate_legacy_obb_data_exec:s0
Add aidl_lazy_test_server This is a test service for testing dynamic start/stop of AIDL services. In order to test realistic use cases with SELinux enabled, it requires the same permissions as a regular service. Bug: 147153962 Test: aidl_lazy_test aidl_lazy_test_1 aidl_lazy_test_2 Change-Id: Ifc3b2eaefba9c06c94f9cf24b4474107d4e26563
2020-01-04 01:32:07 +01:00
/system/bin/aidl_lazy_test_server u:object_r:aidl_lazy_test_server_exec:s0
New domain "install_recovery" Create a new domain for the one-shot init service flash_recovery. This domain is initially in permissive_or_unconfined() for testing. Any SELinux denials won't be enforced for now. Change-Id: I7146dc154a5c78b6f3b4b6fb5d5855a05a30bfd8
2014-07-03 01:18:16 +02:00
SE Android policy.
2012-01-04 18:33:27 +01:00
#############################
sepolicy: add /vendor to file_contexts /vendor has the same permissions as /system/vendor for devices that have a separate vendor partition. Bug: 8341435 Change-Id: If0c78b31f8a6e8e5680f1d076c323d1628fb07b2
2013-03-20 20:03:04 +01:00
# Vendor files
#
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
/(vendor|system/vendor)(/.*)? u:object_r:vendor_file:s0
vendor_shell: add sepolicy for vendor shell Bug: 36463595 Test: Boot sailfish and make sure all vendor services that are shell scripts work. (Checke exited status) Change-Id: I3d1d564114a914dec8179fb93a9e94493c2808da Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-13 22:06:00 +02:00
/(vendor|system/vendor)/bin/sh u:object_r:vendor_shell_exec:s0
toolbox: add sepolicy for vendor toybox The vendor toybox MUST always be executed without transition and non-vendor processes are not allowed to execute the binary. Bug: 36463595 Test: Boot and test if system shell can run /vendor/bin/echo Result: requires 'su' Change-Id: Ifb9aa61f247f91fb870b99d60ac7f849ee9c6adc Signed-off-by: Sandeep Patil <sspatil@google.com> (cherry picked from commit c112cd18e8999c0242a2560219033231a0e19898)
2017-04-13 00:19:12 +02:00
/(vendor|system/vendor)/bin/toybox_vendor u:object_r:vendor_toolbox_exec:s0
Add toolbox to vendor partition Bug: 71861796 Test: no more denials on walleye for shell init scripts Change-Id: I51eab267c95a915f927b0aaa7db9d678a83093c7
2018-01-11 21:53:09 +01:00
/(vendor|system/vendor)/bin/toolbox u:object_r:vendor_toolbox_exec:s0
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
/(vendor|system/vendor)/etc(/.*)? u:object_r:vendor_configs_file:s0
sepolicy for vendor cgroups.json and task_profiles.json files Vendors should be able to specify additional cgroups and task profiles without changing system files. Add access rules for /vendor/etc/cgroups.json and /vendor/etc/task_profiles.json files which will augment cgroups and task profiles specified in /etc/cgroups.json and /etc/task_profiles.json system files. As with system files /vendor/etc/cgroups.json is readable only by init process. task_profiles.json is readable by any process that uses cgroups. Bug: 124960615 Change-Id: I12fcff0159b4e7935ce15cc19ae36230da0524fc Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2019-02-20 00:02:14 +01:00
/(vendor|system/vendor)/etc/cgroups\.json u:object_r:vendor_cgroup_desc_file:s0
/(vendor|system/vendor)/etc/task_profiles\.json u:object_r:vendor_task_profiles_file:s0
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
/(vendor|system/vendor)/lib(64)?/egl(/.*)? u:object_r:same_process_hal_file:s0
Rename vndk-stable to vndk-sp (SP=Same-process) The concept of VNDK-stable set is gone because they no longer need to be stable across several Android releases. Instead, they are just small set of system libraries (other than Low-Level NDK) that can be used by same-process HALs. They need to be stable only during an Android release as other VNDK libraries. However, since they are eligible for double loading, we still need to distinguish those libs from other VNDK libraries. So we give them a name vndk-sp, which means VNDK designed for same-process HALs. Bug: 37139956 Test: booting successful with vndk-sp libs in /vendor/lib(64)?/vndk-sp Change-Id: I892c4514deb3c6c8006e3659bed1ad3363420732
2017-04-10 06:37:40 +02:00
/(vendor|system/vendor)/lib(64)?/vndk-sp(/.*)? u:object_r:vndk_sp_file:s0
sepolicy: allow access to vndk-stable libs Vndk-stable libs are system libs that are used by same process HALs. Since same process HALs can be loaded to any process, so are vndk-stable libs. Bug: 37138502 Test: none, because the directory is currently empty and thus this is no-op. sailfish builds and boots. Change-Id: I67a2c8c2e4c3517aa30b4a97dc80dc2800e47b5a
2017-04-07 14:16:19 +02:00
Properly escape dots in file_contexts filenames I found these with the regex (?<!\\)\.(?!\*|\+) Test: make Change-Id: I1c2e817d164b1074cb359cdb6d46bcf71e220765
2018-10-24 15:50:22 +02:00
/(vendor|system/vendor)/manifest\.xml u:object_r:vendor_configs_file:s0
/(vendor|system/vendor)/compatibility_matrix\.xml u:object_r:vendor_configs_file:s0
move /vendor VINTF data to /vendor/etc/vintf Test: boots Test: hwservicemanager can read these files Bug: 36790901 Change-Id: I0431a7f166face993c1d14b6209c9b502a506e09
2018-01-19 02:53:35 +01:00
/(vendor|system/vendor)/etc/vintf(/.*)? u:object_r:vendor_configs_file:s0
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
/(vendor|system/vendor)/app(/.*)? u:object_r:vendor_app_file:s0
Label /vendor/priv-app as vendor_app_file In P, we will be supporting privileged apps in vendor partition, thus need to label /vendor/priv-app as vendor_app_file so that apps can exist under the dir. Bug: 35301609 Test: N/A since there is no /vendor/priv-app yet. Framework change which is currently in the internal is required. Change-Id: I86a765ef9da5267113e64a7cbb38ba0abf5c2835
2017-11-20 13:09:55 +01:00
/(vendor|system/vendor)/priv-app(/.*)? u:object_r:vendor_app_file:s0
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
/(vendor|system/vendor)/overlay(/.*)? u:object_r:vendor_overlay_file:s0
/(vendor|system/vendor)/framework(/.*)? u:object_r:vendor_framework_file:s0
file_contexts: Include legacy /system/vendor paths Probably flew under the radar because Google only tests on devices that include devices with a physical /vendor partition. Test: "make selinux_policy", confirm correct labels on a legacy device Change-Id: I1aa856c6e3774912d1f4c0a09bbc2d174016f59d Signed-off-by: Felix <google@ix5.org>
2019-10-03 22:30:28 +02:00
/(vendor|system/vendor)/apex(/[^/]+){0,2} u:object_r:vendor_apex_file:s0
/(vendor|system/vendor)/bin/misc_writer u:object_r:vendor_misc_writer_exec:s0
/(vendor|system/vendor)/bin/boringssl_self_test(32|64) u:object_r:vendor_boringssl_self_test_exec:s0
Adding vendor_apex_file for /vendor/apex apexd needs to read /vendor/apex dir and files in it. Bug: 131190070 Bug: 123378252 Test: 1. Add apex to /vendor/apex -> see if boot succeeds with new policy 2. Add flattened apex to /vendor/apex -> see if only root files are labelled as vendor_apex_file Change-Id: I37795ab6d659ac82639ba5e34d628fe1b5cdb350
2019-04-24 03:45:40 +02:00
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
# HAL location
/(vendor|system/vendor)/lib(64)?/hw u:object_r:vendor_hal_file:s0
sepolicy: fix missing label on vendor_service_contexts Vendors can publish services with servicemanager only on non-Treble builds. vendor_service_contexts is not meant to be read by servicemanager. https://android.googlesource.com/platform/system/sepolicy/+/5bccbfefe494aa6fed73a58d80713e28257ba7f1/public/servicemanager.te#22 Bug: 141333155 Test: create /vendor/etc/selinux/vendor_service_contexts and make sure it is correctly labeled. Change-Id: Ib68c50e0cdb2c39f0857a10289bfa26fa11b1b3c
2019-10-02 00:23:25 +02:00
/(vendor|system/vendor)/etc/selinux/(vendor|nonplat)_service_contexts u:object_r:nonplat_service_contexts_file:s0
Moving recovery resources from /system to /vendor This change is part of a topic that moves the recovery resources from the system partition to the vendor partition, if it exists, or the vendor directory on the system partition otherwise. The recovery resources are moving from the system image to the vendor partition so that a single system image may be used with either an A/B or a non-A/B vendor image. The topic removes a delta in the system image that prevented such reuse in the past. The recovery resources that are moving are involved with updating the recovery partition after an update. In a non-A/B configuration, the system boots from the recovery partition, updates the other partitions (system, vendor, etc.) Then, the next time the system boots normally, a script updates the recovery partition (if necessary). This script, the executables it invokes, and the data files that it uses were previously on the system partition. The resources that are moving include the following. * install-recovery.sh * applypatch * recovery-resource.dat (if present) * recovery-from-boot.p (if present) This change includes the sepolicy changes to move the recovery resources from system to vendor. The big change is renaming install_recovery*.te to vendor_install_recovery*.te to emphasize the move to vendor. Other changes follow from that. The net result is that the application of the recovery patch has the same permissions that it had when it lived in system. Bug: 68319577 Test: Ensure that recovery partition is updated correctly. Change-Id: If29cb22b2a7a5ce1b25d45ef8635e6cb81103327
2019-09-18 01:59:42 +02:00
/(vendor|system/vendor)/bin/install-recovery\.sh u:object_r:vendor_install_recovery_exec:s0
add /odm to file_contexts /odm has the same permissions as /system/... for devices with a separate odm partition Bug: 19609718 Change-Id: I6dd83d43c5fd8682248e79d11b0ca676030eadf0
2015-03-18 21:11:11 +01:00
#############################
Label /oem files Files on the /oem partition are weird. The /oem partition is an ext4 partition, built in the Android tree using the "oem_image" build target added in build/ commit b8888432f0bc0706d5e00e971dde3ac2e986f2af. Since it's an ext4 image, it requires SELinux labels to be defined at build time. However, the partition is mounted using context=u:object_r:oemfs:s0, which ignores the labels on the filesystem. Assign all the files on the /oem image to be oemfs, which is consistent with how they'll be mounted when /oem is mounted. Other options would be to use an "unlabeled" label, or try to fix the build system to not require SELinux labels for /oem images. Bug: 20816563 Change-Id: Ibe8d9ff626eace8a2d5d02c3f06290105baa59fe
2015-05-07 01:33:56 +02:00
# OEM and ODM files
add /odm to file_contexts /odm has the same permissions as /system/... for devices with a separate odm partition Bug: 19609718 Change-Id: I6dd83d43c5fd8682248e79d11b0ca676030eadf0
2015-03-18 21:11:11 +01:00
#
/odm is another vendor partition other than /vendor Sub directories under /odm (or /vendor/odm when there isn't an odm partition) are labeled so that artifacts under the sub directories are treated the same as their counterpart in the vendor partition. For example, /odm/app/* is labeled as vendor_app_file just like /vendor/app/*. Bug: 71366495 Test: m -j Change-Id: I72a14fd55672cd2867edd88ced9828ea49726694
2018-03-07 18:53:45 +01:00
/(odm|vendor/odm)(/.*)? u:object_r:vendor_file:s0
/(odm|vendor/odm)/lib(64)?/egl(/.*)? u:object_r:same_process_hal_file:s0
/(odm|vendor/odm)/lib(64)?/hw u:object_r:vendor_hal_file:s0
/(odm|vendor/odm)/lib(64)?/vndk-sp(/.*)? u:object_r:vndk_sp_file:s0
/(odm|vendor/odm)/bin/sh u:object_r:vendor_shell_exec:s0
/(odm|vendor/odm)/etc(/.*)? u:object_r:vendor_configs_file:s0
/(odm|vendor/odm)/app(/.*)? u:object_r:vendor_app_file:s0
/(odm|vendor/odm)/priv-app(/.*)? u:object_r:vendor_app_file:s0
/(odm|vendor/odm)/overlay(/.*)? u:object_r:vendor_overlay_file:s0
/(odm|vendor/odm)/framework(/.*)? u:object_r:vendor_framework_file:s0
/odm is another vendor partition that can be customied by ODMs Since /odm is an extension of /vendor, libs in /odm should be treated just like the ones in /vendor. Bug: 67890517 Test: none as we don't yet have /odm partition. Change-Id: I5232baef769c7fa8c7641b462cfa1d7537d3cfdf
2017-12-13 03:54:59 +01:00
Allow system_server to read vendor_file Input device configuration files .idc, .kl that are placed in /vendor are currently not accessible. Allow the read access here. Bug: 112880217 Test: move .idc and .kl files from /system to /vendor, then observe logcat. With this patch, avc denials disappear. Change-Id: I72ad62b9adf415f787565adced73fd8aaff38832
2018-10-08 21:04:15 +02:00
# Input configuration
file_contexts: Include legacy /system/vendor paths Probably flew under the radar because Google only tests on devices that include devices with a physical /vendor partition. Test: "make selinux_policy", confirm correct labels on a legacy device Change-Id: I1aa856c6e3774912d1f4c0a09bbc2d174016f59d Signed-off-by: Felix <google@ix5.org>
2019-10-03 22:30:28 +02:00
/(odm|vendor/odm|vendor|system/vendor)/usr/keylayout(/.*)?\.kl u:object_r:vendor_keylayout_file:s0
/(odm|vendor/odm|vendor|system/vendor)/usr/keychars(/.*)?\.kcm u:object_r:vendor_keychars_file:s0
/(odm|vendor/odm|vendor|system/vendor)/usr/idc(/.*)?\.idc u:object_r:vendor_idc_file:s0
Allow system_server to read vendor_file Input device configuration files .idc, .kl that are placed in /vendor are currently not accessible. Allow the read access here. Bug: 112880217 Test: move .idc and .kl files from /system to /vendor, then observe logcat. With this patch, avc denials disappear. Change-Id: I72ad62b9adf415f787565adced73fd8aaff38832
2018-10-08 21:04:15 +02:00
Label /oem files Files on the /oem partition are weird. The /oem partition is an ext4 partition, built in the Android tree using the "oem_image" build target added in build/ commit b8888432f0bc0706d5e00e971dde3ac2e986f2af. Since it's an ext4 image, it requires SELinux labels to be defined at build time. However, the partition is mounted using context=u:object_r:oemfs:s0, which ignores the labels on the filesystem. Assign all the files on the /oem image to be oemfs, which is consistent with how they'll be mounted when /oem is mounted. Other options would be to use an "unlabeled" label, or try to fix the build system to not require SELinux labels for /oem images. Bug: 20816563 Change-Id: Ibe8d9ff626eace8a2d5d02c3f06290105baa59fe
2015-05-07 01:33:56 +02:00
/oem(/.*)? u:object_r:oemfs:s0
Add rule for /oem/overlay Bug: 121033532 Test: builds, boots Change-Id: I70b23b11831d57b3241e6057c745aa4ce9f795ef
2019-02-25 14:41:13 +01:00
/oem/overlay(/.*)? u:object_r:vendor_overlay_file:s0
Label /oem files Files on the /oem partition are weird. The /oem partition is an ext4 partition, built in the Android tree using the "oem_image" build target added in build/ commit b8888432f0bc0706d5e00e971dde3ac2e986f2af. Since it's an ext4 image, it requires SELinux labels to be defined at build time. However, the partition is mounted using context=u:object_r:oemfs:s0, which ignores the labels on the filesystem. Assign all the files on the /oem image to be oemfs, which is consistent with how they'll be mounted when /oem is mounted. Other options would be to use an "unlabeled" label, or try to fix the build system to not require SELinux labels for /oem images. Bug: 20816563 Change-Id: Ibe8d9ff626eace8a2d5d02c3f06290105baa59fe
2015-05-07 01:33:56 +02:00
Add /odm/etc/selinux/odm_sepolicy.cil This change adds the support of odm sepolicy customization, which can be configured through the newly added build varaible: - BOARD_ODM_SEPOLICY_DIRS += device/${ODM_NAME}/${BOM_NAME}/sepolicy Also moving precompiled sepolicy to /odm when BOARD_ODM_SEPOLICY_DIRS is set. On a DUT, precompiled sepolicy on /odm will override the one in /vendor. This is intentional because /odm is the hardware customization for /vendor and both should be updated together if desired. Bug: 64240127 Test: boot a device with /odm partition Change-Id: Ia8f81a78c88cbfefb3ff19e2ccd2648da6284d09
2017-11-27 04:41:33 +01:00
# The precompiled monolithic sepolicy will be under /odm only when
# BOARD_USES_ODMIMAGE is true: a separate odm.img is built.
/odm/etc/selinux/precompiled_sepolicy u:object_r:sepolicy_file:s0
/odm/etc/selinux/precompiled_sepolicy\.plat_and_mapping\.sha256 u:object_r:sepolicy_file:s0
Properly escape dots in file_contexts filenames I found these with the regex (?<!\\)\.(?!\*|\+) Test: make Change-Id: I1c2e817d164b1074cb359cdb6d46bcf71e220765
2018-10-24 15:50:22 +02:00
/(odm|vendor/odm)/etc/selinux/odm_sepolicy\.cil u:object_r:sepolicy_file:s0
Add /odm/etc/selinux/odm_file_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: I087292fb23d05fc17272778d668ac78a721b2593
2017-11-29 09:14:53 +01:00
/(odm|vendor/odm)/etc/selinux/odm_file_contexts u:object_r:file_contexts_file:s0
Add /odm/etc/selinux/odm_seapp_contexts Bug: 64240127 Test: normal boot a device Change-Id: I3626357237cc18a99511f1ebd9dd3ff5a7655963
2017-11-29 09:15:28 +01:00
/(odm|vendor/odm)/etc/selinux/odm_seapp_contexts u:object_r:seapp_contexts_file:s0
Add /odm/etc/selinux/odm_property_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: Ibd71219f60644e57370c0293decf11d82f1cb35c
2017-11-29 09:15:55 +01:00
/(odm|vendor/odm)/etc/selinux/odm_property_contexts u:object_r:property_contexts_file:s0
Add /odm/etc/selinux/odm_hwservice_contexts Bug: 64240127 Test: normal boot and recovery boot a device Change-Id: I22d29e8476380d19aca1be359e0228ab6bbc3b0f
2017-11-29 09:16:26 +01:00
/(odm|vendor/odm)/etc/selinux/odm_hwservice_contexts u:object_r:hwservice_contexts_file:s0
Properly escape dots in file_contexts filenames I found these with the regex (?<!\\)\.(?!\*|\+) Test: make Change-Id: I1c2e817d164b1074cb359cdb6d46bcf71e220765
2018-10-24 15:50:22 +02:00
/(odm|vendor/odm)/etc/selinux/odm_mac_permissions\.xml u:object_r:mac_perms_file:s0
add /odm to file_contexts /odm has the same permissions as /system/... for devices with a separate odm partition Bug: 19609718 Change-Id: I6dd83d43c5fd8682248e79d11b0ca676030eadf0
2015-03-18 21:11:11 +01:00
Add a default rule for /product files Since /product is an extension of /system, its file contexts should be consistent with ones of /system. Bug: 64195575 Test: tested installing a RRO, apps, priv-apps and permissions Change-Id: I7560aaaed852ba07ebe1eb23b303301481c897f2
2018-01-17 07:27:35 +01:00
#############################
# Product files
#
Add a rule for /product-services partition. Like /system and /product, /product-services will contain apps that should have the same privileges as the one in other system partitions. Bug: 80741439 Test: successfully tested e2e on two devices, one with /product-services partition and another with /product-services symlinking to -> /system/product-services Change-Id: Ieee7a9a7641a178f44bb406dbdef39ed46713899
2018-05-29 14:17:03 +02:00
/(product|system/product)(/.*)? u:object_r:system_file:s0
Allow domain access r_file_perms for passwd and group files In b/73062966, we add new AID ranges for each partition that doesn't yet have them (system, system_ext, odm, product). We also add group and passwd files to these partitions to be able to map these AIDs into human readable user and group names, and vice versa. All processes should be able to read all users and groups. We divide the ranges into non-overlapping regions for each partition and we namespace the names with the partition name as a prefix. Allow domain r_file_perms to /(system|product|system_ext)/etc/(group|passwd). Vendor and odm passwd and group files already have this access, since /(vendor|odm)/etc/* is already domain readable. Example contents: blueline:/ $ cat /system/etc/passwd system_tom::6050:6050::/:/bin/sh blueline:/ $ cat /product/etc/passwd product_tom::7013:7013::/:/bin/sh Bug: 73062966 Test: tree-hugger selinux denial during boot test Change-Id: Ib4dc31778e95e952174e1365497feaf93dca7156
2019-07-15 22:33:48 +02:00
/(product|system/product)/etc/group u:object_r:system_group_file:s0
/(product|system/product)/etc/passwd u:object_r:system_passwd_file:s0
Add rules for /product{,_services}/overlay These rules mirror those for /vendor/overlay and /odm/overlay, including the possilibity of a symlink like /system/vendor -> /vendor. Test: builds, boots Change-Id: I323e48fcc13c4ac7779902506539c2600708cc88
2018-09-27 09:45:30 +02:00
/(product|system/product)/overlay(/.*)? u:object_r:vendor_overlay_file:s0
Add a rule for /product-services partition. Like /system and /product, /product-services will contain apps that should have the same privileges as the one in other system partitions. Bug: 80741439 Test: successfully tested e2e on two devices, one with /product-services partition and another with /product-services symlinking to -> /system/product-services Change-Id: Ieee7a9a7641a178f44bb406dbdef39ed46713899
2018-05-29 14:17:03 +02:00
Separate product_hwservice_contexts out of system sepolicy. Bug: 119305624 Test: normal/recovery boot aosp_taimen Change-Id: I1009745686acd51563378dac56e857be0d60e794
2018-12-21 01:13:10 +01:00
/(product|system/product)/etc/selinux/product_file_contexts u:object_r:file_contexts_file:s0
/(product|system/product)/etc/selinux/product_hwservice_contexts u:object_r:hwservice_contexts_file:s0
Separate product_property_contexts out of system sepolicy. Bug: 119305624 Test: normal/recovery boot aosp_taimen Change-Id: Ib7a29a9f8f23dd917cc25c23c7612f9e4ae36ea0
2018-12-21 04:31:42 +01:00
/(product|system/product)/etc/selinux/product_property_contexts u:object_r:property_contexts_file:s0
Separate product_seapp_contexts out of system sepolicy. Bug: 119305624 Test: normal/recovery boot aosp_taimen Change-Id: Ia8d69be16011db8dd63fa41672449a4ade7302c2
2018-12-21 19:46:45 +01:00
/(product|system/product)/etc/selinux/product_seapp_contexts u:object_r:seapp_contexts_file:s0
Separate product_service_contexts out of system sepolicy. Bug: 119305624 Test: normal/recovery boot aosp_taimen Change-Id: I15aa275fa658b58f5a5d3e651d164f9fcd87c0af
2018-12-21 21:28:14 +01:00
/(product|system/product)/etc/selinux/product_service_contexts u:object_r:service_contexts_file:s0
Separate product_mac_permissions.xml out of system sepolicy. Bug: 119305624 Test: normal/recovery boot aosp_taimen Change-Id: I46da995886ce421bb87e741d577f659426ff79c4
2018-12-22 01:07:21 +01:00
/(product|system/product)/etc/selinux/product_mac_permissions\.xml u:object_r:mac_perms_file:s0
Separate product_file_contexts out of system sepolicy. Bug: 119305624 Test: boot blueline Change-Id: I3ecdeab3bb33c3cb5e80dc10ba1079c9853048f8
2018-12-19 04:51:19 +01:00
Label /product/lib(64)/* as system_lib_file Bug: 138545724 Test: n/a Change-Id: Ic707229a04c2484503154110c45f4acb5ff61bd5
2019-07-29 21:39:08 +02:00
/(product|system/product)/lib(64)?(/.*)? u:object_r:system_lib_file:s0
Add a rule for /product-services partition. Like /system and /product, /product-services will contain apps that should have the same privileges as the one in other system partitions. Bug: 80741439 Test: successfully tested e2e on two devices, one with /product-services partition and another with /product-services symlinking to -> /system/product-services Change-Id: Ieee7a9a7641a178f44bb406dbdef39ed46713899
2018-05-29 14:17:03 +02:00
#############################
Rename product_services to system_ext Bug: 134359158 Test: build and check if system_ext.img is created Change-Id: I395324d369d9467895471f5b62d327fd9b3381dc
2019-06-26 02:27:36 +02:00
# SystemExt files
Add a rule for /product-services partition. Like /system and /product, /product-services will contain apps that should have the same privileges as the one in other system partitions. Bug: 80741439 Test: successfully tested e2e on two devices, one with /product-services partition and another with /product-services symlinking to -> /system/product-services Change-Id: Ieee7a9a7641a178f44bb406dbdef39ed46713899
2018-05-29 14:17:03 +02:00
#
Rename product_services to system_ext Bug: 134359158 Test: build and check if system_ext.img is created Change-Id: I395324d369d9467895471f5b62d327fd9b3381dc
2019-06-26 02:27:36 +02:00
/(system_ext|system/system_ext)(/.*)? u:object_r:system_file:s0
Allow domain access r_file_perms for passwd and group files In b/73062966, we add new AID ranges for each partition that doesn't yet have them (system, system_ext, odm, product). We also add group and passwd files to these partitions to be able to map these AIDs into human readable user and group names, and vice versa. All processes should be able to read all users and groups. We divide the ranges into non-overlapping regions for each partition and we namespace the names with the partition name as a prefix. Allow domain r_file_perms to /(system|product|system_ext)/etc/(group|passwd). Vendor and odm passwd and group files already have this access, since /(vendor|odm)/etc/* is already domain readable. Example contents: blueline:/ $ cat /system/etc/passwd system_tom::6050:6050::/:/bin/sh blueline:/ $ cat /product/etc/passwd product_tom::7013:7013::/:/bin/sh Bug: 73062966 Test: tree-hugger selinux denial during boot test Change-Id: Ib4dc31778e95e952174e1365497feaf93dca7156
2019-07-15 22:33:48 +02:00
/(system_ext|system/system_ext)/etc/group u:object_r:system_group_file:s0
/(system_ext|system/system_ext)/etc/passwd u:object_r:system_passwd_file:s0
Rename product_services to system_ext Bug: 134359158 Test: build and check if system_ext.img is created Change-Id: I395324d369d9467895471f5b62d327fd9b3381dc
2019-06-26 02:27:36 +02:00
/(system_ext|system/system_ext)/overlay(/.*)? u:object_r:vendor_overlay_file:s0
sepolicy for vendor overlay Make /(product|system/product)/vendor_overlay/<ver> have the vendor file context. If vendor_overlay requires to mount on the vendor directories other than 'vendor_file', the contexts must be defined in the device specific sepolicy files. Bug: 119076200 Test: build and check if the files are overided and have the required sepolicy contexts. Change-Id: I69ed38d4ea8e7d89f56865b1ca1e26f290e9892d
2018-11-06 07:00:49 +01:00
Separate system_ext_mac_permissions.xml out of system sepolicy. Bug: 137712473 Test: boot crosshatch Test: Moving product sepolicy to system_ext and checks the file contents in /system_ext/etc/selinux are identical to previous contents in /product/etc/selinux. Change-Id: I434e7f23a1ae7d01d084335783255330329c44e9
2019-09-09 16:05:49 +02:00
/(system_ext|system/system_ext)/etc/selinux/system_ext_file_contexts u:object_r:file_contexts_file:s0
/(system_ext|system/system_ext)/etc/selinux/system_ext_hwservice_contexts u:object_r:hwservice_contexts_file:s0
/(system_ext|system/system_ext)/etc/selinux/system_ext_property_contexts u:object_r:property_contexts_file:s0
/(system_ext|system/system_ext)/etc/selinux/system_ext_seapp_contexts u:object_r:seapp_contexts_file:s0
/(system_ext|system/system_ext)/etc/selinux/system_ext_service_contexts u:object_r:service_contexts_file:s0
/(system_ext|system/system_ext)/etc/selinux/system_ext_mac_permissions\.xml u:object_r:mac_perms_file:s0
Separate system_ext_file_contexts out of system sepolicy. Bug: 137712473 Test: boot crosshatch Change-Id: I09f63771d08ad18fb41fca801dd587b086be58c7
2019-09-09 16:04:06 +02:00
sepolicy for vendor overlay Make /(product|system/product)/vendor_overlay/<ver> have the vendor file context. If vendor_overlay requires to mount on the vendor directories other than 'vendor_file', the contexts must be defined in the device specific sepolicy files. Bug: 119076200 Test: build and check if the files are overided and have the required sepolicy contexts. Change-Id: I69ed38d4ea8e7d89f56865b1ca1e26f290e9892d
2018-11-06 07:00:49 +01:00
#############################
# Vendor files from /(product|system/product)/vendor_overlay
#
# NOTE: For additional vendor file contexts for vendor overlay files,
# use device specific file_contexts.
#
/(product|system/product)/vendor_overlay/[0-9]+/.* u:object_r:vendor_file:s0
Add a default rule for /product files Since /product is an extension of /system, its file contexts should be consistent with ones of /system. Bug: 64195575 Test: tested installing a RRO, apps, priv-apps and permissions Change-Id: I7560aaaed852ba07ebe1eb23b303301481c897f2
2018-01-17 07:27:35 +01:00
sepolicy: add /vendor to file_contexts /vendor has the same permissions as /system/vendor for devices that have a separate vendor partition. Bug: 8341435 Change-Id: If0c78b31f8a6e8e5680f1d076c323d1628fb07b2
2013-03-20 20:03:04 +01:00
#############################
SE Android policy.
2012-01-04 18:33:27 +01:00
# Data files
#
Initial policy for expanded storage. Expanded storage supports a subset of the features of the internal data partition. Mirror that policy for consistency. vold is also granted enough permissions to prepare initial directories. avc: denied { write } for name="ext" dev="tmpfs" ino=3130 scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { add_name } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { create } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { setattr } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" dev="tmpfs" ino=7243 scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { mounton } for path="/mnt/ext/57f8f4bc-abf4-655f-bf67-946fc0f9f25b" dev="tmpfs" ino=7243 scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { getattr } for path="/mnt/ext" dev="tmpfs" ino=3130 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { setattr } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" dev="tmpfs" ino=4471 scontext=u:r:vold:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=1 avc: denied { getattr } for path="/mnt/expand/57f8f4bc-abf4-655f-bf67-946fc0f9f25b/media" dev="dm-0" ino=145153 scontext=u:r:vold:s0 tcontext=u:object_r:media_rw_data_file:s0 tclass=dir permissive=1 avc: denied { rmdir } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" dev="tmpfs" ino=6380 scontext=u:r:vold:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=1 avc: denied { create } for name="tmp" scontext=u:r:vold:s0 tcontext=u:object_r:shell_data_file:s0 tclass=dir permissive=1 avc: denied { setattr } for name="tmp" dev="dm-0" ino=72578 scontext=u:r:vold:s0 tcontext=u:object_r:shell_data_file:s0 tclass=dir permissive=1 Bug: 19993667 Change-Id: I73c98b36e7c066f21650a9e16ea82c5a0ef3d6c5
2015-04-07 01:21:54 +02:00
# NOTE: When modifying existing label rules, changes may also need to
# propagate to the "Expanded data files" section.
#
Root of /data belongs to init (re-landing) Give /data itself a different label to its contents, to ensure that only init creates files and directories there. This change originally landed as aosp/1106014 and was reverted in aosp/1116238 to fix b/140402208. aosp/1116298 fixes the underlying problem, and with that we can re-land this change. Bug: 139190159 Bug: 140402208 Test: aosp boots, logs look good Change-Id: I1a366c577a0fff307ca366a6844231bcf8afe3bf
2019-08-02 00:57:47 +02:00
/data u:object_r:system_data_root_file:s0
/data/(.*)? u:object_r:system_data_file:s0
Relabel /data/system/packages.list to new type. Conservatively grant access to packages_list_file to everything that had access to system_data_file:file even if the comment in the SELinux policy suggests it was for another use. Ran a diff on the resulting SEPolicy, the only difference of domains being granted is those that had system_data_file:dir permissiosn which is clearly not applicable for packages.list diff -u0 <(sesearch --allow -t system_data_file ~/sepolicy | sed 's/system_data_file/packages_list_file/') <(sesearch --allow -t packages_list_file ~/sepolicy_new) --- /proc/self/fd/16 2019-03-19 20:01:44.378409146 +0000 +++ /proc/self/fd/18 2019-03-19 20:01:44.378409146 +0000 @@ -3 +2,0 @@ -allow appdomain packages_list_file:dir getattr; @@ -6 +4,0 @@ -allow coredomain packages_list_file:dir getattr; @@ -8 +5,0 @@ -allow domain packages_list_file:dir search; @@ -35 +31,0 @@ -allow system_server packages_list_file:dir { rename search setattr read lock create reparent getattr write relabelfrom ioctl rmdir remove_name open add_name }; @@ -40 +35,0 @@ -allow tee packages_list_file:dir { search read lock getattr ioctl open }; @@ -43,3 +37,0 @@ -allow traced_probes packages_list_file:dir { read getattr open search }; -allow vendor_init packages_list_file:dir { search setattr read create getattr write relabelfrom ioctl rmdir remove_name open add_name }; -allow vold packages_list_file:dir { search setattr read lock create getattr mounton write ioctl rmdir remove_name open add_name }; @@ -48 +39,0 @@ -allow vold_prepare_subdirs packages_list_file:dir { read write relabelfrom rmdir remove_name open add_name }; @@ -50 +40,0 @@ -allow zygote packages_list_file:dir { search read lock getattr ioctl open }; Bug: 123186697 Change-Id: Ieabf313653deb5314872b63cd47dadd535af7b07
2019-03-19 19:14:38 +01:00
/data/system/packages\.list u:object_r:packages_list_file:s0
Adding e4crypt support Add selinux rules to allow file level encryption to work Change-Id: I1e4bba23e99cf5b2624a7df843688fba6f3c3209
2015-03-11 23:44:14 +01:00
/data/unencrypted(/.*)? u:object_r:unencrypted_data_file:s0
App data backup security policy. Policy covers: * backup_data_file type for labeling all files/dirs under /data dealing with backup mechanism. * cache_backup_file type for labeling all files/dirs under /cache dealing with backup mechanism. This also covers the the use of LocalTransport for local archive and restore testing. * the use of 'adb shell bmgr' to initiate backup mechanism from shell. * the use of 'adb backup/restore' to archive and restore the device's data. Change-Id: I700a92d8addb9bb91474bc07ca4bb71eb4fc840e Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2012-12-04 14:13:58 +01:00
/data/backup(/.*)? u:object_r:backup_data_file:s0
/data/secure/backup(/.*)? u:object_r:backup_data_file:s0
Add file_contexts entries for socket files. So that we do not relabel them on a restorecon -R /data. Change-Id: I8dd915d9bb80067339621b905ea2b4ea0fa8d71e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-04 20:29:51 +01:00
/data/system/ndebugsocket u:object_r:system_ndebug_socket:s0
Add rules for an unix domain socket for system_server System_server will listen on incoming packets from zygotes. Bug: 136036078 Test: atest CtsAppExitTestCases:ActivityManagerAppExitInfoTest Change-Id: I42feaa317615b90c5277cd82191e677548888a71
2019-12-30 06:38:38 +01:00
/data/system/unsolzygotesocket u:object_r:system_unsolzygote_socket:s0
Policy changes to support running the latest CTS.
2012-03-07 20:59:01 +01:00
/data/drm(/.*)? u:object_r:drm_data_file:s0
Fix SELinux policies to allow resource overlays. The following commits added support for runtime resource overlays. New command line tool 'idmap' * 65a05fd56dbc9fd9c2511a97f49c445a748fb3c5 Runtime resource overlay, iteration 2 * 48d22323ce39f9aab003dce74456889b6414af55 Runtime resource overlay, iteration 2, test cases * ad6ed950dbfa152c193dd7e49c369d9e831f1591 During SELinux tightening, support for these runtime resource overlays was unknowingly broken. Fix it. This change has been tested by hackbod and she reports that everything is working after this change. I haven't independently verified the functionality. Test cases are available for this by running: * python frameworks/base/core/tests/overlaytests/testrunner.py Change-Id: I1c70484011fd9041bec4ef34f93f7a5509906f40
2014-06-16 23:19:31 +02:00
/data/resource-cache(/.*)? u:object_r:resourcecache_data_file:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/data/dalvik-cache(/.*)? u:object_r:dalvikcache_data_file:s0
Selinux: introduce policy for OTA preopt Add permissions to dex2oat, introduce otapreopt binary and otadexopt service. Bug: 25612095 Change-Id: I80fcba2785e80b2931d7d82bb07474f6cd0099f7
2015-12-03 06:23:30 +01:00
/data/ota(/.*)? u:object_r:ota_data_file:s0
Add ota_package_file label for OTA packages. (cherry picked from commit 6c3f2831aca571ec3b01f60996965a432aa8164d) Allow priv_app, uncrypt, update_engine to access the OTA packages at /data/ota_package (both A/B and non-A/B). GMSCore (priv_app) checks the existence of the folder, and downloads the package there if present. Bug: 28944800 Change-Id: I3c0717861fce7f93b33874a99f6a4a55567612a5
2016-05-25 06:07:48 +02:00
/data/ota_package(/.*)? u:object_r:ota_package_file:s0
Allow adbd to write to /data/adb adbd writes debugging information to /data/adb when persist.adb.trace_mask is set. Allow it. Bug: https://code.google.com/p/android/issues/detail?id=72895 Change-Id: Ia5af09045e9f72a95325b429c30a5ae78e104bdc
2014-10-21 06:56:02 +02:00
/data/adb(/.*)? u:object_r:adb_data_file:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/data/anr(/.*)? u:object_r:anr_data_file:s0
Add policy for apexd. apexd is a new daemon for managing APEX packages installed on the device. It hosts a single binder service, "apexservice". Bug: 112455435 Test: builds, binder service can be registered, apexes can be accessed, verified and mounted Change-Id: I634ad100f10b2edcd9a9c0df0d33896fa5d4ed97
2018-08-17 09:35:42 +02:00
/data/apex(/.*)? u:object_r:apex_data_file:s0
Use label staging_data_file for installed APEX. This is needed in cases SELinux labels are restored under /data/apex by an external process calling restorecon. In normal condition files under /data/apex/active retain the label staging_data_file used at their original creation by StagingManager. However, we observed that the label might be changed to apex_data_file, which we were able to reproduce by running restorecon. Explicitly mark files under /data/apex/active and /data/apex/backup as staging_data_file. This CL also remove some stale rules being addressed since. Test: ran restorecon on files in /data/apex/active, attempted installing a new apex which triggered the violation when files are linked to /data/apex/backup. With this CL, the operation succeeds. Bug: 112669193 Change-Id: Ib4136e9b9f4993a5b7e02aade8f5c5e300a7793c
2019-03-01 12:28:23 +01:00
/data/apex/active/(.*)? u:object_r:staging_data_file:s0
/data/apex/backup/(.*)? u:object_r:staging_data_file:s0
Rules to allow installing package directories. Earlier changes had extended the rules, but some additional changes are needed. avc: denied { relabelfrom } for name="vmdl-723825123.tmp" dev="mmcblk0p28" ino=162910 scontext=u:r:system_server:s0 tcontext=u:object_r:apk_data_file:s0 tclass=dir Bug: 14975160 Change-Id: I875cfc3538d4b098d27c7c7b756d1868a54cc976
2014-07-07 19:58:53 +02:00
/data/app(/.*)? u:object_r:apk_data_file:s0
Support for storing OAT files in app directory oat dir inside apk_tmp_file should be labeled as dalvikcache_data_file. Bug: 19550105 Change-Id: Ie928b5f47bfc42167bf86fdf10d6913ef25d145d
2015-03-04 03:19:12 +01:00
/data/app/[^/]+/oat(/.*)? u:object_r:dalvikcache_data_file:s0
/data/app/vmdl[^/]+\.tmp(/.*)? u:object_r:apk_tmp_file:s0
/data/app/vmdl[^/]+\.tmp/oat(/.*)? u:object_r:dalvikcache_data_file:s0
Rules to allow installing package directories. Earlier changes had extended the rules, but some additional changes are needed. avc: denied { relabelfrom } for name="vmdl-723825123.tmp" dev="mmcblk0p28" ino=162910 scontext=u:r:system_server:s0 tcontext=u:object_r:apk_data_file:s0 tclass=dir Bug: 14975160 Change-Id: I875cfc3538d4b098d27c7c7b756d1868a54cc976
2014-07-07 19:58:53 +02:00
/data/app-private(/.*)? u:object_r:apk_private_data_file:s0
/data/app-private/vmdl.*\.tmp(/.*)? u:object_r:apk_private_tmp_file:s0
Full sepolicy for gsid. Bug: 122556707 Test: manual test Change-Id: I2536deefb3aa75deee4aeae7df074349b705b0f0
2019-01-23 04:05:29 +01:00
/data/gsi(/.*)? u:object_r:gsi_data_file:s0
update_engine: rules to apply virtual A/B OTA - /data/gsi/ota/* now has the type ota_image_data_file. At runtime during an OTA, update_engine uses libsnapshot to talk to gsid to create these images as a backing storage of snapshots. These "COW images" stores the changes update_engine has applied to the partitions. If the update is successful, these changes will be merged to the partitions, and these images will be teared down. If the update fails, these images will be deleted after rolling back to the previous slot. - /metadata/gsi/ota/* now has the type ota_metadata_file. At runtime during an OTA, update_engine and gsid stores update states and information of the created snapshots there. At next boot, init reads these files to re-create the snapshots. Beside these assignments, this CL also allows gsid and update_engine to have the these permissions to do these operations. Bug: 135752105 Test: apply OTA, no failure Change-Id: Ibd53cacb6b4ee569c33cffbc18b1b801b62265de
2019-08-07 22:01:15 +02:00
/data/gsi/ota(/.*)? u:object_r:ota_image_data_file:s0
[incremental] labels for incfs and directory root Adding two labels: "incfs" for the incremental filesystem and "incremental_root_file" for file paths /data/incremental/*. Doc: go/incremental-selinux Test: manual Change-Id: I7d45ed1677e3422119b2861dfc7b541945fcb7a2
2019-12-18 23:02:38 +01:00
/data/incremental(/.*)? u:object_r:incremental_root_file:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/data/tombstones(/.*)? u:object_r:tombstone_data_file:s0
Wifi hal - Firmware dump permissions we are aiming to improve logging performance by having wifi hal directly write to the flash. Wifi hal need to be able to create, write, and delete files in a directory. This will be restricted to userdebug and eng builds only. Bug: 70170285 Test: compile, run on device Change-Id: Id0cd317411f4c393d7529aa31b501046d7350edb
2017-12-15 23:01:44 +01:00
/data/vendor/tombstones/wifi(/.*)? u:object_r:tombstone_wifi_data_file:s0
Revert "Revert "Various minor policy fixes based on CTS."" This reverts commit ba84bf1dec64d745b6efc516799b2c722a672cd9 Hidden dependency resolved. Change-Id: I9f0844f643abfda8405db2c722a36c847882c392
2013-03-26 19:00:13 +01:00
/data/local/tmp(/.*)? u:object_r:shell_data_file:s0
Add label for kernel test files and executables This required for kernel to do loopback mounts on filesystem images created by the kernel system call tests in LTP. Add a corresponding neverallow to stop all domains from accessing the location at /data/local/tmp/ltp. Bug: 73220071 Test: Boot sailfish successfully Test: run vts-kernel -m VtsKernelLtp -t syscalls.fchown04 Change-Id: I73f5f14017e22971fc246a05751ba67be4653bca Signed-off-by: Sandeep Patil <sspatil@google.com>
2018-02-20 21:41:30 +01:00
/data/local/tmp/ltp(/.*)? u:object_r:nativetest_data_file:s0
Adding write permissions to traceur Fixing denials that stopped traceur from being able to write to debugfs_tracing. Also cleaning up general find denials for services that traceur doesn't have permission to access. Additionally, labeling /data/local/trace as a trace_data_file in order to give traceur a UX friendly area to write its traces to now that it will no longer be a shell user. It will be write/readable by traceur, and deletable/readable by shell. Test: Traceur functionality is not being blocked by selinux policy Bug: 68126425 Change-Id: I201c82975a31094102e90bc81454d3c2a48fae36
2018-01-16 01:44:04 +01:00
/data/local/traces(/.*)? u:object_r:trace_data_file:s0
Label /data/media with its own type and allow access. /data/media presently is left in system_data_file, which requires anything that wants to write to it to be able to write to system_data_file. Introduce a new type for /data/media, media_rw_data_file (to match the media_rw UID assigned to it and distinguish it from /data/misc/media which has media UID and media_data_file type), and allow access to it. We allow this for all platform app domains as WRITE_MEDIA_STORAGE permission is granted to signature|system. We should not have to allow it to untrusted_app. Set up type transitions in sdcardd to automatically label any directories or files it creates with the new type. Change-Id: I5c7e6245b854a9213099e40a41d9583755d37d42 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-17 20:39:35 +01:00
/data/media(/.*)? u:object_r:media_rw_data_file:s0
Apply a label to /data/mediadrm files. /data/mediadrm is appearing on devices but is receiving the system_data_file type. Use the media_data_file label to help classify these files. This new label will help with the following denials. with exisiting allow rules for mediaserver are already in place. type=1400 msg=audit(1389139139.551:308): avc: denied { open } for pid=179 comm="mediaserver" name="ay64.dat" dev="mmcblk0p23" ino=136819 scontext=u:r:mediaserver:s0 tcontext=u:object_r:system_data_file:s0 tclass=file type=1400 msg=audit(1389139140.783:309): avc: denied { read } for pid=179 comm="mediaserver" name="IDM1013" dev="mmcblk0p23" ino=136818 scontext=u:r:mediaserver:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir type=1400 msg=audit(1389139140.783:310): avc: denied { open } for pid=179 comm="mediaserver" name="IDM1013" dev="mmcblk0p23" ino=136818 scontext=u:r:mediaserver:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir Change-Id: I84ac78517fdbb0264cf07379120a62675505fc95 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-01-08 03:53:01 +01:00
/data/mediadrm(/.*)? u:object_r:media_data_file:s0
Create a new SELinux type for /data/nativetest 1) Don't use the generic "system_data_file" for the files in /data/nativetest. Rather, ensure it has it's own special label. This allows us to distinguish these files from other files in SELinux policy. 2) Allow the shell user to execute files from /data/nativetest, on userdebug or eng builds only. 3) Add a neverallow rule (compile time assertion + CTS test) that nobody is allowed to execute these files on user builds, and only the shell user is allowed to execute these files on userdebug/eng builds. Bug: 25340994 Change-Id: I3e292cdd1908f342699d6c52f8bbbe6065359413
2015-10-29 00:45:58 +01:00
/data/nativetest(/.*)? u:object_r:nativetest_data_file:s0
Allow debuggerd to access native tests Test: run a gtest in /data/nativetest/ with no permission denial Change-Id: Id644ed7dbea59becaf84b6073c9144711ad07c10
2017-01-12 23:18:50 +01:00
/data/nativetest64(/.*)? u:object_r:nativetest_data_file:s0
Re-label /data/pkg_staging files as staging. While the directory is not present anymore in Q, it has been shipped on Q Beta 2 and the absence of such label might cause issues to devices with pending installs which receive an OTA > Beta 2. Bug: 130184133 Test: m Change-Id: Ie3e77eebd2e7fd7b3a6a940d189cbc2bb386dc0e
2019-04-09 18:12:13 +02:00
# This directory was removed after Q Beta 2, but we need to preserve labels for upgrading devices.
/data/pkg_staging(/.*)? u:object_r:staging_data_file:s0
Protect /data/property. /data/property is only accessible by root and is used by the init property service for storing persistent property values. Create a separate type for it and only allow init to write to the directory and files within it. Ensure that we do not allow access to other domains in future changes or device-specific policy via a neverallow rule. Change-Id: Iff556b9606c5651c0f1bba902e30b59bdd6f063a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-29 15:22:16 +02:00
/data/property(/.*)? u:object_r:property_data_file:s0
SELinux policies for /data/preloads directory A new directory is created in user data partition that contains preloaded content such as a retail mode demo video and pre-loaded APKs. The new directory is writable/deletable by system server. It can only be readable (including directory list) by privileged or platform apps Bug: 28855287 Change-Id: I3816cd3a1ed5b9a030965698a66265057214f037
2016-05-20 20:08:45 +02:00
/data/preloads(/.*)? u:object_r:preloads_data_file:s0
Split preloads into media_file and data_file Untrusted apps should only access /data/preloads/media and demo directory. Bug: 36197686 Test: Verified retail mode. Checked non-privileged APK cannot access /data/preloads Change-Id: I8e9c21ff6aba799aa31bf06893cdf60dafc04446
2017-03-14 19:42:03 +01:00
/data/preloads/media(/.*)? u:object_r:preloads_media_file:s0
/data/preloads/demo(/.*)? u:object_r:preloads_media_file:s0
Sepolicies for server configural flags reset Test: m -j succeeded and manual tested on device Change-Id: I3415c58335361a9da4ef2368e61bc4e0250a91bb
2018-11-09 01:46:19 +01:00
/data/server_configurable_flags(/.*)? u:object_r:server_configurable_flags_data_file:s0
Rename data/pkg_staging to data/app-staging Test: n/a Bug: 126330086 Change-Id: I34d5085d8e6546d77cc854e27ca849462d482396
2019-02-27 12:21:20 +01:00
/data/app-staging(/.*)? u:object_r:staging_data_file:s0
alphabetize /data/misc entries. Alphabetize the entries for the /data/misc subdirectories. Change-Id: I3690085cbb99c225545545668dedd66341a14edb
2013-12-13 00:23:10 +01:00
SE Android policy.
2012-01-04 18:33:27 +01:00
# Misc data
alphabetize /data/misc entries. Alphabetize the entries for the /data/misc subdirectories. Change-Id: I3690085cbb99c225545545668dedd66341a14edb
2013-12-13 00:23:10 +01:00
/data/misc/adb(/.*)? u:object_r:adb_keys_file:s0
Add type for APEX data directories. This adds a new apex_module_data_file type for the APEX data directories under /data/misc/apexdata and /data/misc_[de|ce]/<u>/apexdata. Permission is given for vold to identify which APEXes are present and create the corresponding directories under apexdata in the ce/de user directories. See go/apex-data-directories. Bug: 141148175 Test: Built & flashed, checked directories were created. Change-Id: I95591e5fe85fc34f7ed21e2f4a75900ec2cfacfa
2019-11-19 19:10:16 +01:00
/data/misc/apexdata(/.*)? u:object_r:apex_module_data_file:s0
Add policies for permission APEX data directory. Bug: 136503238 Test: presubmit Change-Id: I636ab95070df4c58cf2c98b395d99cb807a7f243
2020-01-17 00:47:02 +01:00
/data/misc/apexdata/com.android.permission(/.*)? u:object_r:apex_permission_data_file:s0
Add type for directories containing snapshots of apex data. This adds a new apex_rollback_data_file type for the snapshots (backups) of APEX data directories that can be restored in the event of a rollback. Permission is given for apexd to create files and dirs in those directories and for vold_prepare_subdirs to create the directories. See go/apex-data-directories for details. Bug: 141148175 Test: Built and flashed, checked directory was created with the correct type. Change-Id: I94b448dfc096e5702d3e33ace6f9df69f58340fd
2019-12-02 19:29:48 +01:00
/data/misc/apexrollback(/.*)? u:object_r:apex_rollback_data_file:s0
Setup policy for downloaded apns directory apns downloaded will enter a new directory that TelephonyProvider can access. Bug: 79948106 Test: Manual Change-Id: I1e7660adf020dc7052da94dfa03fd58d0386ac55
2018-05-21 17:01:02 +02:00
/data/misc/apns(/.*)? u:object_r:radio_data_file:s0
Rename camera_calibration_file and audio_firmware_file. Use more general type names for the contents of /data/misc/camera and /data/misc/audio. These were the names used in our policy until 4.3 was released, at which point we switched to be consistent with AOSP. However, the Galaxy S4 4.2.2 image, Galaxy S4 4.3 image, and Galaxy Note 3 4.3 image all shipped with policies using _data_file names because they were based on our older policy. So we may as well switch AOSP to these names. Not sure if in fact these could be all coalesced to the new media_data_file type for /data/misc/media introduced by Ic374488f8b62bd4f8b3c90f30da0e8d1ed1a7343. Options to fix already existing devices, which would only apply to Nexus devices with 4.3 or 4.4 at this point: 1) Add restorecon_recursive /data/misc/audio /data/misc/camera to either the system/core init.rc or to the device-specific init.*.rc files. -or- 2) Add a typealias declaration in the policy to remap the old type names. to the new ones. Then existing types on persistent storage will be remapped internally to the new ones. -or- 3) Some sort of relabeld. Option #2 is implemented by this change. Change-Id: Id36203f5bb66b5200efc1205630b5b260ef97496 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-11-07 19:42:46 +01:00
/data/misc/audio(/.*)? u:object_r:audio_data_file:s0
Restore audio tee sink Bug: 27323882 Change-Id: Idf3977d74817c4f90f9e993d2e1e5302cc56f41d
2016-02-24 01:16:16 +01:00
/data/misc/audioserver(/.*)? u:object_r:audioserver_data_file:s0
Update SELinux policy for audiohal Change-Id: Iaa9907ed516c947175a59bf49938c0ee03b4f6d1
2016-08-04 22:40:23 +02:00
/data/misc/audiohal(/.*)? u:object_r:audiohal_data_file:s0
bootstat: Implement the SELinux policy to allow reading/writing to /data/misc/bootstat. BUG: 21724738 Change-Id: I2789f57cc8182af1a7c33672ef82297f32f54e2e
2016-01-19 19:54:20 +01:00
/data/misc/bootstat(/.*)? u:object_r:bootstat_data_file:s0
Add SELinux settings to support tracing during boot. This CL adds the SELinux settings required to support tracing during boot. https://android-review.googlesource.com/#/c/157163/ BUG: 21739901 Change-Id: Ib3a7107776141ac8cf4f1ca06674f47a0d4b6ae0
2015-06-24 08:24:17 +02:00
/data/misc/boottrace(/.*)? u:object_r:boottrace_data_file:s0
alphabetize /data/misc entries. Alphabetize the entries for the /data/misc subdirectories. Change-Id: I3690085cbb99c225545545668dedd66341a14edb
2013-12-13 00:23:10 +01:00
/data/misc/bluetooth(/.*)? u:object_r:bluetooth_data_file:s0
Allow bluetooth service to access bluetooth directory and add /logs (6/6) Bug: 31466840 Change-Id: I3984754034349e6c41de6ae9cccbaab95ca5a918
2016-09-16 21:55:42 +02:00
/data/misc/bluetooth/logs(/.*)? u:object_r:bluetooth_logs_data_file:s0
alphabetize /data/misc entries. Alphabetize the entries for the /data/misc subdirectories. Change-Id: I3690085cbb99c225545545668dedd66341a14edb
2013-12-13 00:23:10 +01:00
/data/misc/bluedroid(/.*)? u:object_r:bluetooth_data_file:s0
Add file_contexts entries for socket files. So that we do not relabel them on a restorecon -R /data. Change-Id: I8dd915d9bb80067339621b905ea2b4ea0fa8d71e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-04 20:29:51 +01:00
/data/misc/bluedroid/\.a2dp_ctrl u:object_r:bluetooth_socket:s0
/data/misc/bluedroid/\.a2dp_data u:object_r:bluetooth_socket:s0
alphabetize /data/misc entries. Alphabetize the entries for the /data/misc subdirectories. Change-Id: I3690085cbb99c225545545668dedd66341a14edb
2013-12-13 00:23:10 +01:00
/data/misc/camera(/.*)? u:object_r:camera_data_file:s0
Setting up SELinux policy for carrier id Bug: 64131637 Test: Manual Change-Id: I0170c5eb465aa663582e3974348380a8f0c9b27f
2018-01-02 19:21:33 +01:00
/data/misc/carrierid(/.*)? u:object_r:radio_data_file:s0
dhcp policy.
2012-08-15 12:25:14 +02:00
/data/misc/dhcp(/.*)? u:object_r:dhcp_data_file:s0
Properly escape dots in file_contexts filenames I found these with the regex (?<!\\)\.(?!\*|\+) Test: make Change-Id: I1c2e817d164b1074cb359cdb6d46bcf71e220765
2018-10-24 15:50:22 +02:00
/data/misc/dhcp-6\.8\.2(/.*)? u:object_r:dhcp_data_file:s0
Setting up SELinux policy for Emergency number database Test: Manual; https://paste.googleplex.com/6222197494382592 Bug: 136027884 Change-Id: I29214de6b5b5a62bff246c1256567844f4ce55c7
2019-10-15 22:13:56 +02:00
/data/misc/emergencynumberdb(/.*)? u:object_r:emergency_data_file:s0
gatekeeperd: use more specific label for /data file Use a more specific label for /data/misc/gatekeeper Rearrange some other rules. Change-Id: Ib634e52526cf31a8f0a0e6d12bbf0f69dff8f6b5
2015-04-18 02:56:31 +02:00
/data/misc/gatekeeper(/.*)? u:object_r:gatekeeper_data_file:s0
Add incident command and incidentd daemon se policy. Test: adb shell incident Bug: 31122534 Change-Id: I4ac9c9ab86867f09b63550707673149fe60f1906
2016-11-21 08:23:04 +01:00
/data/misc/incidents(/.*)? u:object_r:incident_data_file:s0
Move layout_version to /data/misc/installd Bug: 139543295 Test: Boot, ensure file is properly created Change-Id: I577b25bcf61505970b153884d8ac3567957bb50a
2019-08-16 22:41:55 +02:00
/data/misc/installd(/.*)? u:object_r:install_data_file:s0
Pull keychain-data policy out of system-data Migrators should be allowed to write to /data/misc/keychain in order to remove it. Similarly /data/misc/user should be writable by system apps. TODO: Revoke zygote's rights to read from /data/misc/keychain on behalf of some preloaded security classes. Bug: 17811821 Change-Id: I9e9c6883cff1dca3755732225404909c16a0e547
2014-10-13 13:10:08 +02:00
/data/misc/keychain(/.*)? u:object_r:keychain_data_file:s0
alphabetize /data/misc entries. Alphabetize the entries for the /data/misc subdirectories. Change-Id: I3690085cbb99c225545545668dedd66341a14edb
2013-12-13 00:23:10 +01:00
/data/misc/keystore(/.*)? u:object_r:keystore_data_file:s0
logd: logpersistd - Enable logpersistd to write to /data/misc/logd - Enable logpersistd to read from pstore to help complete any content lost by reboot disruption - Enable shell readonly ability logpersistd files in /data/misc/logd - Enable logcat -f when placed into logd context to act as a logpersistd (nee logcatd) agent, restrict access to run only in userdebug or eng Bug: 19608716 Change-Id: I3209582bc796a1093c325c90068a48bf268e5ab5
2015-05-27 00:12:45 +02:00
/data/misc/logd(/.*)? u:object_r:misc_logd_file:s0
alphabetize /data/misc entries. Alphabetize the entries for the /data/misc subdirectories. Change-Id: I3690085cbb99c225545545668dedd66341a14edb
2013-12-13 00:23:10 +01:00
/data/misc/media(/.*)? u:object_r:media_data_file:s0
Allow netd to create data files in /data/misc/net/. This will be used to populate rt_tables (a mapping from routing table numbers to table names) that's read by the iproute2 utilities. Change-Id: I69deb1a64d5d6647470823405bf0cc55b24b22de
2014-07-08 07:04:57 +02:00
/data/misc/net(/.*)? u:object_r:net_data_file:s0
Add Network Watchlist data file selinux policy(Used in ConfigUpdater) Bug: 63908748 Test: Able to boot Change-Id: I14d8856d7aac7be9d1f26ecf5bfff69ea5ee9607
2017-12-14 10:56:32 +01:00
/data/misc/network_watchlist(/.*)? u:object_r:network_watchlist_data_file:s0
SELinux policies for Perfetto cmdline client (/system/bin/perfetto) Instead of having statsd linking the perfetto client library and talk directly to its socket, we let just statsd exec() the /system/bin/perfetto cmdline client. There are two reasons for this: 1) Simplify the interaction between statsd and perfetto, reduce dependencies, binary size bloat and isolate faults. 2) The cmdline client also takes care of handing the trace to Dropbox. This allows to expose the binder interaction surface to the short-lived cmdline client and avoid to grant binder access to the perfetto traced daemon. This cmdline client will be used by: - statsd - the shell user (for our UI and Studio) Bug: 70942310 Change-Id: I8cdde181481ad0a1a5cae5937ac446cedac54a1f
2018-01-24 17:07:09 +01:00
/data/misc/perfetto-traces(/.*)? u:object_r:perfetto_traces_data_file:s0
Add recovery_persist & recovery_refresh One time executables. recovery_refresh can be used at any time to ensure recovery logs in pmsg are re-placed at the end of the FIFO. recovery_persist takes the recovery logs in pmsg and drops them into /data/misc/recovery/ directory. Bug: 27176738 Change-Id: Ife3cf323930fb7a6a5d1704667961f9d42bfc5ac
2016-03-16 16:11:49 +01:00
/data/misc/recovery(/.*)? u:object_r:recovery_data_file:s0
Define SELinux policy for RELRO sharing support. Define a domain and appropriate access rules for shared RELRO files (used for loading the WebView native library). Any app is permitted to read the files as they are public data, but only the shared_relro process is permitted to create/update them. Bug: 13005501 Change-Id: I9d5ba9e9eedb9b8c80fe6f84a3fc85a68553d52e
2014-05-23 12:01:58 +02:00
/data/misc/shared_relro(/.*)? u:object_r:shared_relro_file:s0
Label /data/misc/sms as a radio_data_file. This change helps with the following denials. avc: denied { write } for pid=14157 comm="Thread-88" name="premium_sms_policy.xml" dev="mmcblk0p28" ino=618998 scontext=u:r:radio:s0 tcontext=u:object_r:system_data_file:s0 tclass=file avc: denied { write } for pid=14293 comm="Thread-89" name="sms" dev="mmcblk0p28" ino=618952 scontext=u:r:radio:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir Prior to this patch the directory was labeled as system_data_file which is a bit too generic. This directory contains xml files with regexs which represent premium numbers that are used to warn the user before sending. Change-Id: I98288b25aa1546477e05eee9f7622324b013e695 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-18 18:29:51 +01:00
/data/misc/sms(/.*)? u:object_r:radio_data_file:s0
active metric dir for statsd Bug: 123904359 Test: unit test Change-Id: I92ac4ef97fb4f951270679f829601b1aca893b7c
2019-02-05 22:30:17 +01:00
/data/misc/stats-active-metric(/.*)? u:object_r:stats_data_file:s0
Setting up SELinux policy for statsd and stats service Bug: 63757906 Test: manual testing conducted Change-Id: Id03413ce82b5646d4bceddc59e16c7d5ee5bc193
2017-12-19 00:14:33 +01:00
/data/misc/stats-data(/.*)? u:object_r:stats_data_file:s0
/data/misc/stats-service(/.*)? u:object_r:stats_data_file:s0
alphabetize /data/misc entries. Alphabetize the entries for the /data/misc subdirectories. Change-Id: I3690085cbb99c225545545668dedd66341a14edb
2013-12-13 00:23:10 +01:00
/data/misc/systemkeys(/.*)? u:object_r:systemkeys_data_file:s0
SELinux configuration for TextClassifier model updates. Test: bit FrameworksCoreTests:android.view.textclassifier.TextClassificationManagerTest Bug: 34780396 Change-Id: I8b98fef913df571e55474ea2529f71750874941c
2017-04-26 22:20:20 +02:00
/data/misc/textclassifier(/.*)? u:object_r:textclassifier_data_file:s0
train info persist to disk sepolicy Test: will add gts Bug: 122807604 Change-Id: I60d2b207d8cf652ff90111cc5bef996f14d93376
2019-02-13 00:40:02 +01:00
/data/misc/train-info(/.*)? u:object_r:stats_data_file:s0
Pull keychain-data policy out of system-data Migrators should be allowed to write to /data/misc/keychain in order to remove it. Similarly /data/misc/user should be writable by system apps. TODO: Revoke zygote's rights to read from /data/misc/keychain on behalf of some preloaded security classes. Bug: 17811821 Change-Id: I9e9c6883cff1dca3755732225404909c16a0e547
2014-10-13 13:10:08 +02:00
/data/misc/user(/.*)? u:object_r:misc_user_data_file:s0
alphabetize /data/misc entries. Alphabetize the entries for the /data/misc subdirectories. Change-Id: I3690085cbb99c225545545668dedd66341a14edb
2013-12-13 00:23:10 +01:00
/data/misc/vpn(/.*)? u:object_r:vpn_data_file:s0
/data/misc/wifi(/.*)? u:object_r:wifi_data_file:s0
sepolicy: Permission changes for new wifi mainline module Move wifi services out of system_server into a separate APK/process. Changes: a) Created sepolicy for the new wifi apk. b) The new APK will run with network_stack uid (eventually will be moved to the same process). Used 'audit2allow' tool to gather list of permissions required. Note: The existing wifi related permissions in system_server is left behind to allow the module to be loaded into system_server or network_stack process depending on device configuration. Bug: 113174748 Test: Device boots up and able to make wifi connection. Test: Tested hotspot functionality. Test: Ran WifiManagerTest & WifiSoftApTest ACTS tests locally. Test: Will send for wifi regression tests. Change-Id: Id19643a235bf0c28238f2729926b893ac2025b97 (cherry-picked from c7aa90091e6bec70a31a643cc4519a9a86fb0b38)
2019-06-10 21:46:09 +02:00
/data/misc_ce/[0-9]+/wifi(/.*)? u:object_r:wifi_data_file:s0
Label /data/misc/wifi/sockets with wpa_socket. This will ensure that any sockets created in this directory will default to wpa_socket unless a type_transition is defined. Define a type transition for system_server to keep its separate system_wpa_socket type assigned for its socket. Allow wpa to create and unlink sockets in the directory. We leave the already existing rules for wifi_data_file in place for compatibility with existing devices that have wifi_data_file on /data/misc/wifi/sockets. Change-Id: I9e35cc93abf89ce3594860aa3193f84a3b42ea6e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-01-29 19:45:51 +01:00
/data/misc/wifi/sockets(/.*)? u:object_r:wpa_socket:s0
/data/misc/wifi/sockets/wpa_ctrl.* u:object_r:system_wpa_socket:s0
Label /data/misc/zoneinfo And allow any SELinux domain to read these timezone related files. Addresses the following denial: <5>[ 4.746399] type=1400 audit(3430294.470:7): avc: denied { open } for pid=197 comm="time_daemon" name="tzdata" dev="mmcblk0p28" ino=618992 scontext=u:r:time:s0 tcontext=u:object_r:system_data_file:s0 tclass=file Change-Id: Iff32465e62729d7aad8c79607848d89ce0aede86
2013-12-13 00:32:42 +01:00
/data/misc/zoneinfo(/.*)? u:object_r:zoneinfo_data_file:s0
Directory for vold to store private data. Creates new directory at /data/misc/vold for storing key material on internal storage. Only vold should have access to this label. Change-Id: I7f2d1314ad3b2686e29e2037207ad83d2d3bf465
2015-04-01 00:03:13 +02:00
/data/misc/vold(/.*)? u:object_r:vold_data_file:s0
iorapd: Add new binder service iorapd. This daemon is very locked down. Only system_server can access it. Bug: 72170747 Change-Id: I7b72b9191cb192be96001d84d067c28292c9688f
2018-10-05 23:48:29 +02:00
/data/misc/iorapd(/.*)? u:object_r:iorapd_data_file:s0
Move update_engine policy to AOSP. The update_engine daemon from Brillo is expected to be used also in Android so move its selinux policy to AOSP. Put update_engine in the whitelist (currently only has the recovery there) allowing it to bypass the notallow for writing to partititions labeled as system_block_device. Also introduce the misc_block_device dev_type as update_engine in some configurations may need to read/write the misc partition. Start migrating uncrypt to use this instead of overly broad block_device:blk_file access. Bug: 23186405 Test: Manually tested with Brillo build. Change-Id: Icf8cdb4133d4bbdf14bacc6c0fa7418810ac307a
2015-10-05 23:04:39 +02:00
/data/misc/update_engine(/.*)? u:object_r:update_engine_data_file:s0
Allow update_engine to access /data/misc/update_engine_log Add label update_engine_log_data_file for log files created by update engine in directory /data/misc/update_engine_log. Bug: 65568605 Test: manual Change-Id: I379db82a0ea540e41cb3b8e03f93d9ce64fac7c9
2017-11-06 12:56:00 +01:00
/data/misc/update_engine_log(/.*)? u:object_r:update_engine_log_data_file:s0
Protect dropbox service data with selinux Create a new label for /data/system/dropbox, and neverallow direct access to anything other than init and system_server. While all apps may write to the dropbox service, only apps with android.permission.READ_LOGS, a signature|privileged|development permission, may read them. Grant access to priv_app, system_app, and platform_app, and neverallow access to all untrusted_apps. Bug: 31681871 Test: atest CtsStatsdHostTestCases Test: atest DropBoxTest Test: atest ErrorsTests Change-Id: Ice302b74b13c4d66e07b069c1cdac55954d9f5df
2018-04-16 16:49:49 +02:00
/data/system/dropbox(/.*)? u:object_r:dropbox_data_file:s0
Allow system_server to collect app heapdumps (debug builds only) On debuggable builds, system_server can request app heap dumps by running something similar to the following commands: % adb shell am set-watch-heap com.android.systemui 1048576 % adb shell dumpsys procstats --start-testing which will dump the app's heap to /data/system/heapdump. See framework/base commit b9a5e4ad30c9add140fd13491419ae66e947809d. Allow this behavior. Addresses the following denial: avc: denied { write } for path="/data/system/heapdump/javaheap.bin" dev="dm-0" ino=150747 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:system_data_file:s0 tclass=file permissive=0 Bug: 20073185 Change-Id: I4b925033a5456867caf2697de6c2d683d0743540
2015-04-08 01:40:44 +02:00
/data/system/heapdump(/.*)? u:object_r:heapdump_data_file:s0
Add SElinux rules for /data/misc/trace The directory is to be used in eng/userdebug build to store method traces (previously stored in /data/dalvik-cache/profiles). Bug: 25612377 Change-Id: Ia4365a8d1f13d33ee54115dc5e3bf62786503993
2015-11-10 19:49:57 +01:00
/data/misc/trace(/.*)? u:object_r:method_trace_data_file:s0
Add window trace files SELinux policy rules - Allow system_server to create and write to /data/misc/wmtrace/* - Allow surfaceflinger to create and write files from /data/misc/wmtrace/* - Allow dumpstate to read files from /data/misc/wmtrace/* permissions are restricted to userdebug or eng builds Bug: 64831661 Test: adb shell cmd window tracing start && adb shell cmd window tracing stop Test: adb shell su root service call SurfaceFlinger 1025 i32 1 >/dev/null && adb shell su root service call SurfaceFlinger 1025 i32 0 >/dev/null Test: adb bugreport ~/tmp.zip && adb shell su root dmesg | grep 'avc: ' Change-Id: I0b15166560739d73d7749201f3ad197dbcf5791c
2017-11-17 17:23:32 +01:00
/data/misc/wmtrace(/.*)? u:object_r:wm_trace_data_file:s0
Update permissions for the dedicated profile folders Bug: 26719109 Bug: 26563023 Change-Id: Ie0ca764467c874c061752cbbc73e1bacead9b995
2016-02-01 20:28:39 +01:00
# TODO(calin) label profile reference differently so that only
# profman run as a special user can write to them
/data/misc/profiles/cur(/.*)? u:object_r:user_profile_data_file:s0
/data/misc/profiles/ref(/.*)? u:object_r:user_profile_data_file:s0
SELinux policy for /data/misc/profman Bug: 28748264 Change-Id: I872c25666707beb737f3ce7a4f706c0135df7ad5
2016-05-27 21:41:35 +02:00
/data/misc/profman(/.*)? u:object_r:profman_dump_data_file:s0
label /data/vendor{_ce,_de} Restrictions introduced in vendor init mean that new devices may not no longer exempt vendor init from writing to system_data_file. This means we must introduce a new label for /data/vendor which vendor_init may write to. Bug: 73087047 Test: build and boot Taimen and Marlin. Complete SUW, enroll fingerprint No new denials. Change-Id: I65f904bb28952d4776aab947515947e14befbe34
2018-02-08 01:29:06 +01:00
/data/vendor(/.*)? u:object_r:vendor_data_file:s0
/data/vendor_ce(/.*)? u:object_r:vendor_data_file:s0
/data/vendor_de(/.*)? u:object_r:vendor_data_file:s0
alphabetize /data/misc entries. Alphabetize the entries for the /data/misc subdirectories. Change-Id: I3690085cbb99c225545545668dedd66341a14edb
2013-12-13 00:23:10 +01:00
storaged: move storaged file from DE to CE Allow vold/system_server to call storaged service Test: adb shell storaged -u Bug: 63740245 Change-Id: I88219e32520006db20299468b7a8c7ce0bfa58e0 Merged-In: I88219e32520006db20299468b7a8c7ce0bfa58e0 (cherry picked from commit fa6c3d7c4c9e18bc5d1877db0ed4c8ef833783d2)
2017-10-17 01:39:13 +02:00
# storaged proto files
allow vold_prepare_subdirs to create storaged directories Test: Boot device, observe logs Bug: 63740245 Change-Id: I1068304b12ea90736b7927b7368ba1a213d2fbae
2017-10-19 23:41:37 +02:00
/data/misc_de/[0-9]+/storaged(/.*)? u:object_r:storaged_data_file:s0
storaged: move storaged file from DE to CE Allow vold/system_server to call storaged service Test: adb shell storaged -u Bug: 63740245 Change-Id: I88219e32520006db20299468b7a8c7ce0bfa58e0 Merged-In: I88219e32520006db20299468b7a8c7ce0bfa58e0 (cherry picked from commit fa6c3d7c4c9e18bc5d1877db0ed4c8ef833783d2)
2017-10-17 01:39:13 +02:00
/data/misc_ce/[0-9]+/storaged(/.*)? u:object_r:storaged_data_file:s0
Add selinux policy for fingerprintd Change-Id: Ibcb714248c28abf21272986facaade376dcbd7ef
2015-05-13 00:16:06 +02:00
# Fingerprint data
/data/system/users/[0-9]+/fpdata(/.*)? u:object_r:fingerprintd_data_file:s0
Fingerprint data is now stored in one of two ways depending on the shipping API version: For devices shipped on O-MR1 nothing changes, data is stored under /data/system/users/<user-id>/fpdata/... Devices shipped from now on will instead store fingerprint data under /data/vendor_de/<user-id>/fpdata. Support for /data/vendor_de and /data/vendor_ce has been added to vold. Bug: 36997597 Change-Id: Ibc7cc33b756f64abe68a749c0ada0ca4f6d92514 Merged-In: Ibc7cc33b756f64abe68a749c0ada0ca4f6d92514 Test: manually (cherry picked from commit 6116daa71a226dc848978717064b805272801ff4)
2018-01-22 22:24:10 +01:00
# Fingerprint vendor data file
Revert "Add placeholder iris and face policy for vold data directory" This reverts commit 92bde4b941b7078a5fdf8aec6660ca44d0ffbb49. Reason for revert: Rebooting after OTA fails due to the filesystem still seeing the old label on the device. Bug: 116528212 Bug: 119747564 Change-Id: Ib5f920f85c7e305e89c377369dca038d2c6c738c Test: rollback change
2018-11-19 19:42:11 +01:00
/data/vendor_de/[0-9]+/fpdata(/.*)? u:object_r:fingerprint_vendor_data_file:s0
Fingerprint data is now stored in one of two ways depending on the shipping API version: For devices shipped on O-MR1 nothing changes, data is stored under /data/system/users/<user-id>/fpdata/... Devices shipped from now on will instead store fingerprint data under /data/vendor_de/<user-id>/fpdata. Support for /data/vendor_de and /data/vendor_ce has been added to vold. Bug: 36997597 Change-Id: Ibc7cc33b756f64abe68a749c0ada0ca4f6d92514 Merged-In: Ibc7cc33b756f64abe68a749c0ada0ca4f6d92514 Test: manually (cherry picked from commit 6116daa71a226dc848978717064b805272801ff4)
2018-01-22 22:24:10 +01:00
Add placeholder iris and face policy for vold data directory This is PS1 of aosp/828283 which was reverted. Using PS1 shouldn't cause the same issue. Test: vold is able to create directories, ag/5534962 Bug: 116528212 Change-Id: I84aca49a8dae0a087498120780dea0962aca04b3
2018-11-16 00:28:07 +01:00
# Face vendor data file
/data/vendor_de/[0-9]+/facedata(/.*)? u:object_r:face_vendor_data_file:s0
Add /data/vendor_ce/0/facedata alongside its vendor_de relation Bug: 131084614 Test: Modify vold_prepare_subdirs to match and test on Crosshatch. Change-Id: Id5402e6b5da3f1e5549f49f8273dd9f052c348d7
2019-04-24 02:26:12 +02:00
/data/vendor_ce/[0-9]+/facedata(/.*)? u:object_r:face_vendor_data_file:s0
Add placeholder iris and face policy for vold data directory This is PS1 of aosp/828283 which was reverted. Using PS1 shouldn't cause the same issue. Test: vold is able to create directories, ag/5534962 Bug: 116528212 Change-Id: I84aca49a8dae0a087498120780dea0962aca04b3
2018-11-16 00:28:07 +01:00
# Iris vendor data file
/data/vendor_de/[0-9]+/irisdata(/.*)? u:object_r:iris_vendor_data_file:s0
bootchart: add policy rules for bootchart allow the bootchart to create dir and files at init, also allow user to create the stop and start file under /data/bootchart directory to start and stop bootchart Change-Id: Icfee8dcd17366383eef00fbe3139744bf4427a6b Signed-off-by: Yongqin Liu <yongqin.liu@linaro.org>
2014-12-05 06:40:22 +01:00
# Bootchart data
/data/bootchart(/.*)? u:object_r:bootchart_data_file:s0
Add initial sepolicy for app data snapshots. Define a rollback_data_file label and apply it to the snapshots directory. This change contains just enough detail to allow vold_prepare_subdirs to prepare these directories correctly. A follow up change will flesh out the access policy on these directories in more detail. Test: make, manual Bug: 112431924 Change-Id: I4fa7187d9558697016af4918df6e34aac1957176
2019-01-14 16:02:12 +01:00
# App data snapshots (managed by installd).
/data/misc_de/[0-9]+/rollback(/.*)? u:object_r:rollback_data_file:s0
/data/misc_ce/[0-9]+/rollback(/.*)? u:object_r:rollback_data_file:s0
Add type for APEX data directories. This adds a new apex_module_data_file type for the APEX data directories under /data/misc/apexdata and /data/misc_[de|ce]/<u>/apexdata. Permission is given for vold to identify which APEXes are present and create the corresponding directories under apexdata in the ce/de user directories. See go/apex-data-directories. Bug: 141148175 Test: Built & flashed, checked directories were created. Change-Id: I95591e5fe85fc34f7ed21e2f4a75900ec2cfacfa
2019-11-19 19:10:16 +01:00
# Apex data directories
/data/misc_de/[0-9]+/apexdata(/.*)? u:object_r:apex_module_data_file:s0
/data/misc_ce/[0-9]+/apexdata(/.*)? u:object_r:apex_module_data_file:s0
Add policies for permission APEX data directory. Bug: 136503238 Test: presubmit Change-Id: I636ab95070df4c58cf2c98b395d99cb807a7f243
2020-01-17 00:47:02 +01:00
/data/misc_de/[0-9]+/apexdata/com.android.permission(/.*)? u:object_r:apex_permission_data_file:s0
/data/misc_ce/[0-9]+/apexdata/com.android.permission(/.*)? u:object_r:apex_permission_data_file:s0
Add type for APEX data directories. This adds a new apex_module_data_file type for the APEX data directories under /data/misc/apexdata and /data/misc_[de|ce]/<u>/apexdata. Permission is given for vold to identify which APEXes are present and create the corresponding directories under apexdata in the ce/de user directories. See go/apex-data-directories. Bug: 141148175 Test: Built & flashed, checked directories were created. Change-Id: I95591e5fe85fc34f7ed21e2f4a75900ec2cfacfa
2019-11-19 19:10:16 +01:00
Add type for directories containing snapshots of apex data. This adds a new apex_rollback_data_file type for the snapshots (backups) of APEX data directories that can be restored in the event of a rollback. Permission is given for apexd to create files and dirs in those directories and for vold_prepare_subdirs to create the directories. See go/apex-data-directories for details. Bug: 141148175 Test: Built and flashed, checked directory was created with the correct type. Change-Id: I94b448dfc096e5702d3e33ace6f9df69f58340fd
2019-12-02 19:29:48 +01:00
# Apex rollback directories
/data/misc_de/[0-9]+/apexrollback(/.*)? u:object_r:apex_rollback_data_file:s0
/data/misc_ce/[0-9]+/apexrollback(/.*)? u:object_r:apex_rollback_data_file:s0
Initial policy for expanded storage. Expanded storage supports a subset of the features of the internal data partition. Mirror that policy for consistency. vold is also granted enough permissions to prepare initial directories. avc: denied { write } for name="ext" dev="tmpfs" ino=3130 scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { add_name } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { create } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { setattr } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" dev="tmpfs" ino=7243 scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { mounton } for path="/mnt/ext/57f8f4bc-abf4-655f-bf67-946fc0f9f25b" dev="tmpfs" ino=7243 scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { getattr } for path="/mnt/ext" dev="tmpfs" ino=3130 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { setattr } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" dev="tmpfs" ino=4471 scontext=u:r:vold:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=1 avc: denied { getattr } for path="/mnt/expand/57f8f4bc-abf4-655f-bf67-946fc0f9f25b/media" dev="dm-0" ino=145153 scontext=u:r:vold:s0 tcontext=u:object_r:media_rw_data_file:s0 tclass=dir permissive=1 avc: denied { rmdir } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" dev="tmpfs" ino=6380 scontext=u:r:vold:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=1 avc: denied { create } for name="tmp" scontext=u:r:vold:s0 tcontext=u:object_r:shell_data_file:s0 tclass=dir permissive=1 avc: denied { setattr } for name="tmp" dev="dm-0" ino=72578 scontext=u:r:vold:s0 tcontext=u:object_r:shell_data_file:s0 tclass=dir permissive=1 Bug: 19993667 Change-Id: I73c98b36e7c066f21650a9e16ea82c5a0ef3d6c5
2015-04-07 01:21:54 +02:00
#############################
# Expanded data files
#
/mnt/expand(/.*)? u:object_r:mnt_expand_file:s0
/mnt/expand/[^/]+(/.*)? u:object_r:system_data_file:s0
/mnt/expand/[^/]+/app(/.*)? u:object_r:apk_data_file:s0
/mnt/expand/[^/]+/app/[^/]+/oat(/.*)? u:object_r:dalvikcache_data_file:s0
/mnt/expand/[^/]+/app/vmdl[^/]+\.tmp(/.*)? u:object_r:apk_tmp_file:s0
/mnt/expand/[^/]+/app/vmdl[^/]+\.tmp/oat(/.*)? u:object_r:dalvikcache_data_file:s0
/mnt/expand/[^/]+/local/tmp(/.*)? u:object_r:shell_data_file:s0
/mnt/expand/[^/]+/media(/.*)? u:object_r:media_rw_data_file:s0
drop_caches label, vold scratch space on expanded. Define an explicit label for /proc/sys/vm/drop_caches and grant to the various people who need it, including vold which uses it when performing storage benchmarks. Also let vold create new directories under it's private storage area where the benchmarks will be carried out. Mirror the definition of the private storage area on expanded media. avc: denied { write } for name="drop_caches" dev="proc" ino=20524 scontext=u:r:vold:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=0 Bug: 21172095 Change-Id: I300b1cdbd235ff60e64064d3ba6e5ea783baf23f
2015-05-15 05:55:31 +02:00
/mnt/expand/[^/]+/misc/vold(/.*)? u:object_r:vold_data_file:s0
Initial policy for expanded storage. Expanded storage supports a subset of the features of the internal data partition. Mirror that policy for consistency. vold is also granted enough permissions to prepare initial directories. avc: denied { write } for name="ext" dev="tmpfs" ino=3130 scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { add_name } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { create } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { setattr } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" dev="tmpfs" ino=7243 scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { mounton } for path="/mnt/ext/57f8f4bc-abf4-655f-bf67-946fc0f9f25b" dev="tmpfs" ino=7243 scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { getattr } for path="/mnt/ext" dev="tmpfs" ino=3130 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { setattr } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" dev="tmpfs" ino=4471 scontext=u:r:vold:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=1 avc: denied { getattr } for path="/mnt/expand/57f8f4bc-abf4-655f-bf67-946fc0f9f25b/media" dev="dm-0" ino=145153 scontext=u:r:vold:s0 tcontext=u:object_r:media_rw_data_file:s0 tclass=dir permissive=1 avc: denied { rmdir } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" dev="tmpfs" ino=6380 scontext=u:r:vold:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=1 avc: denied { create } for name="tmp" scontext=u:r:vold:s0 tcontext=u:object_r:shell_data_file:s0 tclass=dir permissive=1 avc: denied { setattr } for name="tmp" dev="dm-0" ino=72578 scontext=u:r:vold:s0 tcontext=u:object_r:shell_data_file:s0 tclass=dir permissive=1 Bug: 19993667 Change-Id: I73c98b36e7c066f21650a9e16ea82c5a0ef3d6c5
2015-04-07 01:21:54 +02:00
allow coredump functionality (cherrypick of commit d7e004ebf949ae21b299a49cff9917f6560200a3) Change-Id: I7993698ac96f21db0039681275280dbd43ff61ba
2014-10-31 20:40:12 +01:00
# coredump directory for userdebug/eng devices
/cores(/.*)? u:object_r:coredump_file:s0
Add rules for original + processed wallpaper files Bug 25454501 Change-Id: I31357e658ecdbcc69df47fbc2d22e4849dd1539b
2016-01-27 01:39:34 +01:00
# Wallpaper files
Track wallpaper API changes Bug 25454162 Change-Id: I3cd299ce28bf6235605265c47762969851845b78
2016-02-11 04:39:12 +01:00
/data/system/users/[0-9]+/wallpaper_lock_orig u:object_r:wallpaper_file:s0
/data/system/users/[0-9]+/wallpaper_lock u:object_r:wallpaper_file:s0
Add rules for original + processed wallpaper files Bug 25454501 Change-Id: I31357e658ecdbcc69df47fbc2d22e4849dd1539b
2016-01-27 01:39:34 +01:00
/data/system/users/[0-9]+/wallpaper_orig u:object_r:wallpaper_file:s0
New users need a wallpaper_file type. Change-Id: I7ff4ed9f73f43918cac05a026af68cca8dbe02c3 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-11-30 16:41:14 +01:00
/data/system/users/[0-9]+/wallpaper u:object_r:wallpaper_file:s0
Offer to cache ringtones in system DE storage. Ringtones often live on shared media, which is now encrypted with CE keys and not available until after the user is unlocked. To improve the user experience while locked, cache the default ringtone, notification sound, and alarm sound in a DE storage area. Also fix bug where wallpaper_file wasn't getting data_file_type. Bug: 26730753 Change-Id: Ib1f08d03eb734c3dce91daab41601d3ed14f4f0d
2016-02-23 01:50:01 +01:00
# Ringtone files
/data/system_de/[0-9]+/ringtones(/.*)? u:object_r:ringtone_file:s0
Allow "shortcut manager" icons to be returned to apps ... and client apps to read them. A full path looks like this: /data/system_ce/[user-id]/shortcut_service/bitmaps/[creator-app-package]/[timestamp].png System server will: - Create/delete the directories. - Write/remove PNG files in them. - Open the PNG files and return file descriptors to client apps Client apps will: - Receive file descriptors and read from them. Bug 27548047 Change-Id: I3d9ac6ab0c92b2953b84c3c5aabe1f653e6bea6b
2016-03-09 00:06:44 +01:00
# ShortcutManager icons, e.g.
# /data/system_ce/0/shortcut_service/bitmaps/com.example.app/1457472879282.png
/data/system_ce/[0-9]+/shortcut_service/bitmaps(/.*)? u:object_r:shortcut_manager_icons:s0
Modified security policy to allow user to get their own icon. BUG: 27583869 Change-Id: I0a25bd03f3998d48dba355b91140611e38ce7b0d
2016-02-25 16:37:06 +01:00
# User icon files
Properly escape dots in file_contexts filenames I found these with the regex (?<!\\)\.(?!\*|\+) Test: make Change-Id: I1c2e817d164b1074cb359cdb6d46bcf71e220765
2018-10-24 15:50:22 +02:00
/data/system/users/[0-9]+/photo\.png u:object_r:icon_file:s0
Modified security policy to allow user to get their own icon. BUG: 27583869 Change-Id: I0a25bd03f3998d48dba355b91140611e38ce7b0d
2016-02-25 16:37:06 +01:00
vold_prepare_subdirs sets policy in vold-created dirs. Bug: 25861755 Test: Boot device, observe logs Change-Id: I6c13430d42e9794003eb48e6ca219b874112b900 Merged-In: I6c13430d42e9794003eb48e6ca219b874112b900 (cherry picked from commit 47f3ed09d222ee126cf2fe23b5fe15cd0b64520e)
2017-10-13 23:54:32 +02:00
# vold per-user data
/data/misc_de/[0-9]+/vold(/.*)? u:object_r:vold_data_file:s0
/data/misc_ce/[0-9]+/vold(/.*)? u:object_r:vold_data_file:s0
iorapd: Add new binder service iorapd. This daemon is very locked down. Only system_server can access it. Bug: 72170747 Change-Id: I7b72b9191cb192be96001d84d067c28292c9688f
2018-10-05 23:48:29 +02:00
# iorapd per-user data
/data/misc_ce/[0-9]+/iorapd(/.*)? u:object_r:iorapd_data_file:s0
Add rules for multi-user backup/restore The backup system service will move its storage location to per-user CE directories to support multiple users. Add additional iterations on the existing rules to support the new location. /data/backup -> /data/system_ce/[user id]/backup Previously covered by rule backup_data_file /cache/backup -> /data/system_ce/[user id]/backup_stage Previously covered by rule cache_backup_file Also add support for vold to create and perform restorecon on the new locations. Example denials and detailed proposal in the doc on the linked bug. Bug: 121197420 Test: 1) Boot device; check dirs created with correct label; run backup successfully on system user 2) Create secondary user; check dirs created with correct label; run backup successfully Change-Id: I47faa69cd2a6ac55fb762edbf366a86d3b06ca77
2019-01-15 22:20:13 +01:00
# Backup service persistent per-user bookkeeping
/data/system_ce/[0-9]+/backup(/.*)? u:object_r:backup_data_file:s0
# Backup service temporary per-user data for inter-change with apps
/data/system_ce/[0-9]+/backup_stage(/.*)? u:object_r:backup_data_file:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
#############################
# efs files
#
/efs(/.*)? u:object_r:efs_file:s0
Offer to cache ringtones in system DE storage. Ringtones often live on shared media, which is now encrypted with CE keys and not available until after the user is unlocked. To improve the user experience while locked, cache the default ringtone, notification sound, and alarm sound in a DE storage area. Also fix bug where wallpaper_file wasn't getting data_file_type. Bug: 26730753 Change-Id: Ib1f08d03eb734c3dce91daab41601d3ed14f4f0d
2016-02-23 01:50:01 +01:00
SE Android policy.
2012-01-04 18:33:27 +01:00
#############################
# Cache files
#
/cache(/.*)? u:object_r:cache_file:s0
Creates a new permission for /cache/recovery This permission was created mostly for dumpstate (so it can include recovery files on bugreports when an OTA fails), but it was applied to uncrypt and recovery as well (since it had a wider access before). Grant access to cache_recovery_file where we previously granted access to cache_file. Add auditallow rules to determine if this is really needed. BUG: 25351711 Change-Id: I07745181dbb4f0bde75694ea31b3ab79a4682f18
2015-12-22 21:37:17 +01:00
/cache/recovery(/.*)? u:object_r:cache_recovery_file:s0
Move staged backup content to a specific cache subdir Also narrowly specify the domain for the local transport's bookkeeping. Bug 26834865 Change-Id: I2eea8a10f29356ffecabd8e102f7afa90123c535
2016-01-28 20:30:41 +01:00
# General backup/restore interchange with apps
/cache/backup_stage(/.*)? u:object_r:cache_backup_file:s0
# LocalTransport (backup) uses this subtree
/cache/backup(/.*)? u:object_r:cache_private_backup_file:s0
fs_mgr: add overlayfs handling for squashfs system filesystems /cache/overlay directory in support of overlayfs mounts on userdebug and eng devices. Overlayfs in turn can be capable of supporting adb remount for read-only or restricted-storage filesystems like squashfs or right-sized (zero free space) system partitions respectively. Test: compile Bug: 109821005 Bug: 110985612 Change-Id: I3ece03886db7cc97f864497cf93ec6c6c39bccd1
2018-06-13 17:02:29 +02:00
#############################
# Overlayfs support directories
#
/cache/overlay(/.*)? u:object_r:overlayfs_file:s0
fs_mgr: add /mnt/scratch to possible overlayfs support directories A default set of options are available, but can override in a fstab overlay entry with upperdir=, lowerdir= to the same mount point, workdir=. The default is a valid /mnt/scratch/overlay/ or /cache/overlay/ directory, with .../<mount_point>/upper and .../<mount_point>/work, associated with each system partition <mount_point>. Test: manual Bug: 109821005 Change-Id: I5662c01fad17d105665be065f6dcd7c3fdc40d95
2018-07-02 17:13:40 +02:00
/mnt/scratch(/.*)? u:object_r:overlayfs_file:s0
fs_mgr: add overlayfs handling for squashfs system filesystems /cache/overlay directory in support of overlayfs mounts on userdebug and eng devices. Overlayfs in turn can be capable of supporting adb remount for read-only or restricted-storage filesystems like squashfs or right-sized (zero free space) system partitions respectively. Test: compile Bug: 109821005 Bug: 110985612 Change-Id: I3ece03886db7cc97f864497cf93ec6c6c39bccd1
2018-06-13 17:02:29 +02:00
sepolicy: add support for devices without cache partition Adds the rules for /data/cache used for devices which do not have a cache partition. Bug: 28747374 Change-Id: I7c749e7692c9b8eab02029bbae5a3c78585030da
2016-05-14 00:22:44 +02:00
/data/cache(/.*)? u:object_r:cache_file:s0
/data/cache/recovery(/.*)? u:object_r:cache_recovery_file:s0
# General backup/restore interchange with apps
/data/cache/backup_stage(/.*)? u:object_r:cache_backup_file:s0
# LocalTransport (backup) uses this subtree
/data/cache/backup(/.*)? u:object_r:cache_private_backup_file:s0
Move more metadata policy from device to here Test: booted metadata-encrypted device Bug: 79781913 Change-Id: Ib4cb4a04145e5619994083da055f06fe7ae0137a
2018-05-17 19:15:53 +02:00
#############################
# Metadata files
#
/metadata(/.*)? u:object_r:metadata_file:s0
Add policy for /metadata/apex. This is an area that apexd can use to store session metadata, which won't be rolled back with filesystem checkpointing. Bug: 126740531 Test: builds Change-Id: I5abbc500dc1b92aa46830829be76e7a4381eef91
2019-03-12 16:37:13 +01:00
/metadata/apex(/.*)? u:object_r:apex_metadata_file:s0
Move more metadata policy from device to here Test: booted metadata-encrypted device Bug: 79781913 Change-Id: Ib4cb4a04145e5619994083da055f06fe7ae0137a
2018-05-17 19:15:53 +02:00
/metadata/vold(/.*)? u:object_r:vold_metadata_file:s0
Full sepolicy for gsid. Bug: 122556707 Test: manual test Change-Id: I2536deefb3aa75deee4aeae7df074349b705b0f0
2019-01-23 04:05:29 +01:00
/metadata/gsi(/.*)? u:object_r:gsi_metadata_file:s0
update_engine: rules to apply virtual A/B OTA - /data/gsi/ota/* now has the type ota_image_data_file. At runtime during an OTA, update_engine uses libsnapshot to talk to gsid to create these images as a backing storage of snapshots. These "COW images" stores the changes update_engine has applied to the partitions. If the update is successful, these changes will be merged to the partitions, and these images will be teared down. If the update fails, these images will be deleted after rolling back to the previous slot. - /metadata/gsi/ota/* now has the type ota_metadata_file. At runtime during an OTA, update_engine and gsid stores update states and information of the created snapshots there. At next boot, init reads these files to re-create the snapshots. Beside these assignments, this CL also allows gsid and update_engine to have the these permissions to do these operations. Bug: 135752105 Test: apply OTA, no failure Change-Id: Ibd53cacb6b4ee569c33cffbc18b1b801b62265de
2019-08-07 22:01:15 +02:00
/metadata/gsi/ota(/.*)? u:object_r:ota_metadata_file:s0
Add sepolicy for /metadata/password_slots. The device OS and an installed GSI will both attempt to write authentication data to the same weaver slots. To prevent this, we can use the /metadata partition (required for GSI support) to communicate which slots are in use between OS images. To do this we define a new /metadata/password_slots directory and define sepolicy to allow system_server (see PasswordSlotManager) to access it. Bug: 123716647 Test: no denials on crosshatch Change-Id: I8e3679d332503b5fb8a8eb6455de068c22eba30b
2019-02-28 23:11:34 +01:00
/metadata/password_slots(/.*)? u:object_r:password_slot_metadata_file:s0
Add selinux labels for /metadata/ota. /metadata/ota will store critical bits necessary to reify system and vendor partition state during an OTA. It will be accessed primarily by first-stage init, recovery/fastbootd, and update_engine. Bug: 136678799 Test: manual test Change-Id: Ib78cb96ac60ca11bb27d2b2fe011482e64ba0cf8
2019-07-09 04:03:59 +02:00
/metadata/ota(/.*)? u:object_r:ota_metadata_file:s0
Move more metadata policy from device to here Test: booted metadata-encrypted device Bug: 79781913 Change-Id: Ib4cb4a04145e5619994083da055f06fe7ae0137a
2018-05-17 19:15:53 +02:00
Add missing comment from my previous merge in 47966ce. Test: Built. Change-Id: Ia5f5b52e10e9411cd87901053675d9e77a622529
2017-07-27 21:23:00 +02:00
#############################
New asec container labeling. This patchset covers the /mnt/asec variety only.
2012-07-30 20:20:40 +02:00
# asec containers
Rules to allow installing package directories. Earlier changes had extended the rules, but some additional changes are needed. avc: denied { relabelfrom } for name="vmdl-723825123.tmp" dev="mmcblk0p28" ino=162910 scontext=u:r:system_server:s0 tcontext=u:object_r:apk_data_file:s0 tclass=dir Bug: 14975160 Change-Id: I875cfc3538d4b098d27c7c7b756d1868a54cc976
2014-07-07 19:58:53 +02:00
/mnt/asec(/.*)? u:object_r:asec_apk_file:s0
/mnt/asec/[^/]+/[^/]+\.zip u:object_r:asec_public_file:s0
/mnt/asec/[^/]+/lib(/.*)? u:object_r:asec_public_file:s0
/data/app-asec(/.*)? u:object_r:asec_image_file:s0
Updated policy for external storage. An upcoming platform release is redesigning how external storage works. At a high level, vold is taking on a more active role in managing devices that dynamically appear. This change also creates further restricted domains for tools doing low-level access of external storage devices, including sgdisk and blkid. It also extends sdcardd to be launchable by vold, since launching by init will eventually go away. For compatibility, rules required to keep AOSP builds working are marked with "TODO" to eventually remove. Slightly relax system_server external storage rules to allow calls like statfs(). Still neverallow open file descriptors, since they can cause kernel to kill us. Here are the relevant violations that this CL is designed to allow: avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
#############################
# external storage
/mnt/media_rw(/.*)? u:object_r:mnt_media_rw_file:s0
/mnt/user(/.*)? u:object_r:mnt_user_file:s0
Deprecate /mnt/sdcard -> /storage/self/primary symlink. "This symlink was suppose to have been removed in the Gingerbread time frame, but lives on." https://android.googlesource.com/platform/system/core/+/d2f0a2c%5E!/ Apps targeting R+ must NOT use that symlink. For older apps we allow core init.rc to create /mnt/sdcard -> /storage/self/primary symlink. Bug: 129497117 Test: boot device, /mnt/sdcard still around. Change-Id: I6ecd1928c0f598792d9badbf6616e3acc0450b0d
2019-04-12 00:23:24 +02:00
/mnt/sdcard u:object_r:mnt_sdcard_file:s0
Protect runtime storage mount points. We have a bunch of magic that mounts the correct view of storage access based on the runtime permissions of an app, but we forgot to protect the real underlying data sources; oops. This series of changes just bumps the directory heirarchy one level to give us /mnt/runtime which we can mask off as 0700 to prevent people from jumping to the exposed internals. Also add CTS tests to verify that we're protecting access to internal mount points like this. Bug: 22964288 Change-Id: Ic585c4d4381fe51bd764902ef28c38db63b7f2cc
2015-08-06 20:52:45 +02:00
/mnt/runtime(/.*)? u:object_r:storage_file:s0
Updated policy for external storage. An upcoming platform release is redesigning how external storage works. At a high level, vold is taking on a more active role in managing devices that dynamically appear. This change also creates further restricted domains for tools doing low-level access of external storage devices, including sgdisk and blkid. It also extends sdcardd to be launchable by vold, since launching by init will eventually go away. For compatibility, rules required to keep AOSP builds working are marked with "TODO" to eventually remove. Slightly relax system_server external storage rules to allow calls like statfs(). Still neverallow open file descriptors, since they can cause kernel to kill us. Here are the relevant violations that this CL is designed to allow: avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
/storage(/.*)? u:object_r:storage_file:s0
Sepolicy for rw mount point for vendors. Bug: 64905218 Test: device boots with /mnt/vendor present and selinux label mnt_vendor_file applied correctly. Change-Id: Ib34e2859948019d237cf2fe8f71845ef2533ae27 Merged-In: Ib34e2859948019d237cf2fe8f71845ef2533ae27 (cherry picked from commit 210a805b46782a2a49bf5338732cf8c6abaf95de)
2018-04-11 05:49:45 +02:00
#############################
# mount point for read-write vendor partitions
Sepolicy for rw mount point for product extensions. Bug: 110808288 Test: device boots with /mnt/product present and selinux label mnt_product_file applied correctly. Change-Id: I596e4b79285fe1a79d31ad1b07f4bcffe6a6cd98
2018-06-29 04:10:00 +02:00
/mnt/vendor(/.*)? u:object_r:mnt_vendor_file:s0
#############################
# mount point for read-write product partitions
/mnt/product(/.*)? u:object_r:mnt_product_file:s0
Reference in a new issue Copy permalink