tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/file.te

657 lines
31 KiB
Text
Raw Normal View History

SE Android policy.
2012-01-04 18:33:27 +01:00
# Filesystem types
type labeledfs, fs_type;
type pipefs, fs_type;
type sockfs, fs_type;
type rootfs, fs_type;
proc_type attribute for files under /proc. With this attribute it will be easier to reference /proc files. Bug: 74182216 Test: policy builds Change-Id: I5b7da508d821e45f122832261a742a201e8fdf2c
2018-02-16 03:07:18 +01:00
type proc, fs_type, proc_type;
Add sepolicy for binderfs /dev/binder, /dev/hwbinder and /dev/vndbinder are relocating to /dev/binderfs/binder /dev/binderfs/hwbinder and /dev/binderfs/vndbinder. This patch adds the sepolicy to allow the switch. The following are some of the denials that get taken care of by this patch(there are too many to copy). audit(1575835230.863:16): avc: denied { search } for comm="servicemanager" name="/" dev="binder" ino=1 scontext=u:r:servicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir permissive=1 audit(1575835230.863:16): avc: denied { read } for comm="servicemanager" name="binder" dev="binder" ino=4 scontext=u:r:servicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.863:17): avc: denied { write } for comm="servicemanager" name="binder" dev="binder" ino=4 scontext=u:r:servicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.863:17): avc: denied { open } for comm="servicemanager" path="/dev/binderfs/binder" dev="binder" ino=4 scontext=u:r:servicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.863:18): avc: denied { ioctl } for comm="servicemanager" path="/dev/binderfs/binder" dev="binder" ino=4 ioctlcmd=0x6209 scontext=u:r:servicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.863:19): avc: denied { map } for comm="servicemanager" path="/dev/binderfs/binder" dev="binder" ino=4 scontext=u:r:servicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.867:20): avc: denied { search } for comm="vndservicemanag" name="/" dev="binder" ino=1 scontext=u:r:vndservicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir permissive=1 audit(1575835230.867:20): avc: denied { read } for comm="vndservicemanag" name="vndbinder" dev="binder" ino=6 scontext=u:r:vndservicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.867:21): avc: denied { write } for comm="vndservicemanag" name="vndbinder" dev="binder" ino=6 scontext=u:r:vndservicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.867:21): avc: denied { open } for comm="vndservicemanag" path="/dev/binderfs/vndbinder" dev="binder" ino=6 scontext=u:r:vndservicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.867:22): avc: denied { ioctl } for comm="vndservicemanag" path="/dev/binderfs/vndbinder" dev="binder" ino=6 ioctlcmd=0x6209 scontext=u:r:vndservicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.867:23): avc: denied { map } for comm="vndservicemanag" path="/dev/binderfs/vndbinder" dev="binder" ino=6 scontext=u:r:vndservicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.871:25): avc: denied { search } for comm="hwservicemanage" name="/" dev="binder" ino=1 scontext=u:r:hwservicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir permissive=1 audit(1575835238.351:72): avc: denied { search } for comm="android.hardwar" name="proc" dev="binder" ino=1048586 scontext=u:r:hal_configstore_default:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir permissive=1 Test: boots without any issues when binderfs in enabled. Bug: 136497735 Change-Id: Ib0f8f2156c960eb7b394dd7c79ae96c7da8bc213
2019-12-08 21:11:01 +01:00
type binderfs, fs_type;
type binderfs_logs, fs_type;
type binderfs_logs_proc, fs_type;
Allow system server read binderfs stats When receiving the binder transaction errors reported by Android applications, AMS needs a way to verify that information. Currently Linux kernel doesn't provide such an API. Use binderfs instead until kernel binder driver adds that functionality in the future. Bug: 199336863 Test: send binder calls to frozen apps and check logcat Test: take bugreport and check binder stats logs Change-Id: I3bab3d4f35616b4a7b99d6ac6dc79fb86e7f28d4
2023-10-12 06:48:19 +02:00
type binderfs_logs_stats, fs_type;
Guard new types with starting_at_board_api macro To prevent these types from being released in 24Q3, which must be same as 202404 release. Bug: 330670954 Test: build Change-Id: Ibb124fbb069f2025a572bc09c73c241f808676c3
2024-04-22 08:43:18 +02:00
starting_at_board_api(202504, `
type binderfs_logs_transactions, fs_type;
')
sepolicy: allow access to binderfs feature files The binder driver now advertises the features it supports through individual files under /dev/binderfs/features/*. Let all domains have access to these files to determine how to interact with the driver. Bug: 191910201 Tested: clients are able to read feature files via libbinder Signed-off-by: Carlos Llamas <cmllamas@google.com> Change-Id: Ice5de9efee74e571ef0a23ce093af162fc3b276e
2022-02-24 17:15:56 +01:00
type binderfs_features, fs_type;
Restrict the ability to set usermodehelpers and proc security settings. Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06 15:31:40 +01:00
# Security-sensitive proc nodes that should not be writable to most.
proc_type attribute for files under /proc. With this attribute it will be easier to reference /proc files. Bug: 74182216 Test: policy builds Change-Id: I5b7da508d821e45f122832261a742a201e8fdf2c
2018-02-16 03:07:18 +01:00
type proc_security, fs_type, proc_type;
type proc_drop_caches, fs_type, proc_type;
type proc_overcommit_memory, fs_type, proc_type;
type proc_min_free_order_shift, fs_type, proc_type;
Relabel /proc/kpageflags and grant access to heapprofd. Bug: 132952543 Change-Id: I3d956ba7279af37d783515c0bf649e6fb94c3082
2019-05-16 20:47:04 +02:00
type proc_kpageflags, fs_type, proc_type;
allow init to access watermark_boost_factor Bug: 189938926 Test: boot Signed-off-by: Martin Liu <liumartin@google.com> Change-Id: I07c8490c94c837952921e95f12efa6213edbf056
2021-07-01 06:10:26 +02:00
type proc_watermark_boost_factor, fs_type, proc_type;
add percpu_pagelist_high_fraction type Bug: 309409009 Test: boot Change-Id: I04db2ab3a95a5427e6d89cf128ed953fdc823107 Signed-off-by: Martin Liu <liumartin@google.com>
2023-11-06 15:35:45 +01:00
type proc_percpu_pagelist_high_fraction, fs_type, proc_type;
Guard proc_compaction_proactiveness Bug: 330670954 Test: TH Change-Id: I92c5f5d08fbe16a7c185e430799c98b6a9b38ecf
2024-04-25 02:58:55 +02:00
starting_at_board_api(202504, `
type proc_compaction_proactiveness, fs_type, proc_type;
')
Restrict the ability to set usermodehelpers and proc security settings. Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06 15:31:40 +01:00
# proc, sysfs, or other nodes that permit configuration of kernel usermodehelpers.
proc_type attribute for files under /proc. With this attribute it will be easier to reference /proc files. Bug: 74182216 Test: policy builds Change-Id: I5b7da508d821e45f122832261a742a201e8fdf2c
2018-02-16 03:07:18 +01:00
type usermodehelper, fs_type, proc_type;
create separate usermodehelper type for sysfs Prevent files in /proc from incorrectly having sysfs_type attribute. Rework neverallows so that ueventd has write access to all of /sys which it needs to handle uevents. Bug: 63147833 Test: Build. Flash angler, verify files are correctly labeled and no new denials are in the logs. Change-Id: Ib94d44e78cee0e83e2ac924f1c72e611e8e73558
2017-07-12 19:37:57 +02:00
type sysfs_usermodehelper, fs_type, sysfs_type;
Rename qtaguid_proc to conform to name conventions Test: build Bug: 68774956 Change-Id: I0f9fd87eb41e67e14f35e49eba13e3d1de745250
2018-04-03 18:53:23 +02:00
type proc_qtaguid_ctrl, fs_type, mlstrustedobject, proc_type;
proc_type attribute for files under /proc. With this attribute it will be easier to reference /proc files. Bug: 74182216 Test: policy builds Change-Id: I5b7da508d821e45f122832261a742a201e8fdf2c
2018-02-16 03:07:18 +01:00
type proc_qtaguid_stat, fs_type, mlstrustedobject, proc_type;
type proc_bluetooth_writable, fs_type, proc_type;
type proc_abi, fs_type, proc_type;
type proc_asound, fs_type, proc_type;
Add sepolicy for /proc/bootconfig Vendor boot hal, init, and vold processes all require permission. Test: build and boot aosp_cf_x86_64_phone Bug: 173815685 Change-Id: I15692dcd39dfc9c3a3b7d8c12d03eff0a7c96f72
2021-02-17 18:30:52 +01:00
type proc_bootconfig, fs_type, proc_type;
introduce new 'proc_bpf' for bpf related sysctls What to tag chosen based on output of: find /proc 2>/dev/null | egrep bpf on a 5.10 kernel. Tagged with prefixes to be more likely not require changes in the future $ adb root $ adb shell 'ls -lZ /proc/sys/net/core/bpf_* /proc/sys/kernel/*bpf*' Before: -rw-r--r-- 1 root root u:object_r:proc:s0 0 2021-11-11 02:11 /proc/sys/kernel/bpf_stats_enabled -rw-r--r-- 1 root root u:object_r:proc:s0 0 2021-11-11 02:11 /proc/sys/kernel/unprivileged_bpf_disabled -rw-r--r-- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_enable -rw------- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_harden -rw------- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_kallsyms -rw------- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_limit After: -rw-r--r-- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/kernel/bpf_stats_enabled -rw-r--r-- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/kernel/unprivileged_bpf_disabled -rw-r--r-- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_enable -rw------- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_harden -rw------- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_kallsyms -rw------- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_limit Test: TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I46ea81ff42d3b915cf7a96735dc2636d9808ead6
2021-11-11 10:51:15 +01:00
type proc_bpf, fs_type, proc_type;
proc_type attribute for files under /proc. With this attribute it will be easier to reference /proc files. Bug: 74182216 Test: policy builds Change-Id: I5b7da508d821e45f122832261a742a201e8fdf2c
2018-02-16 03:07:18 +01:00
type proc_buddyinfo, fs_type, proc_type;
Allow shell read access to cgroup state at /proc/cgroups. Test: adb shell cat /proc/cgroups Bug: 335278695 Change-Id: I52773c63200a2a048a4c5497c338ddcbe0f23593
2024-04-26 20:28:28 +02:00
starting_at_board_api(202504, `
type proc_cgroups, fs_type, proc_type;
')
proc_type attribute for files under /proc. With this attribute it will be easier to reference /proc files. Bug: 74182216 Test: policy builds Change-Id: I5b7da508d821e45f122832261a742a201e8fdf2c
2018-02-16 03:07:18 +01:00
type proc_cmdline, fs_type, proc_type;
Allow init to write to /proc/cpu/alignment The root init.rc does "write /proc/cpu/alignment 4", but we don't actually allow this write in core sepolicy. This seems to be a 32-bit ARM only proc file. Noticed when booting 32-bit ARM Cuttlefish. Bug: 145371497 Change-Id: Ic099395708f7236bcc2fc5c561809a7e129786de
2021-10-29 05:31:44 +02:00
type proc_cpu_alignment, fs_type, proc_type;
proc_type attribute for files under /proc. With this attribute it will be easier to reference /proc files. Bug: 74182216 Test: policy builds Change-Id: I5b7da508d821e45f122832261a742a201e8fdf2c
2018-02-16 03:07:18 +01:00
type proc_cpuinfo, fs_type, proc_type;
type proc_dirty, fs_type, proc_type;
type proc_diskstats, fs_type, proc_type;
type proc_extra_free_kbytes, fs_type, proc_type;
type proc_filesystems, fs_type, proc_type;
add label for /proc/sys/fs/verity/require_signatures This CL add new label for files created by fsverity. Bug: 112038861 Test: ls -Z /proc/sys/fs/verity/require_signatures. Change-Id: I8e49ad9a43282bc608449eb0db4ea78617c4ee9a
2019-03-09 00:47:22 +01:00
type proc_fs_verity, fs_type, proc_type;
proc_type attribute for files under /proc. With this attribute it will be easier to reference /proc files. Bug: 74182216 Test: policy builds Change-Id: I5b7da508d821e45f122832261a742a201e8fdf2c
2018-02-16 03:07:18 +01:00
type proc_hostname, fs_type, proc_type;
type proc_hung_task, fs_type, proc_type;
type proc_interrupts, fs_type, proc_type;
type proc_iomem, fs_type, proc_type;
Allow tracing service to access kallsyms on userdebug This CL allows the traced_probes service to temporarily lower kptr_restrict and read /proc/kallsyms. This is allowed only on userdebug/eng builds. The lowering of kptr_restrict is done via an init property because the kernel checks that the kptr_restrict writer is CAP_SYS_ADMIN, regardless of the /proc file ACLs [1]. [1] https://github.com/torvalds/linux/blob/4cbffc461ec91287c4cb1d0e27b01b988d0b8fba/kernel/sysctl.c#L2254 Bug: 136133013 Design doc: go/perfetto-kallsyms Test: perfetto_integrationtests --gtest_filter=PerfettoTest.KernelAddressSymbolization in r.android.com/1454882 Change-Id: Ic06e7a9a74c0f3e42fa63f7f41decc385c9fea2c
2020-10-09 10:15:10 +02:00
type proc_kallsyms, fs_type, proc_type;
add selinux rules for mini-keyctl mini-keyctl is a binary used to load channel keys to .fsverity keyring. This CL creates a new domain for mini-keyctl and a type for /proc/keys and adds allow rules needed by this binary. Bug: 112038861 Test: manual Merged-In: I3b744d302859a02dfe63c81c7f33bb30912d7994 Change-Id: I3b744d302859a02dfe63c81c7f33bb30912d7994
2019-01-30 00:27:21 +01:00
type proc_keys, fs_type, proc_type;
proc_type attribute for files under /proc. With this attribute it will be easier to reference /proc files. Bug: 74182216 Test: policy builds Change-Id: I5b7da508d821e45f122832261a742a201e8fdf2c
2018-02-16 03:07:18 +01:00
type proc_kmsg, fs_type, proc_type;
type proc_loadavg, fs_type, proc_type;
sepolicy: allow system_server to read /proc/locks Access to /proc/locks is necessary to activity manager to determine wheter a process holds a lock or not prior freezing it. Test: verified access of /proc/locks while testing other CLs in the same topic. Bug: 176928302 Change-Id: I14a65da126ff26c6528edae137d3ee85d3611509
2021-01-07 00:14:24 +01:00
type proc_locks, fs_type, proc_type;
lmkd: grant access to /proc/lowmemorykiller lmkd needs to read /proc/lowmemorykiller to send statslog events in response to applications being killed. Bug: 130017100 Change-Id: I929d5a372e1b2f63b7b5ed421f1898ebddaec01c
2019-04-26 18:27:58 +02:00
type proc_lowmemorykiller, fs_type, proc_type;
proc_type attribute for files under /proc. With this attribute it will be easier to reference /proc files. Bug: 74182216 Test: policy builds Change-Id: I5b7da508d821e45f122832261a742a201e8fdf2c
2018-02-16 03:07:18 +01:00
type proc_max_map_count, fs_type, proc_type;
type proc_meminfo, fs_type, proc_type;
type proc_misc, fs_type, proc_type;
type proc_modules, fs_type, proc_type;
type proc_mounts, fs_type, proc_type;
Start the process of locking down proc/net Files in /proc/net leak information. This change is the first step in determining which files apps may use, whitelisting benign access, and otherwise removing access while providing safe alternative APIs. To that end, this change: * Introduces the proc_net_type attribute which will assigned to any new SELinux types in /proc/net to avoid removing access to privileged processes. These processes may be evaluated later, but are lower priority than apps. * Labels /proc/net/{tcp,tcp6,udp,udp6} as proc_net_vpn due to existing use by VPN apps. This may be replaced by an alternative API. * Audits all other proc/net access for apps. * Audits proc/net access for other processes which are currently granted broad read access to /proc/net but should not be including storaged, zygote, clatd, logd, preopt2cachename and vold. Bug: 9496886 Bug: 68016944 Test: Boot Taimen-userdebug. On both wifi and cellular: stream youtube navigate maps, send text message, make voice call, make video call. Verify no avc "granted" messages in the logs. Test: A few VPN apps including "VPN Monster", "Turbo VPN", and "Freighter". Verify no logspam with the current setup. Test: atest CtsNativeNetTestCases Test: atest netd_integration_test Test: atest QtaguidPermissionTest Test: atest FileSystemPermissionTest Change-Id: I7e49f796a25cf68bc698c6c9206e24af3ae11457 Merged-In: I7e49f796a25cf68bc698c6c9206e24af3ae11457 (cherry picked from commit 087318957f26e921d62f2e234fc14bff3c59030e)
2018-04-10 21:47:48 +02:00
type proc_net, fs_type, proc_type, proc_net_type;
Remove access to /proc/net/{tcp,udp} Remove these files from proc_net_type. Domains that need access must have permission explicitly granted. Neverallow app access except the shell domain. Bug: 114475727 Test: atest CtsLibcoreOjTestCases Test: netstat, lsof Test: adb bugreport Change-Id: I2304e3e98c0d637af78a361569466aa2fbe79fa0
2018-09-28 19:55:14 +02:00
type proc_net_tcp_udp, fs_type, proc_type;
proc_type attribute for files under /proc. With this attribute it will be easier to reference /proc files. Bug: 74182216 Test: policy builds Change-Id: I5b7da508d821e45f122832261a742a201e8fdf2c
2018-02-16 03:07:18 +01:00
type proc_page_cluster, fs_type, proc_type;
type proc_pagetypeinfo, fs_type, proc_type;
type proc_panic, fs_type, proc_type;
type proc_perf, fs_type, proc_type;
type proc_pid_max, fs_type, proc_type;
type proc_pipe_conf, fs_type, proc_type;
sepolicy: Allow lmkd access to psi procfs nodes Lmkd needs read access to /proc/pressure/memory, proc/pressure/cpu and proc/pressure/io nodes to read current psi levels. Lmkd needs write access to /proc/pressure/memory to set psi monitor triggers. Bug: 111308141 Test: modified lmkd to use PSI and tested using lmkd_unit_test Signed-off-by: Suren Baghdasaryan <surenb@google.com> Merged-In: I9efd60c7fbb89cc08938fa5119b13d794813b52b Change-Id: I9efd60c7fbb89cc08938fa5119b13d794813b52b
2018-05-11 00:36:59 +02:00
type proc_pressure_cpu, fs_type, proc_type;
type proc_pressure_io, fs_type, proc_type;
type proc_pressure_mem, fs_type, proc_type;
proc_type attribute for files under /proc. With this attribute it will be easier to reference /proc files. Bug: 74182216 Test: policy builds Change-Id: I5b7da508d821e45f122832261a742a201e8fdf2c
2018-02-16 03:07:18 +01:00
type proc_random, fs_type, proc_type;
type proc_sched, fs_type, proc_type;
access to /proc/slabinfo init, dumpstate and shell Test: check avc for init is now gone Bug: 7232205 Bug: 109821005 Change-Id: I299a0ba29bcc97a97047f12a5c48f6056f5e6de5
2018-06-14 16:34:19 +02:00
type proc_slabinfo, fs_type, proc_type;
proc_type attribute for files under /proc. With this attribute it will be easier to reference /proc files. Bug: 74182216 Test: policy builds Change-Id: I5b7da508d821e45f122832261a742a201e8fdf2c
2018-02-16 03:07:18 +01:00
type proc_stat, fs_type, proc_type;
type proc_swaps, fs_type, proc_type;
type proc_sysrq, fs_type, proc_type;
type proc_timer, fs_type, proc_type;
type proc_tty_drivers, fs_type, proc_type;
type proc_uid_cputime_showstat, fs_type, proc_type;
type proc_uid_cputime_removeuid, fs_type, proc_type;
type proc_uid_io_stats, fs_type, proc_type;
type proc_uid_procstat_set, fs_type, proc_type;
type proc_uid_time_in_state, fs_type, proc_type;
type proc_uid_concurrent_active_time, fs_type, proc_type;
type proc_uid_concurrent_policy_time, fs_type, proc_type;
type proc_uid_cpupower, fs_type, proc_type;
type proc_uptime, fs_type, proc_type;
type proc_version, fs_type, proc_type;
type proc_vmallocinfo, fs_type, proc_type;
type proc_vmstat, fs_type, proc_type;
Allow init to execute extra_free_kbytes.sh script extra_free_kbytes.sh is used by init to set /sys/vm/watermark_scale_factor value. Allow init to execute extra_free_kbytes.sh and the script to access /proc/sys/vm/watermark_scale_factor and /proc/sys/vm/extra_free_kbytes files. Bug: 109664768 Signed-off-by: Suren Baghdasaryan <surenb@google.com> Change-Id: I55ec07e12a1cc5322cfdd4a48d0bdc607f45d832
2021-07-29 23:29:47 +02:00
type proc_watermark_scale_factor, fs_type, proc_type;
proc_type attribute for files under /proc. With this attribute it will be easier to reference /proc files. Bug: 74182216 Test: policy builds Change-Id: I5b7da508d821e45f122832261a742a201e8fdf2c
2018-02-16 03:07:18 +01:00
type proc_zoneinfo, fs_type, proc_type;
Move vendor_sched to common sepolicy Previously vendor_sched is put under product area which will be replaced by GSI. To solve it, move it to system/sepolicy. Bug: 194656257 Test: build pass Change-Id: Ia0b855e3a876a58b58f79b4fba09293419797b47
2021-07-29 15:24:38 +02:00
type proc_vendor_sched, proc_type, fs_type;
More MLS trusted subject/object annotations. dumpstate and lmkd need to act on apps running at any level. Various file types need to be writable by apps running at any level. Change-Id: Idf574d96ba961cc110a48d0a00d30807df6777ba Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-11 21:51:28 +02:00
type selinuxfs, fs_type, mlstrustedobject;
Add sepolicy for FUSE control filesystem. To allow vold to abort it. Bug: 153411204 Test: vold can access it Merged-In: I334eaf3459905c27d614db8eda18c27e62bea5fa Change-Id: I334eaf3459905c27d614db8eda18c27e62bea5fa
2020-05-28 15:04:48 +02:00
type fusectlfs, fs_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
type cgroup, fs_type, mlstrustedobject;
sepolicy support for cgroup v2 cgroup v2 is going to be used for freezer v2 support. The cgroup v2 hiearchy will be mounted by init under /sys/fs/cgroup hence proper access rights are necessary for sysfs. After mounting, the cgroup v2 kernfs will use the label cgroup_v2 and system_manager will handle the freezer Bug: 154548692 Test: verified that files undes sysfs and cgroup v2 kernfs are accessed as required to allow proper functioning for the freezer. Change-Id: Idfb3f6e77b60dad032d1e306d2f9b58cd5775960
2020-05-27 23:10:39 +02:00
type cgroup_v2, fs_type;
Add sysfs_type attribute to sysfs, coalesce ueventd rules. As per the discussion in: https://android-review.googlesource.com/#/c/92903/ Add sysfs_type attribute to sysfs type so that it is included in rules on sysfs_type, allow setattr to all sysfs_type for ueventd for chown/chmod, and get rid of redundant rules. Change-Id: I1228385d5703168c3852ec75605ed8da7c99b83d Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-08 19:18:52 +02:00
type sysfs, fs_type, sysfs_type, mlstrustedobject;
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
type sysfs_android_usb, fs_type, sysfs_type;
sysfs_uio: declare type in core policy /dev/uio uio_device is already declared. Accessing uio through /sys is also common. Bug: 26990688 Change-Id: I3db941161dae31d3b87f265708abbcd9171a2c1f
2016-03-25 15:52:22 +01:00
type sysfs_uio, sysfs_type, fs_type;
Add sysfs_batteryinfo label. Shell user needs to be able to get current device battery_level via /sys/class/power_supply/battery/capacity. Create a global label and corresponding policy for accessing this. Rely on each device to label the appropriate sysfs entry. Bug: 26219114 Change-Id: I2c5ef489a9db2fdf7bbd5afd04278214b814351c
2016-01-05 23:32:54 +01:00
type sysfs_batteryinfo, fs_type, sysfs_type;
Update policy for Android 4.2 / latest master. Update policy for Android 4.2 / latest master. Primarily this consists of changes around the bluetooth subsystem. The zygote also needs further permissions to set up /storage/emulated. adbd service now gets a socket under /dev/socket. keystore uses the binder. Change-Id: I8c5aeb8d100313c75169734a0fa614aa974b3bfc Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-11-16 15:06:47 +01:00
type sysfs_bluetooth_writable, fs_type, sysfs_type, mlstrustedobject;
Allow traced_probes to read devfreq - Add dir read access to /sys/class/devfreq/ - Add file read access to /sys/class/devfreq/$DEVICE/cur_freq Resolves the following denials: W traced_probes: type=1400 audit(0.0:8): avc: denied { read } for name="devfreq" dev="sysfs" ino=28076 scontext=u:r:traced_probes:s0 tcontext=u:object_r:sysfs:s0 tclass=dir permissive=0 W traced_probes: type=1400 audit(0.0:226): avc: denied { read } for name="cur_freq" dev="sysfs" ino=54729 scontext=u:r:traced_probes:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=0 See ag/14187061 for device specific sysfs_devfreq_cur labels Bug: 181850306 Test: ls -Z, record perfetto trace Change-Id: I23cebb16505313160e14b49e82e24da9b81cad70
2021-04-16 14:02:06 +02:00
type sysfs_devfreq_cur, fs_type, sysfs_type;
type sysfs_devfreq_dir, fs_type, sysfs_type;
Stop using the bdev_type and sysfs_block_type SELinux attributes Stop using these SELinux attributes since the apexd and init SELinux policies no longer rely on these attributes. The difference between the previous versions of this patch and the current patch is that the current patch does not remove any SELinux attributes. See also https://android-review.googlesource.com/c/platform/system/sepolicy/+/1850656. See also https://android-review.googlesource.com/c/platform/system/sepolicy/+/1862919. This patch includes a revert of commit 8b2b951349c4 ("Restore permission for shell to list /sys/class/block"). That commit is no longer necessary since it was a bug fix for the introduction of the sysfs_block type. Bug: 202520796 Test: source build/envsetup.sh && lunch aosp_x86_64 && m && launch_cvd Change-Id: I73e1133af8146c154af95d4b96132e49dbec730c Signed-off-by: Bart Van Assche <bvanassche@google.com>
2021-10-08 18:30:42 +02:00
type sysfs_devices_block, fs_type, sysfs_type;
Create sysfs_dm label. Prior to this CL, /sys/devices/virtual/block/dm-X was using the generic sysfs label. This CL creates sysfs_dm label and grants the following accesses: - update_verifier to read sysfs_dm dir and file at /sys/devices/virtual/block/dm-X. - vold to write sysfs_dm. Bug: 63440407 Test: update_verifier successfully triggers blocks verification and marks a sucessful boot; Test: No sysfs_dm related denials on sailfish. Change-Id: I6349412707800f1bd3a2fb94d4fe505558400c95
2017-10-05 22:50:07 +02:00
type sysfs_dm, fs_type, sysfs_type;
Allow init to configure dm_verity kernel driver. To disable hash-tree prefetching. Bug: 136247322 Test: atest google/perf/boottime/boottime-test Change-Id: Ibdcb88d1014f58918119867c6d701dc58af0c049
2019-12-16 13:39:15 +01:00
type sysfs_dm_verity, fs_type, sysfs_type;
Allow dumpsys to read total DMA-BUF heap pool size These permissions are added to allow dumpsys to read /sys/kernel/dma_heap/total_pools_kb. Fixes the following sepolicy denials: avc: denied { read } for name="total_pools_kb" dev="sysfs" ino=3252 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 avc: denied { open } for path="/sys/kernel/dma_heap/total_pools_kb" dev="sysfs" ino=3252 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 avc: denied { getattr } for path="/sys/kernel/dma_heap/total_pools_kb" dev="sysfs" ino=3252 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 Bug: 167709539 Test: dumpsys meminfo Change-Id: I1c15b41b067da84a7b629cafe27972f30c86ae27
2021-02-01 19:25:05 +01:00
type sysfs_dma_heap, fs_type, sysfs_type;
Allow dumpstate to read DMA-BUF sysfs stats These permissions are required for dumpstate to read the DMA-BUF sysfs stats present at /sys/kernel/dmabuf/buffers Bug: 167709539 Test: adb shell am bug-report Change-Id: I1c00843775452b7a7aa39b059e1d77d77aed1e9c
2021-01-11 06:09:37 +01:00
type sysfs_dmabuf_stats, fs_type, sysfs_type;
/proc, /sys access from uncrypt, update_engine, postinstall_dexopt New types: 1. proc_random 2. sysfs_dt_firmware_android Labeled: 1. /proc/sys/kernel/random as proc_random. 2. /sys/firmware/devicetree/base/firmware/android/{compatible, fstab, vbmeta} as sysfs_dt_firmware_android. Changed access: 1. uncrypt, update_engine, postinstall_dexopt have access to generic proc and sysfs labels removed. 2. appropriate permissions were added to uncrypt, update_engine, update_engine_common, postinstall_dexopt. Bug: 67416435 Bug: 67416336 Test: fake ota go/manual-ab-ota runs without denials Test: adb sideload runs without denials to new types Change-Id: Id31310ceb151a18652fcbb58037a0b90c1f6505a
2017-10-04 19:34:11 +02:00
type sysfs_dt_firmware_android, fs_type, sysfs_type;
Add sysfs_extcon for /sys/class/extcon Bug: 124364409 Change-Id: Idc33732454674bbdc7f4ff6eda173acc24e318b3 Test: cherry picked to pi-tv-dr-dev and tested on JBL Link bar
2019-02-15 21:15:21 +01:00
type sysfs_extcon, fs_type, sysfs_type;
allow system_server to access files under /sys/kernel/ion/ In order for system_server to report ION allocations in dumpsys meminfo report it needs access to ION sysfs nodes. Bug: 138148041 Test: dumpsys meminfo Change-Id: I8b1efebe8f4b06a3975e96ddd6a8cbcacdb52fb2 Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2019-11-17 23:41:33 +01:00
type sysfs_ion, fs_type, sysfs_type;
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
type sysfs_ipv4, fs_type, sysfs_type;
Sepolicy: Label kernel notes Label /sys/kernel/notes. Bug: 70275668 Test: m Change-Id: Ieb666425d2db13f85225fb902fe06b0bf2335bef
2017-12-06 19:09:50 +01:00
type sysfs_kernel_notes, fs_type, sysfs_type, mlstrustedobject;
hal_light: add permission to sys/class/leds. /sys/class/leds is the standard location for linux files dealing with leds, however the exact contents of this directory is non-standard (hence the need for a hal). Bug: 32022100 Test: compiles and works for the subset of common files Change-Id: I7571d7267d5ed531c4cf95599d5f2acc22287ef4
2017-01-05 02:56:04 +01:00
type sysfs_leds, fs_type, sysfs_type;
Allow apexd to write to sysfs loop device parameters. To configure read-ahead on loop devices, eg. /sys/devices/virtual/block/loop0/queue/read_ahead_kb Bug: 120776455 Test: configuring read-ahead on loop devices works from apexd Change-Id: Ib25372358e8ca62fa634daf286e4b64e635fac58
2018-12-18 15:38:59 +01:00
type sysfs_loop, fs_type, sysfs_type;
Adds GPU sepolicy to support devices with DRM gralloc/rendering ... such as Cuttlefish (Cloud Android virtual device) which has a DRM virtio-gpu based gralloc and (sometimes) DRM virtio-gpu based rendering (when forwarding rendering commands to the host machine with Mesa3D in the guest and virglrenderer on the host). After this change is submitted, changes such as aosp/1997572 can be submitted to removed sepolicy that is currently duplicated across device/google/cuttlefish and device/linaro/dragonboard as well. Adds a sysfs_gpu type (existing replicated sysfs_gpu definitions across several devices are removed in the attached topic). The uses of `sysfs_gpu:file` comes from Mesa using libdrm's `drmGetDevices2()` which calls into `drmParsePciDeviceInfo()` to get vendor id, device id, version etc. Bug: b/161819018 Test: launch_cvd Test: launch_cvd --gpu_mode=gfxstream Change-Id: I4f7d4b0fb90bfeef72f94396ff0c5fe44d53510c Merged-In: I4f7d4b0fb90bfeef72f94396ff0c5fe44d53510c
2022-02-24 19:32:16 +01:00
type sysfs_gpu, fs_type, sysfs_type;
Create sysfs_hwrandom type. HwRngTest needs access to the hwrandom sysfs files, but untrused_app does not have access to sysfs. Give these files their own label and allow the needed read access. Bug: 27263241 Change-Id: I718ba485e9e6627bac6e579f746658d85134b24b
2016-03-12 00:23:49 +01:00
type sysfs_hwrandom, fs_type, sysfs_type;
Integrate nfc_power and rild rules from tuna sepolicy by Bryan Hinton.
2012-03-19 20:56:01 +01:00
type sysfs_nfc_power_writable, fs_type, sysfs_type, mlstrustedobject;
Introduce controls on wake lock interface Change-Id: Ie0ee266e9e6facb2ab2abd652f68765239a41af1
2013-09-29 00:46:21 +02:00
type sysfs_wake_lock, fs_type, sysfs_type;
Restrict netd fwk policy. Remove netd access to sysfs_type attribute. These were moved from vendor to fwk policy: 1. sysfs_net type declaration 2. labeling of /sys/devices/virtual/net with sysfs_net 3. netd access to sysfs_net Bug: 65643247 Test: can browse internet without netd denials Test: netd_unit_test, netd_integration_test without netd denials Change-Id: Ic1b95a098f438c4c6bc969bee801bf7dd1a13f6e
2017-10-02 00:53:01 +02:00
type sysfs_net, fs_type, sysfs_type;
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
type sysfs_power, fs_type, sysfs_type;
type sysfs_rtc, fs_type, sysfs_type;
system_suspend access to suspend, wakeup stats Android is moving away from debugfs. Information from /d/wakeup_sources and /d/suspend_stats is now also exposed in sysfs under /sys/class/wakeup/* and /sys/power/suspend_stats/* respectively: https://lkml.org/lkml/2019/7/31/1349 https://lkml.org/lkml/2019/8/6/1275 Allow SystemSuspend to read those sysfs nodes. One caveat is that /sys/class/wakeup/wakeupN can be a symlink to a device-specific location. In this case, device sepolicy should label that the files appropriately. This is similar to how device policy applies "sysfs_net" and "sysfs_batteryinfo" labels. Bug: 144095608 Bug: 129087298 Test: boot cuttlefish; system_suspend is able to read /sys/power/suspend_stats/* and /sys/class/wakeup/* Change-Id: I350c88a271c0f422d0557aeb5e05e1537dc97bc9
2019-11-07 22:37:34 +01:00
type sysfs_suspend_stats, fs_type, sysfs_type;
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
type sysfs_switch, fs_type, sysfs_type;
allow writes to /sys/power/sync_on_suspend from init When suspend.disable_sync_on_suspend is set init must write to /sys/power/sync_on_suspend. Bug: 285395636 Change-Id: Ica1b039c3192f08ec84aa07d35c2d0c61e7449c0
2023-10-04 00:31:22 +02:00
type sysfs_sync_on_suspend, fs_type, sysfs_type;
Allow global read access to /sys/kernel/mm/transparent_hugepage/ If kernel is built with CONFIG_TRANSPARENT_HUGEPAGE optimization, libjemalloc5 will attempt to read /sys/kernel/mm/transparent_hugepage/enabled and hit an SELinux denial. Various denials similiar to the following are seen on cuttlefish: avc: denied { open } for comm="surfaceflinger" path="/sys/kernel/mm/transparent_hugepage/enabled" dev="sysfs" ino=776 scontext=u:r:surfaceflinger:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 Bug: 28053261 Test: boot cuttlefish without above denials. Change-Id: Ic33f12d31aacc42d662a8c5c297fbb5f84d4deea
2019-03-13 20:06:01 +01:00
type sysfs_transparent_hugepage, fs_type, sysfs_type;
Add sepolicy for Multi-Gen LRU sysfs control init is allowed to enable/disable MG-LRU. Bug: 227651406 Bug: 228525049 Test: setprop persist.device_config.mglru_native.lru_gen_config Test: verify no avc denials in logcat Change-Id: I20223f3628cb6909c3fd2eb2b821ff2d52202dd2
2022-04-07 01:36:58 +02:00
type sysfs_lru_gen_enabled, fs_type, sysfs_type;
silence innocuous denials to /proc and /sys Bug: 74182216 Test: build bullhead, sailfish sepolicy Change-Id: I6d0635a49c025870c9ecb46147e6c9a1c407fe16
2018-03-21 18:43:30 +01:00
type sysfs_usb, fs_type, sysfs_type;
system_suspend access to suspend, wakeup stats Android is moving away from debugfs. Information from /d/wakeup_sources and /d/suspend_stats is now also exposed in sysfs under /sys/class/wakeup/* and /sys/power/suspend_stats/* respectively: https://lkml.org/lkml/2019/7/31/1349 https://lkml.org/lkml/2019/8/6/1275 Allow SystemSuspend to read those sysfs nodes. One caveat is that /sys/class/wakeup/wakeupN can be a symlink to a device-specific location. In this case, device sepolicy should label that the files appropriately. This is similar to how device policy applies "sysfs_net" and "sysfs_batteryinfo" labels. Bug: 144095608 Bug: 129087298 Test: boot cuttlefish; system_suspend is able to read /sys/power/suspend_stats/* and /sys/class/wakeup/* Change-Id: I350c88a271c0f422d0557aeb5e05e1537dc97bc9
2019-11-07 22:37:34 +01:00
type sysfs_wakeup, fs_type, sysfs_type;
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
type sysfs_wakeup_reasons, fs_type, sysfs_type;
allow init to run mke2fs tools to format partitions Test: let fs_mgr format a damaged /data partition Bug: 35219933 Change-Id: If92352ea7a70780e9d81ab10963d63e16b793792
2017-05-02 22:45:08 +02:00
type sysfs_fs_ext4_features, sysfs_type, fs_type;
Add Label to f2fs sysfs files Test: ls -lZ /sys/fs/f2fs Bug: 123367711 Change-Id: I0035feb8409b7ec8e11510795fb7d8845992694e
2019-02-15 23:29:05 +01:00
type sysfs_fs_f2fs, sysfs_type, fs_type;
Allow bpfloader to read fuse's bpf_prog number Bug: 202785178 Test: Along with rest of topic, file /sys/fs/bpf/prog_fuse_media_fuse_media appears on boot with fuse-bpf in kernel Merged-In: Ibccdf177c75fef0314c86319be3f0b0f249ce59d Change-Id: Ibccdf177c75fef0314c86319be3f0b0f249ce59d
2021-11-12 01:53:26 +01:00
type sysfs_fs_fuse_bpf, sysfs_type, fs_type;
Use kernel sys/fs/fuse/features/fuse_bpf flag to enable fuse_bpf Bug: 262887267 Test: ro.fuse.bpf.is_running is true Change-Id: I9c4a54e9ac232e9f35a6be5b3bcc3cc040d64b47
2023-03-01 23:32:25 +01:00
type sysfs_fs_fuse_features, sysfs_type, fs_type;
IncFS: update SE policies for the new API IncFS in S adds a bunch of new ioctls, and requires the users to read its features in sysfs directory. This change adds all the features, maps them into the processes that need to call into them, and allows any incfs user to query the features Bug: 170231230 Test: incremental unit tests Change-Id: Ieea6dca38ae9829230bc17d0c73f50c93c407d35
2021-01-15 06:01:25 +01:00
type sysfs_fs_incfs_features, sysfs_type, fs_type;
[sepolicy] allow system server to read incfs metrics from sysfs Address denial messages like: 05-05 05:02:21.480 1597 1597 W Binder:1597_12: type=1400 audit(0.0:140): avc: denied { read } for name="reads_delayed_min" dev="sysfs" ino=107358 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=0 BUG: 184844615 Test: atest android.cts.statsdatom.incremental.AppErrorAtomTests#testAppCrashOnIncremental Change-Id: I201e27e48a08f99f41a030e06c6f22518294e056
2021-05-05 07:40:23 +02:00
type sysfs_fs_incfs_metrics, sysfs_type, fs_type;
Move vendor_sched to common sepolicy Previously vendor_sched is put under product area which will be replaced by GSI. To solve it, move it to system/sepolicy. Bug: 194656257 Test: build pass Change-Id: Ia0b855e3a876a58b58f79b4fba09293419797b47
2021-07-29 15:24:38 +02:00
type sysfs_vendor_sched, sysfs_type, fs_type;
userdebug_or_eng(`
typeattribute sysfs_vendor_sched mlstrustedobject;
')
much more finegrained bpf selinux privs for networking mainline Goal is to gain a better handle on who has access to which maps and to allow (with bpfloader changes to create in one directory and move into the target directory) per-map selection of selinux context, while still having reasonable defaults for stuff pinned directly into the target location. BPFFS (ie. /sys/fs/bpf) labelling is as follows: subdirectory selinux context mainline usecase / usable by / fs_bpf no (*) core operating system (ie. platform) /net_private fs_bpf_net_private yes, T+ network_stack /net_shared fs_bpf_net_shared yes, T+ network_stack & system_server /netd_readonly fs_bpf_netd_readonly yes, T+ network_stack & system_server & r/o to netd /netd_shared fs_bpf_netd_shared yes, T+ network_stack & system_server & netd [**] /tethering fs_bpf_tethering yes, S+ network_stack /vendor fs_bpf_vendor no, T+ vendor * initial support for bpf was added back in P, but things worked differently back then with no bpfloader, and instead netd doing stuff by hand, bpfloader with pinning into /sys/fs/bpf was (I believe) added in Q (and was definitely there in R) ** additionally bpf programs are accesible to netutils_wrapper for use by iptables xt_bpf extensions 'mainline yes' currently means shipped by the com.android.tethering apex, but this is really another case of bad naming, as it's really the 'networking/connectivity/tethering' apex / mainline module. Long term the plan is to merge a few other networking mainline modules into it (and maybe give it a saner name...). The reason for splitting net_private vs tethering is that: S+ must support 4.9+ kernels and S era bpfloader v0.2+ T+ must support 4.14+ kernels and T beta3 era bpfloader v0.13+ The kernel affects the intelligence of the in-kernel bpf verifier and the available bpf helper functions. Older kernels have a tendency to reject programs that newer kernels allow. / && /vendor are not shipped via mainline, so only need to work with the bpfloader that's part of the core os. Bug: 218408035 Test: TreeHugger, manually on cuttlefish Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I674866ebe32aca4fc851818c1ffcbec12ac4f7d4 (cherry picked from commit 15715aea32b85c933778b97a46de6ccab42ca7fb)
2022-05-21 14:03:29 +02:00
type fs_bpf, fs_type, bpffs_type;
# TODO: S+ fs_bpf_tethering (used by mainline) should be private
type fs_bpf_tethering, fs_type, bpffs_type;
type fs_bpf_vendor, fs_type, bpffs_type;
Guard new types with starting_at_board_api macro To prevent these types from being released in 24Q3, which must be same as 202404 release. Bug: 330670954 Test: build Change-Id: Ibb124fbb069f2025a572bc09c73c241f808676c3
2024-04-22 08:43:18 +02:00
starting_at_board_api(202504, `
type fs_bpf_lmkd_memevents_rb, fs_type, bpffs_type;
type fs_bpf_lmkd_memevents_prog, fs_type, bpffs_type;
')
sepolicy: Add policy for sdcardfs and configfs Change-Id: I4c318efba76e61b6ab0be9491c352f281b1c2bff Bug: 19160983
2016-03-02 01:13:50 +01:00
type configfs, fs_type;
Add file context type for /sys/devices/cs_etm This is the cs_etm (Coresight ETM) sysfs directory. Bug: 79161490 Test: build Change-Id: I9a66bb4b2684ef8637106a36f7d490d8f805cabf
2020-08-31 09:24:40 +02:00
# /sys/devices/cs_etm
type sysfs_devices_cs_etm, fs_type, sysfs_type;
sysfs_devices_system_cpu should be a sysfs_type Otherwise the following denials occur on mako: <5>[ 2.494246] type=1400 audit(1382544550.200:4): avc: denied { associate } for pid=1 comm="init" name="time_in_state" dev="sysfs" ino=17444 scontext=u:object_r:sy sfs_devices_system_cpu:s0 tcontext=u:object_r:sysfs:s0 tclass=filesystem <5>[ 2.494735] type=1400 audit(1382544550.200:5): avc: denied { associate } for pid=1 comm="init" name="total_trans" dev="sysfs" ino=17443 scontext=u:object_r:sysf s_devices_system_cpu:s0 tcontext=u:object_r:sysfs:s0 tclass=filesystem <5>[ 2.495162] type=1400 audit(1382544550.200:6): avc: denied { associate } for pid=1 comm="init" name="stats" dev="sysfs" ino=17442 scontext=u:object_r:sysfs_devi ces_system_cpu:s0 tcontext=u:object_r:sysfs:s0 tclass=filesystem <5>[ 2.495620] type=1400 audit(1382544550.200:7): avc: denied { associate } for pid=1 comm="init" name="scaling_governor" dev="sysfs" ino=17435 scontext=u:object_r :sysfs_devices_system_cpu:s0 tcontext=u:object_r:sysfs:s0 tclass=filesystem <5>[ 2.496047] type=1400 audit(1382544550.200:8): avc: denied { associate } for pid=1 comm="init" name="cpuinfo_transition_latency" dev="sysfs" ino=17429 scontext= u:object_r:sysfs_devices_system_cpu:s0 tcontext=u:object_r:sysfs:s0 tclass=filesystem <5>[ 2.496505] type=1400 audit(1382544550.200:9): avc: denied { associate } for pid=1 comm="init" name="scaling_available_frequencies" dev="sysfs" ino=17439 sconte xt=u:object_r:sysfs_devices_system_cpu:s0 tcontext=u:object_r:sysfs:s0 tclass=filesystem <5>[ 2.496963] type=1400 audit(1382544550.200:10): avc: denied { associate } for pid=1 comm="init" name="scaling_driver" dev="sysfs" ino=17436 scontext=u:object_r: sysfs_devices_system_cpu:s0 tcontext=u:object_r:sysfs:s0 tclass=filesystem Change-Id: I584a1cf61cb871a38be4d3b308cef03e64cfda8e
2013-10-23 18:08:23 +02:00
# /sys/devices/system/cpu
type sysfs_devices_system_cpu, fs_type, sysfs_type;
initial lmkd policy. * Allow writes to /proc/PID/oom_score_adj * Allow writes to /sys/module/lowmemorykiller/* Addresses the following denials: <5>[ 3.825371] type=1400 audit(9781555.430:5): avc: denied { write } for pid=176 comm="lmkd" name="minfree" dev="sysfs" ino=6056 scontext=u:r:lmkd:s0 tcontext=u:object_r:sysfs:s0 tclass=file <5>[ 48.874747] type=1400 audit(9781600.639:16): avc: denied { search } for pid=176 comm="lmkd" name="896" dev="proc" ino=9589 scontext=u:r:lmkd:s0 tcontext=u:r:system_server:s0 tclass=dir <5>[ 48.874889] type=1400 audit(9781600.639:17): avc: denied { dac_override } for pid=176 comm="lmkd" capability=1 scontext=u:r:lmkd:s0 tcontext=u:r:lmkd:s0 tclass=capability <5>[ 48.874982] type=1400 audit(9781600.639:18): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=8942 scontext=u:r:lmkd:s0 tcontext=u:r:system_server:s0 tclass=file <5>[ 48.875075] type=1400 audit(9781600.639:19): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=8942 scontext=u:r:lmkd:s0 tcontext=u:r:system_server:s0 tclass=file <5>[ 49.409231] type=1400 audit(9781601.169:20): avc: denied { write } for pid=176 comm="lmkd" name="minfree" dev="sysfs" ino=6056 scontext=u:r:lmkd:s0 tcontext=u:object_r:sysfs:s0 tclass=file <5>[ 209.081990] type=1400 audit(9781760.839:24): avc: denied { search } for pid=176 comm="lmkd" name="1556" dev="proc" ino=10961 scontext=u:r:lmkd:s0 tcontext=u:r:platform_app:s0 tclass=dir <5>[ 209.082240] type=1400 audit(9781760.839:25): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11654 scontext=u:r:lmkd:s0 tcontext=u:r:platform_app:s0 tclass=file <5>[ 209.082498] type=1400 audit(9781760.839:26): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11654 scontext=u:r:lmkd:s0 tcontext=u:r:platform_app:s0 tclass=file <5>[ 209.119673] type=1400 audit(9781760.879:27): avc: denied { search } for pid=176 comm="lmkd" name="1577" dev="proc" ino=12708 scontext=u:r:lmkd:s0 tcontext=u:r:release_app:s0 tclass=dir <5>[ 209.119937] type=1400 audit(9781760.879:28): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11657 scontext=u:r:lmkd:s0 tcontext=u:r:release_app:s0 tclass=file <5>[ 209.120105] type=1400 audit(9781760.879:29): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11657 scontext=u:r:lmkd:s0 tcontext=u:r:release_app:s0 tclass=file <5>[ 209.235597] type=1400 audit(9781760.999:30): avc: denied { search } for pid=176 comm="lmkd" name="1600" dev="proc" ino=11659 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=dir <5>[ 209.235798] type=1400 audit(9781760.999:31): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11667 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=file <5>[ 209.236006] type=1400 audit(9781760.999:32): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11667 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=file <5>[ 214.297283] type=1400 audit(9781766.059:64): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11211 scontext=u:r:lmkd:s0 tcontext=u:r:untrusted_app:s0 tclass=file <5>[ 214.297415] type=1400 audit(9781766.059:65): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11211 scontext=u:r:lmkd:s0 tcontext=u:r:untrusted_app:s0 tclass=file <5>[ 214.355060] type=1400 audit(9781766.119:66): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12907 scontext=u:r:lmkd:s0 tcontext=u:r:system_app:s0 tclass=file <5>[ 214.355236] type=1400 audit(9781766.119:67): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12907 scontext=u:r:lmkd:s0 tcontext=u:r:system_app:s0 tclass=file <5>[ 214.516920] type=1400 audit(9781766.279:68): avc: denied { search } for pid=176 comm="lmkd" name="1907" dev="proc" ino=11742 scontext=u:r:lmkd:s0 tcontext=u:r:media_app:s0 tclass=dir <5>[ 214.678861] type=1400 audit(9781766.439:69): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12915 scontext=u:r:lmkd:s0 tcontext=u:r:media_app:s0 tclass=file <5>[ 214.678992] type=1400 audit(9781766.439:70): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12915 scontext=u:r:lmkd:s0 tcontext=u:r:media_app:s0 tclass=file <5>[ 214.708284] type=1400 audit(9781766.469:71): avc: denied { search } for pid=176 comm="lmkd" name="1765" dev="proc" ino=12851 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=dir <5>[ 214.708435] type=1400 audit(9781766.469:72): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12870 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=file <5>[ 214.708648] type=1400 audit(9781766.469:73): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12870 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=file Change-Id: Ie3c1ab8ce9e77742d0cc3c73f40010afd018ccd4
2014-02-13 21:19:50 +01:00
# /sys/module/lowmemorykiller
type sysfs_lowmemorykiller, fs_type, sysfs_type;
Define explicit label for wlan sysfs fwpath avc: denied { write } for name="fwpath" dev="sysfs" ino=6863 scontext=u:r:wificond:s0 tcontext=u:object_r:sysfs_wlan_fwpath:s0 tclass=file permissive=0 Test: wificond and netd can write to this path, wifi works Test: `runtest frameworks-wifi` passes Bug: 29579539 Change-Id: Ia21c654b00b09b9fe3e50d564b82966c9c8e6994 (cherry picked from commit 7d13dd806f37523ba8164325fef9b000d6eacd7c)
2016-06-30 23:23:12 +02:00
# /sys/module/wlan/parameters/fwpath
type sysfs_wlan_fwpath, fs_type, sysfs_type;
sepolicy: Add policy for vibrator HIDL service Fixes the following denials: avc: denied { open } for pid=7530 comm="android.hardwar" path="/sys/devices/virtual/timed_output/vibrator/enable" dev="sysfs" ino=20519 scontext=u:r:android_hardware_vibrator_1_0_service:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 avc: denied { call } for pid=9173 comm="Binder:7735_C" scontext=u:r:system_server:s0 tcontext=u:r:android_hardware_vibrator_1_0_service:s0 tclass=binder permissive=1 Test: m Bug: 32021191 Change-Id: I243a86b449794e3c2f0abf91ddcf405eff548d0c
2016-10-11 20:01:49 +02:00
type sysfs_vibrator, fs_type, sysfs_type;
Add SePolicy for system_server accessing sysfs uhid. Add SePolicy to allow Android input manager accessing sysfs uhid folder. Bug: 161633432 Test: dumpsys input and watch for input device battery status. Change-Id: I6ed1ab45f1cff409982c36627e12e62667819f37
2020-11-21 04:17:22 +01:00
type sysfs_uhid, fs_type, sysfs_type;
Move sysfs_thermal to global policy and grant access. sysfs_thermal nodes are common enough to warrant an entry in global policy and the new HardwarePropertiesManagerService exists explicitly to expose some of this information. Address the following denials: avc: denied { search } for name="thermal" dev="sysfs" ino=17509 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_thermal:s0 tclass=dir permissive=1 avc: denied { read } for name="temp" dev="sysfs" ino=17848 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_thermal:s0 tclass=file permissive=1 avc: denied { open } for path="/sys/devices/virtual/thermal/thermal_zone8/temp" dev="sysfs" ino=17848 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_thermal:s0 tclass=file permissive=1 avc: denied { getattr } for path="/sys/devices/virtual/thermal/thermal_zone8/temp" dev="sysfs" ino=17848 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_thermal:s0 tclass=file permissive=1 Bug: 27809332 Change-Id: I2dbc737971bf37d197adf0d5ff07cb611199300d
2016-03-24 17:23:54 +01:00
type sysfs_thermal, sysfs_type, fs_type;
Create sysfs_zram label. Address following denials: avc: denied { getattr } for path="/sys/devices/virtual/block/zram0/disksize" dev="sysfs" ino=14958 scontext=u:r:init:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=file permissive=0 avc: denied { search } for name="zram0" dev="sysfs" ino=14903 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=dir permissive=0 avc: denied { read } for name="mem_used_total" dev="sysfs" ino=14970 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=file permissive=0 avc: denied { write } for name="uevent" dev="sysfs" ino=14904 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=file permissive=0 avc: denied { open } for path="/sys/devices/virtual/block/zram0/uevent" dev="sysfs" ino=14904 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=file permissive=0 avc: denied { read } for pid=348 comm="vold" name="zram0" dev="sysfs" ino=15223 scontext=u:r:vold:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=dir permissive=0 avc: denied { search } for pid=3494 comm="ContactsProvide" name="zram0"dev="sysfs" ino=15223 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:sysfs_zram:s0 tclass=dir permissive=0 Bug: 22032619 Change-Id: I40cf918b7cafdba6cb3d42b04b1616a84e4ce158
2016-01-04 23:23:23 +01:00
type sysfs_zram, fs_type, sysfs_type;
type sysfs_zram_uevent, fs_type, sysfs_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
type inotify, fs_type, mlstrustedobject;
Add policy for run-as program. Add policy for run-as program and label it in file_contexts. Drop MLS constraints on local socket checks other than create/relabel as this interferes with connections with services, in particular for adb forward. Change-Id: Ib0c4abeb7cbef559e150a620c45a7c31e0531114 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-11-13 19:00:05 +01:00
type devpts, fs_type, mlstrustedobject;
SE Android policy.
2012-01-04 18:33:27 +01:00
type tmpfs, fs_type;
type shm, fs_type;
type mqueue, fs_type;
Add fusefs_type for FUSE filesystems Any FUSE filesystem will receive the 'fuse' type when mounted. It is possible to change this behaviour by specifying the "context=" or "fscontext=" option in mount(). Because 'fuse' has historically been used only for the emulated storage, it also received the 'sdcard_type' attribute. Replace the 'sdcard_type' attribute from 'fuse' with the new 'fusefs_type'. This attribute can be attached on derived types (such as app_fusefs). This change: - Remove the neverallow restriction on this new type. This means any custom FUSE implementation can be mounted/unmounted (if the correct allow rule is added). See domain.te. - Change the attribute of 'fuse' from 'sdcard_type' to 'fusefs_type'. See file.te. - Modify all references to 'sdcard_type' to explicitly include 'fuse' for compatibility reason. Bug: 177481425 Bug: 190804537 Test: Build and boot aosp_cf_x86_64_phone-userdebug Change-Id: Id4e410a049f72647accd4c3cf43eaa55e94c318f
2021-06-23 10:21:49 +02:00
type fuse, fusefs_type, fs_type, mlstrustedobject;
Adds support for fuseblk binaries. This is a rather large, single change to the SEPolicies, as fuseblk required multiple new domains. The goal is to allow any fuseblk drivers to also use the same sepolicy. Note the compartmentalized domain for sys_admin and mount/unmount permissions. Bug: 254407246 Test: Extensive testing with an ADT-4 and NTFS USB drives. Change-Id: I6619ac77ce44ba60edd6ab10e8436a8712459b48
2023-01-17 18:22:34 +01:00
type fuseblk, sdcard_type, fusefs_type, fs_type, mlstrustedobject;
sepolicy: Add policy for sdcardfs and configfs Change-Id: I4c318efba76e61b6ab0be9491c352f281b1c2bff Bug: 19160983
2016-03-02 01:13:50 +01:00
type sdcardfs, sdcard_type, fs_type, mlstrustedobject;
Rename sdcard_internal/external types. Rename sdcard_internal/external types to fuse and vfat respectively to make it clear that they are assigned to any fuse or vfat filesystem by default (absent a context= mount option) and do not necessarily represent the SDcard. The sdcard_type attribute is still assigned to both types and can still be used in allow rules to permit access to either the internal or external SDcard. Define type aliases for the old names to preserve compatibility on policy reload and for device-specific policies that may not yet be updated. Change-Id: I8d91a8c4c1342b94e4f1bb62ca7ffd2ca4b06ba1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-07-08 20:45:09 +02:00
type vfat, sdcard_type, fs_type, mlstrustedobject;
Add exFAT support; unify behind "sdcard_type". We're adding support for OEMs to ship exFAT, which behaves identical to vfat. Some rules have been manually enumerating labels related to these "public" volumes, so unify them all behind "sdcard_type". Test: atest Bug: 67822822 Change-Id: I09157fd1fc666ec5d98082c6e2cefce7c8d3ae56
2018-03-30 20:22:54 +02:00
type exfat, sdcard_type, fs_type, mlstrustedobject;
Mark debugfs type with debugfs_type attribute Test: build policy Change-Id: If13838e8da6e3fe14bb5c7c7ade6f8ac0d5d1982
2017-06-26 00:35:54 +02:00
type debugfs, fs_type, debugfs_type;
Label kprobes and restrict access Bug: 149659981 Test: build Change-Id: I6abcd1bb9af15e7ba0f1f5e711ea9ac661bffc25
2020-06-10 12:27:12 +02:00
type debugfs_kprobes, fs_type, debugfs_type;
Storaged permission setting Allowing storaged for reading from pseudo filesystems and debugfs. Bug: 32221677 Change-Id: I837cead9a68f0b399703b64d724cb9c4b205c335
2016-06-18 00:05:10 +02:00
type debugfs_mmc, fs_type, debugfs_type;
Revert "Revert "Add neverallows for debugfs access"" This reverts commit e95e0ec0a5f2f6fdf362d14b7960850a05e790b5. Now that b/186727553 is fixed, it should be safe to revert this revert. Test: build Bug: 184381659 Change-Id: Ibea3882296db880f5cafe4f9efa36d79a183c8a1
2021-05-05 07:01:51 +02:00
type debugfs_mm_events_tracing, fs_type, debugfs_type, tracefs_type;
type debugfs_trace_marker, fs_type, debugfs_type, mlstrustedobject, tracefs_type;
type debugfs_tracing, fs_type, debugfs_type, mlstrustedobject, tracefs_type;
type debugfs_tracing_debug, fs_type, debugfs_type, mlstrustedobject, tracefs_type;
type debugfs_tracing_instances, fs_type, debugfs_type, tracefs_type;
type debugfs_tracing_printk_formats, fs_type, debugfs_type, tracefs_type;
Selinux permissions for incidentd project Bug: 64222712 Test: manual Change-Id: Ica77ae3c9e535eddac9fccf11710b0bcb3254ab3
2018-01-22 23:00:46 +01:00
type debugfs_wakeup_sources, fs_type, debugfs_type;
Revert "Revert "Add neverallows for debugfs access"" This reverts commit e95e0ec0a5f2f6fdf362d14b7960850a05e790b5. Now that b/186727553 is fixed, it should be safe to revert this revert. Test: build Bug: 184381659 Change-Id: Ibea3882296db880f5cafe4f9efa36d79a183c8a1
2021-05-05 07:01:51 +02:00
type debugfs_wifi_tracing, fs_type, debugfs_type, tracefs_type;
Add sepolicy for the securityfs mount type. See discussion in aosp/1233645. There was a concern about this filesystem automounting when enabled, so this change adds sepolicy to preemptively lock it down. I'm not confident it actually automounts. If it does, it'll land in /sys/kernel/security, which is also protected with the sysfs policy. Test: Builds Bug: 148102533 Change-Id: I78a246a5c18953f2471f84367ab383afb2742908
2020-02-19 00:26:44 +01:00
type securityfs, fs_type;
Add selinux rules for additional file contexts in userdebug These rules allow the additional tracepoints we need for running traceur in userdebug builds to be writeable. Bug: 37110010 Test: I'm testing by running atrace -l and confirming that the tracepoints that I'm attempting to enable are available. Change-Id: Ia352100ed67819ae5acca2aad803fa392d8b80fd
2017-04-14 21:12:50 +02:00
pstore file system labeling pstore(persistent store) have been applied since kernel 3.5 We need to label the pstore-fs in order to use Android with kernel 3.5 or upper version. My kernel version is 3.10 and I got the below denial log when I ran the "df" command on the adb shell. type=1400 msg=audit(1388540540.220:18): avc: denied { getattr } for pid=7296 comm="df" name="/" dev="pstore" ino=7703 scontext=u:r:init:s0 tcontext=u:object_r:unlabeled:s0 tclass=filesystem And the below log is also shown during booting type=1400 msg=audit(1388539193.750:4): avc: denied { mount } for pid=2844 comm="mount" name="/" dev="pstore" ino=11393 scontext=u:r:init_shell:s0 tcontext=u:object_r:unlabeled:s0 tclass=filesystem Change-Id: Iaba543d44565c4f20a77a95b9573a628bbd3fd34
2014-04-10 06:32:54 +02:00
type pstorefs, fs_type;
Move MediaProvider to its own domain, add new MtpServer permissions Also move necessary priv_app permissions into MediaProvider domain and remove MediaProvider specific permissions from priv_app. The new MtpServer permissions fix the following denials: avc: denied { write } for comm=6D747020666673206F70656E name="ep0" dev="functionfs" ino=12326 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:functionfs:s0 tclass=file permissive=1 denial from setting property sys.usb.ffs.mtp.ready, context priv_app Bug: 30976142 Test: Manual, verify permissions are allowed Change-Id: I4e66c5a8b36be21cdb726b5d00c1ec99c54a4aa4
2016-09-22 20:07:50 +02:00
type functionfs, fs_type, mlstrustedobject;
Define contextmount_type attribute and add it to oemfs. Several device-specific policy changes with the same Change-Id also add this attribute to device-specific types. Change-Id: I09e13839b1956f61875a38844fe4fc3c911ea60f Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-30 14:49:51 +02:00
type oemfs, fs_type, contextmount_type;
label usbfs Right now usbfs doesn't have any labels, generating the following kernel warnings: <7>[ 3.009582] SELinux: initialized (dev usbfs, type usbfs), not configured for labeling and the occasional SELinux unlabeled auditallow logs: <4>[ 285.579254] type=1400 audit(1402010345.094:16): avc: granted { search } for pid=371 comm="qcks" name="/" dev="usbfs" ino=15794 scontext=u:r:kickstart:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir <4>[ 285.632354] type=1400 audit(1402010345.154:18): avc: granted { search } for pid=371 comm="qcks" name="001" dev="usbfs" ino=15796 scontext=u:r:kickstart:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir Make sure usbfs is assigned via genfscon Change-Id: I7191f2584014ba55a3c3a98e7efd0350dc958782
2014-06-07 16:31:31 +02:00
type usbfs, fs_type;
genfs_contexts: provide a label for binfmt_misc Provide a default label for binfmt_misc. This is not used by the core policy, although it may be used in device specific policy. Bug: 20152930 Change-Id: Id51d69333bfeda40720d0e65e1539fab0b6e1e95
2015-04-11 02:42:49 +02:00
type binfmt_miscfs, fs_type;
Add fusefs_type for FUSE filesystems Any FUSE filesystem will receive the 'fuse' type when mounted. It is possible to change this behaviour by specifying the "context=" or "fscontext=" option in mount(). Because 'fuse' has historically been used only for the emulated storage, it also received the 'sdcard_type' attribute. Replace the 'sdcard_type' attribute from 'fuse' with the new 'fusefs_type'. This attribute can be attached on derived types (such as app_fusefs). This change: - Remove the neverallow restriction on this new type. This means any custom FUSE implementation can be mounted/unmounted (if the correct allow rule is added). See domain.te. - Change the attribute of 'fuse' from 'sdcard_type' to 'fusefs_type'. See file.te. - Modify all references to 'sdcard_type' to explicitly include 'fuse' for compatibility reason. Bug: 177481425 Bug: 190804537 Test: Build and boot aosp_cf_x86_64_phone-userdebug Change-Id: Id4e410a049f72647accd4c3cf43eaa55e94c318f
2021-06-23 10:21:49 +02:00
type app_fusefs, fs_type, fusefs_type, contextmount_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
# File types
type unlabeled, file_type;
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
SE Android policy.
2012-01-04 18:33:27 +01:00
# Default type for anything under /system.
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type system_file, system_file_type, file_type;
asan: global read access to /system/asan.options Bug: 117178352 Test: no denials to /system/asan.options on asan walleye Change-Id: I6042693afb926a22a3e2be79bd2a7ba062806143
2018-10-07 01:16:46 +02:00
# Default type for /system/asan.options
type system_asan_options_file, system_file_type, file_type;
system/etc/event-log-tags available to all This was a regression in Q, and the file is an implementation of liblog. Bug: 113083310 Test: use tags from vendor and see no denials Change-Id: I726cc1fcfad39afc197b21e431a687a3e4c8ee4a
2019-01-10 22:59:37 +01:00
# Type for /system/etc/event-log-tags (liblog implementation detail)
type system_event_log_tags_file, system_file_type, file_type;
More granular vendor access to /system files. This change limits global access to /system files down to: /system/bin/linker* /system/lib[64]/* /system/etc/ld.config* /system/etc/seccomp_policy/* /system/etc/security/cacerts/* /system/usr/share/zoneinfo/* Bug: 111243627 Test: boot device, browse internet without denials to system_* types. Test: VtsHalDrmV1_{1, 0}TargetTest without denials Change-Id: I69894b29733979c2bc944ac80229e84de5d519f4
2018-08-12 00:34:49 +02:00
# Default type for anything under /system/lib[64].
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type system_lib_file, system_file_type, file_type;
Allow bootstrap bionic only to init, ueventd, and apexd The bootstrap bionic (/system/lib/bootstrap/*) are only to the early processes that are executed before the bionic libraries become available via the runtime APEX. Allowing them to other processes is not needed and sometimes causes a problem like b/123183824. Bug: 123183824 Test: device boots to the UI Test: atest CtsJniTestCases:android.jni.cts.JniStaticTest#test_linker_namespaces Change-Id: Id7bba2e8ed1c9faf6aa85dbbdd89add04826b160
2019-03-14 18:45:33 +01:00
# system libraries that are available only to bootstrap processes
type system_bootstrap_lib_file, system_file_type, file_type;
Allow domain access r_file_perms for passwd and group files In b/73062966, we add new AID ranges for each partition that doesn't yet have them (system, system_ext, odm, product). We also add group and passwd files to these partitions to be able to map these AIDs into human readable user and group names, and vice versa. All processes should be able to read all users and groups. We divide the ranges into non-overlapping regions for each partition and we namespace the names with the partition name as a prefix. Allow domain r_file_perms to /(system|product|system_ext)/etc/(group|passwd). Vendor and odm passwd and group files already have this access, since /(vendor|odm)/etc/* is already domain readable. Example contents: blueline:/ $ cat /system/etc/passwd system_tom::6050:6050::/:/bin/sh blueline:/ $ cat /product/etc/passwd product_tom::7013:7013::/:/bin/sh Bug: 73062966 Test: tree-hugger selinux denial during boot test Change-Id: Ib4dc31778e95e952174e1365497feaf93dca7156
2019-07-15 22:33:48 +02:00
# Default type for the group file /system/etc/group.
type system_group_file, system_file_type, file_type;
More granular vendor access to /system files. This change limits global access to /system files down to: /system/bin/linker* /system/lib[64]/* /system/etc/ld.config* /system/etc/seccomp_policy/* /system/etc/security/cacerts/* /system/usr/share/zoneinfo/* Bug: 111243627 Test: boot device, browse internet without denials to system_* types. Test: VtsHalDrmV1_{1, 0}TargetTest without denials Change-Id: I69894b29733979c2bc944ac80229e84de5d519f4
2018-08-12 00:34:49 +02:00
# Default type for linker executable /system/bin/linker[64].
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type system_linker_exec, system_file_type, file_type;
More granular vendor access to /system files. This change limits global access to /system files down to: /system/bin/linker* /system/lib[64]/* /system/etc/ld.config* /system/etc/seccomp_policy/* /system/etc/security/cacerts/* /system/usr/share/zoneinfo/* Bug: 111243627 Test: boot device, browse internet without denials to system_* types. Test: VtsHalDrmV1_{1, 0}TargetTest without denials Change-Id: I69894b29733979c2bc944ac80229e84de5d519f4
2018-08-12 00:34:49 +02:00
# Default type for linker config /system/etc/ld.config.*.
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type system_linker_config_file, system_file_type, file_type;
Allow domain access r_file_perms for passwd and group files In b/73062966, we add new AID ranges for each partition that doesn't yet have them (system, system_ext, odm, product). We also add group and passwd files to these partitions to be able to map these AIDs into human readable user and group names, and vice versa. All processes should be able to read all users and groups. We divide the ranges into non-overlapping regions for each partition and we namespace the names with the partition name as a prefix. Allow domain r_file_perms to /(system|product|system_ext)/etc/(group|passwd). Vendor and odm passwd and group files already have this access, since /(vendor|odm)/etc/* is already domain readable. Example contents: blueline:/ $ cat /system/etc/passwd system_tom::6050:6050::/:/bin/sh blueline:/ $ cat /product/etc/passwd product_tom::7013:7013::/:/bin/sh Bug: 73062966 Test: tree-hugger selinux denial during boot test Change-Id: Ib4dc31778e95e952174e1365497feaf93dca7156
2019-07-15 22:33:48 +02:00
# Default type for the passwd file /system/etc/passwd.
type system_passwd_file, system_file_type, file_type;
More granular vendor access to /system files. This change limits global access to /system files down to: /system/bin/linker* /system/lib[64]/* /system/etc/ld.config* /system/etc/seccomp_policy/* /system/etc/security/cacerts/* /system/usr/share/zoneinfo/* Bug: 111243627 Test: boot device, browse internet without denials to system_* types. Test: VtsHalDrmV1_{1, 0}TargetTest without denials Change-Id: I69894b29733979c2bc944ac80229e84de5d519f4
2018-08-12 00:34:49 +02:00
# Default type for linker config /system/etc/seccomp_policy/*.
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type system_seccomp_policy_file, system_file_type, file_type;
More granular vendor access to /system files. This change limits global access to /system files down to: /system/bin/linker* /system/lib[64]/* /system/etc/ld.config* /system/etc/seccomp_policy/* /system/etc/security/cacerts/* /system/usr/share/zoneinfo/* Bug: 111243627 Test: boot device, browse internet without denials to system_* types. Test: VtsHalDrmV1_{1, 0}TargetTest without denials Change-Id: I69894b29733979c2bc944ac80229e84de5d519f4
2018-08-12 00:34:49 +02:00
# Default type for cacerts in /system/etc/security/cacerts/*.
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type system_security_cacerts_file, system_file_type, file_type;
Add type for /system/bin/tcpdump. We add this type with the intent to expose /system/bin/tcpdump to vendor on userdebug devices only. Bug: 111243627 Test: device boots /system/bin/tcpdump correctly labeled as tcpdump_exec, can browse internet, turn wifi on/off Change-Id: Icb35e84c87120d198fbb2b44edfa5edf6021d0f0
2018-10-11 19:49:59 +02:00
# Default type for /system/bin/tcpdump.
type tcpdump_exec, system_file_type, exec_type, file_type;
Label /system/usr/share/zoneinfo differently /system/usr/share/zoneinfo is currently labeled zoneinfo_data_file, a label shared with /data/misc/zoneinfo. However, each of these directory locations has different security characteristics. In particular, the files in /system/usr/share/zoneinfo must never be writable, whereas /data/misc/zoneinfo may be written to by system_server. Reusing the same label hides these different security characteristics. Create a separate label for /system/usr/share/zoneinfo. Test: Device boots and no obvious problems. Change-Id: I8cf16ff038b06b38f77388e546d9b7a6865f7879
2018-09-27 17:45:16 +02:00
# Default type for zoneinfo files in /system/usr/share/zoneinfo/*.
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type system_zoneinfo_file, system_file_type, file_type;
sepolicy changes to configure cgroup.rc and task_profiles.json access cgroups.json file contains cgroup information required to mount cgroup controllers and is readable only by init process. cgroup.rc contains cgroup map information consisting of the list of cgroups available in the system and their mounting locations. It is created by init process and should be readable by any processes that uses cgroups and should be writable only by init process. task_profiles.json file contains task profiles used to operate on cgroups. This information should be readable by any process that uses cgroups and should be writable only by init process. Bug: 111307099 Test: builds, boots Change-Id: Ib2c87c0fc3663c7fc69628f05c846519b65948b5 Merged-In: Ib2c87c0fc3663c7fc69628f05c846519b65948b5 Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2019-01-11 02:10:31 +01:00
# Cgroups description file under /system/etc/cgroups.json
type cgroup_desc_file, system_file_type, file_type;
Add rules for per-API level task profiles and cgroup description files Define access rights to new per-API level task profiles and cgroup description files under /etc/task_profiles/. Bug: 172066799 Test: boot with per-API task profiles Signed-off-by: Suren Baghdasaryan <surenb@google.com> Change-Id: I04c9929fdffe33a9fc82d431a53f47630f9dcfc3
2020-11-21 03:57:36 +01:00
# Cgroups description file under /system/etc/task_profiles/cgroups_*.json
type cgroup_desc_api_file, system_file_type, file_type;
sepolicy for vendor cgroups.json and task_profiles.json files Vendors should be able to specify additional cgroups and task profiles without changing system files. Add access rules for /vendor/etc/cgroups.json and /vendor/etc/task_profiles.json files which will augment cgroups and task profiles specified in /etc/cgroups.json and /etc/task_profiles.json system files. As with system files /vendor/etc/cgroups.json is readable only by init process. task_profiles.json is readable by any process that uses cgroups. Bug: 124960615 Change-Id: I12fcff0159b4e7935ce15cc19ae36230da0524fc Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2019-02-20 00:02:14 +01:00
# Vendor cgroups description file under /vendor/etc/cgroups.json
type vendor_cgroup_desc_file, vendor_file_type, file_type;
sepolicy changes to configure cgroup.rc and task_profiles.json access cgroups.json file contains cgroup information required to mount cgroup controllers and is readable only by init process. cgroup.rc contains cgroup map information consisting of the list of cgroups available in the system and their mounting locations. It is created by init process and should be readable by any processes that uses cgroups and should be writable only by init process. task_profiles.json file contains task profiles used to operate on cgroups. This information should be readable by any process that uses cgroups and should be writable only by init process. Bug: 111307099 Test: builds, boots Change-Id: Ib2c87c0fc3663c7fc69628f05c846519b65948b5 Merged-In: Ib2c87c0fc3663c7fc69628f05c846519b65948b5 Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2019-01-11 02:10:31 +01:00
# Task profiles file under /system/etc/task_profiles.json
type task_profiles_file, system_file_type, file_type;
Add rules for per-API level task profiles and cgroup description files Define access rights to new per-API level task profiles and cgroup description files under /etc/task_profiles/. Bug: 172066799 Test: boot with per-API task profiles Signed-off-by: Suren Baghdasaryan <surenb@google.com> Change-Id: I04c9929fdffe33a9fc82d431a53f47630f9dcfc3
2020-11-21 03:57:36 +01:00
# Task profiles file under /system/etc/task_profiles/task_profiles_*.json
type task_profiles_api_file, system_file_type, file_type;
sepolicy for vendor cgroups.json and task_profiles.json files Vendors should be able to specify additional cgroups and task profiles without changing system files. Add access rules for /vendor/etc/cgroups.json and /vendor/etc/task_profiles.json files which will augment cgroups and task profiles specified in /etc/cgroups.json and /etc/task_profiles.json system files. As with system files /vendor/etc/cgroups.json is readable only by init process. task_profiles.json is readable by any process that uses cgroups. Bug: 124960615 Change-Id: I12fcff0159b4e7935ce15cc19ae36230da0524fc Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2019-02-20 00:02:14 +01:00
# Vendor task profiles file under /vendor/etc/task_profiles.json
type vendor_task_profiles_file, vendor_file_type, file_type;
Rename the context for the ART APEX. Test: Boot (with default flattened APEXes) Bug: 135753770 Change-Id: I551e88a250d3bd891f63a6bccee0682d0d0de7cf
2019-07-17 16:48:30 +02:00
# Type for /system/apex/com.android.art
type art_apex_dir, system_file_type, file_type;
Move linker config under /linkerconfig Currently linker config locates under /dev, but this makes some problem in case of using two system partitions using chroot. To match system image and configuration, linker config better stays under /linkerconfig Bug: 144966380 Test: m -j passed && tested from cuttlefish Change-Id: Iea67663442888c410f29f8dd0c44fe49e3fcef94
2019-11-22 06:56:10 +01:00
# /linkerconfig(/.*)?
type linkerconfig_file, file_type;
new label for incremental control files Test: manual with incremental installation Test: coral:/data/incremental/MT_data_incremental_tmp_1658593565/mount # ls -lZ .pending_reads Test: -rw-rw-rw- 1 root root u:object_r:incremental_control_file:s0 0 1969-12-31 19:00 .pending_reads BUG: 133435829 Change-Id: Ie090e085d94c5121bf61237974effecef2dcb180
2020-02-13 03:16:09 +01:00
# Control files under /data/incremental
type incremental_control_file, file_type, data_file_type, core_data_file_type;
label boot animations on oem with bootanim_oem_file Bootanimation only access boot animation files on oem. Label these files with bootanim_oem_file and remove oemfs file allow rule. Also allow mediaserver and app to read this new label as they can access /oem/media folder. Bug: 324437684 Test: Confirm that boot animation on oem is shown without violations Change-Id: I940ccde9391a5daa920f31926d32e68b1de5b7eb
2024-02-15 08:34:47 +01:00
# /oem/media/bootanimation.zip|shutdownanimation.zip|userspace-reboot.zip
type bootanim_oem_file, file_type, system_file_type;
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
# Default type for directories search for
# HAL implementations
type vendor_hal_file, vendor_file_type, file_type;
# Default type for under /vendor or /system/vendor
type vendor_file, vendor_file_type, file_type;
# Default type for everything in /vendor/app
type vendor_app_file, vendor_file_type, file_type;
# Default type for everything under /vendor/etc/
type vendor_configs_file, vendor_file_type, file_type;
Update comment on same_process_hal_file type. Test: n/a Change-Id: I929772fa36da6b96494d14cfa48b47dcc76cccd4
2018-08-08 19:02:12 +02:00
# Default type for all *same process* HALs and their lib/bin dependencies.
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
# e.g. libEGL_xxx.so, android.hardware.graphics.mapper@2.0-impl.so
type same_process_hal_file, vendor_file_type, file_type;
Rename vndk-stable to vndk-sp (SP=Same-process) The concept of VNDK-stable set is gone because they no longer need to be stable across several Android releases. Instead, they are just small set of system libraries (other than Low-Level NDK) that can be used by same-process HALs. They need to be stable only during an Android release as other VNDK libraries. However, since they are eligible for double loading, we still need to distinguish those libs from other VNDK libraries. So we give them a name vndk-sp, which means VNDK designed for same-process HALs. Bug: 37139956 Test: booting successful with vndk-sp libs in /vendor/lib(64)?/vndk-sp Change-Id: I892c4514deb3c6c8006e3659bed1ad3363420732
2017-04-10 06:37:40 +02:00
# Default type for vndk-sp libs. /vendor/lib/vndk-sp
type vndk_sp_file, vendor_file_type, file_type;
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
# Default type for everything in /vendor/framework
type vendor_framework_file, vendor_file_type, file_type;
# Default type for everything in /vendor/overlay
type vendor_overlay_file, vendor_file_type, file_type;
SELinux type for vendor public libs. Vendor public libs are exposed to apps (not system), and their ABI stability is guaranteed by vendor. Introducing new selinux type so that we don't conflate concepts of same-process HAL and vendor public lib. The former is exposed to all domains, while the latter should only be acessible by apps. Bug: 76413554 Test: build-only change, policy builds Change-Id: I89dad351374f46c7fe2726991eb4c05064c37ed5
2018-04-30 23:38:21 +02:00
# Type for all vendor public libraries. These libs should only be exposed to
# apps. ABI stability of these libs is vendor's responsibility.
type vendor_public_lib_file, vendor_file_type, file_type;
Add vendor_public_framework_file type to SEPolicy And allow access from system apps to vendor libs public only for system. These files should be marked individually by OEMs. Maintainance ownership for these libraries is also OEM's responsability. Similar with vendor_public_libs_file type, this allows for an explicit labeling of OEM system apps that can access libs from vendor. Bug: 172526961 Test: build-only change, policy builds Change-Id: I7d4c8232e0b52e73f373d3347170c87ab2dcce52
2021-01-25 13:57:56 +01:00
# Type for all vendor public libraries for system. These libs should only be exposed to
# system. ABI stability of these libs is vendor's responsibility.
type vendor_public_framework_file, vendor_file_type, file_type;
Introduce vendor_microdroid_file for microdroid vendor image In AVF, virtualizationmanager checks the selinux label of given disk image for proving whether the given image is edited maliciously. Existing one(vendor_configs_file, /vendor/etc/*) was too wide to use for this purpose. Bug: 285854379 Test: m Change-Id: I6c966c92b238a2262d2eb7f41041ed4c359e9e0a
2023-11-15 09:59:30 +01:00
# Type for all microdroid related files in the vendor partition.
vendor_microdroid_file shouldn't be overwrited If malicious process in the host overwrites microdroid vendor image, unexpected behavior could be happened. Bug: 285854379 Test: adb shell /apex/com.android.virt/bin/vm run-microdroid --vendor /vendor/etc/avf/microdroid/microdroid_vendor.img Change-Id: I18ce5112b75b2793c85bb59c137715beb602a5f3
2023-11-27 07:01:40 +01:00
# Files having this type should be read-only.
Introduce vendor_microdroid_file for microdroid vendor image In AVF, virtualizationmanager checks the selinux label of given disk image for proving whether the given image is edited maliciously. Existing one(vendor_configs_file, /vendor/etc/*) was too wide to use for this purpose. Bug: 285854379 Test: m Change-Id: I6c966c92b238a2262d2eb7f41041ed4c359e9e0a
2023-11-15 09:59:30 +01:00
type vendor_microdroid_file, vendor_file_type, file_type;
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
Allow system app and update_engine to read OTA from /vendor Introuducing vendor_boot_ota_file which will be used to allow reading OTAs from /vendor/boot_otas when BOARD_16K_OTA_MOVE_VENDOR := true is set. These OTAs will be read from settings app(system_app) and update engine. Test: m, m Settings && adb install -r $ANDROID_PRODUCT_OUT/system_ext/priv-app/Settings/Settings.apk Bug: 335022191 Change-Id: Ie42e0de12694ed74f9a98cd115f72d207f67c834
2024-04-30 00:03:20 +02:00
starting_at_board_api(202504, `
# boot otas for 16KB developer option
type vendor_boot_ota_file, vendor_file_type, file_type;
')
Allow system_server to read vendor_file Input device configuration files .idc, .kl that are placed in /vendor are currently not accessible. Allow the read access here. Bug: 112880217 Test: move .idc and .kl files from /system to /vendor, then observe logcat. With this patch, avc denials disappear. Change-Id: I72ad62b9adf415f787565adced73fd8aaff38832
2018-10-08 21:04:15 +02:00
# Input configuration
type vendor_keylayout_file, vendor_file_type, file_type;
type vendor_keychars_file, vendor_file_type, file_type;
type vendor_idc_file, vendor_file_type, file_type;
Added sepolicy rule for vendor uuid mapping config New type added in sepolicy to restrict Vendor defined uuid mapping config file access to SecureElement. Bug: b/180639372 Test: Run OMAPI CTS and VTS tests Change-Id: I81d715fa5d5a72c893c529eb542ce62747afcd03
2021-11-18 23:59:29 +01:00
# Type for vendor uuid mapping config file
type vendor_uuid_mapping_config_file, vendor_file_type, file_type;
Don't prevent crosvm from accessing vendor-owned VM disk images There can be VM disk images that are specific to the underlying SoC. e.g. in case where SoC-specific hardware is dedicated to a VM and the VM needs drivers (or HALs) for the hardware. Don't prevent crosvm from reading such a SoC-specific VM disk images. Note that this doesn't actually allow crosvm to do that in AOSP. Such an allow rule could be added in downstreams where such use cases exist. Bug: 193605879 Test: m Change-Id: If19c0b6adae4c91676b142324c2903879548a135
2021-08-09 02:24:45 +02:00
# SoC-specific virtual machine disk files
type vendor_vm_file, vendor_file_type, file_type;
# SoC-specific virtual machine disk files that are mutable
type vendor_vm_data_file, vendor_file_type, file_type;
Add metadata_file class for root of metadata folder. Bug: 77335096 Test: booted device with metadata encryption and without Change-Id: I5bc5d46deb4e91912725c4887fde0c3a41c9fc91
2018-04-20 20:14:49 +02:00
# /metadata partition itself
type metadata_file, file_type;
# Vold files within /metadata
Allow vendor_init and e2fs to enable metadata encryption Bug: 63927601 Test: Enable metadata encryption in fstab on Taimen, check boot success. Change-Id: Iddbcd05501d360d2adc4edf8ea7ed89816642d26
2018-02-01 19:15:34 +01:00
type vold_metadata_file, file_type;
Full sepolicy for gsid. Bug: 122556707 Test: manual test Change-Id: I2536deefb3aa75deee4aeae7df074349b705b0f0
2019-01-23 04:05:29 +01:00
# GSI files within /metadata
Split gsi_metadata_file and add gsi_metadata_file_type attribute Split gsi_metadata_file into gsi_metadata_file plus gsi_public_metadata_file, and add gsi_metadata_file_type attribute. Files that are okay to be publicly readable are labeled with gsi_public_metadata_file. Right now only files needed to infer the device fstab belong to this label. The difference between gsi_metadata_file and gsi_public_metadata_file is that gsi_public_metadata_file has relaxed neverallow rules, so processes who wish to read the fstab can add the respective allow rules to their policy files. Allow gsid to restorecon on gsi_metadata_file to fix the file context of gsi_public_metadata_file. Bug: 181110285 Test: Build pass Test: Issue a DSU installation then verify no DSU related denials and files under /metadata/gsi/ are labeled correctly. Change-Id: I54a5fe734dd345e28fd8c0874d5fceaf80ab8c11
2021-03-22 06:46:12 +01:00
type gsi_metadata_file, gsi_metadata_file_type, file_type;
# DSU (GSI) files within /metadata that are globally readable.
type gsi_public_metadata_file, gsi_metadata_file_type, file_type;
Add sepolicy for /metadata/password_slots. The device OS and an installed GSI will both attempt to write authentication data to the same weaver slots. To prevent this, we can use the /metadata partition (required for GSI support) to communicate which slots are in use between OS images. To do this we define a new /metadata/password_slots directory and define sepolicy to allow system_server (see PasswordSlotManager) to access it. Bug: 123716647 Test: no denials on crosshatch Change-Id: I8e3679d332503b5fb8a8eb6455de068c22eba30b
2019-02-28 23:11:34 +01:00
# system_server shares Weaver slot information in /metadata
type password_slot_metadata_file, file_type;
Add policy for /metadata/apex. This is an area that apexd can use to store session metadata, which won't be rolled back with filesystem checkpointing. Bug: 126740531 Test: builds Change-Id: I5abbc500dc1b92aa46830829be76e7a4381eef91
2019-03-12 16:37:13 +01:00
# APEX files within /metadata
type apex_metadata_file, file_type;
Add selinux labels for /metadata/ota. /metadata/ota will store critical bits necessary to reify system and vendor partition state during an OTA. It will be accessed primarily by first-stage init, recovery/fastbootd, and update_engine. Bug: 136678799 Test: manual test Change-Id: Ib78cb96ac60ca11bb27d2b2fe011482e64ba0cf8
2019-07-09 04:03:59 +02:00
# libsnapshot files within /metadata
type ota_metadata_file, file_type;
bootstat: enhance last reboot reason property with file backing Helps with support of recovery and rollback boot reason history, by also using /metadata/bootstat/persist.sys.boot.reason to file the reboot reason. For now, label this file metadata_bootstat_file. Test: manual Bug: 129007837 Change-Id: Id1d21c404067414847bef14a0c43f70cafe1a3e2
2019-05-23 21:49:42 +02:00
# property files within /metadata/bootstat
type metadata_bootstat_file, file_type;
Selinux policy for new userspace reboot logging dir Add userspace_reboot_metadata_file, which is written to by init, and read by system server. System server will also handle the deletion policy and organization of files within this directory, so it needs additional permissions. Test: Builds Bug: 151820675 Change-Id: Ifbd70a6564e2705e3edf7da6b05486517413b211
2020-06-02 11:47:16 +02:00
# userspace reboot files within /metadata/userspacereboot
type userspace_reboot_metadata_file, file_type;
Create sepolicy for allowing system_server rw in /metadata/staged-install Bug: 146343545 Test: presubmit Change-Id: I4a7a74ec4c5046d167741389a40da7f330d4c63d Merged-In: I4a7a74ec4c5046d167741389a40da7f330d4c63d (cherry picked from commit be5c4de29fe7ead7fa55ab6865d9f397dd179a30)
2020-05-19 13:43:18 +02:00
# Staged install files within /metadata/staged-install
type staged_install_file, file_type;
Add sepolicy for /metadata/watchdog See go/rescue-party-reboot for more context. One integer will be stored in a file in this directory, which will be read and then deleted at the next boot. No userdata is stored. Test: Write and read from file from PackageWatchdog Bug: 171951174 Change-Id: I18f59bd9ad324a0513b1184b2f4fe78c592640db
2020-12-05 18:25:35 +01:00
# Metadata information within /metadata/watchdog
type watchdog_metadata_file, file_type;
Create sepolicy for allowing system_server rw in /metadata/repair-mode Bug: 277561275 Test: ls -all -Z /metadata/repair-mode Change-Id: Ie27b6ef377bb3503e87fbc5bb2446bc0de396123
2023-05-25 08:59:05 +02:00
# Repair mode files within /metadata/repair-mode
type repair_mode_metadata_file, file_type;
selinux setup for files under /metadata/aconfig dir 1, /metadata/aconfig is the directory that stores aconfig storage related protobuf files and flag value files boot copy. Grant read access to everybody. But limit the write access only to init and aconfig storage service process (to be created later) 2, /metadata/aconfig/flags is the sub directory that stores persistent aconfig value files.Initially set it up to be accessible by system_server process only . When aconfig storage service process is created, will add another permission to storage service process. Context to why we are hosting flag data on /metadata partition: Android is adopting trunk stable workflow, flagging and A/B testing is essential to every platform component. We need some place to host the flag that are accessible to system processes that starts before /data partition becomes available. In addition, there has been a long discussion regarding utilizing /metadata partition for some process data, another example is mainline modules, we are trying to make them to be able to be mounted earlier, but cannot due to /data availability. Bug: 312444587 Test: m Change-Id: I7e7dae5cf8c4268d71229c770af31b5e9f071428
2024-02-13 04:18:32 +01:00
# Aconfig storage file
type aconfig_storage_metadata_file, file_type;
# Aconfig storage flag value persistent copy
type aconfig_storage_flags_metadata_file, file_type;
Allow vendor_init and e2fs to enable metadata encryption Bug: 63927601 Test: Enable metadata encryption in fstab on Taimen, check boot success. Change-Id: Iddbcd05501d360d2adc4edf8ea7ed89816642d26
2018-02-01 19:15:34 +01:00
Add new cpu variant related rules to SELinux I added ro.bionic.(2nd_)?_(arch|cpu_variant) to vendor system properties. And have init to write them to files under dev/. This change set SELinux rules for these properties and files. For the system properties: vendor/default.prop will set them. init will read them. For the files /dev/cpu_variant:.*: init will write them. bionic libc will read them. (Basically world readable). This is to allow libc select the right optimized routine at runtime. Like memcpy / strcmp etc. Test: getprop to make sure the properties are set. Test: ls -laZ to make sure /dev/cpu_variant:.* are correctly labeled. Change-Id: I41662493dce30eae6d41bf0985709045c44247d3
2018-11-06 00:03:16 +01:00
# Type for /dev/cpu_variant:.*.
type dev_cpu_variant, file_type;
logd: restrict access to /dev/event-log-tags Create an event_log_tags_file label and use it for /dev/event-log-tags. Only trusted system log readers are allowed direct read access to this file, no write access. Untrusted domain requests lack direct access, and are thus checked for credentials via the "plan b" long path socket to the event log tag service. Test: gTest logd-unit-tests, liblog-unit-tests and logcat-unit-tests Bug: 31456426 Bug: 30566487 Change-Id: Ib9b71ca225d4436d764c9bc340ff7b1c9c252a9e
2016-11-08 00:11:39 +01:00
# Speedup access for trusted applications to the runtime event tags
type runtime_event_log_tags_file, file_type;
Dependencies for new goldfish service domains. In order to support the new goldfish service domains in a change with the same Change-Id for the build project, we need the following changes in external/sepolicy: - /system/bin/logcat needs its own type so that it can be used as an entrypoint for the goldfish-logcat service. A neverallow rule prevents us from allowing entrypoint to any type not in exec_type. - The config. and dalvik. property namespaces need to be labeled with something other than default_prop so that the qemu-props service can set them. A neverallow rule prevents us from allowing qemu-props to set default_prop. We allow rx_file_perms to logcat_exec for any domain that was previously allowed read_logd() as many programs will read the logs by running logcat. We do not do this for all domains as it would violate a neverallow rule on the kernel domain executing any file without transitioning to another domain, and as we ultimately want to apply the same restriction to the init domain (and possibly others). Change-Id: Idce1fb5ed9680af84788ae69a5ace684c6663974 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-04 14:44:49 +02:00
# Type for /system/bin/logcat.
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type logcat_exec, system_file_type, exec_type, file_type;
sepolicy changes to configure cgroup.rc and task_profiles.json access cgroups.json file contains cgroup information required to mount cgroup controllers and is readable only by init process. cgroup.rc contains cgroup map information consisting of the list of cgroups available in the system and their mounting locations. It is created by init process and should be readable by any processes that uses cgroups and should be writable only by init process. task_profiles.json file contains task profiles used to operate on cgroups. This information should be readable by any process that uses cgroups and should be writable only by init process. Bug: 111307099 Test: builds, boots Change-Id: Ib2c87c0fc3663c7fc69628f05c846519b65948b5 Merged-In: Ib2c87c0fc3663c7fc69628f05c846519b65948b5 Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2019-01-11 02:10:31 +01:00
# Speedup access to cgroup map file
type cgroup_rc_file, file_type;
allow coredump functionality (cherrypick of commit d7e004ebf949ae21b299a49cff9917f6560200a3) Change-Id: I7993698ac96f21db0039681275280dbd43ff61ba
2014-10-31 20:40:12 +01:00
# /cores for coredumps on userdebug / eng builds
type coredump_file, file_type;
Root of /data belongs to init (re-landing) Give /data itself a different label to its contents, to ensure that only init creates files and directories there. This change originally landed as aosp/1106014 and was reverted in aosp/1116238 to fix b/140402208. aosp/1116298 fixes the underlying problem, and with that we can re-land this change. Bug: 139190159 Bug: 140402208 Test: aosp boots, logs look good Change-Id: I1a366c577a0fff307ca366a6844231bcf8afe3bf
2019-08-02 00:57:47 +02:00
# Type of /data itself
type system_data_root_file, file_type, data_file_type, core_data_file_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
# Default type for anything under /data.
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type system_data_file, file_type, data_file_type, core_data_file_type;
Restrict creating per-user encrypted directories Creating a per-user encrypted directory such as /data/system_ce/0 and the subdirectories in it too early has been a recurring bug. Typically, individual services in system_server are to blame; system_server has permission to create these directories, and it's easy to write "mkdirs()" instead of "mkdir()". Such bugs are very bad, as they prevent these directories from being encrypted, as encryption policies can only be set on empty directories. Due to recent changes, a factory reset is now forced in such cases, which helps detect these bugs; however, it would be much better to prevent them in the first place. This CL locks down the ability to create these directories to just vold and init, or to just vold when possible. This is done by assigning new types to the directories that contain these directories, and then only allowing the needed domains to write to these parent directories. This is similar to what https://r.android.com/1117297 did for /data itself. Three new types are used instead of just one, since these directories had three different types already (system_data_file, media_rw_data_file, vendor_data_file), and this allows the policy to be a bit more precise. A significant limitation is that /data/user/0 is currently being created by init during early boot. Therefore, this CL doesn't help much for /data/user/0, though it helps a lot for the other directories. As the next step, I'll try to eliminate the /data/user/0 quirk. Anyway, this CL is needed regardless of whether we're able to do that. Test: Booted cuttlefish. Ran 'sm partition disk:253,32 private', then created and deleted a user. Used 'ls -lZ' to check the relevant SELinux labels on both internal and adoptable storage. Also did similar tests on raven, with the addition of going through the setup wizard and using an app that creates media files. No relevant SELinux denials seen during any of this. Bug: 156305599 Change-Id: I1fbdd180f56dd2fe4703763936f5850cef8ab0ba
2022-05-05 00:18:02 +02:00
# Default type for directories containing per-user encrypted directories, such
# as /data/user and /data/user_de.
type system_userdir_file, file_type, data_file_type, core_data_file_type;
Relabel /data/system/packages.list to new type. Conservatively grant access to packages_list_file to everything that had access to system_data_file:file even if the comment in the SELinux policy suggests it was for another use. Ran a diff on the resulting SEPolicy, the only difference of domains being granted is those that had system_data_file:dir permissiosn which is clearly not applicable for packages.list diff -u0 <(sesearch --allow -t system_data_file ~/sepolicy | sed 's/system_data_file/packages_list_file/') <(sesearch --allow -t packages_list_file ~/sepolicy_new) --- /proc/self/fd/16 2019-03-19 20:01:44.378409146 +0000 +++ /proc/self/fd/18 2019-03-19 20:01:44.378409146 +0000 @@ -3 +2,0 @@ -allow appdomain packages_list_file:dir getattr; @@ -6 +4,0 @@ -allow coredomain packages_list_file:dir getattr; @@ -8 +5,0 @@ -allow domain packages_list_file:dir search; @@ -35 +31,0 @@ -allow system_server packages_list_file:dir { rename search setattr read lock create reparent getattr write relabelfrom ioctl rmdir remove_name open add_name }; @@ -40 +35,0 @@ -allow tee packages_list_file:dir { search read lock getattr ioctl open }; @@ -43,3 +37,0 @@ -allow traced_probes packages_list_file:dir { read getattr open search }; -allow vendor_init packages_list_file:dir { search setattr read create getattr write relabelfrom ioctl rmdir remove_name open add_name }; -allow vold packages_list_file:dir { search setattr read lock create getattr mounton write ioctl rmdir remove_name open add_name }; @@ -48 +39,0 @@ -allow vold_prepare_subdirs packages_list_file:dir { read write relabelfrom rmdir remove_name open add_name }; @@ -50 +40,0 @@ -allow zygote packages_list_file:dir { search read lock getattr ioctl open }; Bug: 123186697 Change-Id: Ieabf313653deb5314872b63cd47dadd535af7b07
2019-03-19 19:14:38 +01:00
# Type for /data/system/packages.list.
# TODO(b/129332765): Narrow down permissions to this.
# Find out users of system_data_file that should be granted only this.
type packages_list_file, file_type, data_file_type, core_data_file_type;
Add label and permission for game_mode_intervention.list Bug: 219543620 Doc: go/game-dashboard-information-to-perfetto Test: TBD Change-Id: Ic6622aadef05e22c95d4ba739beed0e6fa1f3a38
2022-03-25 19:08:59 +01:00
type game_mode_intervention_list_file, file_type, data_file_type, core_data_file_type;
Restrict creating per-user encrypted directories Creating a per-user encrypted directory such as /data/system_ce/0 and the subdirectories in it too early has been a recurring bug. Typically, individual services in system_server are to blame; system_server has permission to create these directories, and it's easy to write "mkdirs()" instead of "mkdir()". Such bugs are very bad, as they prevent these directories from being encrypted, as encryption policies can only be set on empty directories. Due to recent changes, a factory reset is now forced in such cases, which helps detect these bugs; however, it would be much better to prevent them in the first place. This CL locks down the ability to create these directories to just vold and init, or to just vold when possible. This is done by assigning new types to the directories that contain these directories, and then only allowing the needed domains to write to these parent directories. This is similar to what https://r.android.com/1117297 did for /data itself. Three new types are used instead of just one, since these directories had three different types already (system_data_file, media_rw_data_file, vendor_data_file), and this allows the policy to be a bit more precise. A significant limitation is that /data/user/0 is currently being created by init during early boot. Therefore, this CL doesn't help much for /data/user/0, though it helps a lot for the other directories. As the next step, I'll try to eliminate the /data/user/0 quirk. Anyway, this CL is needed regardless of whether we're able to do that. Test: Booted cuttlefish. Ran 'sm partition disk:253,32 private', then created and deleted a user. Used 'ls -lZ' to check the relevant SELinux labels on both internal and adoptable storage. Also did similar tests on raven, with the addition of going through the setup wizard and using an app that creates media files. No relevant SELinux denials seen during any of this. Bug: 156305599 Change-Id: I1fbdd180f56dd2fe4703763936f5850cef8ab0ba
2022-05-05 00:18:02 +02:00
# Default type for anything inside /data/vendor_{ce,de}.
label /data/vendor{_ce,_de} Restrictions introduced in vendor init mean that new devices may not no longer exempt vendor init from writing to system_data_file. This means we must introduce a new label for /data/vendor which vendor_init may write to. Bug: 73087047 Test: build and boot Taimen and Marlin. Complete SUW, enroll fingerprint No new denials. Change-Id: I65f904bb28952d4776aab947515947e14befbe34
2018-02-08 01:29:06 +01:00
type vendor_data_file, file_type, data_file_type;
Restrict creating per-user encrypted directories Creating a per-user encrypted directory such as /data/system_ce/0 and the subdirectories in it too early has been a recurring bug. Typically, individual services in system_server are to blame; system_server has permission to create these directories, and it's easy to write "mkdirs()" instead of "mkdir()". Such bugs are very bad, as they prevent these directories from being encrypted, as encryption policies can only be set on empty directories. Due to recent changes, a factory reset is now forced in such cases, which helps detect these bugs; however, it would be much better to prevent them in the first place. This CL locks down the ability to create these directories to just vold and init, or to just vold when possible. This is done by assigning new types to the directories that contain these directories, and then only allowing the needed domains to write to these parent directories. This is similar to what https://r.android.com/1117297 did for /data itself. Three new types are used instead of just one, since these directories had three different types already (system_data_file, media_rw_data_file, vendor_data_file), and this allows the policy to be a bit more precise. A significant limitation is that /data/user/0 is currently being created by init during early boot. Therefore, this CL doesn't help much for /data/user/0, though it helps a lot for the other directories. As the next step, I'll try to eliminate the /data/user/0 quirk. Anyway, this CL is needed regardless of whether we're able to do that. Test: Booted cuttlefish. Ran 'sm partition disk:253,32 private', then created and deleted a user. Used 'ls -lZ' to check the relevant SELinux labels on both internal and adoptable storage. Also did similar tests on raven, with the addition of going through the setup wizard and using an app that creates media files. No relevant SELinux denials seen during any of this. Bug: 156305599 Change-Id: I1fbdd180f56dd2fe4703763936f5850cef8ab0ba
2022-05-05 00:18:02 +02:00
# Type for /data/vendor_{ce,de} themselves. This has core_data_file_type
# because these directories themselves are platform-managed; only the files
# *inside* them are vendor data. (Somewhat similar to system_data_root_file.)
type vendor_userdir_file, file_type, data_file_type, core_data_file_type;
Adding e4crypt support Add selinux rules to allow file level encryption to work Change-Id: I1e4bba23e99cf5b2624a7df843688fba6f3c3209
2015-03-11 23:44:14 +01:00
# Unencrypted data
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type unencrypted_data_file, file_type, data_file_type, core_data_file_type;
Move layout_version to /data/misc/installd Bug: 139543295 Test: Boot, ensure file is properly created Change-Id: I577b25bcf61505970b153884d8ac3567957bb50a
2019-08-16 22:41:55 +02:00
# installd-create files in /data/misc/installd such as layout_version
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type install_data_file, file_type, data_file_type, core_data_file_type;
Policy changes to support running the latest CTS.
2012-03-07 20:59:01 +01:00
# /data/drm - DRM plugin data
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type drm_data_file, file_type, data_file_type, core_data_file_type;
Allow adbd to write to /data/adb adbd writes debugging information to /data/adb when persist.adb.trace_mask is set. Allow it. Bug: https://code.google.com/p/android/issues/detail?id=72895 Change-Id: Ia5af09045e9f72a95325b429c30a5ae78e104bdc
2014-10-21 06:56:02 +02:00
# /data/adb - adb debugging files
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type adb_data_file, file_type, data_file_type, core_data_file_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
# /data/anr - ANR traces
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type anr_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
SE Android policy.
2012-01-04 18:33:27 +01:00
# /data/tombstones - core dumps
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type tombstone_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Wifi hal - Firmware dump permissions we are aiming to improve logging performance by having wifi hal directly write to the flash. Wifi hal need to be able to create, write, and delete files in a directory. This will be restricted to userdebug and eng builds only. Bug: 70170285 Test: compile, run on device Change-Id: Id0cd317411f4c393d7529aa31b501046d7350edb
2017-12-15 23:01:44 +01:00
# /data/vendor/tombstones/wifi - vendor wifi dumps
type tombstone_wifi_data_file, file_type, data_file_type;
Add policy for apexd. apexd is a new daemon for managing APEX packages installed on the device. It hosts a single binder service, "apexservice". Bug: 112455435 Test: builds, binder service can be registered, apexes can be accessed, verified and mounted Change-Id: I634ad100f10b2edcd9a9c0df0d33896fa5d4ed97
2018-08-17 09:35:42 +02:00
# /data/apex - APEX data files
type apex_data_file, file_type, data_file_type, core_data_file_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
# /data/app - user-installed apps
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type apk_data_file, file_type, data_file_type, core_data_file_type;
type apk_tmp_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Add new domains for private apps. /data/app-private is used when making an app purchase or forward locking. Provide a new label for the directory as well as the tmp files that appear under it. Change-Id: I910cd1aa63538253e10a8d80268212ad9fc9fca5 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2013-04-03 20:21:46 +02:00
# /data/app-private - forward-locked apps
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type apk_private_data_file, file_type, data_file_type, core_data_file_type;
type apk_private_tmp_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
SE Android policy.
2012-01-04 18:33:27 +01:00
# /data/dalvik-cache
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type dalvikcache_data_file, file_type, data_file_type, core_data_file_type;
Selinux: introduce policy for OTA preopt Add permissions to dex2oat, introduce otapreopt binary and otadexopt service. Bug: 25612095 Change-Id: I80fcba2785e80b2931d7d82bb07474f6cd0099f7
2015-12-03 06:23:30 +01:00
# /data/ota
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type ota_data_file, file_type, data_file_type, core_data_file_type;
Add ota_package_file label for OTA packages. (cherry picked from commit 6c3f2831aca571ec3b01f60996965a432aa8164d) Allow priv_app, uncrypt, update_engine to access the OTA packages at /data/ota_package (both A/B and non-A/B). GMSCore (priv_app) checks the existence of the folder, and downloads the package there if present. Bug: 28944800 Change-Id: I3c0717861fce7f93b33874a99f6a4a55567612a5
2016-05-25 06:07:48 +02:00
# /data/ota_package
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type ota_package_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Update permissions for the dedicated profile folders Bug: 26719109 Bug: 26563023 Change-Id: Ie0ca764467c874c061752cbbc73e1bacead9b995
2016-02-01 20:28:39 +01:00
# /data/misc/profiles
Split user_profile_data_file label. user_profile_data_file is mlstrustedobject. And it needs to be, because we want untrusted apps to be able to write to their profile files, but they do not have levels. But now we want to apply levels in the parent directories that have the same label, and we want them to work so they need to not be MLS-exempt. To resolve that we introduce a new label, user_profile_root_file, which is applied to those directories (but no files). We grant mostly the same access to the new label as directories with the existing label. Apart from appdomain, almost every domain which accesses user_profile_data_file, and now user_profile_root_file, is already mlstrustedsubject and so can't be affected by this change. The exception is postinstall_dexopt which we now make mlstrustedobject. Bug: 141677108 Bug: 175311045 Test: Manual: flash with wipe Test: Manual: flash on top of older version Test: Manual: install & uninstall apps Test: Manual: create & remove user Test: Presubmits. Change-Id: I4e0def3d513b129d6c292f7edb076db341b4a2b3
2020-12-04 15:07:52 +01:00
type user_profile_root_file, file_type, data_file_type, core_data_file_type;
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type user_profile_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
SELinux policy for /data/misc/profman Bug: 28748264 Change-Id: I872c25666707beb737f3ce7a4f706c0135df7ad5
2016-05-27 21:41:35 +02:00
# /data/misc/profman
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type profman_dump_data_file, file_type, data_file_type, core_data_file_type;
sepolicy: new prereboot_data_file type This adds the type and permissions for dumping and appending prereboot information. Bug: 145203410 Test: Didn't see denials while dumping and appending prereboot info. Change-Id: Ic08408b9bebc3648a7668ed8475f96a5302635fa
2020-01-02 09:14:48 +01:00
# /data/misc/prereboot
type prereboot_data_file, file_type, data_file_type, core_data_file_type;
Fix SELinux policies to allow resource overlays. The following commits added support for runtime resource overlays. New command line tool 'idmap' * 65a05fd56dbc9fd9c2511a97f49c445a748fb3c5 Runtime resource overlay, iteration 2 * 48d22323ce39f9aab003dce74456889b6414af55 Runtime resource overlay, iteration 2, test cases * ad6ed950dbfa152c193dd7e49c369d9e831f1591 During SELinux tightening, support for these runtime resource overlays was unknowingly broken. Fix it. This change has been tested by hackbod and she reports that everything is working after this change. I haven't independently verified the functionality. Test cases are available for this by running: * python frameworks/base/core/tests/overlaytests/testrunner.py Change-Id: I1c70484011fd9041bec4ef34f93f7a5509906f40
2014-06-16 23:19:31 +02:00
# /data/resource-cache
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type resourcecache_data_file, file_type, data_file_type, core_data_file_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
# /data/local - writable by shell
Introduce app_data_file_type attribute. This gives us an easy way for the policy to refer to all existing or future types used for app private data files in type= assignments in seapp_contexts. Apply the label to all the existing types, then refactor rules to use the new attribute. This is intended as a pure refactoring, except that: - Some neverallow rules are extended to cover types they previous omitted; - We allow iorap_inode2filename limited access to shell_data_file and nfc_data_file; - We allow zygote limited access to system_app_data_file. This mostly reverts the revert in commit b01e1d97bf1320d54c8641cfff687f13f32013bf, restoring commit 27e0c740f1894e9a390b7105255eb29401d25c35. Changes to check_seapp to enforce use of app_data_file_type is omitted, to be included in a following CL. Test: Presubmits Bug: 171795911 Change-Id: I02b31e7b3d5634c94763387284b5a154fe5b71b4
2020-10-27 18:35:33 +01:00
type shell_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type, mlstrustedobject;
Protect /data/property. /data/property is only accessible by root and is used by the init property service for storing persistent property values. Create a separate type for it and only allow init to write to the directory and files within it. Ensure that we do not allow access to other domains in future changes or device-specific policy via a neverallow rule. Change-Id: Iff556b9606c5651c0f1bba902e30b59bdd6f063a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-29 15:22:16 +02:00
# /data/property
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type property_data_file, file_type, data_file_type, core_data_file_type;
bootchart: add policy rules for bootchart allow the bootchart to create dir and files at init, also allow user to create the stop and start file under /data/bootchart directory to start and stop bootchart Change-Id: Icfee8dcd17366383eef00fbe3139744bf4427a6b Signed-off-by: Yongqin Liu <yongqin.liu@linaro.org>
2014-12-05 06:40:22 +01:00
# /data/bootchart
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type bootchart_data_file, file_type, data_file_type, core_data_file_type;
Protect dropbox service data with selinux Create a new label for /data/system/dropbox, and neverallow direct access to anything other than init and system_server. While all apps may write to the dropbox service, only apps with android.permission.READ_LOGS, a signature|privileged|development permission, may read them. Grant access to priv_app, system_app, and platform_app, and neverallow access to all untrusted_apps. Bug: 31681871 Test: atest CtsStatsdHostTestCases Test: atest DropBoxTest Test: atest ErrorsTests Change-Id: Ice302b74b13c4d66e07b069c1cdac55954d9f5df
2018-04-16 16:49:49 +02:00
# /data/system/dropbox
type dropbox_data_file, file_type, data_file_type, core_data_file_type;
Allow system_server to collect app heapdumps (debug builds only) On debuggable builds, system_server can request app heap dumps by running something similar to the following commands: % adb shell am set-watch-heap com.android.systemui 1048576 % adb shell dumpsys procstats --start-testing which will dump the app's heap to /data/system/heapdump. See framework/base commit b9a5e4ad30c9add140fd13491419ae66e947809d. Allow this behavior. Addresses the following denial: avc: denied { write } for path="/data/system/heapdump/javaheap.bin" dev="dm-0" ino=150747 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:system_data_file:s0 tclass=file permissive=0 Bug: 20073185 Change-Id: I4b925033a5456867caf2697de6c2d683d0743540
2015-04-08 01:40:44 +02:00
# /data/system/heapdump
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type heapdump_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Create a new SELinux type for /data/nativetest 1) Don't use the generic "system_data_file" for the files in /data/nativetest. Rather, ensure it has it's own special label. This allows us to distinguish these files from other files in SELinux policy. 2) Allow the shell user to execute files from /data/nativetest, on userdebug or eng builds only. 3) Add a neverallow rule (compile time assertion + CTS test) that nobody is allowed to execute these files on user builds, and only the shell user is allowed to execute these files on userdebug/eng builds. Bug: 25340994 Change-Id: I3e292cdd1908f342699d6c52f8bbbe6065359413
2015-10-29 00:45:58 +01:00
# /data/nativetest
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type nativetest_data_file, file_type, data_file_type, core_data_file_type;
Add shell_test_data_file for /data/local/tests Add a domain for /data/local/tests which will be used by atest to execute tests on devices as shell or root. Bug: 138450837 Test: atest binderVendorDoubleLoadTest memunreachable_unit_test memunreachable_binder_test Change-Id: Ia34314bd9430e21c8b3304ac079e3d9b5705e19c
2020-09-01 01:11:11 +02:00
# /data/local/tests
type shell_test_data_file, file_type, data_file_type, core_data_file_type;
Offer to cache ringtones in system DE storage. Ringtones often live on shared media, which is now encrypted with CE keys and not available until after the user is unlocked. To improve the user experience while locked, cache the default ringtone, notification sound, and alarm sound in a DE storage area. Also fix bug where wallpaper_file wasn't getting data_file_type. Bug: 26730753 Change-Id: Ib1f08d03eb734c3dce91daab41601d3ed14f4f0d
2016-02-23 01:50:01 +01:00
# /data/system_de/0/ringtones
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type ringtone_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
SELinux policies for /data/preloads directory A new directory is created in user data partition that contains preloaded content such as a retail mode demo video and pre-loaded APKs. The new directory is writable/deletable by system server. It can only be readable (including directory list) by privileged or platform apps Bug: 28855287 Change-Id: I3816cd3a1ed5b9a030965698a66265057214f037
2016-05-20 20:08:45 +02:00
# /data/preloads
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type preloads_data_file, file_type, data_file_type, core_data_file_type;
Split preloads into media_file and data_file Untrusted apps should only access /data/preloads/media and demo directory. Bug: 36197686 Test: Verified retail mode. Checked non-privileged APK cannot access /data/preloads Change-Id: I8e9c21ff6aba799aa31bf06893cdf60dafc04446
2017-03-14 19:42:03 +01:00
# /data/preloads/media
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type preloads_media_file, file_type, data_file_type, core_data_file_type;
Ban core components from accessing vendor data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open FD such as ioctl/stat/read/write/append. This commit asserts that core components marked with attribute coredomain may only access core data types marked with attribute core_data_file_type. A temporary exemption is granted to domains that currently rely on access. (cherry picked from commit cd97e71084b026b201f8d5a0bc08c283f8d673cd) Bug: 34980020 Test: build Marlin policy Change-Id: I2f0442f2628fbac1f2f7aa5ddf2a13e16b2546cc
2017-03-30 00:50:32 +02:00
# /data/misc/dhcp and /data/misc/dhcp-6.8.2
type dhcp_data_file, file_type, data_file_type, core_data_file_type;
Sepolicies for server configural flags reset Test: m -j succeeded and manual tested on device Change-Id: I3415c58335361a9da4ef2368e61bc4e0250a91bb
2018-11-09 01:46:19 +01:00
# /data/server_configurable_flags
type server_configurable_flags_data_file, file_type, data_file_type, core_data_file_type;
Rename data/pkg_staging to data/app-staging Test: n/a Bug: 126330086 Change-Id: I34d5085d8e6546d77cc854e27ca849462d482396 Merged-In: I34d5085d8e6546d77cc854e27ca849462d482396
2019-02-27 12:21:20 +01:00
# /data/app-staging
SEPolicy for Staged Installs. Test: basic workflow between apexd and PackageManager tested with changes being developed. Bug: 118865310 Change-Id: I1ae866f33e9b22493585e108c4fd45400493c7ac
2019-01-02 15:20:52 +01:00
type staging_data_file, file_type, data_file_type, core_data_file_type;
Adding vendor_apex_file for /vendor/apex apexd needs to read /vendor/apex dir and files in it. Bug: 131190070 Bug: 123378252 Test: 1. Add apex to /vendor/apex -> see if boot succeeds with new policy 2. Add flattened apex to /vendor/apex -> see if only root files are labelled as vendor_apex_file Change-Id: I37795ab6d659ac82639ba5e34d628fe1b5cdb350
2019-04-24 03:45:40 +02:00
# /vendor/apex
type vendor_apex_file, vendor_file_type, file_type;
Introduce vendor_apex_metadata_file A new label for ./apex_manifest.pb and ./ entries in vendor apexes. This is read-allowed by a few system components which need to read "apex" in general. For example, linkerconfig needs to read apex_manifest.pb from all apexes including vendor apexes. Previously, these entries were labelled as system_file even for vendor apexes. Bug: 285075529 Test: m && launch_cvd Test: atest VendorApexHostTestsCases Change-Id: Icc234bf604e3cafe6da81d21db744abfaa524dcf
2023-05-31 10:51:14 +02:00
# apex_manifest.pb in vendor apex
type vendor_apex_metadata_file, vendor_file_type, file_type;
Allow dumpstate to read /data/system/shutdown-checkpoints/ Bug: 260366497 Bug: 264600011 Test: Take bugreport and check dmesg for avc error Test: Reboot and check shutdown-checkpoints Change-Id: Ifcc7de30ee64e18f78af147cd3da39d7c6dc6f5f
2023-02-06 09:32:45 +01:00
# /data/system/shutdown-checkpoints
type shutdown_checkpoints_system_data_file, file_type, data_file_type, core_data_file_type;
alphabetize /data/misc entries. Alphabetize the entries for the /data/misc subdirectories. Change-Id: I3690085cbb99c225545545668dedd66341a14edb
2013-12-13 00:23:10 +01:00
Updated policy for external storage. An upcoming platform release is redesigning how external storage works. At a high level, vold is taking on a more active role in managing devices that dynamically appear. This change also creates further restricted domains for tools doing low-level access of external storage devices, including sgdisk and blkid. It also extends sdcardd to be launchable by vold, since launching by init will eventually go away. For compatibility, rules required to keep AOSP builds working are marked with "TODO" to eventually remove. Slightly relax system_server external storage rules to allow calls like statfs(). Still neverallow open file descriptors, since they can cause kernel to kill us. Here are the relevant violations that this CL is designed to allow: avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
# Mount locations managed by vold
type mnt_media_rw_file, file_type;
type mnt_user_file, file_type;
Grant vold, installd, zygote and apps access to /mnt/pass_through /mnt/pass_through was introduced to allow the FUSE daemon unrestricted access to the lower filesystem (or sdcardfs). At zygote fork time, the FUSE daemon will have /mnt/pass_through/0 bind mounted to /storage instead of /mnt/user/0. To keep /sdcard (symlink to /storage/self/primary) paths working, we create a 'self' directory with an additional 'primary' symlink to /mnt/pass_through/0/emulated/0 which is a FUSE mount point. The following components need varying sepolicy privileges: Vold: Creates the self/primary symlink and mounts the lower filesystem on /mnt/pass_through/0/emulated. So needs create_dir and mount access + create_file access for the symlink zygote: In case zygote starts an app before vold sets up the paths. This is unlikely but can happen if the FUSE daemon (a zygote forked app) is started before system_server completes vold mounts. Same sepolicy requirements as vold installd: Needs to clear/destroy app data using lower filesystem mounted on /mnt/pass_through so needs read_dir access to walk /mnt/pass_through priv_app (FUSE daemon): Needs to server content from the lower filesystem mounted on /mnt/pass_through so needs read_dir access to walk /mnt/pass_through Bug: 135341433 Test: adb shell ls /mnt/pass_through/0/self/primary Change-Id: I16e35b9007c2143282600c56adbc9468a1b7f240
2020-01-13 21:42:37 +01:00
type mnt_pass_through_file, file_type;
Initial policy for expanded storage. Expanded storage supports a subset of the features of the internal data partition. Mirror that policy for consistency. vold is also granted enough permissions to prepare initial directories. avc: denied { write } for name="ext" dev="tmpfs" ino=3130 scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { add_name } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { create } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { setattr } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" dev="tmpfs" ino=7243 scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { mounton } for path="/mnt/ext/57f8f4bc-abf4-655f-bf67-946fc0f9f25b" dev="tmpfs" ino=7243 scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { getattr } for path="/mnt/ext" dev="tmpfs" ino=3130 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { setattr } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" dev="tmpfs" ino=4471 scontext=u:r:vold:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=1 avc: denied { getattr } for path="/mnt/expand/57f8f4bc-abf4-655f-bf67-946fc0f9f25b/media" dev="dm-0" ino=145153 scontext=u:r:vold:s0 tcontext=u:object_r:media_rw_data_file:s0 tclass=dir permissive=1 avc: denied { rmdir } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" dev="tmpfs" ino=6380 scontext=u:r:vold:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=1 avc: denied { create } for name="tmp" scontext=u:r:vold:s0 tcontext=u:object_r:shell_data_file:s0 tclass=dir permissive=1 avc: denied { setattr } for name="tmp" dev="dm-0" ino=72578 scontext=u:r:vold:s0 tcontext=u:object_r:shell_data_file:s0 tclass=dir permissive=1 Bug: 19993667 Change-Id: I73c98b36e7c066f21650a9e16ea82c5a0ef3d6c5
2015-04-07 01:21:54 +02:00
type mnt_expand_file, file_type;
Deprecate /mnt/sdcard -> /storage/self/primary symlink. "This symlink was suppose to have been removed in the Gingerbread time frame, but lives on." https://android.googlesource.com/platform/system/core/+/d2f0a2c%5E!/ Apps targeting R+ must NOT use that symlink. For older apps we allow core init.rc to create /mnt/sdcard -> /storage/self/primary symlink. Bug: 129497117 Test: boot device, /mnt/sdcard still around. Change-Id: I6ecd1928c0f598792d9badbf6616e3acc0450b0d
2019-04-12 00:23:24 +02:00
type mnt_sdcard_file, file_type;
Updated policy for external storage. An upcoming platform release is redesigning how external storage works. At a high level, vold is taking on a more active role in managing devices that dynamically appear. This change also creates further restricted domains for tools doing low-level access of external storage devices, including sgdisk and blkid. It also extends sdcardd to be launchable by vold, since launching by init will eventually go away. For compatibility, rules required to keep AOSP builds working are marked with "TODO" to eventually remove. Slightly relax system_server external storage rules to allow calls like statfs(). Still neverallow open file descriptors, since they can cause kernel to kill us. Here are the relevant violations that this CL is designed to allow: avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
type storage_file, file_type;
# Label for storage dirs which are just mount stubs
type mnt_media_rw_stub_file, file_type;
type storage_stub_file, file_type;
Sepolicy for rw mount point for vendors. Bug: 64905218 Test: device boots with /mnt/vendor present and selinux label mnt_vendor_file applied correctly. Change-Id: Ib34e2859948019d237cf2fe8f71845ef2533ae27
2018-04-11 05:49:45 +02:00
# Mount location for read-write vendor partitions.
type mnt_vendor_file, file_type;
Sepolicy for rw mount point for vendors. Bug: 64905218 Test: device boots with /mnt/vendor present and selinux label mnt_vendor_file applied correctly. Change-Id: Ib34e2859948019d237cf2fe8f71845ef2533ae27 Merged-In: Ib34e2859948019d237cf2fe8f71845ef2533ae27 (cherry picked from commit 210a805b46782a2a49bf5338732cf8c6abaf95de)
2018-04-11 05:49:45 +02:00
Sepolicy for rw mount point for product extensions. Bug: 110808288 Test: device boots with /mnt/product present and selinux label mnt_product_file applied correctly. Change-Id: I596e4b79285fe1a79d31ad1b07f4bcffe6a6cd98
2018-06-29 04:10:00 +02:00
# Mount location for read-write product partitions.
type mnt_product_file, file_type;
Updated policy for external storage. An upcoming platform release is redesigning how external storage works. At a high level, vold is taking on a more active role in managing devices that dynamically appear. This change also creates further restricted domains for tools doing low-level access of external storage devices, including sgdisk and blkid. It also extends sdcardd to be launchable by vold, since launching by init will eventually go away. For compatibility, rules required to keep AOSP builds working are marked with "TODO" to eventually remove. Slightly relax system_server external storage rules to allow calls like statfs(). Still neverallow open file descriptors, since they can cause kernel to kill us. Here are the relevant violations that this CL is designed to allow: avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
Add policy for apexd. apexd is a new daemon for managing APEX packages installed on the device. It hosts a single binder service, "apexservice". Bug: 112455435 Test: builds, binder service can be registered, apexes can be accessed, verified and mounted Change-Id: I634ad100f10b2edcd9a9c0df0d33896fa5d4ed97
2018-08-17 09:35:42 +02:00
# Mount point used for APEX images
type apex_mnt_dir, file_type;
Introduce apex_info_file type /apex/apex-info-file.xml is labeled as apex_info_file. It is created/written by apexd once by apexd, and can be read by zygote and system_server. The content of the file is essentially the same as the return value of getAllPackages() call to apexd. Bug: 154823184 Test: m Merged-In: Ic6af79ddebf465b389d9dcb5fd569d3a786423b2 (cherry picked from commit f1de4c02cc3da98d052ca81e48e7d4682eea6088) Change-Id: Ic6af79ddebf465b389d9dcb5fd569d3a786423b2
2020-05-11 13:49:07 +02:00
# /apex/apex-info-list.xml created by apexd
type apex_info_file, file_type;
New postinstall domain and rules to run post-install program. When using the A/B updater, a device specific hook is sometimes needed to run after the new partitions are updated but before rebooting into the new image. This hook is referred to throughout the code as the "postinstall" step. This patch creates a new execution domain "postinstall" which update_engine will use to run said hook. Since the hook needs to run from the new image (namelly, slot "B"), update_engine needs to temporarly mount this B partition into /postinstall and then run a program from there. Since the new program in B runs from the old execution context in A, we can't rely on the labels set in the xattr in the new filesystem to enforce the policies baked into the old running image. Instead, when temporarily mounting the new filesystem in update_engine, we override all the new file attributes with the new postinstall_file type by passing "context=u:object_r:postinstall_file:s0" to the mount syscall. This allows us to set new rules specific to the postinstall environment that are consistent with the rules in the old system. Bug: 27177071 TEST=Deployed a payload with a trivial postinstall script to edison-eng. (cherry picked from commit 6cb2c893b12db00c73009f6ab1f6c69426b0cc05) Change-Id: I49a529eecf1ef0524819470876ef7c8c2659c7ef
2016-03-02 01:14:45 +01:00
# /postinstall: Mount point used by update_engine to run postinstall.
type postinstall_mnt_dir, file_type;
# Files inside the /postinstall mountpoint are all labeled as postinstall_file.
Allow postinstall_file to be an entrypoint. postinstall_file was an exec_type so it could be an entrypoint for the domain_auto_trans from update_engine domain to postinstall domain. This patch removes the exec_type from postinstall_file and exempts it from the neverallow rule to become an entrypoint. Bug: 28008031 TEST=postinstall_example still runs as the "postinstall" domain on edison-eng. Change-Id: Icbf5b262c6f971ce054f1b4896c611b32a6d66b5
2016-04-06 01:07:25 +02:00
type postinstall_file, file_type;
Introduce a `postinstall_apex_mnt_dir` label for `/postinstall/apex`. Directory `/postinstall/apex` is used as a mount point for a tmpfs filesystem during A/B OTA updates. APEX packages from the new system partition are mounted ("activated") in subdirectories of `/postinstall/apex`, so that they are available when `otapreopt` is running. Directory `/postinstall/apex` used to be of type `tmpfs` for SELinux purposes. The new `postinstall_apex_mnt_dir` label is more restrictive, and tightens permissions granted to `otapreopt_chroot`, `otapreopt` (running as `postinstall_dexopt`), and `dex2oat`, regarding the apexd logic recently added to `otapreopt_chroot`. Test: A/B OTA update test (asit/dexoptota/self_full). Bug: 113373927 Bug: 120796514 Change-Id: I03f0b0433d9c066a0c607f864d60ca62fc68c990
2019-01-24 15:32:17 +01:00
# /postinstall/apex: Mount point used for APEX images within /postinstall.
type postinstall_apex_mnt_dir, file_type;
New postinstall domain and rules to run post-install program. When using the A/B updater, a device specific hook is sometimes needed to run after the new partitions are updated but before rebooting into the new image. This hook is referred to throughout the code as the "postinstall" step. This patch creates a new execution domain "postinstall" which update_engine will use to run said hook. Since the hook needs to run from the new image (namelly, slot "B"), update_engine needs to temporarly mount this B partition into /postinstall and then run a program from there. Since the new program in B runs from the old execution context in A, we can't rely on the labels set in the xattr in the new filesystem to enforce the policies baked into the old running image. Instead, when temporarily mounting the new filesystem in update_engine, we override all the new file attributes with the new postinstall_file type by passing "context=u:object_r:postinstall_file:s0" to the mount syscall. This allows us to set new rules specific to the postinstall environment that are consistent with the rules in the old system. Bug: 27177071 TEST=Deployed a payload with a trivial postinstall script to edison-eng. (cherry picked from commit 6cb2c893b12db00c73009f6ab1f6c69426b0cc05) Change-Id: I49a529eecf1ef0524819470876ef7c8c2659c7ef
2016-03-02 01:14:45 +01:00
Allow Zygote and Installd to remount directories in /data/data Zygote/Installd now can do the following operations in app data directory: - Mount on it - Create directories in it - Mount directory for each app data, and get/set attributes Bug: 143937733 Test: No denials at boot Test: No denials seen when creating mounts Change-Id: I6e852a5f5182f1abcb3136a3b23ccea69c3328db
2019-12-13 13:30:26 +01:00
# /data_mirror: Contains mirror directory for storing all apps data.
type mirror_data_file, file_type, core_data_file_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
# /data/misc subdirectories
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type adb_keys_file, file_type, data_file_type, core_data_file_type;
Refactor apex data file types. We ended up with 4 labels for specific APEX files that were all identical; I've replaced them with a single one (apex_system_server_data_file). Additionally I created an attribute to be applied to a "standard" APEX module data file type that establishes the basics (it can be managed by vold_prepare_subdirs and apexd), to make it easier to add new such types - which I'm about to do. Fix: 189415223 Test: Presubmits Change-Id: I4406f6680aa8aa0e38afddb2f3ba75f8bfbb8c3c
2021-07-12 15:21:48 +02:00
type apex_system_server_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
Add type for APEX data directories. This adds a new apex_module_data_file type for the APEX data directories under /data/misc/apexdata and /data/misc_[de|ce]/<u>/apexdata. Permission is given for vold to identify which APEXes are present and create the corresponding directories under apexdata in the ce/de user directories. See go/apex-data-directories. Bug: 141148175 Test: Built & flashed, checked directories were created. Change-Id: I95591e5fe85fc34f7ed21e2f4a75900ec2cfacfa
2019-11-19 19:10:16 +01:00
type apex_module_data_file, file_type, data_file_type, core_data_file_type;
Add necessary sepolicy for update_engine to reserve space on data Test: serve an OTA, make sure /data/apex/reserved is present Bug: 172911822 Change-Id: I9f7967c9047ae834eb55a48d56ffc34a7b37f5db
2021-01-28 22:14:20 +01:00
type apex_ota_reserved_file, file_type, data_file_type, core_data_file_type;
Add type for directories containing snapshots of apex data. This adds a new apex_rollback_data_file type for the snapshots (backups) of APEX data directories that can be restored in the event of a rollback. Permission is given for apexd to create files and dirs in those directories and for vold_prepare_subdirs to create the directories. See go/apex-data-directories for details. Bug: 141148175 Test: Built and flashed, checked directory was created with the correct type. Change-Id: I94b448dfc096e5702d3e33ace6f9df69f58340fd
2019-12-02 19:29:48 +01:00
type apex_rollback_data_file, file_type, data_file_type, core_data_file_type;
Add data directory for appcompat This directory is used to store override config, so that they can persist across reboot. Test: atest CompatConfigTest Bug: 145509340 Change-Id: I5e8f2b3093daeccd6c95dff24a8c6c0ff31235ca
2020-12-23 16:21:23 +01:00
type appcompat_data_file, file_type, data_file_type, core_data_file_type;
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type audio_data_file, file_type, data_file_type, core_data_file_type;
type audioserver_data_file, file_type, data_file_type, core_data_file_type;
Introduce app_data_file_type attribute. This gives us an easy way for the policy to refer to all existing or future types used for app private data files in type= assignments in seapp_contexts. Apply the label to all the existing types, then refactor rules to use the new attribute. This is intended as a pure refactoring, except that: - Some neverallow rules are extended to cover types they previous omitted; - We allow iorap_inode2filename limited access to shell_data_file and nfc_data_file; - We allow zygote limited access to system_app_data_file. This mostly reverts the revert in commit b01e1d97bf1320d54c8641cfff687f13f32013bf, restoring commit 27e0c740f1894e9a390b7105255eb29401d25c35. Changes to check_seapp to enforce use of app_data_file_type is omitted, to be included in a following CL. Test: Presubmits Bug: 171795911 Change-Id: I02b31e7b3d5634c94763387284b5a154fe5b71b4
2020-10-27 18:35:33 +01:00
type bluetooth_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type;
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type bluetooth_logs_data_file, file_type, data_file_type, core_data_file_type;
type bootstat_data_file, file_type, data_file_type, core_data_file_type;
type boottrace_data_file, file_type, data_file_type, core_data_file_type;
type camera_data_file, file_type, data_file_type, core_data_file_type;
Add SELinux policy for credstore and update for IC HAL port from HIDL to AIDL. The credstore service is a system service which backs the android.security.identity.* Framework APIs. It essentially calls into the Identity Credential HAL while providing persistent storage for credentials. Bug: 111446262 Test: atest android.security.identity.cts Test: VtsHalIdentityTargetTest Test: android.hardware.identity-support-lib-test Change-Id: I5cd9a6ae810e764326355c0842e88c490f214c60
2020-01-17 22:47:53 +01:00
type credstore_data_file, file_type, data_file_type, core_data_file_type;
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type gatekeeper_data_file, file_type, data_file_type, core_data_file_type;
type incident_data_file, file_type, data_file_type, core_data_file_type;
type keychain_data_file, file_type, data_file_type, core_data_file_type;
type keystore_data_file, file_type, data_file_type, core_data_file_type;
type media_data_file, file_type, data_file_type, core_data_file_type;
type media_rw_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Restrict creating per-user encrypted directories Creating a per-user encrypted directory such as /data/system_ce/0 and the subdirectories in it too early has been a recurring bug. Typically, individual services in system_server are to blame; system_server has permission to create these directories, and it's easy to write "mkdirs()" instead of "mkdir()". Such bugs are very bad, as they prevent these directories from being encrypted, as encryption policies can only be set on empty directories. Due to recent changes, a factory reset is now forced in such cases, which helps detect these bugs; however, it would be much better to prevent them in the first place. This CL locks down the ability to create these directories to just vold and init, or to just vold when possible. This is done by assigning new types to the directories that contain these directories, and then only allowing the needed domains to write to these parent directories. This is similar to what https://r.android.com/1117297 did for /data itself. Three new types are used instead of just one, since these directories had three different types already (system_data_file, media_rw_data_file, vendor_data_file), and this allows the policy to be a bit more precise. A significant limitation is that /data/user/0 is currently being created by init during early boot. Therefore, this CL doesn't help much for /data/user/0, though it helps a lot for the other directories. As the next step, I'll try to eliminate the /data/user/0 quirk. Anyway, this CL is needed regardless of whether we're able to do that. Test: Booted cuttlefish. Ran 'sm partition disk:253,32 private', then created and deleted a user. Used 'ls -lZ' to check the relevant SELinux labels on both internal and adoptable storage. Also did similar tests on raven, with the addition of going through the setup wizard and using an app that creates media files. No relevant SELinux denials seen during any of this. Bug: 156305599 Change-Id: I1fbdd180f56dd2fe4703763936f5850cef8ab0ba
2022-05-05 00:18:02 +02:00
type media_userdir_file, file_type, data_file_type, core_data_file_type;
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type misc_user_data_file, file_type, data_file_type, core_data_file_type;
type net_data_file, file_type, data_file_type, core_data_file_type;
Add Network Watchlist data file selinux policy(Used in ConfigUpdater) Bug: 63908748 Test: Able to boot Change-Id: I14d8856d7aac7be9d1f26ecf5bfff69ea5ee9607
2017-12-14 10:56:32 +01:00
type network_watchlist_data_file, file_type, data_file_type, core_data_file_type;
Introduce app_data_file_type attribute. This gives us an easy way for the policy to refer to all existing or future types used for app private data files in type= assignments in seapp_contexts. Apply the label to all the existing types, then refactor rules to use the new attribute. This is intended as a pure refactoring, except that: - Some neverallow rules are extended to cover types they previous omitted; - We allow iorap_inode2filename limited access to shell_data_file and nfc_data_file; - We allow zygote limited access to system_app_data_file. This mostly reverts the revert in commit b01e1d97bf1320d54c8641cfff687f13f32013bf, restoring commit 27e0c740f1894e9a390b7105255eb29401d25c35. Changes to check_seapp to enforce use of app_data_file_type is omitted, to be included in a following CL. Test: Presubmits Bug: 171795911 Change-Id: I02b31e7b3d5634c94763387284b5a154fe5b71b4
2020-10-27 18:35:33 +01:00
type nfc_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type;
Add sepolicy to allow read/write nfc snoop log data Bug: 153704838 Test: nfc snoop log could be accessed Change-Id: I694426ddb776114e5028b9e33455dd98fb502f0a
2020-07-08 11:09:49 +02:00
type nfc_logs_data_file, file_type, data_file_type, core_data_file_type;
Introduce app_data_file_type attribute. This gives us an easy way for the policy to refer to all existing or future types used for app private data files in type= assignments in seapp_contexts. Apply the label to all the existing types, then refactor rules to use the new attribute. This is intended as a pure refactoring, except that: - Some neverallow rules are extended to cover types they previous omitted; - We allow iorap_inode2filename limited access to shell_data_file and nfc_data_file; - We allow zygote limited access to system_app_data_file. This mostly reverts the revert in commit b01e1d97bf1320d54c8641cfff687f13f32013bf, restoring commit 27e0c740f1894e9a390b7105255eb29401d25c35. Changes to check_seapp to enforce use of app_data_file_type is omitted, to be included in a following CL. Test: Presubmits Bug: 171795911 Change-Id: I02b31e7b3d5634c94763387284b5a154fe5b71b4
2020-10-27 18:35:33 +01:00
type radio_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type, mlstrustedobject;
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type recovery_data_file, file_type, data_file_type, core_data_file_type;
Make shared_relro levelFrom=all. Also make shared_relro_file mlstrustedobject to ensure these files can still be read by any app in any user. Bug: 170622707 Test: Manual: delete the files, check they are re-created and accessible. Test: Manual: no denials seen Test: Presubmits Change-Id: Icce4ee858219e3fd0e307f3edfb3c66005872a45
2020-09-24 14:46:46 +02:00
type shared_relro_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
snapshotctl better logging Test: snapshotctl merge --log-to-file Bug: 148818798 Change-Id: I0e9c8ebb6632a56670a566f7a541e52e0bd24b08
2020-02-04 02:01:49 +01:00
type snapshotctl_log_data_file, file_type, data_file_type, core_data_file_type;
Restrict system server from reading statsd data Bug: 267367423 Test: m -j Change-Id: I0628142c2380cf568643f864ae211fbf5380550c
2023-02-02 20:57:18 +01:00
type stats_config_data_file, file_type, data_file_type, core_data_file_type;
Allow all app types to socket send to statsdw (statsd socket) Also move statsd to /public/ Bug: 110538431 Test: manual testing Change-Id: I58319e169eaab7d997ed3628c3c9709cf7bd0d4a
2018-08-22 08:59:46 +02:00
type stats_data_file, file_type, data_file_type, core_data_file_type;
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type systemkeys_data_file, file_type, data_file_type, core_data_file_type;
SELinux configuration for TextClassifier model updates. Test: bit FrameworksCoreTests:android.view.textclassifier.TextClassificationManagerTest Bug: 34780396 Change-Id: I8b98fef913df571e55474ea2529f71750874941c
2017-04-26 22:20:20 +02:00
type textclassifier_data_file, file_type, data_file_type, core_data_file_type;
Adding write permissions to traceur Fixing denials that stopped traceur from being able to write to debugfs_tracing. Also cleaning up general find denials for services that traceur doesn't have permission to access. Additionally, labeling /data/local/trace as a trace_data_file in order to give traceur a UX friendly area to write its traces to now that it will no longer be a shell user. It will be write/readable by traceur, and deletable/readable by shell. Test: Traceur functionality is not being blocked by selinux policy Bug: 68126425 Change-Id: I201c82975a31094102e90bc81454d3c2a48fae36
2018-01-16 01:44:04 +01:00
type trace_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type vpn_data_file, file_type, data_file_type, core_data_file_type;
type wifi_data_file, file_type, data_file_type, core_data_file_type;
type vold_data_file, file_type, data_file_type, core_data_file_type;
tee domain is a vendor domain As a result, Keymaster and DRM HALs are permitted to talk to tee domain over sockets. Unfortunately, the tee domain needs to remain on the exemptions list because drmserver, mediaserver, and surfaceflinger are currently permitted to talk to this domain over sockets. We need to figure out why global policy even defines a TEE domain... Test: mmm system/sepolicy Bug: 36601092 Bug: 36601602 Bug: 36714625 Bug: 36715266 Change-Id: I0b95e23361204bd046ae5ad22f9f953c810c1895
2017-03-29 06:59:24 +02:00
type tee_data_file, file_type, data_file_type;
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type update_engine_data_file, file_type, data_file_type, core_data_file_type;
Allow update_engine to access /data/misc/update_engine_log Add label update_engine_log_data_file for log files created by update engine in directory /data/misc/update_engine_log. Bug: 65568605 Test: manual Change-Id: I379db82a0ea540e41cb3b8e03f93d9ce64fac7c9
2017-11-06 12:56:00 +01:00
type update_engine_log_data_file, file_type, data_file_type, core_data_file_type;
Allow snapuserd to write log files to /data/misc snapuserd logs are important when OTA failures happen. To make debugging easier, allow snapuserd to persist logs in /data/misc/snapuserd_logs , and capture these logs in bugreport. Bug: 280127810 Change-Id: I49e30fd97ea143e7b9c799b0c746150217d5cbe0
2023-04-29 02:25:49 +02:00
type snapuserd_log_data_file, file_type, data_file_type, core_data_file_type;
Add SElinux rules for /data/misc/trace The directory is to be used in eng/userdebug build to store method traces (previously stored in /data/dalvik-cache/profiles). Bug: 25612377 Change-Id: Ia4365a8d1f13d33ee54115dc5e3bf62786503993
2015-11-10 19:49:57 +01:00
# /data/misc/trace for method traces on userdebug / eng builds
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type method_trace_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Full sepolicy for gsid. Bug: 122556707 Test: manual test Change-Id: I2536deefb3aa75deee4aeae7df074349b705b0f0
2019-01-23 04:05:29 +01:00
type gsi_data_file, file_type, data_file_type, core_data_file_type;
Add new selinux type for radio process ConnectivityService is going to become mainline and can not access hidden APIs. Telephony and Settings were both accessing the hidden API ConnectivityManager#getMobileProvisioningUrl. Moving #getMobileProvisioningUrl method into telephony means that there is one less access to a hidden API within the overall framework since the Connectivity stack never needed this value. Thus, move getMobileProvisioningUrl parsing to telephony surface and provide the corresponding sepolicy permission for its access. The exsting radio_data_file is an app data type and may allow more permission than necessary. Thus create a new type and give the necessary read access only. Bug: 175177794 Test: verify that the radio process could read /data/misc/radio/provisioning_urls.xml successfully Change-Id: I191261a57667dc7936c22786d75da971f94710ef
2020-12-24 08:11:15 +01:00
type radio_core_data_file, file_type, data_file_type, core_data_file_type;
alphabetize /data/misc entries. Alphabetize the entries for the /data/misc subdirectories. Change-Id: I3690085cbb99c225545545668dedd66341a14edb
2013-12-13 00:23:10 +01:00
SE Android policy.
2012-01-04 18:33:27 +01:00
# /data/data subdirectories - app sandboxes
Introduce app_data_file_type attribute. This gives us an easy way for the policy to refer to all existing or future types used for app private data files in type= assignments in seapp_contexts. Apply the label to all the existing types, then refactor rules to use the new attribute. This is intended as a pure refactoring, except that: - Some neverallow rules are extended to cover types they previous omitted; - We allow iorap_inode2filename limited access to shell_data_file and nfc_data_file; - We allow zygote limited access to system_app_data_file. This mostly reverts the revert in commit b01e1d97bf1320d54c8641cfff687f13f32013bf, restoring commit 27e0c740f1894e9a390b7105255eb29401d25c35. Changes to check_seapp to enforce use of app_data_file_type is omitted, to be included in a following CL. Test: Presubmits Bug: 171795911 Change-Id: I02b31e7b3d5634c94763387284b5a154fe5b71b4
2020-10-27 18:35:33 +01:00
type app_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type;
Start partitioning off privapp_data_file from app_data_file Currently, both untrusted apps and priv-apps use the SELinux file label "app_data_file" for files in their /data/data directory. This is problematic, as we really want different rules for such files. For example, we may want to allow untrusted apps to load executable code from priv-app directories, but disallow untrusted apps from loading executable code from their own home directories. This change adds a new file type "privapp_data_file". For compatibility, we adjust the policy to support access privapp_data_files almost everywhere we were previously granting access to app_data_files (adbd and run-as being exceptions). Additional future tightening is possible here by removing some of these newly added rules. This label will start getting used in a followup change to system/sepolicy/private/seapp_contexts, similar to: -user=_app isPrivApp=true domain=priv_app type=app_data_file levelFrom=user +user=_app isPrivApp=true domain=priv_app type=privapp_data_file levelFrom=user For now, this newly introduced label has no usage, so this change is essentially a no-op. Test: Factory reset and boot - no problems on fresh install. Test: Upgrade to new version and test. No compatibility problems on filesystem upgrade. Change-Id: I9618b7d91d1c2bcb5837cdabc949f0cf741a2837
2018-08-03 00:54:23 +02:00
# /data/data subdirectories - priv-app sandboxes
Introduce app_data_file_type attribute. This gives us an easy way for the policy to refer to all existing or future types used for app private data files in type= assignments in seapp_contexts. Apply the label to all the existing types, then refactor rules to use the new attribute. This is intended as a pure refactoring, except that: - Some neverallow rules are extended to cover types they previous omitted; - We allow iorap_inode2filename limited access to shell_data_file and nfc_data_file; - We allow zygote limited access to system_app_data_file. This mostly reverts the revert in commit b01e1d97bf1320d54c8641cfff687f13f32013bf, restoring commit 27e0c740f1894e9a390b7105255eb29401d25c35. Changes to check_seapp to enforce use of app_data_file_type is omitted, to be included in a following CL. Test: Presubmits Bug: 171795911 Change-Id: I02b31e7b3d5634c94763387284b5a154fe5b71b4
2020-10-27 18:35:33 +01:00
type privapp_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type;
Label app data directories for system UID apps with a different type. We were using system_data_file for the /data/data directories of system UID apps to match the DAC ownership of system UID shared with other system files. However, we are seeing cases where files created in these directories must be writable by other apps, and we would like to avoid allowing write to system data files outside of these directories. So introduce a separate system_app_data_file type and assign it. This should also help protect against arbitrary writes by system UID apps to other system data directories. This resolves the following denial when cropping or taking a user photo for secondary users: avc: denied { write } for path="/data/data/com.android.settings/cache/TakeEditUserPhoto2.jpg" dev="mmcblk0p28" ino=82120 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:system_data_file:s0 tclass=file avc: denied { write } for path="/data/data/com.android.settings/cache/CropEditUserPhoto.jpg" dev="mmcblk0p30" ino=602905 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:system_data_file:s0 tclass=file Bug: 14604553 Change-Id: Ifa10e3283b07f6bd6ecc16eceeb663edfd756cea Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-07 19:10:02 +02:00
# /data/data subdirectory for system UID apps.
Introduce app_data_file_type attribute. This gives us an easy way for the policy to refer to all existing or future types used for app private data files in type= assignments in seapp_contexts. Apply the label to all the existing types, then refactor rules to use the new attribute. This is intended as a pure refactoring, except that: - Some neverallow rules are extended to cover types they previous omitted; - We allow iorap_inode2filename limited access to shell_data_file and nfc_data_file; - We allow zygote limited access to system_app_data_file. This mostly reverts the revert in commit b01e1d97bf1320d54c8641cfff687f13f32013bf, restoring commit 27e0c740f1894e9a390b7105255eb29401d25c35. Changes to check_seapp to enforce use of app_data_file_type is omitted, to be included in a following CL. Test: Presubmits Bug: 171795911 Change-Id: I02b31e7b3d5634c94763387284b5a154fe5b71b4
2020-10-27 18:35:33 +01:00
type system_app_data_file, file_type, data_file_type, core_data_file_type, app_data_file_type, mlstrustedobject;
Get rid of separate platform_app_data_file type. The original concept was to allow separation between /data/data/<pkgdir> files of "platform" apps (signed by one of the four build keys) and untrusted apps. But we had to allow read/write to support passing of open files via Binder or local socket for compatibilty, and it seems that direct open by pathname is in fact used in Android as well, only passing the pathname via Binder or local socket. So there is no real benefit to keeping it as a separate type. Retain a type alias for platform_app_data_file to app_data_file until restorecon /data/data support is in place to provide compatibility. Change-Id: Ic15066f48765322ad40500b2ba2801bb3ced5489 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-03-12 18:31:14 +01:00
# Compatibility with type name used in Android 4.3 and 4.4.
SE Android policy.
2012-01-04 18:33:27 +01:00
# Default type for anything under /cache
Annotate data types owned by the core platform This will be used to enforce data separation between platform and vendor. Test: build Bug: 34980020 Change-Id: Ia312f00068d3982c7aae7e35bd0c96a6eb9ea3be
2017-11-06 17:33:33 +01:00
type cache_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
fs_mgr: add /mnt/scratch to possible overlayfs support directories A default set of options are available, but can override in a fstab overlay entry with upperdir=, lowerdir= to the same mount point, workdir=. The default is a valid /mnt/scratch/overlay/ or /cache/overlay/ directory, with .../<mount_point>/upper and .../<mount_point>/work, associated with each system partition <mount_point>. Test: manual Bug: 109821005 Change-Id: I5662c01fad17d105665be065f6dcd7c3fdc40d95
2018-07-02 17:13:40 +02:00
# Type for /cache/overlay /mnt/scratch/overlay
fs_mgr: add overlayfs handling for squashfs system filesystems /cache/overlay directory in support of overlayfs mounts on userdebug and eng devices. Overlayfs in turn can be capable of supporting adb remount for read-only or restricted-storage filesystems like squashfs or right-sized (zero free space) system partitions respectively. Test: compile Bug: 109821005 Bug: 110985612 Change-Id: I3ece03886db7cc97f864497cf93ec6c6c39bccd1
2018-06-13 17:02:29 +02:00
type overlayfs_file, file_type, data_file_type, core_data_file_type;
Move staged backup content to a specific cache subdir Also narrowly specify the domain for the local transport's bookkeeping. Bug 26834865 Change-Id: I2eea8a10f29356ffecabd8e102f7afa90123c535
2016-01-28 20:30:41 +01:00
# Type for /cache/backup_stage/* (fd interchange with apps)
Annotate data types owned by the core platform This will be used to enforce data separation between platform and vendor. Test: build Bug: 34980020 Change-Id: Ia312f00068d3982c7aae7e35bd0c96a6eb9ea3be
2017-11-06 17:33:33 +01:00
type cache_backup_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Move staged backup content to a specific cache subdir Also narrowly specify the domain for the local transport's bookkeeping. Bug 26834865 Change-Id: I2eea8a10f29356ffecabd8e102f7afa90123c535
2016-01-28 20:30:41 +01:00
# type for anything under /cache/backup (local transport storage)
Annotate data types owned by the core platform This will be used to enforce data separation between platform and vendor. Test: build Bug: 34980020 Change-Id: Ia312f00068d3982c7aae7e35bd0c96a6eb9ea3be
2017-11-06 17:33:33 +01:00
type cache_private_backup_file, file_type, data_file_type, core_data_file_type;
Creates a new permission for /cache/recovery This permission was created mostly for dumpstate (so it can include recovery files on bugreports when an OTA fails), but it was applied to uncrypt and recovery as well (since it had a wider access before). Grant access to cache_recovery_file where we previously granted access to cache_file. Add auditallow rules to determine if this is really needed. BUG: 25351711 Change-Id: I07745181dbb4f0bde75694ea31b3ab79a4682f18
2015-12-22 21:37:17 +01:00
# Type for anything under /cache/recovery
Annotate data types owned by the core platform This will be used to enforce data separation between platform and vendor. Test: build Bug: 34980020 Change-Id: Ia312f00068d3982c7aae7e35bd0c96a6eb9ea3be
2017-11-06 17:33:33 +01:00
type cache_recovery_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
SE Android policy.
2012-01-04 18:33:27 +01:00
# Default type for anything under /efs
type efs_file, file_type;
Introduce a separate wallpaper_file type for the wallpaper file.
2012-03-19 15:29:36 +01:00
# Type for wallpaper file.
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type wallpaper_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Allow "shortcut manager" icons to be returned to apps ... and client apps to read them. A full path looks like this: /data/system_ce/[user-id]/shortcut_service/bitmaps/[creator-app-package]/[timestamp].png System server will: - Create/delete the directories. - Write/remove PNG files in them. - Open the PNG files and return file descriptors to client apps Client apps will: - Receive file descriptors and read from them. Bug 27548047 Change-Id: I3d9ac6ab0c92b2953b84c3c5aabe1f653e6bea6b
2016-03-09 00:06:44 +01:00
# Type for shortcut manager icon file.
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type shortcut_manager_icons, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Modified security policy to allow user to get their own icon. BUG: 27583869 Change-Id: I0a25bd03f3998d48dba355b91140611e38ce7b0d
2016-02-25 16:37:06 +01:00
# Type for user icon file.
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type icon_file, file_type, data_file_type, core_data_file_type;
Add SELinux policy for asec containers. Creates 2 new types: - asec_apk_file : files found under /mnt/asec when the asec images are mounted - asec_image_file : the actual encrypted apks under /data/app-asec Change-Id: I963472add1980ac068d3a6d36a24f27233022832 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2012-10-22 19:50:01 +02:00
# /mnt/asec
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type asec_apk_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Introduce asec_public_file type. This new type will allow us to write finer-grained policy concerning asec containers. Some files of these containers need to be world readable. Change-Id: Iefee74214d664acd262edecbb4f981d633ff96ce Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-02-04 17:36:41 +01:00
# Elements of asec files (/mnt/asec) that are world readable
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type asec_public_file, file_type, data_file_type, core_data_file_type;
Add SELinux policy for asec containers. Creates 2 new types: - asec_apk_file : files found under /mnt/asec when the asec images are mounted - asec_image_file : the actual encrypted apks under /data/app-asec Change-Id: I963472add1980ac068d3a6d36a24f27233022832 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2012-10-22 19:50:01 +02:00
# /data/app-asec
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type asec_image_file, file_type, data_file_type, core_data_file_type;
App data backup security policy. Policy covers: * backup_data_file type for labeling all files/dirs under /data dealing with backup mechanism. * cache_backup_file type for labeling all files/dirs under /cache dealing with backup mechanism. This also covers the the use of LocalTransport for local archive and restore testing. * the use of 'adb shell bmgr' to initiate backup mechanism from shell. * the use of 'adb backup/restore' to archive and restore the device's data. Change-Id: I700a92d8addb9bb91474bc07ca4bb71eb4fc840e Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2012-12-04 14:13:58 +01:00
# /data/backup and /data/secure/backup
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type backup_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Policy for hci_attach service.
2012-05-31 15:40:12 +02:00
# All devices have bluetooth efs files. But they
# vary per device, so this type is used in per
Correct spelling mistake Change-Id: If4deccfe740c8de6b88929a0d0439667c3ea340d
2012-09-07 03:50:35 +02:00
# device policy
Policy for hci_attach service.
2012-05-31 15:40:12 +02:00
type bluetooth_efs_file, file_type;
New SeLinux policy for fingerprint HIDL Move from fingerprintd to new fingerprint_hal and update SeLinux policy. Test: Boot with no errors related to fingerprint sepolicy Bug: 33199080 Change-Id: Idfde0cb0530e75e705033042f64f3040f6df22d6
2016-12-16 04:46:43 +01:00
# Type for fingerprint template file
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type fingerprintd_data_file, file_type, data_file_type, core_data_file_type;
Revert "Add placeholder iris and face policy for vold data directory" This reverts commit 92bde4b941b7078a5fdf8aec6660ca44d0ffbb49. Reason for revert: Rebooting after OTA fails due to the filesystem still seeing the old label on the device. Bug: 116528212 Bug: 119747564 Change-Id: Ib5f920f85c7e305e89c377369dca038d2c6c738c Test: rollback change
2018-11-19 19:42:11 +01:00
# Type for _new_ fingerprint template file
type fingerprint_vendor_data_file, file_type, data_file_type;
Add SELinux label for app fuse. The labels for filesystem and files are assigned by vold with using context= mount option. Change-Id: I8a9d701a46a333093a27107fc3c52b17a2af1a94
2016-01-28 07:48:39 +01:00
# Type for appfuse file.
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type app_fuse_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Add placeholder iris and face policy for vold data directory This is PS1 of aosp/828283 which was reverted. Using PS1 shouldn't cause the same issue. Test: vold is able to create directories, ag/5534962 Bug: 116528212 Change-Id: I84aca49a8dae0a087498120780dea0962aca04b3
2018-11-16 00:28:07 +01:00
# Type for face template file
type face_vendor_data_file, file_type, data_file_type;
# Type for iris template file
type iris_vendor_data_file, file_type, data_file_type;
Policy for hci_attach service.
2012-05-31 15:40:12 +02:00
SE Android policy.
2012-01-04 18:33:27 +01:00
# Socket types
Tighten restrictions on core <-> vendor socket comms This futher restricts neverallows for sockets which may be exposed as filesystem nodes. This is achieved by labelling all such sockets created by core/non-vendor domains using the new coredomain_socket attribute, and then adding neverallow rules targeting that attribute. This has now effect on what domains are permitted to do. This only changes neverallow rules. Test: mmm system/sepolicy Bug: 36577153 (cherry picked from commit cf2ffdf0d86f485dfff05a2f13819997bfd462e1) Change-Id: Iffeee571a2ff61fb9515fa6849d060649636524e
2017-03-31 02:39:00 +02:00
type adbd_socket, file_type, coredomain_socket;
Annotate data types owned by the core platform This will be used to enforce data separation between platform and vendor. Test: build Bug: 34980020 Change-Id: Ia312f00068d3982c7aae7e35bd0c96a6eb9ea3be
2017-11-06 17:33:33 +01:00
type bluetooth_socket, file_type, data_file_type, core_data_file_type, coredomain_socket;
Tighten restrictions on core <-> vendor socket comms This futher restricts neverallows for sockets which may be exposed as filesystem nodes. This is achieved by labelling all such sockets created by core/non-vendor domains using the new coredomain_socket attribute, and then adding neverallow rules targeting that attribute. This has now effect on what domains are permitted to do. This only changes neverallow rules. Test: mmm system/sepolicy Bug: 36577153 (cherry picked from commit cf2ffdf0d86f485dfff05a2f13819997bfd462e1) Change-Id: Iffeee571a2ff61fb9515fa6849d060649636524e
2017-03-31 02:39:00 +02:00
type dnsproxyd_socket, file_type, coredomain_socket, mlstrustedobject;
type dumpstate_socket, file_type, coredomain_socket;
type fwmarkd_socket, file_type, coredomain_socket, mlstrustedobject;
type lmkd_socket, file_type, coredomain_socket;
type logd_socket, file_type, coredomain_socket, mlstrustedobject;
type logdr_socket, file_type, coredomain_socket, mlstrustedobject;
type logdw_socket, file_type, coredomain_socket, mlstrustedobject;
type mdns_socket, file_type, coredomain_socket;
type mdnsd_socket, file_type, coredomain_socket, mlstrustedobject;
Annotate data types owned by the core platform This will be used to enforce data separation between platform and vendor. Test: build Bug: 34980020 Change-Id: Ia312f00068d3982c7aae7e35bd0c96a6eb9ea3be
2017-11-06 17:33:33 +01:00
type misc_logd_file, coredomain_socket, file_type, data_file_type, core_data_file_type;
Tighten restrictions on core <-> vendor socket comms This futher restricts neverallows for sockets which may be exposed as filesystem nodes. This is achieved by labelling all such sockets created by core/non-vendor domains using the new coredomain_socket attribute, and then adding neverallow rules targeting that attribute. This has now effect on what domains are permitted to do. This only changes neverallow rules. Test: mmm system/sepolicy Bug: 36577153 (cherry picked from commit cf2ffdf0d86f485dfff05a2f13819997bfd462e1) Change-Id: Iffeee571a2ff61fb9515fa6849d060649636524e
2017-03-31 02:39:00 +02:00
type mtpd_socket, file_type, coredomain_socket;
[Thread] move ot-daemon socket to /dev/socket/ot-daemon On Android, unix sockets are located in /dev/socket/ and managed by init. This commit follows the convention for ot-daemon Bug: 320451788 Test: verified that ot-daemon can create socket /dev/socket/ot-daemon/thread-wpan.sock Change-Id: I6b0fe45602bb54d6d482f5be46ddb5402bea477b
2024-01-16 15:19:28 +01:00
type ot_daemon_socket, file_type, coredomain_socket;
Tighten restrictions on core <-> vendor socket comms This futher restricts neverallows for sockets which may be exposed as filesystem nodes. This is achieved by labelling all such sockets created by core/non-vendor domains using the new coredomain_socket attribute, and then adding neverallow rules targeting that attribute. This has now effect on what domains are permitted to do. This only changes neverallow rules. Test: mmm system/sepolicy Bug: 36577153 (cherry picked from commit cf2ffdf0d86f485dfff05a2f13819997bfd462e1) Change-Id: Iffeee571a2ff61fb9515fa6849d060649636524e
2017-03-31 02:39:00 +02:00
type property_socket, file_type, coredomain_socket, mlstrustedobject;
type racoon_socket, file_type, coredomain_socket;
Add sepolicy for fastbootd Also allow adb and fastboot to talk to recovery through recovery_socket. This enables changing between modes with usb commands. Test: No selinux denials Bug: 78793464 Change-Id: I80c54d4eaf3b94a1fe26d2280af4e57cb1593790
2018-05-29 19:54:16 +02:00
type recovery_socket, file_type, coredomain_socket;
SE Android policy.
2012-01-04 18:33:27 +01:00
type rild_socket, file_type;
type rild_debug_socket, file_type;
Add sepolicy for dm-user devices and the snapuserd daemon. dm-user is a new device-mapper module, providing a FUSE-like service for block devices. It creates control nodes as misc devices under /dev/dm-user/. Make sure these nodes get a unique selabel. snapuserd is a daemon for servicing requests from dm-user. It is a low-level component of Virtual A/B updates, and provides the bridge betewen dm-snapshot and the new COW format. For this reason it needs read/write access to device-mapper devices. Bug: 168259959 Test: ctl.start snapuserd, no denials vts_libsnapshot_test, no denials Change-Id: I36858a23941767f6127d6fbb9e6755c68b91ad31
2020-10-20 07:11:29 +02:00
type snapuserd_socket, file_type, coredomain_socket;
Add new snapuserd socket and property rules. This adds a new property prefix owned by snapuserd, for communicating when the service is ready to accept connections (snapuserd.ready and snapuserd.proxy_ready). This also adds a new socket context. This is a seqpacket socket used to communicate with a special instance of snapuserd that bridges to the first-stage daemon. Bug: 193833730 Test: no denials after OTA applies and boots Change-Id: Ibad03659eba5c25e205ba00f27d0b4f98585a84b
2021-07-27 00:03:11 +02:00
type snapuserd_proxy_socket, file_type, coredomain_socket;
Allow all app types to socket send to statsdw (statsd socket) Also move statsd to /public/ Bug: 110538431 Test: manual testing Change-Id: I58319e169eaab7d997ed3628c3c9709cf7bd0d4a
2018-08-22 08:59:46 +02:00
type statsdw_socket, file_type, coredomain_socket, mlstrustedobject;
Test that /data is properly labeled Data outside of /data/vendor should have the core_data_file_type. Exempt data_between_core_and_vendor for some types. Ensure core_data_file_type and coredomain_socket do not get expanded to their underlying types. Test: build sepolicy for all targets in master (this is a build time test) Bug: 34980020 Change-Id: I59387a87875f4603a001fb03f22fa31cae84bf5a
2018-01-24 16:01:13 +01:00
type system_wpa_socket, file_type, data_file_type, core_data_file_type, coredomain_socket;
Annotate data types owned by the core platform This will be used to enforce data separation between platform and vendor. Test: build Bug: 34980020 Change-Id: Ia312f00068d3982c7aae7e35bd0c96a6eb9ea3be
2017-11-06 17:33:33 +01:00
type system_ndebug_socket, file_type, data_file_type, core_data_file_type, coredomain_socket, mlstrustedobject;
Add rules for an unix domain socket for system_server System_server will listen on incoming packets from zygotes. Bug: 136036078 Test: atest CtsAppExitTestCases:ActivityManagerAppExitInfoTest Change-Id: I42feaa317615b90c5277cd82191e677548888a71
2019-12-30 06:38:38 +01:00
type system_unsolzygote_socket, file_type, data_file_type, core_data_file_type, coredomain_socket, mlstrustedobject;
Tighten restrictions on core <-> vendor socket comms This futher restricts neverallows for sockets which may be exposed as filesystem nodes. This is achieved by labelling all such sockets created by core/non-vendor domains using the new coredomain_socket attribute, and then adding neverallow rules targeting that attribute. This has now effect on what domains are permitted to do. This only changes neverallow rules. Test: mmm system/sepolicy Bug: 36577153 (cherry picked from commit cf2ffdf0d86f485dfff05a2f13819997bfd462e1) Change-Id: Iffeee571a2ff61fb9515fa6849d060649636524e
2017-03-31 02:39:00 +02:00
type tombstoned_crash_socket, file_type, coredomain_socket, mlstrustedobject;
SEPolicy: Changes for new stack dumping scheme. Applications connect to tombstoned via a unix domain socket and request an open FD to which they can write their traces. This socket has a new label (tombstoned_java_trace_socket) and appdomain and system_server are given permissions to connect and write to it. Apps no longer need permissions to open files under /data/anr/ and these permissions will be withdrawn in a future change. Bug: 32064548 Test: Manual (cherry picked from commit a8832dabc7f3b7b2381760d2b95f81abf78db709) Change-Id: I70a3e6e230268d12b454e849fa88418082269c4f
2017-05-15 19:39:16 +02:00
type tombstoned_java_trace_socket, file_type, mlstrustedobject;
Tighten restrictions on core <-> vendor socket comms This futher restricts neverallows for sockets which may be exposed as filesystem nodes. This is achieved by labelling all such sockets created by core/non-vendor domains using the new coredomain_socket attribute, and then adding neverallow rules targeting that attribute. This has now effect on what domains are permitted to do. This only changes neverallow rules. Test: mmm system/sepolicy Bug: 36577153 (cherry picked from commit cf2ffdf0d86f485dfff05a2f13819997bfd462e1) Change-Id: Iffeee571a2ff61fb9515fa6849d060649636524e
2017-03-31 02:39:00 +02:00
type tombstoned_intercept_socket, file_type, coredomain_socket;
Allow the Traceur app to start Perfetto. Bug: 116754732 Test: Started a trace in Traceur using Perfetto successfully. Change-Id: I217857bf1f43f1b7b24454687d1f26b9d5c6c56a
2018-10-20 02:01:24 +02:00
type traced_consumer_socket, file_type, coredomain_socket, mlstrustedobject;
initial policy for traced_perf daemon (perf profiler) The steps involved in setting up profiling and stack unwinding are described in detail at go/perfetto-perf-android. To summarize the interesting case: the daemon uses cpu-wide perf_event_open, with userspace stack and register sampling on. For each sample, it identifies whether the process is profileable, and obtains the FDs for /proc/[pid]/{maps,mem} using a dedicated RT signal (with the bionic signal handler handing over the FDs over a dedicated socket). It then uses libunwindstack to unwind & symbolize the stacks, sending the results to the central tracing daemon (traced). This patch covers the app profiling use-cases. Splitting out the "profile most things on debug builds" into a separate patch for easier review. Most of the exceptions in domain.te & coredomain.te come from the "vendor_file_type" allow-rule. We want a subset of that (effectively all libraries/executables), but I believe that in practice it's hard to use just the specific subtypes, and we're better off allowing access to all vendor_file_type files. Bug: 137092007 Change-Id: I4aa482cfb3f9fb2fabf02e1dff92e2b5ce121a47
2020-01-22 20:16:13 +01:00
type traced_perf_socket, file_type, coredomain_socket, mlstrustedobject;
type traced_producer_socket, file_type, coredomain_socket, mlstrustedobject;
Tighten restrictions on core <-> vendor socket comms This futher restricts neverallows for sockets which may be exposed as filesystem nodes. This is achieved by labelling all such sockets created by core/non-vendor domains using the new coredomain_socket attribute, and then adding neverallow rules targeting that attribute. This has now effect on what domains are permitted to do. This only changes neverallow rules. Test: mmm system/sepolicy Bug: 36577153 (cherry picked from commit cf2ffdf0d86f485dfff05a2f13819997bfd462e1) Change-Id: Iffeee571a2ff61fb9515fa6849d060649636524e
2017-03-31 02:39:00 +02:00
type uncrypt_socket, file_type, coredomain_socket;
Test that /data is properly labeled Data outside of /data/vendor should have the core_data_file_type. Exempt data_between_core_and_vendor for some types. Ensure core_data_file_type and coredomain_socket do not get expanded to their underlying types. Test: build sepolicy for all targets in master (this is a build time test) Bug: 34980020 Change-Id: I59387a87875f4603a001fb03f22fa31cae84bf5a
2018-01-24 16:01:13 +01:00
type wpa_socket, file_type, data_file_type, core_data_file_type;
Tighten restrictions on core <-> vendor socket comms This futher restricts neverallows for sockets which may be exposed as filesystem nodes. This is achieved by labelling all such sockets created by core/non-vendor domains using the new coredomain_socket attribute, and then adding neverallow rules targeting that attribute. This has now effect on what domains are permitted to do. This only changes neverallow rules. Test: mmm system/sepolicy Bug: 36577153 (cherry picked from commit cf2ffdf0d86f485dfff05a2f13819997bfd462e1) Change-Id: Iffeee571a2ff61fb9515fa6849d060649636524e
2017-03-31 02:39:00 +02:00
type zygote_socket, file_type, coredomain_socket;
Make heapprofd work with MLS. Arbitrary apps need to connect to heapprofd in order to send samples. Relevant denial trying to profile com.google.android.inputmethod.latin on userdebug: 12-20 14:50:20.420 25219 25219 I heapprofd: type=1400 audit(0.0:1006): avc: denied { read } for path="/proc/24819/mem" dev="proc" ino=244219 scontext=u:r:heapprofd:s0 tcontext=u:r:untrusted_app_27:s0:c133,c256,c512,c768 tclass=file permissive=1 Bug: 121370989 Test: m Test: flash walleye Test: profile com.google.android.inputmethod.latin Change-Id: Iee82c8c49951e5a5726cd5ab0b9e8fa71226c802
2018-12-21 14:29:55 +01:00
type heapprofd_socket, file_type, coredomain_socket, mlstrustedobject;
Corrected denials for LocationManager when accessing gps over uart.
2012-07-10 23:36:22 +02:00
# UART (for GPS) control proc file
type gps_control, file_type;
SELinux policies for PDX services Specify per-service rules for PDX transport. Now being able to grant permissions to individual services provided by processes, not all services of a process. Also tighter control over which permissions are required for client and server for individual components of IPC (endpoints, channels, etc). Bug: 37646189 Change-Id: I78eb8ae8b6e08105666445a66bfcbd2f1d69d0ea
2017-05-01 22:01:44 +02:00
# PDX endpoint types
type pdx_display_dir, pdx_endpoint_dir_type, file_type;
type pdx_performance_dir, pdx_endpoint_dir_type, file_type;
type pdx_bufferhub_dir, pdx_endpoint_dir_type, file_type;
pdx_service_socket_types(display_client, pdx_display_dir)
pdx_service_socket_types(display_manager, pdx_display_dir)
pdx_service_socket_types(display_screenshot, pdx_display_dir)
pdx_service_socket_types(display_vsync, pdx_display_dir)
pdx_service_socket_types(performance_client, pdx_performance_dir)
pdx_service_socket_types(bufferhub_client, pdx_bufferhub_dir)
file_context: explicitly label all file context files file_context files need to be explicitly labeled as they are now split across system and vendor and won't have the generic world readable 'system_file' label. Bug: 36002414 Test: no new 'file_context' denials at boot complete on sailfish Test: successfully booted into recovery without denials and sideloaded OTA update. Test: ./cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi \ arm64-v8a --module CtsSecurityHostTestCases -t \ android.security.cts.SELinuxHostTest#testAospFileContexts Change-Id: I603157e9fa7d1de3679d41e343de397631666273 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-24 23:02:13 +01:00
# file_contexts files
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type file_contexts_file, system_file_type, file_type;
file_context: explicitly label all file context files file_context files need to be explicitly labeled as they are now split across system and vendor and won't have the generic world readable 'system_file' label. Bug: 36002414 Test: no new 'file_context' denials at boot complete on sailfish Test: successfully booted into recovery without denials and sideloaded OTA update. Test: ./cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi \ arm64-v8a --module CtsSecurityHostTestCases -t \ android.security.cts.SELinuxHostTest#testAospFileContexts Change-Id: I603157e9fa7d1de3679d41e343de397631666273 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-24 23:02:13 +01:00
mac_permissions: explicitly label all mac_permissions files *mac_permissions.xml files need to be explicitly labeled as they are now split cross system and vendor and won't have the generic world readable 'system_file' or 'rootfs' label. Bug: 36003167 Test: no new 'mac_perms_file' denials at boot complete on sailfish Test: successfully booted into recovery without denials and sideloaded OTA update. Test: Launch 'chrome' and succesfully load a website. Test: Launch Camera and take a picture. Test: Launch Camera and record a video, succesfully playback recorded video Change-Id: I1c882872bb78d1242ba273756ef0dc27487f58fc Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-27 21:06:04 +02:00
# mac_permissions file
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type mac_perms_file, system_file_type, file_type;
mac_permissions: explicitly label all mac_permissions files *mac_permissions.xml files need to be explicitly labeled as they are now split cross system and vendor and won't have the generic world readable 'system_file' or 'rootfs' label. Bug: 36003167 Test: no new 'mac_perms_file' denials at boot complete on sailfish Test: successfully booted into recovery without denials and sideloaded OTA update. Test: Launch 'chrome' and succesfully load a website. Test: Launch Camera and take a picture. Test: Launch Camera and record a video, succesfully playback recorded video Change-Id: I1c882872bb78d1242ba273756ef0dc27487f58fc Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-27 21:06:04 +02:00
Support fine grain read access control for properties Properties are now broken up from a single /dev/__properties__ file into multiple files, one per property label. This commit provides the mechanism to control read access to each of these files and therefore sets of properties. This allows full access for all domains to each of these new property files to match the current permissions of /dev/__properties__. Future commits will restrict the access. Bug: 21852512 Change-Id: Ie9e43968acc7ac3b88e354a0bdfac75b8a710094
2015-12-02 01:58:27 +01:00
# property_contexts file
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type property_contexts_file, system_file_type, file_type;
Support fine grain read access control for properties Properties are now broken up from a single /dev/__properties__ file into multiple files, one per property label. This commit provides the mechanism to control read access to each of these files and therefore sets of properties. This allows full access for all domains to each of these new property files to match the current permissions of /dev/__properties__. Future commits will restrict the access. Bug: 21852512 Change-Id: Ie9e43968acc7ac3b88e354a0bdfac75b8a710094
2015-12-02 01:58:27 +01:00
seapp_context: explicitly label all seapp context files seapp_context files need to be explicitly labeled as they are now split cross system and vendor and won't have the generic world readable 'system_file' label. Bug: 36002414 Test: no new 'seapp_context' denials at boot complete on sailfish Test: successfully booted into recovery without denials and sideloaded OTA update. Test: ./cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi \ arm64-v8a --module CtsSecurityHostTestCases -t \ android.security.cts.SELinuxHostTest#testAospSeappContexts Test: Launch 'chrome' and succesfully load a website. Test: Launch Camera and take a picture. Test: Launch Camera and record a video, succesfully playback recorded video Change-Id: I19b3e50c6a7c292713d3e56ef0448acf6e4270f7 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-27 19:57:07 +02:00
# seapp_contexts file
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type seapp_contexts_file, system_file_type, file_type;
seapp_context: explicitly label all seapp context files seapp_context files need to be explicitly labeled as they are now split cross system and vendor and won't have the generic world readable 'system_file' label. Bug: 36002414 Test: no new 'seapp_context' denials at boot complete on sailfish Test: successfully booted into recovery without denials and sideloaded OTA update. Test: ./cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi \ arm64-v8a --module CtsSecurityHostTestCases -t \ android.security.cts.SELinuxHostTest#testAospSeappContexts Test: Launch 'chrome' and succesfully load a website. Test: Launch Camera and take a picture. Test: Launch Camera and record a video, succesfully playback recorded video Change-Id: I19b3e50c6a7c292713d3e56ef0448acf6e4270f7 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-27 19:57:07 +02:00
sepolicy: explicitly label all sepolicy files sepolicy files need to be explicitly labeled as they are now split cross system and vendor and won't have the generic world readable 'system_file' or 'rootfs' label. Bug: 36527360 Test: no new 'sepolicy_file' denials at boot complete on sailfish Test: successfully booted into recovery without denials and sideloaded OTA update. Test: Launch 'chrome' and succesfully load a website. Test: Launch Camera and take a picture. Test: Launch Camera and record a video, succesfully playback recorded video Change-Id: I6fe8ba31588c2d75521c6e2b0bf7e6d6eaf80a19 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-27 20:39:16 +02:00
# sepolicy files binary and others
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type sepolicy_file, system_file_type, file_type;
sepolicy: explicitly label all sepolicy files sepolicy files need to be explicitly labeled as they are now split cross system and vendor and won't have the generic world readable 'system_file' or 'rootfs' label. Bug: 36527360 Test: no new 'sepolicy_file' denials at boot complete on sailfish Test: successfully booted into recovery without denials and sideloaded OTA update. Test: Launch 'chrome' and succesfully load a website. Test: Launch Camera and take a picture. Test: Launch Camera and record a video, succesfully playback recorded video Change-Id: I6fe8ba31588c2d75521c6e2b0bf7e6d6eaf80a19 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-27 20:39:16 +02:00
service_contexts: label service_contexts explicitly The label applies to all service_contexts regardless of their location. This also lets us track the service_contexts usage and limit access to the files for the corresponding object manager alone. Bug: 36002427 Test: Boot sailfish and observe no denials for 'serice_contexts' Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check \ --abi arm64-v8a --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testAospServiceContexts Change-Id: I97fc8b24bc99ca5c00d010fb522cd39a35572858 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-24 20:24:43 +01:00
# service_contexts file
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type service_contexts_file, system_file_type, file_type;
Support fine grain read access control for properties Properties are now broken up from a single /dev/__properties__ file into multiple files, one per property label. This commit provides the mechanism to control read access to each of these files and therefore sets of properties. This allows full access for all domains to each of these new property files to match the current permissions of /dev/__properties__. Future commits will restrict the access. Bug: 21852512 Change-Id: Ie9e43968acc7ac3b88e354a0bdfac75b8a710094
2015-12-02 01:58:27 +01:00
Add libselinux keystore_key backend. We add a new back end for SELinux based keystore2_key namespaces. This patch adds the rump policy and build system infrastructure for installing keystore2_key context files on the target devices. Bug: 158500146 Bug: 159466840 Test: None Change-Id: I423c9e68ad259926e4a315d052dfda97fa502106 Merged-In: I423c9e68ad259926e4a315d052dfda97fa502106
2020-07-25 22:02:29 +02:00
# keystore2_key_contexts_file
type keystore2_key_contexts_file, system_file_type, file_type;
sepolicy: label vendor_service_contexts as vendor_service_contexts_file Due to AIDL HAL introduction, vendors can publish services with servicemanager. vendor_service_contexts is labeled as vendor_service_contexts_file, not nonplat_service_contexts_file. And pack it to vendor partition. Bug: 154066722 Test: check file label Change-Id: Ic74b12e4c8e60079c0872b6c27ab2f018fb43969
2020-06-12 10:25:41 +02:00
# vendor service_contexts file
type vendor_service_contexts_file, vendor_file_type, file_type;
Add hwservice_contexts and support for querying it. hwservicemanager can check hwservice_contexts files both from the framework and vendor partitions. Initially, have a wildcard '*' in hwservice_contexts that maps to a label that can be added/found from domain. This needs to be removed when the proper policy is in place. Also, grant su/shell access to hwservicemanager list operations, so tools like 'lshal' continue to work. Bug: 34454312 Test: Marlin boots Change-Id: I3a02d97a82458692b528d85c1b8e78b6f82ea1bc
2017-04-08 01:14:43 +02:00
# hwservice_contexts file
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type hwservice_contexts_file, system_file_type, file_type;
Add hwservice_contexts and support for querying it. hwservicemanager can check hwservice_contexts files both from the framework and vendor partitions. Initially, have a wildcard '*' in hwservice_contexts that maps to a label that can be added/found from domain. This needs to be removed when the proper policy is in place. Also, grant su/shell access to hwservicemanager list operations, so tools like 'lshal' continue to work. Bug: 34454312 Test: Marlin boots Change-Id: I3a02d97a82458692b528d85c1b8e78b6f82ea1bc
2017-04-08 01:14:43 +02:00
Add target for vndservice_contexts. So we can limit vndservicemanager access to just vndservice_contexts. Bug: 36052864 Test: servicemanager,vndservicemanager work Change-Id: I7b132d4f616ba1edd0daf7be750d4b7174c4e188
2017-04-01 02:29:53 +02:00
# vndservice_contexts file
type vndservice_contexts_file, file_type;
Selinux policy for bootreceiver tracing instance Create contexts for /sys/kernel/tracing/instances/bootreceiver Allow read access to files in this dir for system_server. Bug: 172316664 Bug: 181778620 Test: manual runs with KFENCE enabled Signed-off-by: Alexander Potapenko <glider@google.com> Change-Id: I7021a9f32b1392b9afb77294a1fd0a1be232b1f2
2021-03-02 16:46:50 +01:00
# /sys/kernel/tracing/instances/bootreceiver for monitoring kernel memory corruptions.
Revert "Revert "Add neverallows for debugfs access"" This reverts commit e95e0ec0a5f2f6fdf362d14b7960850a05e790b5. Now that b/186727553 is fixed, it should be safe to revert this revert. Test: build Bug: 184381659 Change-Id: Ibea3882296db880f5cafe4f9efa36d79a183c8a1
2021-05-05 07:01:51 +02:00
type debugfs_bootreceiver_tracing, fs_type, debugfs_type, tracefs_type;
Selinux policy for bootreceiver tracing instance Create contexts for /sys/kernel/tracing/instances/bootreceiver Allow read access to files in this dir for system_server. Bug: 172316664 Bug: 181778620 Test: manual runs with KFENCE enabled Signed-off-by: Alexander Potapenko <glider@google.com> Change-Id: I7021a9f32b1392b9afb77294a1fd0a1be232b1f2
2021-03-02 16:46:50 +01:00
Add vendor_kernel_modules type to public. Bug: 166559473 Bug: 183135316 Test: build and boot Change-Id: Idc9f6235a1b69236ce274d9b3173f6d39ee04c82 Merged-In: Idc9f6235a1b69236ce274d9b3173f6d39ee04c82 (cherry picked from commit 3b23f17eae77eea919bf8bd4456aaafc2a65b35f)
2021-03-31 19:23:40 +02:00
# kernel modules
type vendor_kernel_modules, vendor_file_type, file_type;
system_dlkm: sepolicy: add system_dlkm_file_type Add new attribute system_dlkm_file_type for /system_dlkm partition files. Bug: 218392646 Bug: 200082547 Test: TH Signed-off-by: Ramji Jiyani <ramjiyani@google.com> Change-Id: I193c3f1270f7a1b1259bc241def3fe51d77396f3
2022-02-10 01:35:54 +01:00
# system_dlkm
type system_dlkm_file, system_dlkm_file_type, file_type;
Sepolicy: Fix asanwrapper Add asanwrapper support for system server under sanitization. Bug: 36138508 Test: m && m SANITIZE_TARGET=address SANITIZE_LITE=true Test: adb root && adb shell setprop wrap.system_server asanwrapper Change-Id: Id930690d2cfd8334c933e0ec5ac62f88850331d0
2017-04-04 00:23:16 +02:00
# asanwrapper (run a sanitized app_process, to be used with wrap properties)
with_asan(`type asanwrapper_exec, exec_type, file_type;')
hal_audio: remove access to audiohal_data_file This is no longer used and violates Treble data separation. Bug: 68057930 Test: verify on Sailfish that /data/misc/audiohal doesn't exist This dir appears to be Qualcomm specific and should not have been defined in core policy. Change-Id: I55fba7564203a7f8a1d8612abd36ec1f89dc869d
2017-10-21 05:24:15 +02:00
# Deprecated in SDK version 28
type audiohal_data_file, file_type, data_file_type, core_data_file_type;
Add "DO NOT ADD statements" comments to public For visibility Bug: 232023812 Test: N/A Change-Id: I0bc6dc568210b81ba1f52acb18afd4bcc454ea1c
2024-03-28 02:37:28 +01:00
# system/sepolicy/public is for vendor-facing type and attribute definitions.
# DO NOT ADD allow, neverallow, or dontaudit statements here.
# Instead, add such policy rules to system/sepolicy/private/*.te.
Reference in a new issue Copy permalink