tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/file_contexts

249 lines
10 KiB
Text
Raw Normal View History

SE Android policy.
2012-01-04 18:33:27 +01:00
###########################################
# Root
add file_contexts entries for root filesystem It may be useful to generate an ext4 image of the root filesystem instead of using a ramdisk. Whitelist entries in file_contexts to support selinux labeling a root filesystem image. Change-Id: I91a38d0aee4408c46cbfe5dc5e6eda198572e90f
2012-12-21 00:26:02 +01:00
/ u:object_r:rootfs:s0
# Data files
Label adb keys file and allow access to it. The /adb_keys entry will only take effect if a restorecon is applied by init.rc on a kernel that includes the rootfs labeling support, but does no harm otherwise. The /data/misc/adb labeling ensures correct labeling of the adb_keys file created if the device has ro.adb.secure=1 set. Allow adbd to read the file. Change-Id: I97b3d86a69681330bba549491a2fb39df6cf20ef Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-09-30 19:54:09 +02:00
/adb_keys u:object_r:adb_keys_file:s0
Escape dot (.) when it is intended to be literal. Otherwise it is treated as a regex and matches any character. Change-Id: I9e23f01b0e104d3ef57993fd1a3d9a5b13201910 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-05 20:16:06 +02:00
/default\.prop u:object_r:rootfs:s0
add file_contexts entries for root filesystem It may be useful to generate an ext4 image of the root filesystem instead of using a ramdisk. Whitelist entries in file_contexts to support selinux labeling a root filesystem image. Change-Id: I91a38d0aee4408c46cbfe5dc5e6eda198572e90f
2012-12-21 00:26:02 +01:00
/fstab\..* u:object_r:rootfs:s0
/init\..* u:object_r:rootfs:s0
/res(/.*)? u:object_r:rootfs:s0
/ueventd\..* u:object_r:rootfs:s0
# Executables
/charger u:object_r:rootfs:s0
/init u:object_r:rootfs:s0
/sbin(/.*)? u:object_r:rootfs:s0
# Empty directories
/lost\+found u:object_r:rootfs:s0
/proc u:object_r:rootfs:s0
# SELinux policy files
/file_contexts u:object_r:rootfs:s0
/property_contexts u:object_r:rootfs:s0
/seapp_contexts u:object_r:rootfs:s0
/sepolicy u:object_r:rootfs:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
##########################
# Devices
#
/dev(/.*)? u:object_r:device:s0
Drop legacy device types. powervr_device is obsoleted by the more general gpu_device. akm_device and accelerometer_device are obsoleted by the more general sensors_device. We could also drop the file_contexts entries altogether and take them to device-specific policy (in this case, they all came from crespo, so that is obsolete for master). Change-Id: I63cef43b0d66bc99b80b64655416cc050f443e7d Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-01-16 14:47:34 +01:00
/dev/akm8973.* u:object_r:sensors_device:s0
/dev/accelerometer u:object_r:sensors_device:s0
Merge adf_device into graphics_device As of sepolicy commit a16a59e2c7f1e2f09bf7b750101973a974c972e8 (https://android-review.googlesource.com/94580), adf_device and graphics_device have the exact same security properties. Merge them into one type to avoid a proliferation of SELinux types. Change-Id: Ib1a24f5d880798600e103b9e14934e41abb1ef95
2014-06-04 02:01:10 +02:00
/dev/adf[0-9]* u:object_r:graphics_device:s0
/dev/adf-interface[0-9]*\.[0-9]* u:object_r:graphics_device:s0
/dev/adf-overlay-engine[0-9]*\.[0-9]* u:object_r:graphics_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/alarm u:object_r:alarm_device:s0
/dev/android_adb.* u:object_r:adb_device:s0
/dev/ashmem u:object_r:ashmem_device:s0
/dev/audio.* u:object_r:audio_device:s0
/dev/binder u:object_r:binder_device:s0
/dev/block(/.*)? u:object_r:block_device:s0
/dev/block/loop[0-9]* u:object_r:loop_device:s0
/dev/block/ram[0-9]* u:object_r:ram_device:s0
Various policy updates. Assortment of policy changes include: * Bluetooth domain to talk to init and procfs. * New device node domains. * Allow zygote to talk to its executable. * Update system domain access to new device node domains. * Create a post-process sepolicy with dontaudits removed. * Allow rild to use the tty device. Change-Id: Ibb96b590d0035b8f6d1606cd5e4393c174d10ffb Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2013-03-27 11:30:25 +01:00
/dev/bus/usb(.*)? u:object_r:usb_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/cam u:object_r:camera_device:s0
/dev/console u:object_r:console_device:s0
/dev/cpuctl(/.*)? u:object_r:cpuctl_device:s0
/dev/device-mapper u:object_r:dm_device:s0
Allow adbd to access the qemu device and label /dev/eac correctly.
2012-04-03 21:30:28 +02:00
/dev/eac u:object_r:audio_device:s0
Label /dev/fscklogs and allow system_server access to it. Otherwise you get denials such as: type=1400 audit(1383590310.430:623): avc: denied { getattr } for pid=1629 comm="Thread-78" path="/dev/fscklogs/log" dev="tmpfs" ino=1642 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=file type=1400 audit(1383590310.430:624): avc: denied { open } for pid=1629 comm="Thread-78" name="log" dev="tmpfs" ino=1642 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=file type=1400 audit(1383590310.430:625): avc: denied { write } for pid=1629 comm="Thread-78" name="fscklogs" dev="tmpfs" ino=1628 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=dir type=1400 audit(1383590310.430:625): avc: denied { remove_name } for pid=1629 comm="Thread-78" name="log" dev="tmpfs" ino=1642 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=dir type=1400 audit(1383590310.430:625): avc: denied { unlink } for pid=1629 comm="Thread-78" name="log" dev="tmpfs" ino=1642 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=file Change-Id: Ia7ae06a6d4cc5d2a59b8b85a5fb93cc31074fd37 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-11-04 15:47:29 +01:00
/dev/fscklogs(/.*)? u:object_r:fscklogs:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/full u:object_r:full_device:s0
sdcard policy and fuse device label.
2012-05-31 15:44:51 +02:00
/dev/fuse u:object_r:fuse_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/graphics(/.*)? u:object_r:graphics_device:s0
Restrict access to /dev/hw_random to system_server and init. /dev/hw_random is accessed only by init and by EntropyMixer (which runs inside system_server). Other domains are denied access because apps/services should be obtaining randomness from the Linux RNG. Change-Id: Ifde851004301ffd41b2189151a64a0c5989c630f
2013-10-03 22:35:56 +02:00
/dev/hw_random u:object_r:hw_random_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/input(/.*) u:object_r:input_device:s0
Introduce security labels for 2 new device nodes. iio: Industrial I/O subsystem usb_accessory: accessory protocol for usb Allow system access in both cases. Change-Id: I02db9775ec2ddaaeda40fae6d5e56e320957b09c Signed-off-by: Robert Craig <rpcraig@tycho.ncsc.mil>
2013-01-30 19:17:14 +01:00
/dev/iio:device[0-9]+ u:object_r:iio_device:s0
ion fix
2012-06-20 03:46:16 +02:00
/dev/ion u:object_r:ion_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/kmem u:object_r:kmem_device:s0
/dev/log(/.*)? u:object_r:log_device:s0
/dev/mem u:object_r:kmem_device:s0
/dev/modem.* u:object_r:radio_device:s0
Do not allow access to device:chr_file for system Also labels /dev/mpu and /dev/mpuirq as gps device. mpu is motion processing unit and is resposible for gyroscope functionality. Change-Id: If7f1a5752c550b72fac681566e1052f09e139ff0
2013-01-18 21:18:09 +01:00
/dev/mpu u:object_r:gps_device:s0
/dev/mpuirq u:object_r:gps_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/mtd(/.*)? u:object_r:mtd_device:s0
Further policy for Motorola Xoom.
2012-01-06 16:25:53 +01:00
/dev/mtp_usb u:object_r:mtp_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/pn544 u:object_r:nfc_device:s0
Add ppp/mtp policy. Initial policy for Point-to-Point tunneling and tunneling manager services.
2012-08-20 12:13:28 +02:00
/dev/ppp u:object_r:ppp_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/ptmx u:object_r:ptmx_device:s0
Drop legacy device types. powervr_device is obsoleted by the more general gpu_device. akm_device and accelerometer_device are obsoleted by the more general sensors_device. We could also drop the file_contexts entries altogether and take them to device-specific policy (in this case, they all came from crespo, so that is obsolete for master). Change-Id: I63cef43b0d66bc99b80b64655416cc050f443e7d Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-01-16 14:47:34 +01:00
/dev/pvrsrvkm u:object_r:gpu_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/kmsg u:object_r:kmsg_device:s0
/dev/null u:object_r:null_device:s0
/dev/nvhdcp1 u:object_r:video_device:s0
/dev/random u:object_r:random_device:s0
Correct denies of rpmsg device when accessing to remote processors.
2012-07-11 20:21:05 +02:00
/dev/rpmsg-omx[0-9] u:object_r:rpmsg_device:s0
/dev/rproc_user u:object_r:rpmsg_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/snd(/.*)? u:object_r:audio_device:s0
Default to socket_device for anything under /dev/socket. Otherwise sockets that have no specific entry match the /dev(/.*) entry instead, leaving them in device type rather than socket_device type. Every socket should get its own entry regardless, but this at least puts it into a more specific type by default. Change-Id: I97f7999af7f9f83484d3a51440dda791d3726f1a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-02 15:02:22 +01:00
/dev/socket(/.*)? u:object_r:socket_device:s0
Update policy for Android 4.2 / latest master. Update policy for Android 4.2 / latest master. Primarily this consists of changes around the bluetooth subsystem. The zygote also needs further permissions to set up /storage/emulated. adbd service now gets a socket under /dev/socket. keystore uses the binder. Change-Id: I8c5aeb8d100313c75169734a0fa614aa974b3bfc Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-11-16 15:06:47 +01:00
/dev/socket/adbd u:object_r:adbd_socket:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/socket/dnsproxyd u:object_r:dnsproxyd_socket:s0
initial dumpstate domain Add the necessary rules to support dumpstate. Start off initially in permissive until it has more testing. Dumpstate is triggered by running "adb bugreport" Change-Id: Ic17a60cca1f6f40daa4f2c51e9ad6009ef36cfbd
2013-12-14 07:19:45 +01:00
/dev/socket/dumpstate u:object_r:dumpstate_socket:s0
Introduce fwmarkd: a service to set the fwmark of sockets. (cherry picked from commit 7d51096d4106a441a15741592d9ccdd0bfaca907) Change-Id: Ib6198e19dbc306521a26fcecfdf6e8424d163fc9
2014-05-01 20:12:10 +02:00
/dev/socket/fwmarkd u:object_r:fwmarkd_socket:s0
Label /dev/socket/gps with its own type. The type was already defined and used in type transitions for cases where the gps socket is created at runtime by gpsd, but on some devices it is created by init based on an init.<board>.rc socket entry and therefore needs a file_contexts entry. Before: $ ls -Z /dev/socket/gps srw-rw---- gps system u:object_r:device:s0 gps After: $ ls -Z /dev/socket/gps srw-rw---- gps system u:object_r:gps_socket:s0 gps Change-Id: I8eef08d80e965fc4f3e9dd09d4fa446aaed82624 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-09-20 18:32:45 +02:00
/dev/socket/gps u:object_r:gps_socket:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/socket/installd u:object_r:installd_socket:s0
Move lmkd into it's own domain. lmkd low memory killer daemon The kernel low memory killer logic has been moved to a new daemon called lmkd. ActivityManager communicates with this daemon over a named socket. This is just a placeholder policy, starting off in unconfined_domain. Change-Id: Ia3f9a18432c2ae37d4f5526850e11432fd633e10
2013-12-06 01:55:34 +01:00
/dev/socket/lmkd u:object_r:lmkd_socket:s0
sepolicy: Add write_logd, read_logd & control_logd - Add write_logd, read_logd and control_logd macros added along with contexts for user space logd. - Specify above on domain wide, or service-by-service basis - Add logd rules. - deprecate access_logcat as unused. - 'allow <domain> zygote:unix_dgram_socket write;' rule added to deal with fd inheritance. ToDo: investigate means to allow references to close, and reopen in context of application or call setsockcreatecon() to label them in child context. Change-Id: I35dbb9d5122c5ed9b8c8f128abf24a871d6b26d8
2013-11-13 00:34:52 +01:00
/dev/logd_debug u:object_r:logd_debug:s0
/dev/socket/logd u:object_r:logd_socket:s0
/dev/socket/logdr u:object_r:logdr_socket:s0
/dev/socket/logdw u:object_r:logdw_socket:s0
Label /dev/socket/mdns with its own type. Otherwise it gets left in the general device type, and we get denials such as: type=1400 msg=audit(1379617262.940:102): avc: denied { write } for pid=579 comm="mDnsConnector" name="mdns" dev="tmpfs" ino=3213 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=sock_file This of course only shows up if using a confined system_server. Change-Id: I2456dd7aa4d72e6fd15b55c251245186eb54a80a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-09-19 21:09:38 +02:00
/dev/socket/mdns u:object_r:mdns_socket:s0
Add a domain for mdnsd and allow connecting to it. Change-Id: I0a06fa32a46e515671b4e9a6f68e1a3f8b2c21a8 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 19:04:49 +01:00
/dev/socket/mdnsd u:object_r:mdnsd_socket:s0
Address system_server denials. Label /proc/sysrq-trigger and allow access. Label /dev/socket/mtpd and allow access. Resolves denials such as: avc: denied { getattr } for pid=12114 comm="Binder_2" path="socket:[219779]" dev="sockfs" ino=219779 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket avc: denied { call } for pid=1007 comm="Binder_8" scontext=u:r:system_server:s0 tcontext=u:r:su:s0 tclass=binder avc: denied { write } for pid=1024 comm="watchdog" name="sysrq-trigger" dev="proc" ino=4026533682 scontext=u:r:system_server:s0 tcontext=u:object_r:proc:s0 tclass=file avc: denied { write } for pid=11567 comm="LegacyVpnRunner" name="mtpd" dev="tmpfs" ino=36627 scontext=u:r:system_server:s0 tcontext=u:object_r:socket_device:s0 tclass=sock_file avc: denied { ptrace } for pid=10924 comm=5369676E616C2043617463686572 scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=process avc: denied { sigkill } for pid=26077 comm="NativeCrashRepo" scontext=u:r:system_server:s0 tcontext=u:r:zygote:s0 tclass=process avc: denied { write } for pid=1024 comm="android.bg" scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=netlink_socket avc: denied { getattr } for pid=473 comm="FinalizerDaemon" path="socket:[11467]" dev="sockfs" ino=11467 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=tcp_socket avc: denied { getattr } for pid=473 comm="FinalizerDaemon" path="socket:[12076]" dev="sockfs" ino=12076 scontext=u:r:system_server:s0 tcontext=u:r:mediaserv er:s0 tclass=udp_socket avc: denied { getopt } for pid=473 comm="FinalizerDaemon" laddr=192.168.159.172 lport=51576 faddr=93.127.173.40 fport=554 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=tcp_socket avc: denied { getopt } for pid=473 comm="FinalizerDaemon" lport=15658 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=udp_socket avc: denied { read write } for pid=21384 comm="rtsp" path="socket:[443742]" dev="sockfs" ino=443742 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s 0 tclass=tcp_socket avc: denied { read write } for pid=21384 comm="rtsp" path="socket:[444842]" dev="sockfs" ino=444842 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=udp_socket avc: denied { setopt } for pid=1326 comm="Binder_9" lport=16216 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=udp_socket avc: denied { setopt } for pid=1676 comm="Binder_6" laddr=192.168.156.130 lport=51044 faddr=74.125.214.81 fport=554 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=tcp_socket avc: denied { getattr } for pid=10915 comm="system_server" path="/dev/mdm" dev="tmpfs" ino=7484 scontext=u:r:system_server:s0 tcontext=u:object_r:radio_device:s0 tclass=chr_file avc: denied { read } for pid=10915 comm="system_server" name="mdm" dev="tmpfs" ino=7484 scontext=u:r:system_server:s0 tcontext=u:object_r:radio_device:s0 tclass=chr_file avc: denied { unlink } for pid=14866 comm="system_server" name="wallpaper" dev="mmcblk0p9" ino=285715 scontext=u:r:system_server:s0 tcontext=u:object_r:wallpaper_file:s0 tclass=file avc: denied { getattr } for pid=12114 comm="Binder_2" path="socket:[219779]" dev="sockfs" ino=219779 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket avc: denied { getopt } for pid=32300 comm="Binder_1" laddr=::ffff:127.0.0.1 lport=4939 faddr=::ffff:127.0.0.1 fport=53318 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket avc: denied { read write } for pid=10840 comm="pool-17-thread-" path="socket:[205990]" dev="sockfs" ino=205990 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket avc: denied { write } for pid=20817 comm="dumpsys" path="/mnt/shell/emulated/0/aupt-output/bugreport-2014-02-22-11-17-16.txt.tmp" dev="fuse" ino=3100784040 scontext=u:r:system_server:s0 tcontext=u:object_r:sdcard_internal:s0 tclass=file Change-Id: I481ac26667b487031a5d3317b0a028a027a8e641 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-03-05 15:50:08 +01:00
/dev/socket/mtpd u:object_r:mtpd_socket:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/socket/netd u:object_r:netd_socket:s0
/dev/socket/property_service u:object_r:property_socket:s0
racoon policy. Initial policy for racoon (IKE key management). Signed-off-by: Robert Craig <rpcraig@tycho.ncsc.mil> Change-Id: If1e344f39ea914e42afbaa021b272ba1b7113479
2013-01-07 15:21:18 +01:00
/dev/socket/racoon u:object_r:racoon_socket:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/socket/rild u:object_r:rild_socket:s0
/dev/socket/rild-debug u:object_r:rild_debug_socket:s0
/dev/socket/vold u:object_r:vold_socket:s0
/dev/socket/wpa_eth[0-9] u:object_r:wpa_socket:s0
/dev/socket/wpa_wlan[0-9] u:object_r:wpa_socket:s0
/dev/socket/zygote u:object_r:zygote_socket:s0
Label /dev/socket/zygote_secondary zygote_secondary talks over a different socket named /dev/socket/zygote_secondary. Make sure it's properly labeled. See https://android-review.googlesource.com/89604 Addresses the following denial: <12>[ 48.442004] type=1400 audit(1400801842.179:5): avc: denied { write } for pid=1082 comm="main" name="zygote_secondary" dev="tmpfs" ino=9953 scontext=u:r:system_server:s0 tcontext=u:object_r:socket_device:s0 tclass=sock_file permissive=1 Bug: 13647418 Change-Id: I1ff5f1d614295a5870bb8a3992ad9167e1656c92
2014-05-23 01:48:20 +02:00
/dev/socket/zygote_secondary u:object_r:zygote_socket:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/spdif_out.* u:object_r:audio_device:s0
/dev/tegra.* u:object_r:video_device:s0
Add tf_daemon labeling support.
2012-08-24 14:11:09 +02:00
/dev/tf_driver u:object_r:tee_device:s0
run-as policy fixes. - Remove dac_read_search as it is no longer required by run-as. - Introduce a separate type for /dev/tty so that we can allow use of own tty for for a run-as shell without allowing access to other /dev/tty[0-9]* nodes. - Allow sigchld notifications for death of run-as and its descendants by adbd. - Drop redundant rules for executing shell or system commands from untrusted_app; now covered by rules in app.te. Change-Id: Ic3bf7bee9eeabf9ad4a20f61fbb142a64bb37c6c
2013-04-05 20:22:27 +02:00
/dev/tty u:object_r:owntty_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/tty[0-9]* u:object_r:tty_device:s0
/dev/ttyS[0-9]* u:object_r:serial_device:s0
racoon policy. Initial policy for racoon (IKE key management). Signed-off-by: Robert Craig <rpcraig@tycho.ncsc.mil> Change-Id: If1e344f39ea914e42afbaa021b272ba1b7113479
2013-01-07 15:21:18 +01:00
/dev/tun u:object_r:tun_device:s0
/dev/uhid u:object_r:uhid_device:s0
Change the type on /dev/uinput to match /dev/uhid. /dev/uinput is accessed in the same way as /dev/uhid, and unlike /dev/input/*. bluetooth requires access to the former and not to the latter, while shell requires access to the latter and not the former. This is also consistent with their DAC group ownerships (net_bt_stack for /dev/uinput and /dev/uhid vs input for /dev/input/*). Change-Id: I0059d832a7fe036ed888c91e1fb96f3e6e0bd2d4 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-23 19:50:19 +02:00
/dev/uinput u:object_r:uhid_device:s0
Label /dev/uio[0-9]* with its own type. Change-Id: Ibeeec6637022ee8bc9868e102b3d55e3b0d4762c Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-03-26 20:37:54 +01:00
/dev/uio[0-9]* u:object_r:uio_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/urandom u:object_r:urandom_device:s0
Introduce security labels for 2 new device nodes. iio: Industrial I/O subsystem usb_accessory: accessory protocol for usb Allow system access in both cases. Change-Id: I02db9775ec2ddaaeda40fae6d5e56e320957b09c Signed-off-by: Robert Craig <rpcraig@tycho.ncsc.mil>
2013-01-30 19:17:14 +01:00
/dev/usb_accessory u:object_r:usbaccessory_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/vcs[0-9a-z]* u:object_r:vcs_device:s0
/dev/video[0-9]* u:object_r:video_device:s0
watchdog security policy. Initial policy for software watchdog daemon which is started by init. Change-Id: I042a5b1698bf53ce2e50ea06851c374e5123ee2c Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2012-12-03 12:07:45 +01:00
/dev/watchdog u:object_r:watchdog_device:s0
Target the denials/policies over qtaguid file and device: 1. Relabel /proc/net/xt_qtaguid/ctrl from "qtaguid" to "qtaguid_proc"; 2. Label /dev/xt_qtaguid with "qtaguid_device"; 3. Allow mediaserver read/[write] to qtaguid_proc and qtaguid_device; 4. Allow media apps read/[write] to qtaguid_proc and qtaguid_device; 5. Allow system read/[write] to qtaguid_proc and qtaguid_device. Actually, some of policies related to qtaguid have been there already, but we refind existing ones and add new ones.
2012-07-19 20:07:04 +02:00
/dev/xt_qtaguid u:object_r:qtaguid_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/dev/zero u:object_r:zero_device:s0
SELinux policy for users of libcutils klog_write. klog_write/init create /dev/__kmsg__ backed by a kernel character device, keep the file descriptor, and then immediately unlink the file. Change-Id: I729d224347a003eaca29299d216a53c99cc3197c
2013-05-09 21:39:32 +02:00
/dev/__kmsg__ u:object_r:klog_device:s0
Add policy for __properties__ device. Change-Id: Ie9b391283362fb6930f1ae858f0a879835c91e32
2013-03-01 02:33:16 +01:00
/dev/__properties__ u:object_r:properties_device:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
#############################
# System files
#
/system(/.*)? u:object_r:system_file:s0
/system/bin/sh -- u:object_r:shell_exec:s0
Add policy for run-as program. Add policy for run-as program and label it in file_contexts. Drop MLS constraints on local socket checks other than create/relabel as this interferes with connections with services, in particular for adb forward. Change-Id: Ib0c4abeb7cbef559e150a620c45a7c31e0531114 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-11-13 19:00:05 +01:00
/system/bin/run-as -- u:object_r:runas_exec:s0
Define a domain for the bootanim service. Leave the domain permissive initially until it gets more testing. Change-Id: I9d88d76d1ffdc79a2eff4545d37a9e615482df50 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-11 21:17:53 +01:00
/system/bin/bootanimation u:object_r:bootanim_exec:s0
app_process is now a symlink. app_process is now a symlink to app_process32 or app_process64, so we have to update the selinux rules to explicitly refer to them. See change 5a7ee9ad63d for context. Change-Id: I7f7a107d79a8f7a3c193f97809e1e737540258f1
2014-05-14 18:13:24 +02:00
/system/bin/app_process32 u:object_r:zygote_exec:s0
label app_process64 as zygote_exec ... otherwise zygote 64 won't run in the correct SELinux domain. Bug: 13647418 Change-Id: Iada2bf26623784535b70647c472f69b735b8f4fc
2014-04-04 18:45:57 +02:00
/system/bin/app_process64 u:object_r:zygote_exec:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/system/bin/servicemanager u:object_r:servicemanager_exec:s0
/system/bin/surfaceflinger u:object_r:surfaceflinger_exec:s0
/system/bin/drmserver u:object_r:drmserver_exec:s0
initial dumpstate domain Add the necessary rules to support dumpstate. Start off initially in permissive until it has more testing. Dumpstate is triggered by running "adb bugreport" Change-Id: Ic17a60cca1f6f40daa4f2c51e9ad6009ef36cfbd
2013-12-14 07:19:45 +01:00
/system/bin/dumpstate u:object_r:dumpstate_exec:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/system/bin/vold u:object_r:vold_exec:s0
/system/bin/netd u:object_r:netd_exec:s0
/system/bin/rild u:object_r:rild_exec:s0
/system/bin/mediaserver u:object_r:mediaserver_exec:s0
Add a domain for mdnsd and allow connecting to it. Change-Id: I0a06fa32a46e515671b4e9a6f68e1a3f8b2c21a8 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 19:04:49 +01:00
/system/bin/mdnsd u:object_r:mdnsd_exec:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/system/bin/installd u:object_r:installd_exec:s0
/system/bin/keystore u:object_r:keystore_exec:s0
/system/bin/debuggerd u:object_r:debuggerd_exec:s0
Add debuggerd64 entry for 64-bit debuggerd daemon Change-Id: I4cd33a296de0d0597aa6166aa1be48f1b0b52129
2014-02-16 20:34:25 +01:00
/system/bin/debuggerd64 u:object_r:debuggerd_exec:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/system/bin/wpa_supplicant u:object_r:wpa_exec:s0
sdcard policy and fuse device label.
2012-05-31 15:44:51 +02:00
/system/bin/sdcard u:object_r:sdcardd_exec:s0
dhcp policy.
2012-08-15 12:25:14 +02:00
/system/bin/dhcpcd u:object_r:dhcp_exec:s0
Add ppp/mtp policy. Initial policy for Point-to-Point tunneling and tunneling manager services.
2012-08-20 12:13:28 +02:00
/system/bin/mtpd u:object_r:mtp_exec:s0
/system/bin/pppd u:object_r:ppp_exec:s0
Add tf_daemon labeling support.
2012-08-24 14:11:09 +02:00
/system/bin/tf_daemon u:object_r:tee_exec:s0
racoon policy. Initial policy for racoon (IKE key management). Signed-off-by: Robert Craig <rpcraig@tycho.ncsc.mil> Change-Id: If1e344f39ea914e42afbaa021b272ba1b7113479
2013-01-07 15:21:18 +01:00
/system/bin/racoon u:object_r:racoon_exec:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/system/xbin/su u:object_r:su_exec:s0
/system/vendor/bin/gpsd u:object_r:gpsd_exec:s0
Enable SELinux protections for netd. This change does several things: 1) Restore domain.te to the version present at cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version currently being distributed in AOSP. 2) Add "allow domain properties_device:file r_file_perms;" to domain.te, to allow all domains to read /dev/__properties__ . This change was missing from AOSP. 3) Restore netd.te to the version present at 80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version currently being distributed in AOSP. 4) Remove anything involving module loading from netd.te. CTS enforces that Android kernels can't have module loading enabled. 5) Add several new capabilities, plus data file rules, to netd.te, since netd needs to write to files owned by wifi. 6) Add a new unconfined domain called dnsmasq.te, and allow transitions from netd to that domain. Over time, we'll tighten up the dnsmasq.te domain. 7) Add a new unconfined domain called hostapd.te, and allow transitions from netd to that domain. Over time, we'll tighten up the hostapd.te domain. The net effect of these changes is to re-enable SELinux protections for netd. The policy is FAR from perfect, and allows a lot of wiggle room, but we can improve it over time. Testing: as much as possible, I've exercised networking related functionality, including turning on and off wifi, entering airplane mode, and enabling tethering and portable wifi hotspots. It's quite possible I've missed something, and if we experience problems, I can roll back this change. Bug: 9618347 Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
/system/bin/dnsmasq u:object_r:dnsmasq_exec:s0
/system/bin/hostapd u:object_r:hostapd_exec:s0
Fix clatd, broken by selinux policing /dev/tun Bug: 10175701 Change-Id: I185df22bdbaafd56725760ec6c71340b67455046
2013-08-05 08:32:56 +02:00
/system/bin/clatd u:object_r:clatd_exec:s0
Move lmkd into it's own domain. lmkd low memory killer daemon The kernel low memory killer logic has been moved to a new daemon called lmkd. ActivityManager communicates with this daemon over a named socket. This is just a placeholder policy, starting off in unconfined_domain. Change-Id: Ia3f9a18432c2ae37d4f5526850e11432fd633e10
2013-12-06 01:55:34 +01:00
/system/bin/lmkd u:object_r:lmkd_exec:s0
initial inputflinger domain Add a placeholder domain for inputflinger. Mark it initially unconfined and enforcing. Change-Id: I433fd9e1954486136cb8abb084b4e19bb7fc2f19
2013-12-15 21:50:00 +01:00
/system/bin/inputflinger u:object_r:inputflinger_exec:s0
sepolicy: Add write_logd, read_logd & control_logd - Add write_logd, read_logd and control_logd macros added along with contexts for user space logd. - Specify above on domain wide, or service-by-service basis - Add logd rules. - deprecate access_logcat as unused. - 'allow <domain> zygote:unix_dgram_socket write;' rule added to deal with fd inheritance. ToDo: investigate means to allow references to close, and reopen in context of application or call setsockcreatecon() to label them in child context. Change-Id: I35dbb9d5122c5ed9b8c8f128abf24a871d6b26d8
2013-11-13 00:34:52 +01:00
/system/bin/logd u:object_r:logd_exec:s0
initial policy for uncrypt. Add initial support for uncrypt, started via the pre-recovery service in init.rc. On an encrypted device, uncrypt reads an OTA zip file on /data, opens the underlying block device, and writes the unencrypted blocks on top of the encrypted blocks. This allows recovery, which can't normally read encrypted partitions, to reconstruct the OTA image and apply the update as normal. Add an exception to the neverallow rule for sys_rawio. This is needed to support writing to the raw block device. Add an exception to the neverallow rule for unlabeled block devices. The underlying block device for /data varies between devices within the same family (for example, "flo" vs "deb"), and the existing per-device file_context labeling isn't sufficient to cover these differences. Until I can resolve this problem, allow access to any block devices. Bug: 13083922 Change-Id: I7cd4c3493c151e682866fe4645c488b464322379
2014-02-19 22:33:32 +01:00
/system/bin/uncrypt u:object_r:uncrypt_exec:s0
Force logwrapper to system_file Some device-specific policies are improperly creating a security domain for logwrapper, rather than removing the logwrapper lines from init.device.rc. Don't allow that. Explicitly add an entry for /system/bin/logwrapper to force it to a system_file. Attempting to override this will result in the following compile time error: obj/ETC/file_contexts_intermediates/file_contexts: Multiple different specifications for /system/bin/logwrapper (u:object_r:logwrapper_exec:s0 and u:object_r:system_file:s0). Bug: 15616899 Change-Id: Ia55394247a9fa16e00434d61091fff9d9d4ff125
2014-06-17 17:49:17 +02:00
/system/bin/logwrapper u:object_r:system_file:s0
Create vdc domain The init.rc one-shot services "defaultcrypto" and "encrypt" call out to the /system/bin/vdc command line to ask vold to perform encryption operations. Create a new domain for these one-shot services. Allow the vdc domain to talk to vold. Change-Id: I73dc2ee4cc265bc16056b27307c254254940fd9f
2014-06-21 03:11:11 +02:00
/system/bin/vdc u:object_r:vdc_exec:s0
New domain "install_recovery" Create a new domain for the one-shot init service flash_recovery. This domain is initially in permissive_or_unconfined() for testing. Any SELinux denials won't be enforced for now. Change-Id: I7146dc154a5c78b6f3b4b6fb5d5855a05a30bfd8
2014-07-03 01:18:16 +02:00
/system/bin/install-recovery.sh u:object_r:install_recovery_exec:s0
Put dex2oat in it's own sandbox Currently, dex2oat runs in the installd sandbox, and has all the SELinux capabilities that installd does. That's too excessive. dex2oat handles untrusted user data, so we want to put it in it's own tighter sandbox. Bug: 15358102 Change-Id: I08083b84b9769e24d6dad6dbd12401987cb006be
2014-07-03 07:59:19 +02:00
/system/bin/dex2oat u:object_r:dex2oat_exec:s0
Make system use patchoat to relocate during runtime. Add patchoat selinux rules. Bug: 15358152 Change-Id: Ibe92d8b55a24bbf718b0416a21b76e5df7a2de26
2014-08-05 18:15:01 +02:00
# patchoat executable has (essentially) the same requirements as dex2oat.
/system/bin/patchoat u:object_r:dex2oat_exec:s0
New domain "install_recovery" Create a new domain for the one-shot init service flash_recovery. This domain is initially in permissive_or_unconfined() for testing. Any SELinux denials won't be enforced for now. Change-Id: I7146dc154a5c78b6f3b4b6fb5d5855a05a30bfd8
2014-07-03 01:18:16 +02:00
SE Android policy.
2012-01-04 18:33:27 +01:00
#############################
sepolicy: add /vendor to file_contexts /vendor has the same permissions as /system/vendor for devices that have a separate vendor partition. Bug: 8341435 Change-Id: If0c78b31f8a6e8e5680f1d076c323d1628fb07b2
2013-03-20 20:03:04 +01:00
# Vendor files
#
/vendor(/.*)? u:object_r:system_file:s0
/vendor/bin/gpsd u:object_r:gpsd_exec:s0
#############################
SE Android policy.
2012-01-04 18:33:27 +01:00
# Data files
#
/data(/.*)? u:object_r:system_data_file:s0
Label /data/.layout_version with its own type. installd creates /data/.layout_version. Introduce a separate type for this file (and any other file created by installd under a directory labeled system_data_file) so that we can allow create/write access by installd without allowing it to any system data files created by other processes. This prevents installd from overwriting other system data files, and ensure that any files it creates will require explicit rules in order to access. Change-Id: Id04e49cd571390d18792949c8b2b13b1ac59c016 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-12 17:18:21 +02:00
/data/.layout_version u:object_r:install_data_file:s0
App data backup security policy. Policy covers: * backup_data_file type for labeling all files/dirs under /data dealing with backup mechanism. * cache_backup_file type for labeling all files/dirs under /cache dealing with backup mechanism. This also covers the the use of LocalTransport for local archive and restore testing. * the use of 'adb shell bmgr' to initiate backup mechanism from shell. * the use of 'adb backup/restore' to archive and restore the device's data. Change-Id: I700a92d8addb9bb91474bc07ca4bb71eb4fc840e Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2012-12-04 14:13:58 +01:00
/data/backup(/.*)? u:object_r:backup_data_file:s0
/data/secure/backup(/.*)? u:object_r:backup_data_file:s0
Move policy files Update the file_contexts for the new location of the policy files, as well as update the policy for the management of these types. Change-Id: Idc475901ed437efb325807897e620904f4ff03e9
2013-01-23 23:02:43 +01:00
/data/security(/.*)? u:object_r:security_file:s0
Add file_contexts entries for socket files. So that we do not relabel them on a restorecon -R /data. Change-Id: I8dd915d9bb80067339621b905ea2b4ea0fa8d71e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-04 20:29:51 +01:00
/data/system/ndebugsocket u:object_r:system_ndebug_socket:s0
Policy changes to support running the latest CTS.
2012-03-07 20:59:01 +01:00
/data/drm(/.*)? u:object_r:drm_data_file:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/data/gps(/.*)? u:object_r:gps_data_file:s0
Fix SELinux policies to allow resource overlays. The following commits added support for runtime resource overlays. New command line tool 'idmap' * 65a05fd56dbc9fd9c2511a97f49c445a748fb3c5 Runtime resource overlay, iteration 2 * 48d22323ce39f9aab003dce74456889b6414af55 Runtime resource overlay, iteration 2, test cases * ad6ed950dbfa152c193dd7e49c369d9e831f1591 During SELinux tightening, support for these runtime resource overlays was unknowingly broken. Fix it. This change has been tested by hackbod and she reports that everything is working after this change. I haven't independently verified the functionality. Test cases are available for this by running: * python frameworks/base/core/tests/overlaytests/testrunner.py Change-Id: I1c70484011fd9041bec4ef34f93f7a5509906f40
2014-06-16 23:19:31 +02:00
/data/resource-cache(/.*)? u:object_r:resourcecache_data_file:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/data/dalvik-cache(/.*)? u:object_r:dalvikcache_data_file:s0
Define a type for /data/dalvik-cache/profiles. I9b8e59e3bd7df8a1bf60fa7ffd376a24ba0eb42f added a profiles subdirectory to /data/dalvik-cache with files that must be app-writable. As a result, we have denials such as: W/Profiler( 3328): type=1400 audit(0.0:199): avc: denied { write } for name="com.google.android.setupwizard" dev="mmcblk0p28" ino=106067 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:dalvikcache_data_file:s0 tclass=file W/Profiler( 3328): type=1300 audit(0.0:199): arch=40000028 syscall=322 per=800000 success=yes exit=33 a0=ffffff9c a1=b8362708 a2=20002 a3=0 items=1 ppid=194 auid=4294967295 uid=10019 gid=10019 euid=10019 suid=10019 fsuid=10019 egid=10019 sgid=10019 fsgid=10019 tty=(none) ses=4294967295 exe="/system/bin/app_process" subj=u:r:untrusted_app:s0 key=(null) W/auditd ( 286): type=1307 audit(0.0:199): cwd="/" W/auditd ( 286): type=1302 audit(0.0:199): item=0 name="/data/dalvik-cache/profiles/com.google.android.setupwizard" inode=106067 dev=b3:1c mode=0100664 ouid=1012 ogid=50019 rdev=00:00 obj=u:object_r:dalvikcache_data_file:s0 We do not want to allow untrusted app domains to write to the existing type on other /data/dalvik-cache files as that could be used for code injection into another app domain, the zygote or the system_server. So define a new type for this subdirectory. The restorecon_recursive /data in init.rc will fix the labeling on devices that already have a profiles directory created. For correct labeling on first creation, we also need a separate change to installd under the same change id. Bug: 13927667 Change-Id: I4857d031f9e7e60d48b8c72fcb22a81b3a2ebaaa Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-04-09 20:24:33 +02:00
/data/dalvik-cache/profiles(/.*)? u:object_r:dalvikcache_profiles_data_file:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/data/anr(/.*)? u:object_r:anr_data_file:s0
Rules to allow installing package directories. Earlier changes had extended the rules, but some additional changes are needed. avc: denied { relabelfrom } for name="vmdl-723825123.tmp" dev="mmcblk0p28" ino=162910 scontext=u:r:system_server:s0 tcontext=u:object_r:apk_data_file:s0 tclass=dir Bug: 14975160 Change-Id: I875cfc3538d4b098d27c7c7b756d1868a54cc976
2014-07-07 19:58:53 +02:00
/data/app(/.*)? u:object_r:apk_data_file:s0
/data/app/vmdl.*\.tmp(/.*)? u:object_r:apk_tmp_file:s0
/data/app-private(/.*)? u:object_r:apk_private_data_file:s0
/data/app-private/vmdl.*\.tmp(/.*)? u:object_r:apk_private_tmp_file:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
/data/tombstones(/.*)? u:object_r:tombstone_data_file:s0
Revert "Revert "Various minor policy fixes based on CTS."" This reverts commit ba84bf1dec64d745b6efc516799b2c722a672cd9 Hidden dependency resolved. Change-Id: I9f0844f643abfda8405db2c722a36c847882c392
2013-03-26 19:00:13 +01:00
/data/local/tmp(/.*)? u:object_r:shell_data_file:s0
Label /data/media with its own type and allow access. /data/media presently is left in system_data_file, which requires anything that wants to write to it to be able to write to system_data_file. Introduce a new type for /data/media, media_rw_data_file (to match the media_rw UID assigned to it and distinguish it from /data/misc/media which has media UID and media_data_file type), and allow access to it. We allow this for all platform app domains as WRITE_MEDIA_STORAGE permission is granted to signature|system. We should not have to allow it to untrusted_app. Set up type transitions in sdcardd to automatically label any directories or files it creates with the new type. Change-Id: I5c7e6245b854a9213099e40a41d9583755d37d42 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-17 20:39:35 +01:00
/data/media(/.*)? u:object_r:media_rw_data_file:s0
Apply a label to /data/mediadrm files. /data/mediadrm is appearing on devices but is receiving the system_data_file type. Use the media_data_file label to help classify these files. This new label will help with the following denials. with exisiting allow rules for mediaserver are already in place. type=1400 msg=audit(1389139139.551:308): avc: denied { open } for pid=179 comm="mediaserver" name="ay64.dat" dev="mmcblk0p23" ino=136819 scontext=u:r:mediaserver:s0 tcontext=u:object_r:system_data_file:s0 tclass=file type=1400 msg=audit(1389139140.783:309): avc: denied { read } for pid=179 comm="mediaserver" name="IDM1013" dev="mmcblk0p23" ino=136818 scontext=u:r:mediaserver:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir type=1400 msg=audit(1389139140.783:310): avc: denied { open } for pid=179 comm="mediaserver" name="IDM1013" dev="mmcblk0p23" ino=136818 scontext=u:r:mediaserver:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir Change-Id: I84ac78517fdbb0264cf07379120a62675505fc95 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-01-08 03:53:01 +01:00
/data/mediadrm(/.*)? u:object_r:media_data_file:s0
Protect /data/property. /data/property is only accessible by root and is used by the init property service for storing persistent property values. Create a separate type for it and only allow init to write to the directory and files within it. Ensure that we do not allow access to other domains in future changes or device-specific policy via a neverallow rule. Change-Id: Iff556b9606c5651c0f1bba902e30b59bdd6f063a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-29 15:22:16 +02:00
/data/property(/.*)? u:object_r:property_data_file:s0
alphabetize /data/misc entries. Alphabetize the entries for the /data/misc subdirectories. Change-Id: I3690085cbb99c225545545668dedd66341a14edb
2013-12-13 00:23:10 +01:00
SE Android policy.
2012-01-04 18:33:27 +01:00
# Misc data
alphabetize /data/misc entries. Alphabetize the entries for the /data/misc subdirectories. Change-Id: I3690085cbb99c225545545668dedd66341a14edb
2013-12-13 00:23:10 +01:00
/data/misc/adb(/.*)? u:object_r:adb_keys_file:s0
Rename camera_calibration_file and audio_firmware_file. Use more general type names for the contents of /data/misc/camera and /data/misc/audio. These were the names used in our policy until 4.3 was released, at which point we switched to be consistent with AOSP. However, the Galaxy S4 4.2.2 image, Galaxy S4 4.3 image, and Galaxy Note 3 4.3 image all shipped with policies using _data_file names because they were based on our older policy. So we may as well switch AOSP to these names. Not sure if in fact these could be all coalesced to the new media_data_file type for /data/misc/media introduced by Ic374488f8b62bd4f8b3c90f30da0e8d1ed1a7343. Options to fix already existing devices, which would only apply to Nexus devices with 4.3 or 4.4 at this point: 1) Add restorecon_recursive /data/misc/audio /data/misc/camera to either the system/core init.rc or to the device-specific init.*.rc files. -or- 2) Add a typealias declaration in the policy to remap the old type names. to the new ones. Then existing types on persistent storage will be remapped internally to the new ones. -or- 3) Some sort of relabeld. Option #2 is implemented by this change. Change-Id: Id36203f5bb66b5200efc1205630b5b260ef97496 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-11-07 19:42:46 +01:00
/data/misc/audio(/.*)? u:object_r:audio_data_file:s0
alphabetize /data/misc entries. Alphabetize the entries for the /data/misc subdirectories. Change-Id: I3690085cbb99c225545545668dedd66341a14edb
2013-12-13 00:23:10 +01:00
/data/misc/bluetooth(/.*)? u:object_r:bluetooth_data_file:s0
/data/misc/bluedroid(/.*)? u:object_r:bluetooth_data_file:s0
Add file_contexts entries for socket files. So that we do not relabel them on a restorecon -R /data. Change-Id: I8dd915d9bb80067339621b905ea2b4ea0fa8d71e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-04 20:29:51 +01:00
/data/misc/bluedroid/\.a2dp_ctrl u:object_r:bluetooth_socket:s0
/data/misc/bluedroid/\.a2dp_data u:object_r:bluetooth_socket:s0
alphabetize /data/misc entries. Alphabetize the entries for the /data/misc subdirectories. Change-Id: I3690085cbb99c225545545668dedd66341a14edb
2013-12-13 00:23:10 +01:00
/data/misc/camera(/.*)? u:object_r:camera_data_file:s0
dhcp policy.
2012-08-15 12:25:14 +02:00
/data/misc/dhcp(/.*)? u:object_r:dhcp_data_file:s0
alphabetize /data/misc entries. Alphabetize the entries for the /data/misc subdirectories. Change-Id: I3690085cbb99c225545545668dedd66341a14edb
2013-12-13 00:23:10 +01:00
/data/misc/keystore(/.*)? u:object_r:keystore_data_file:s0
/data/misc/media(/.*)? u:object_r:media_data_file:s0
Allow netd to create data files in /data/misc/net/. This will be used to populate rt_tables (a mapping from routing table numbers to table names) that's read by the iproute2 utilities. Change-Id: I69deb1a64d5d6647470823405bf0cc55b24b22de
2014-07-08 07:04:57 +02:00
/data/misc/net(/.*)? u:object_r:net_data_file:s0
Define SELinux policy for RELRO sharing support. Define a domain and appropriate access rules for shared RELRO files (used for loading the WebView native library). Any app is permitted to read the files as they are public data, but only the shared_relro process is permitted to create/update them. Bug: 13005501 Change-Id: I9d5ba9e9eedb9b8c80fe6f84a3fc85a68553d52e
2014-05-23 12:01:58 +02:00
/data/misc/shared_relro(/.*)? u:object_r:shared_relro_file:s0
Label /data/misc/sms as a radio_data_file. This change helps with the following denials. avc: denied { write } for pid=14157 comm="Thread-88" name="premium_sms_policy.xml" dev="mmcblk0p28" ino=618998 scontext=u:r:radio:s0 tcontext=u:object_r:system_data_file:s0 tclass=file avc: denied { write } for pid=14293 comm="Thread-89" name="sms" dev="mmcblk0p28" ino=618952 scontext=u:r:radio:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir Prior to this patch the directory was labeled as system_data_file which is a bit too generic. This directory contains xml files with regexs which represent premium numbers that are used to warn the user before sending. Change-Id: I98288b25aa1546477e05eee9f7622324b013e695 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-03-18 18:29:51 +01:00
/data/misc/sms(/.*)? u:object_r:radio_data_file:s0
alphabetize /data/misc entries. Alphabetize the entries for the /data/misc subdirectories. Change-Id: I3690085cbb99c225545545668dedd66341a14edb
2013-12-13 00:23:10 +01:00
/data/misc/systemkeys(/.*)? u:object_r:systemkeys_data_file:s0
/data/misc/vpn(/.*)? u:object_r:vpn_data_file:s0
/data/misc/wifi(/.*)? u:object_r:wifi_data_file:s0
Label /data/misc/wifi/sockets with wpa_socket. This will ensure that any sockets created in this directory will default to wpa_socket unless a type_transition is defined. Define a type transition for system_server to keep its separate system_wpa_socket type assigned for its socket. Allow wpa to create and unlink sockets in the directory. We leave the already existing rules for wifi_data_file in place for compatibility with existing devices that have wifi_data_file on /data/misc/wifi/sockets. Change-Id: I9e35cc93abf89ce3594860aa3193f84a3b42ea6e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-01-29 19:45:51 +01:00
/data/misc/wifi/sockets(/.*)? u:object_r:wpa_socket:s0
/data/misc/wifi/sockets/wpa_ctrl.* u:object_r:system_wpa_socket:s0
Label /data/misc/wifi/hostapd with wpa_socket type. hostapd creates sockets under /data/misc/wifi/hostapd. Ensure that they are labeled correctly both at runtime (type_transition) and during the init.rc restorecon_recursive /data (file_contexts). Addresses denials such as: avc: denied { create } for pid=20476 comm="hostapd" name="wlan0" scontext=u:r:hostapd:s0 tcontext=u:object_r:wifi_data_file:s0 tclass=sock_file avc: denied { setattr } for pid=20476 comm="hostapd" name="wlan0" dev="mmcblk0p23" ino=619005 scontext=u:r:hostapd:s0 tcontext=u:object_r:wifi_data_file:s0 tclass=sock_file avc: denied { unlink } for pid=20476 comm="hostapd" name="wlan0" dev="mmcblk0p23" ino=619005 scontext=u:r:hostapd:s0 tcontext=u:object_r:wifi_data_file:s0 tclass=sock_file Change-Id: I80a443faeb6017a9d6cbdb8da9d7416f29a7b85f Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-03-12 20:09:17 +01:00
/data/misc/wifi/hostapd(/.*)? u:object_r:wpa_socket:s0
Label /data/misc/zoneinfo And allow any SELinux domain to read these timezone related files. Addresses the following denial: <5>[ 4.746399] type=1400 audit(3430294.470:7): avc: denied { open } for pid=197 comm="time_daemon" name="tzdata" dev="mmcblk0p28" ino=618992 scontext=u:r:time:s0 tcontext=u:object_r:system_data_file:s0 tclass=file Change-Id: Iff32465e62729d7aad8c79607848d89ce0aede86
2013-12-13 00:32:42 +01:00
/data/misc/zoneinfo(/.*)? u:object_r:zoneinfo_data_file:s0
alphabetize /data/misc entries. Alphabetize the entries for the /data/misc subdirectories. Change-Id: I3690085cbb99c225545545668dedd66341a14edb
2013-12-13 00:23:10 +01:00
New users need a wallpaper_file type. Change-Id: I7ff4ed9f73f43918cac05a026af68cca8dbe02c3 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-11-30 16:41:14 +01:00
# Wallpaper file for other users
/data/system/users/[0-9]+/wallpaper u:object_r:wallpaper_file:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
#############################
# efs files
#
/efs(/.*)? u:object_r:efs_file:s0
#############################
# Cache files
#
/cache(/.*)? u:object_r:cache_file:s0
App data backup security policy. Policy covers: * backup_data_file type for labeling all files/dirs under /data dealing with backup mechanism. * cache_backup_file type for labeling all files/dirs under /cache dealing with backup mechanism. This also covers the the use of LocalTransport for local archive and restore testing. * the use of 'adb shell bmgr' to initiate backup mechanism from shell. * the use of 'adb backup/restore' to archive and restore the device's data. Change-Id: I700a92d8addb9bb91474bc07ca4bb71eb4fc840e Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2012-12-04 14:13:58 +01:00
/cache/.*\.data u:object_r:cache_backup_file:s0
/cache/.*\.restore u:object_r:cache_backup_file:s0
# LocalTransport (backup) uses this directory
/cache/backup(/.*)? u:object_r:cache_backup_file:s0
SE Android policy.
2012-01-04 18:33:27 +01:00
#############################
# sysfs files
#
Integrate nfc_power and rild rules from tuna sepolicy by Bryan Hinton.
2012-03-19 20:56:01 +01:00
/sys/devices/platform/nfc-power/nfc_power -- u:object_r:sysfs_nfc_power_writable:s0
Move sysfs_devices_system_cpu to the central policy. Every device has a CPU. This is not device specific. Allow every domain to read these files/directories. For unknown reasons, these files are accessed by A LOT of processes. Allow ueventd to write to these files. This addresses the following denials seen on mako: <5>[ 4.935602] type=1400 audit(1383167737.512:4): avc: denied { read } for pid=140 comm="ueventd" name="cpu0" dev="sysfs" ino=3163 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_devices_system_cpu:s0 tclass=dir <5>[ 4.935785] type=1400 audit(1383167737.512:5): avc: denied { open } for pid=140 comm="ueventd" name="cpu0" dev="sysfs" ino=3163 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_devices_system_cpu:s0 tclass=dir <5>[ 4.935937] type=1400 audit(1383167737.512:6): avc: denied { search } for pid=140 comm="ueventd" name="cpu0" dev="sysfs" ino=3163 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_devices_system_cpu:s0 tclass=dir <5>[ 4.936120] type=1400 audit(1383167737.512:7): avc: denied { write } for pid=140 comm="ueventd" name="uevent" dev="sysfs" ino=3164 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_devices_system_cpu:s0 tclass=file <5>[ 4.936303] type=1400 audit(1383167737.512:8): avc: denied { open } for pid=140 comm="ueventd" name="uevent" dev="sysfs" ino=3164 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_devices_system_cpu:s0 tclass=file Change-Id: I4766dc571762d8fae06aa8c26828c070b80f5936
2013-10-30 22:12:21 +01:00
/sys/devices/system/cpu(/.*)? u:object_r:sysfs_devices_system_cpu:s0
Introduce controls on wake lock interface Change-Id: Ie0ee266e9e6facb2ab2abd652f68765239a41af1
2013-09-29 00:46:21 +02:00
/sys/power/wake_lock -- u:object_r:sysfs_wake_lock:s0
/sys/power/wake_unlock -- u:object_r:sysfs_wake_lock:s0
Restrict the ability to set usermodehelpers and proc security settings. Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06 15:31:40 +01:00
/sys/kernel/uevent_helper -- u:object_r:usermodehelper:s0
initial lmkd policy. * Allow writes to /proc/PID/oom_score_adj * Allow writes to /sys/module/lowmemorykiller/* Addresses the following denials: <5>[ 3.825371] type=1400 audit(9781555.430:5): avc: denied { write } for pid=176 comm="lmkd" name="minfree" dev="sysfs" ino=6056 scontext=u:r:lmkd:s0 tcontext=u:object_r:sysfs:s0 tclass=file <5>[ 48.874747] type=1400 audit(9781600.639:16): avc: denied { search } for pid=176 comm="lmkd" name="896" dev="proc" ino=9589 scontext=u:r:lmkd:s0 tcontext=u:r:system_server:s0 tclass=dir <5>[ 48.874889] type=1400 audit(9781600.639:17): avc: denied { dac_override } for pid=176 comm="lmkd" capability=1 scontext=u:r:lmkd:s0 tcontext=u:r:lmkd:s0 tclass=capability <5>[ 48.874982] type=1400 audit(9781600.639:18): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=8942 scontext=u:r:lmkd:s0 tcontext=u:r:system_server:s0 tclass=file <5>[ 48.875075] type=1400 audit(9781600.639:19): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=8942 scontext=u:r:lmkd:s0 tcontext=u:r:system_server:s0 tclass=file <5>[ 49.409231] type=1400 audit(9781601.169:20): avc: denied { write } for pid=176 comm="lmkd" name="minfree" dev="sysfs" ino=6056 scontext=u:r:lmkd:s0 tcontext=u:object_r:sysfs:s0 tclass=file <5>[ 209.081990] type=1400 audit(9781760.839:24): avc: denied { search } for pid=176 comm="lmkd" name="1556" dev="proc" ino=10961 scontext=u:r:lmkd:s0 tcontext=u:r:platform_app:s0 tclass=dir <5>[ 209.082240] type=1400 audit(9781760.839:25): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11654 scontext=u:r:lmkd:s0 tcontext=u:r:platform_app:s0 tclass=file <5>[ 209.082498] type=1400 audit(9781760.839:26): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11654 scontext=u:r:lmkd:s0 tcontext=u:r:platform_app:s0 tclass=file <5>[ 209.119673] type=1400 audit(9781760.879:27): avc: denied { search } for pid=176 comm="lmkd" name="1577" dev="proc" ino=12708 scontext=u:r:lmkd:s0 tcontext=u:r:release_app:s0 tclass=dir <5>[ 209.119937] type=1400 audit(9781760.879:28): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11657 scontext=u:r:lmkd:s0 tcontext=u:r:release_app:s0 tclass=file <5>[ 209.120105] type=1400 audit(9781760.879:29): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11657 scontext=u:r:lmkd:s0 tcontext=u:r:release_app:s0 tclass=file <5>[ 209.235597] type=1400 audit(9781760.999:30): avc: denied { search } for pid=176 comm="lmkd" name="1600" dev="proc" ino=11659 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=dir <5>[ 209.235798] type=1400 audit(9781760.999:31): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11667 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=file <5>[ 209.236006] type=1400 audit(9781760.999:32): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11667 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=file <5>[ 214.297283] type=1400 audit(9781766.059:64): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11211 scontext=u:r:lmkd:s0 tcontext=u:r:untrusted_app:s0 tclass=file <5>[ 214.297415] type=1400 audit(9781766.059:65): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11211 scontext=u:r:lmkd:s0 tcontext=u:r:untrusted_app:s0 tclass=file <5>[ 214.355060] type=1400 audit(9781766.119:66): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12907 scontext=u:r:lmkd:s0 tcontext=u:r:system_app:s0 tclass=file <5>[ 214.355236] type=1400 audit(9781766.119:67): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12907 scontext=u:r:lmkd:s0 tcontext=u:r:system_app:s0 tclass=file <5>[ 214.516920] type=1400 audit(9781766.279:68): avc: denied { search } for pid=176 comm="lmkd" name="1907" dev="proc" ino=11742 scontext=u:r:lmkd:s0 tcontext=u:r:media_app:s0 tclass=dir <5>[ 214.678861] type=1400 audit(9781766.439:69): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12915 scontext=u:r:lmkd:s0 tcontext=u:r:media_app:s0 tclass=file <5>[ 214.678992] type=1400 audit(9781766.439:70): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12915 scontext=u:r:lmkd:s0 tcontext=u:r:media_app:s0 tclass=file <5>[ 214.708284] type=1400 audit(9781766.469:71): avc: denied { search } for pid=176 comm="lmkd" name="1765" dev="proc" ino=12851 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=dir <5>[ 214.708435] type=1400 audit(9781766.469:72): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12870 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=file <5>[ 214.708648] type=1400 audit(9781766.469:73): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12870 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=file Change-Id: Ie3c1ab8ce9e77742d0cc3c73f40010afd018ccd4
2014-02-13 21:19:50 +01:00
/sys/module/lowmemorykiller(/.*)? -- u:object_r:sysfs_lowmemorykiller:s0
New asec container labeling. This patchset covers the /mnt/asec variety only.
2012-07-30 20:20:40 +02:00
#############################
# asec containers
Rules to allow installing package directories. Earlier changes had extended the rules, but some additional changes are needed. avc: denied { relabelfrom } for name="vmdl-723825123.tmp" dev="mmcblk0p28" ino=162910 scontext=u:r:system_server:s0 tcontext=u:object_r:apk_data_file:s0 tclass=dir Bug: 14975160 Change-Id: I875cfc3538d4b098d27c7c7b756d1868a54cc976
2014-07-07 19:58:53 +02:00
/mnt/asec(/.*)? u:object_r:asec_apk_file:s0
/mnt/asec/[^/]+/[^/]+\.zip u:object_r:asec_public_file:s0
/mnt/asec/[^/]+/lib(/.*)? u:object_r:asec_public_file:s0
/data/app-asec(/.*)? u:object_r:asec_image_file:s0
Reference in a new issue Copy permalink