platform_system_sepolicy/keystore.te

type keystore, domain;
type keystore_exec, exec_type, file_type;

# keystore daemon
init_daemon_domain(keystore)
typeattribute keystore mlstrustedsubject;
binder_use(keystore)
binder_service(keystore)
allow keystore keystore_data_file:dir create_dir_perms;
allow keystore keystore_data_file:notdevfile_class_set create_file_perms;
allow keystore keystore_exec:file { getattr };
allow keystore tee_device:chr_file rw_file_perms;
allow keystore tee:unix_stream_socket connectto;

###
### Neverallow rules
###
### Protect ourself from others
###

neverallow { domain -keystore } keystore_data_file:dir ~{ open create read getattr setattr search relabelto };
neverallow { domain -keystore } keystore_data_file:notdevfile_class_set ~{ relabelto getattr };

neverallow { domain -keystore -init -kernel -recovery } keystore_data_file:dir *;
neverallow { domain -keystore -init -kernel -recovery } keystore_data_file:notdevfile_class_set *;

neverallow domain keystore:process ptrace;

allow keystore keystore_service:service_manager add;

# Check SELinux permissions.
selinux_check_access(keystore)
SE Android policy. 2012-01-04 18:33:27 +01:00			`type keystore, domain;`
			`type keystore_exec, exec_type, file_type;`

			`# keystore daemon`
			`init_daemon_domain(keystore)`
Confine keystore, but leave it permissive for now. Change-Id: Ia92165478764b062e7e33e7741742f5ec8762ad9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-10-29 19:42:37 +01:00			`typeattribute keystore mlstrustedsubject;`
			`binder_use(keystore)`
			`binder_service(keystore)`
			`allow keystore keystore_data_file:dir create_dir_perms;`
			`allow keystore keystore_data_file:notdevfile_class_set create_file_perms;`
			`allow keystore keystore_exec:file { getattr };`
			`allow keystore tee_device:chr_file rw_file_perms;`
Allow keystore to talk to the tee On manta, the keystore CTS tests are failing, because keystore isn't allowed to talk to the tee. Allow it. I've only seen this bug on manta, but it seems appropriate for all domains. Fixes the following denial: <5>[ 286.249563] type=1400 audit(1389210059.924:6): avc: denied { connectto } for pid=126 comm="keystore" path=006D636461656D6F6E scontext=u:r:keystore:s0 tcontext=u:r:tee:s0 tclass=unix_stream_socket Bug: 12450710 Change-Id: I07133d9abeaf967392118ba478a5a391cf0c5fa5 2014-01-08 20:47:00 +01:00			`allow keystore tee:unix_stream_socket connectto;`
Protect keystore's files. Only keystore itself should be reading / writing it's files. Remove keystore file access from other SELinux domains, including unconfined. Add neverallow rules to protect against regressions. Allow init limited access to recurse into keystore's directory. Change-Id: I0bb5de7804f4314997c16fac18507933014bcadf 2014-05-09 08:28:52 +02:00
			`###`
			`### Neverallow rules`
			`###`
Don't allow ptrace on keystore keystore may hold sensitive information in it's memory. Don't allow anyone to ptrace keystore. Change-Id: I4e3717e482b9fd128d38ce687c03122d41678b6f 2014-05-20 06:49:50 +02:00			`### Protect ourself from others`
Protect keystore's files. Only keystore itself should be reading / writing it's files. Remove keystore file access from other SELinux domains, including unconfined. Add neverallow rules to protect against regressions. Allow init limited access to recurse into keystore's directory. Change-Id: I0bb5de7804f4314997c16fac18507933014bcadf 2014-05-09 08:28:52 +02:00			`###`

			`neverallow { domain -keystore } keystore_data_file:dir ~{ open create read getattr setattr search relabelto };`
			`neverallow { domain -keystore } keystore_data_file:notdevfile_class_set ~{ relabelto getattr };`

			`neverallow { domain -keystore -init -kernel -recovery } keystore_data_file:dir *;`
			`neverallow { domain -keystore -init -kernel -recovery } keystore_data_file:notdevfile_class_set *;`
Don't allow ptrace on keystore keystore may hold sensitive information in it's memory. Don't allow anyone to ptrace keystore. Change-Id: I4e3717e482b9fd128d38ce687c03122d41678b6f 2014-05-20 06:49:50 +02:00
			`neverallow domain keystore:process ptrace;`
Add SELinux rules for service_manager. Add a service_mananger class with the verb add. Add a type that groups the services for each of the processes that is allowed to start services in service.te and an attribute for all services controlled by the service manager. Add the service_contexts file which maps service name to target label. Bug: 12909011 Change-Id: I017032a50bc90c57b536e80b972118016d340c7d 2014-06-06 00:52:02 +02:00
			`allow keystore keystore_service:service_manager add;`
Adding policies for KeyStore MAC. Add keystore_key class and an action for each action supported by keystore. Add policies that replicate the access control that already exists in keystore. Add auditallow rules for actions not known to be used frequently. Add macro for those domains wishing to access keystore. Change-Id: Iddd8672b9e9b72b45ee208e6eda608cc9dc61edc 2014-06-17 23:58:52 +02:00
			`# Check SELinux permissions.`
			`selinux_check_access(keystore)`