tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/ueventd.te

42 lines
1.8 KiB
Text
Raw Normal View History

SE Android policy.
2012-01-04 18:33:27 +01:00
# ueventd seclabel is specified in init.rc since
# it lives in the rootfs and has no unique file type.
Create attribute for moving perms out of domain Motivation: Domain is overly permissive. Start removing permissions from domain and assign them to the domain_deprecated attribute. Domain_deprecated and domain can initially be assigned to all domains. The goal is to not assign domain_deprecated to new domains and to start removing domain_deprecated where it is not required or reassigning the appropriate permissions to the inheriting domain when necessary. Bug: 25433265 Change-Id: I8b11cb137df7bdd382629c98d916a73fe276413c
2015-11-03 18:54:39 +01:00
type ueventd, domain, domain_deprecated;
SE Android policy.
2012-01-04 18:33:27 +01:00
tmpfs_domain(ueventd)
Allow /dev/klog access, drop mknod and __null__ access Allow vold, healthd, slideshow, and watchdogd access to /dev/kmsg. These processes log to the kernel dmesg ring buffer, so they need write access to that file. Addresses the following denials: avc: denied { write } for pid=134 comm="watchdogd" name="kmsg" dev="tmpfs" ino=9248 scontext=u:r:watchdogd:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0 avc: denied { write } for pid=166 comm="healthd" name="kmsg" dev="tmpfs" ino=9248 scontext=u:r:healthd:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0 avc: denied { write } for pid=180 comm="vold" name="kmsg" dev="tmpfs" ino=9248 scontext=u:r:vold:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0 These denials were triggered by the change in https://android-review.googlesource.com/151209 . Prior to that change, any code which called klog_init would (unnecessarily) create the device node themselves, rather than using the already existing device node. Drop special /dev/__null__ handling from watchdogd. As of https://android-review.googlesource.com/148288 , watchdogd no longer creates it's own /dev/null device, so it's unnecessary for us to allow for it. Drop mknod from healthd, slideshow, and watchdogd. healthd and slideshow only needed mknod to create /dev/__kmsg__, which is now obsolete. watchdogd only needed mknod to create /dev/__kmsg__ and /dev/__null__, which again is now obsolete. Bug: 21242418 Change-Id: If01c8001084575e7441253f0fa8b4179ae33f534
2015-06-06 16:42:37 +02:00
# TODO: why is ueventd using __kmsg__ when it should just create
# and use /dev/kmsg instead?
type_transition ueventd device:chr_file klog_device "__kmsg__";
allow ueventd klog_device:chr_file { create open write unlink };
Start confining ueventd * Keep ueventd in permissive * Drop unconfined macro to collect logs * Restore allow rules to current NSA maintained policy Change-Id: Ic4ee8e24ccd8887fed151ae1e4f197512849f57b
2013-10-06 21:36:11 +02:00
allow ueventd self:capability { chown mknod net_admin setgid fsetid sys_rawio dac_override fowner };
allow ueventd device:file create_file_perms;
allow ueventd device:chr_file rw_file_perms;
allow ueventd sysfs:file rw_file_perms;
Create sysfs_hwrandom type. HwRngTest needs access to the hwrandom sysfs files, but untrused_app does not have access to sysfs. Give these files their own label and allow the needed read access. (cherry-pick from internal commit: 85c0f8affa4d3aa3c50331e272327e360eb8bed9) Bug: 27263241 Change-Id: If572ad0931a534d76e148b688b76687460e99af9
2016-03-12 00:23:49 +01:00
allow ueventd sysfs_hwrandom:file w_file_perms;
Create sysfs_zram label. Address following denials: avc: denied { getattr } for path="/sys/devices/virtual/block/zram0/disksize" dev="sysfs" ino=14958 scontext=u:r:init:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=file permissive=0 avc: denied { search } for name="zram0" dev="sysfs" ino=14903 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=dir permissive=0 avc: denied { read } for name="mem_used_total" dev="sysfs" ino=14970 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=file permissive=0 avc: denied { write } for name="uevent" dev="sysfs" ino=14904 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=file permissive=0 avc: denied { open } for path="/sys/devices/virtual/block/zram0/uevent" dev="sysfs" ino=14904 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=file permissive=0 avc: denied { read } for pid=348 comm="vold" name="zram0" dev="sysfs" ino=15223 scontext=u:r:vold:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=dir permissive=0 avc: denied { search } for pid=3494 comm="ContactsProvide" name="zram0"dev="sysfs" ino=15223 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:sysfs_zram:s0 tclass=dir permissive=0 Bug: 22032619 Change-Id: I40cf918b7cafdba6cb3d42b04b1616a84e4ce158
2016-01-04 23:23:23 +01:00
allow ueventd sysfs_zram_uevent:file w_file_perms;
allow ueventd sysfs_type lnk_file ueventd is allowed to change files and directories in /sys, but not symbolic links. This is, at a minimum, causing the following denial: type=1400 audit(0.0:5): avc: denied { getattr } for comm="ueventd" path="/sys/devices/tegradc.0/driver" dev=sysfs ino=3386 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_devices_tegradc:s0 tclass=lnk_file Allow ueventd to modify labeling / attributes of symlinks. Change-Id: If641a218e07ef479d1283f3171b2743f3956386d
2014-07-10 08:07:10 +02:00
allow ueventd sysfs_type:{ file lnk_file } { relabelfrom relabelto setattr getattr };
ueventd: Add policy support for ueventd labeling changes Currently, ueventd only modifies the SELinux label on a file if the entry exists in /ueventd.rc. Add policy support to enable an independent restorecon_recursive whenever a uevent message occurs. Change-Id: I0ccb5395ec0be9282095b844a5022e8c0d8903ac
2014-07-04 01:10:01 +02:00
allow ueventd sysfs_type:dir { relabelfrom relabelto setattr r_dir_perms };
Add sysfs_type attribute to sysfs, coalesce ueventd rules. As per the discussion in: https://android-review.googlesource.com/#/c/92903/ Add sysfs_type attribute to sysfs type so that it is included in rules on sysfs_type, allow setattr to all sysfs_type for ueventd for chown/chmod, and get rid of redundant rules. Change-Id: I1228385d5703168c3852ec75605ed8da7c99b83d Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-08 19:18:52 +02:00
allow ueventd sysfs_devices_system_cpu:file rw_file_perms;
Start confining ueventd * Keep ueventd in permissive * Drop unconfined macro to collect logs * Restore allow rules to current NSA maintained policy Change-Id: Ic4ee8e24ccd8887fed151ae1e4f197512849f57b
2013-10-06 21:36:11 +02:00
allow ueventd tmpfs:chr_file rw_file_perms;
allow ueventd dev_type:dir create_dir_perms;
allow ueventd dev_type:lnk_file { create unlink };
allow ueventd dev_type:chr_file { create setattr unlink };
Allow ueventd to relabel block devices There is a race in ueventd's coldboot procedure that permits creation of device block nodes before platform devices are registered. In this case the device node links used to compute the SELinux context are not known and the node is created under the generic context: u:object_r:block_device:s0. Ueventd has been patched to relabel the nodes on subsequent add events but it needs permissions to be allowed to do it. BUG=28388946 Change-Id: Ic836309527a2b81accc50df38bd753d54fa5e318 Signed-off-by: Mihai Serban <mihai.serban@intel.com>
2016-04-25 17:20:26 +02:00
allow ueventd dev_type:blk_file { relabelfrom relabelto create setattr unlink };
Clean up socket rules. Replace * or any permission set containing create with create_socket_perms or create_stream_socket_perms. Add net_domain() to all domains using network sockets and delete rules already covered by domain.te or net.te. For netlink_route_socket, only nlmsg_write needs to be separately granted to specific domains that are permitted to modify the routing table. Clarification: read/write permissions are just ability to perform read/recv() or write/send() on the socket, whereas nlmsg_read/ nlmsg_write permissions control ability to observe or modify the underlying kernel state accessed via the socket. See security/selinux/nlmsgtab.c in the kernel for the mapping of netlink message types to nlmsg_read or nlmsg_write. Delete legacy rule for b/12061011. This change does not touch any rules where only read/write were allowed to a socket created by another domain (inherited across exec or received across socket or binder IPC). We may wish to rewrite some or all of those rules with the rw_socket_perms macro but that is a separate change. Change-Id: Ib0637ab86f6d388043eff928e5d96beb02e5450e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 21:06:11 +01:00
allow ueventd self:netlink_kobject_uevent_socket create_socket_perms;
Start confining ueventd * Keep ueventd in permissive * Drop unconfined macro to collect logs * Restore allow rules to current NSA maintained policy Change-Id: Ic4ee8e24ccd8887fed151ae1e4f197512849f57b
2013-10-06 21:36:11 +02:00
allow ueventd efs_file:dir search;
allow ueventd efs_file:file r_file_perms;
Restrict requesting contexts other than policy-defined defaults. Writing to the /proc/self/attr files (encapsulated by the libselinux set*con functions) enables a program to request a specific security context for various operations instead of the policy-defined defaults. The security context specified using these calls is checked by an operation-specific permission, e.g. dyntransition for setcon, transition for setexeccon, create for setfscreatecon or setsockcreatecon, but the ability to request a context at all is controlled by a process permission. Omit these permissions from domain.te and only add them back where required so that only specific domains can even request a context other than the default defined by the policy. Change-Id: I6a2fb1279318625a80f3ea8e3f0932bdbe6df676 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-23 17:26:19 +02:00
# Use setfscreatecon() to label /dev directories and files.
allow ueventd self:process setfscreate;
neverallow ueventd to set properties Add a compile time assertion that no SELinux rules exist which allow ueventd to set properties, or even connect to the property socket. See https://android-review.googlesource.com/#/c/133120/6/init/devices.cpp@941 for details. Change-Id: Ia9e932a3d94443d70644b14f36c74df4be7e9e32
2015-03-03 05:10:48 +01:00
#####
##### neverallow rules
#####
# ueventd must never set properties, otherwise deadlocks may occur.
# https://android-review.googlesource.com/#/c/133120/6/init/devices.cpp@941
# No writing to the property socket, connecting to init, or setting properties.
neverallow ueventd property_socket:sock_file write;
neverallow ueventd init:unix_stream_socket connectto;
neverallow ueventd property_type:property_service set;
Reference in a new issue Copy permalink