tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/ping.te

17 lines
564 B
Text
Raw Normal View History

Add policy for ping. Change-Id: I168f681d8c67f470b6e639f0b1bf39346c4eb396
2013-05-02 22:26:05 +02:00
type ping, domain;
Make sure exec_type is assigned to all entrypoint types. Some file types used as domain entrypoints were missing the exec_type attribute. Add it and add a neverallow rule to keep it that way. Change-Id: I7563f3e03940a27ae40ed4d6bb74181c26148849 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-09-27 16:38:14 +02:00
type ping_exec, exec_type, file_type;
Add policy for ping. Change-Id: I168f681d8c67f470b6e639f0b1bf39346c4eb396
2013-05-02 22:26:05 +02:00
domain_auto_trans(shell, ping_exec, ping)
Allow dumpstate to use ping. Addreseses the following denials: <5>[ 695.383994] type=1400 audit(1387403898.292:55): avc: denied { execute } for pid=5187 comm="dumpstate" name="ping" dev="mmcblk0p25" ino=213 scontext=u:r:dumpstate:s0 tcontext=u:object_r:ping_exec:s0 tclass=file <5>[ 695.384727] type=1400 audit(1387403898.292:56): avc: denied { read open } for pid=5187 comm="dumpstate" name="ping" dev="mmcblk0p25" ino=213 scontext=u:r:dumpstate:s0 tcontext=u:object_r:ping_exec:s0 tclass=file <5>[ 695.385418] type=1400 audit(1387403898.292:57): avc: denied { execute_no_trans } for pid=5187 comm="dumpstate" path="/system/bin/ping" dev="mmcblk0p25" ino=213 scontext=u:r:dumpstate:s0 tcontext=u:object_r:ping_exec:s0 tclass=file <5>[ 695.391978] type=1400 audit(1387403898.302:58): avc: denied { create } for pid=5187 comm="ping" scontext=u:r:dumpstate:s0 tcontext=u:r:dumpstate:s0 tclass=rawip_socket <5>[ 695.393193] type=1400 audit(1387403898.302:59): avc: denied { setopt } for pid=5187 comm="ping" scontext=u:r:dumpstate:s0 tcontext=u:r:dumpstate:s0 tclass=rawip_socket <5>[ 695.393753] type=1400 audit(1387403898.302:60): avc: denied { getopt } for pid=5187 comm="ping" scontext=u:r:dumpstate:s0 tcontext=u:r:dumpstate:s0 tclass=rawip_socket <5>[ 695.394886] type=1400 audit(1387403898.302:61): avc: denied { write } for pid=5187 comm="ping" scontext=u:r:dumpstate:s0 tcontext=u:r:dumpstate:s0 tclass=rawip_socket <5>[ 695.400693] type=1400 audit(1387403898.312:62): avc: denied { read } for pid=5187 comm="ping" lport=4 scontext=u:r:dumpstate:s0 tcontext=u:r:dumpstate:s0 tclass=rawip_socket Change-Id: If9a790725ec0ba1ca6cb5c9a8ed85288580940e8
2013-12-18 23:53:27 +01:00
domain_auto_trans(dumpstate, ping_exec, ping)
Confine ping, but leave it permissive for now. Change-Id: I3fda2946271456dbe0905651c5015d9eb120a8ea Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:38 +01:00
allow ping self:capability net_raw;
allow ping self:rawip_socket create_socket_perms;
allow ping self:udp_socket create_socket_perms;
allow ping node:rawip_socket node_bind;
allow ping dnsproxyd_socket:sock_file write;
allow ping netd:unix_stream_socket connectto;
allow ping devpts:chr_file rw_file_perms;
allow ping shell:fd use;
Allow dumpstate to use ping. Addreseses the following denials: <5>[ 695.383994] type=1400 audit(1387403898.292:55): avc: denied { execute } for pid=5187 comm="dumpstate" name="ping" dev="mmcblk0p25" ino=213 scontext=u:r:dumpstate:s0 tcontext=u:object_r:ping_exec:s0 tclass=file <5>[ 695.384727] type=1400 audit(1387403898.292:56): avc: denied { read open } for pid=5187 comm="dumpstate" name="ping" dev="mmcblk0p25" ino=213 scontext=u:r:dumpstate:s0 tcontext=u:object_r:ping_exec:s0 tclass=file <5>[ 695.385418] type=1400 audit(1387403898.292:57): avc: denied { execute_no_trans } for pid=5187 comm="dumpstate" path="/system/bin/ping" dev="mmcblk0p25" ino=213 scontext=u:r:dumpstate:s0 tcontext=u:object_r:ping_exec:s0 tclass=file <5>[ 695.391978] type=1400 audit(1387403898.302:58): avc: denied { create } for pid=5187 comm="ping" scontext=u:r:dumpstate:s0 tcontext=u:r:dumpstate:s0 tclass=rawip_socket <5>[ 695.393193] type=1400 audit(1387403898.302:59): avc: denied { setopt } for pid=5187 comm="ping" scontext=u:r:dumpstate:s0 tcontext=u:r:dumpstate:s0 tclass=rawip_socket <5>[ 695.393753] type=1400 audit(1387403898.302:60): avc: denied { getopt } for pid=5187 comm="ping" scontext=u:r:dumpstate:s0 tcontext=u:r:dumpstate:s0 tclass=rawip_socket <5>[ 695.394886] type=1400 audit(1387403898.302:61): avc: denied { write } for pid=5187 comm="ping" scontext=u:r:dumpstate:s0 tcontext=u:r:dumpstate:s0 tclass=rawip_socket <5>[ 695.400693] type=1400 audit(1387403898.312:62): avc: denied { read } for pid=5187 comm="ping" lport=4 scontext=u:r:dumpstate:s0 tcontext=u:r:dumpstate:s0 tclass=rawip_socket Change-Id: If9a790725ec0ba1ca6cb5c9a8ed85288580940e8
2013-12-18 23:53:27 +01:00
allow ping dumpstate:fd use;
allow ping dumpstate:unix_stream_socket { read write };
Reference in a new issue Copy permalink