platform_system_sepolicy/private/remote_prov_app.te

type remote_prov_app, domain;
typeattribute remote_prov_app coredomain;

app_domain(remote_prov_app)
net_domain(remote_prov_app)

set_prop(remote_prov_app, remote_prov_prop)
# The app needs access to properly build a DeviceInfo package for the verifying server
get_prop(remote_prov_app, vendor_security_patch_level_prop)

# if rkpd is enabled, remote provisioner is a noop
get_prop(remote_prov_app, device_config_remote_key_provisioning_native_prop)

allow remote_prov_app {
    app_api_service
    mediametrics_service
    remoteprovisioning_service
}:service_manager find;
SEPolicy for RemoteProvisioning App This change adds the SEPolicy changes required to support the remote provisioning flow. The notable additions are specifically labeling the remote provisioning app and giving it access to find the remote provisioning service which is added in keystore. It also requires network access in order to communicate to the provisioning servers. This functionality is extremely narrow to the point that it seems worth it to define a separate domain for this app, rather than add this in to the priv_app or platform_app permission files. Since this app also communicates with the network, it also seems advantageous to limit its permissions only to what is absolutely necessary to perform its function. Test: No denials! Change-Id: I602c12365a575d914afc91f55e6a9b6aa2e14189 2020-12-24 06:53:08 +01:00			`type remote_prov_app, domain;`
			`typeattribute remote_prov_app coredomain;`

			`app_domain(remote_prov_app)`
			`net_domain(remote_prov_app)`

Allow the remote provisioner app to set rkp_only properties The properties for rkp_only are no longer read only. This allows remote provisioner unit tests to enable/disable the remote provisioning only mode, which is required to fully verify functionality. Test: RemoteProvisionerUnitTests Bug: 227306369 Change-Id: I8006712a49c4d0605f6268068414b49714bbd939 2022-04-20 19:10:49 +02:00			`set_prop(remote_prov_app, remote_prov_prop)`
Granting remote_prov_app access to build prop The RemoteProvisioner app builds a DeviceInfo CBOR object which is eventually used as AAD to verify the authenticity of a signed MAC key in the remote provisioning spec. One of those fields is vendor security patch level, which this patch grants access for the remote_prov_app domain to read. Test: No denials! (atest RemoteProvisionerUnitTests) Change-Id: Iab0426fb5ec184cda171d67451bf44cae897bf9b 2021-02-22 11:07:01 +01:00			`# The app needs access to properly build a DeviceInfo package for the verifying server`
			`get_prop(remote_prov_app, vendor_security_patch_level_prop)`

Allow remote provisioner to read rkpd enablement property This way, remote provisioner can decide to noop when rkpd is enabled. Test: RemoteProvisionerUnitTests Change-Id: I9c300360dc08c6d70431b83e1db714941d8caca1 2023-01-19 04:10:23 +01:00			`# if rkpd is enabled, remote provisioner is a noop`
			`get_prop(remote_prov_app, device_config_remote_key_provisioning_native_prop)`

SEPolicy for RemoteProvisioning App This change adds the SEPolicy changes required to support the remote provisioning flow. The notable additions are specifically labeling the remote provisioning app and giving it access to find the remote provisioning service which is added in keystore. It also requires network access in order to communicate to the provisioning servers. This functionality is extremely narrow to the point that it seems worth it to define a separate domain for this app, rather than add this in to the priv_app or platform_app permission files. Since this app also communicates with the network, it also seems advantageous to limit its permissions only to what is absolutely necessary to perform its function. Test: No denials! Change-Id: I602c12365a575d914afc91f55e6a9b6aa2e14189 2020-12-24 06:53:08 +01:00			`allow remote_prov_app {`
Allow remote_prov_app to find app_api_service Due to the nature of RemoteProvisioner being an app, there are many components under the hood of frameworks that make calls out to standard app available services. This change allows remote_prov_app to find any service labeled with app_api_service to avoid the brittleness that has already arisen from generating SELinux denials on boot, and avoid any potential unintended functionality consequences as a result of those. Test: No selinux denials Change-Id: I95fc4d15a196646deb6b9f6040bac88ee00b2a7f 2021-03-23 21:55:14 +01:00			`app_api_service`
Allow remote_prov_app to find mediametrics. This change allows remote_prov_app to find mediametrics. This is a permission that all apps have. It is now needed for remote_prov_app due to a new feature related to provisioning Widevine through the MediaDrm framework. Bug: 235491155 Test: no selinux denials related to remote_prov_app Change-Id: Id3057b036486288358a9a84100fe808eb56df5fe Merged-In: Id3057b036486288358a9a84100fe808eb56df5fe 2022-06-15 17:38:53 +02:00			`mediametrics_service`
SEPolicy for RemoteProvisioning App This change adds the SEPolicy changes required to support the remote provisioning flow. The notable additions are specifically labeling the remote provisioning app and giving it access to find the remote provisioning service which is added in keystore. It also requires network access in order to communicate to the provisioning servers. This functionality is extremely narrow to the point that it seems worth it to define a separate domain for this app, rather than add this in to the priv_app or platform_app permission files. Since this app also communicates with the network, it also seems advantageous to limit its permissions only to what is absolutely necessary to perform its function. Test: No denials! Change-Id: I602c12365a575d914afc91f55e6a9b6aa2e14189 2020-12-24 06:53:08 +01:00			`remoteprovisioning_service`
			`}:service_manager find;`