tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/ppp.te

23 lines
627 B
Text
Raw Normal View History

Add ppp/mtp policy. Initial policy for Point-to-Point tunneling and tunneling manager services.
2012-08-20 12:13:28 +02:00
# Point to Point Protocol daemon
Create attribute for moving perms out of domain Motivation: Domain is overly permissive. Start removing permissions from domain and assign them to the domain_deprecated attribute. Domain_deprecated and domain can initially be assigned to all domains. The goal is to not assign domain_deprecated to new domains and to start removing domain_deprecated where it is not required or reassigning the appropriate permissions to the inheriting domain when necessary. Bug: 25433265 Change-Id: I8b11cb137df7bdd382629c98d916a73fe276413c
2015-11-03 18:54:39 +01:00
type ppp, domain, domain_deprecated;
Add ppp/mtp policy. Initial policy for Point-to-Point tunneling and tunneling manager services.
2012-08-20 12:13:28 +02:00
type ppp_device, dev_type;
type ppp_exec, exec_type, file_type;
Make ppp permissive or unconfined. Also add rules from our policy. Change-Id: I6f552538cc4f6b28b2883aa74832230944cbdb7a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:38 +01:00
Clean up socket rules. Replace * or any permission set containing create with create_socket_perms or create_stream_socket_perms. Add net_domain() to all domains using network sockets and delete rules already covered by domain.te or net.te. For netlink_route_socket, only nlmsg_write needs to be separately granted to specific domains that are permitted to modify the routing table. Clarification: read/write permissions are just ability to perform read/recv() or write/send() on the socket, whereas nlmsg_read/ nlmsg_write permissions control ability to observe or modify the underlying kernel state accessed via the socket. See security/selinux/nlmsgtab.c in the kernel for the mapping of netlink message types to nlmsg_read or nlmsg_write. Delete legacy rule for b/12061011. This change does not touch any rules where only read/write were allowed to a socket created by another domain (inherited across exec or received across socket or binder IPC). We may wish to rewrite some or all of those rules with the rw_socket_perms macro but that is a separate change. Change-Id: Ib0637ab86f6d388043eff928e5d96beb02e5450e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 21:06:11 +01:00
net_domain(ppp)
domain_deprecated.te: remove /proc/net access Remove /proc/net access to domain_deprecated. Add it to domains where it was missing before. Other than these domains, SELinux denial monitoring hasn't picked up any denials related to /proc/net Bug: 28760354 Test: Device boots Test: No unexpected denials in denial collection logs. Change-Id: Ie5bfa4bc0070793c1e8bf3b00676fd31c08d426a
2016-12-01 00:22:18 +01:00
r_dir_file(ppp, proc_net)
ppp: Allow specific ioctls on mtp:socket. The fix for b/35100237 surfaced this error. This SELinux policy fragment was included only on Marlin, but needs to be included in core policy. Bug: 35100237 Test: With https://android-review.googlesource.com/#/c/354292/ Test: Set up PPTP VPN using http://www.vpnbook.com/ on Marlin. Test: Connect: 03-17 15:41:22.602 3809 3809 I mtpd : Starting pppd (pppox = 9) 03-17 15:41:22.628 3811 3811 I pppd : Using PPPoX (socket = 9) 03-17 15:41:22.637 3811 3811 I pppd : pppd 2.4.7 started by vpn, uid 1016 03-17 15:41:22.639 3811 3811 I pppd : Using interface ppp0 03-17 15:41:22.639 3811 3811 I pppd : Connect: ppp0 <--> 03-17 15:41:22.770 3811 3811 I pppd : CHAP authentication succeeded 03-17 15:41:22.909 3811 3811 I pppd : MPPE 128-bit stateless compression enabled 03-17 15:41:23.065 3811 3811 I pppd : local IP address 172.16.36.113 03-17 15:41:23.065 3811 3811 I pppd : remote IP address 172.16.36.1 03-17 15:41:23.065 3811 3811 I pppd : primary DNS address 8.8.8.8 03-17 15:41:23.065 3811 3811 I pppd : secondary DNS address 91.239.100.100 Change-Id: I192b4dfc9613d1000f804b9c4ca2727d502a1927
2017-03-17 18:48:39 +01:00
allow ppp mtp:socket rw_socket_perms;
# ioctls needed for VPN.
allowxperm ppp self:udp_socket ioctl priv_sock_ioctls;
allowxperm ppp mtp:socket ioctl ppp_ioctls;
Allow ppp to inherit/use mtp unix datagram socket. Resolves denials such as: avc: denied { read write } for path="socket:[33571]" dev="sockfs" ino=33571 scontext=u:r:ppp:s0 tcontext=u:r:mtp:s0 tclass=unix_dgram_socket Change-Id: Icb1ee00d8513179039bfb738647f49480e836f25 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-13 14:24:38 +02:00
allow ppp mtp:unix_dgram_socket rw_socket_perms;
Make ppp permissive or unconfined. Also add rules from our policy. Change-Id: I6f552538cc4f6b28b2883aa74832230944cbdb7a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:38 +01:00
allow ppp ppp_device:chr_file rw_file_perms;
allow ppp self:capability net_admin;
allow ppp system_file:file rx_file_perms;
allow ppp vpn_data_file:dir w_dir_perms;
allow ppp vpn_data_file:file create_file_perms;
allow ppp mtp:fd use;
Reference in a new issue Copy permalink