tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/property.te

40 lines
1.8 KiB
Text
Raw Normal View History

Remove property read access for non-core properties Instead of allowing global read access to all properties, only allow read access to the properties which are part of core SELinux policy. Device-specific policies are no longer readable by default and need to be granted in device-specific policy. Grant read-access to any property where the person has write access. In most cases, anyone who wants to write a property needs read access to that property. Change-Id: I2bd24583067b79f31b3bb0940b4c07fc33d09918
2015-12-08 23:45:50 +01:00
type default_prop, property_type, core_property_type;
type shell_prop, property_type, core_property_type;
type debug_prop, property_type, core_property_type;
type dumpstate_prop, property_type, core_property_type;
type persist_debug_prop, property_type, core_property_type;
type debuggerd_prop, property_type, core_property_type;
type dhcp_prop, property_type, core_property_type;
type fingerprint_prop, property_type, core_property_type;
type ffs_prop, property_type, core_property_type;
type radio_prop, property_type, core_property_type;
type net_radio_prop, property_type, core_property_type;
type system_radio_prop, property_type, core_property_type;
type system_prop, property_type, core_property_type;
type vold_prop, property_type, core_property_type;
allow system server to set log.tag.WifiHAL On eng and userdebug builds (only), allow system server to change the value of log.tag.WifiHAL. WifiStateMachine will set this property to 'D' by default. If/when a user enables "Developer options -> Enable Wi-Fi Verbose Logging", WifiStateMachine change log.tag.WifiHAL to 'V'. BUG=27857554 TEST=manual (see below) Test detail 1. on user build: $ adb shell setprop log.tag.WifiHAL V $ adb shell getprop log.tag.WifiHAL <blank line> $ adb bugreport | grep log.tag.WifiHAL <11>[ 141.918517] init: avc: denied { set } for property=log.tag.WifiHAL pid=4583 uid=2000 gid=2000 scontext=u:r:shell:s0 tcontext=u:object_r:wifi_log_prop:s0 tclass=property_service permissive=0 <11>[ 141.918566] init: sys_prop: permission denied uid:2000 name:log.tag.WifiHAL 2. on userdebug build: $ adb shell getprop log.tag.WifiHAL $ <blank line> $ adb shell setprop log.tag.WifiHAL V $ adb shell getprop log.tag.WifiHAL V 3. on userdebug build with modified WifiStateMachine: $ adb shell getprop log.tag.WifiHAL D Change-Id: I9cdd52a2b47a3dd1065262ea8c329130b7b044db
2016-04-15 20:10:39 +02:00
type wifi_log_prop, property_type, log_property_type;
Remove core_property_type from ctl_* properties Per https://android-review.googlesource.com/185392 , ctl.* properties are not represented as files in the filesystem. So there's no need to grant read access to them, since it's pointless. Remove core_property_type from these properties, which has the net effect of removing read access to these non-existent files. Change-Id: Ic1ca574668a3511c335a7036a2bb7993ff02c1e3
2015-12-09 17:47:02 +01:00
type ctl_bootanim_prop, property_type;
type ctl_default_prop, property_type;
type ctl_dumpstate_prop, property_type;
type ctl_fuse_prop, property_type;
type ctl_mdnsd_prop, property_type;
type ctl_rildaemon_prop, property_type;
type ctl_bugreport_prop, property_type;
type ctl_console_prop, property_type;
Remove property read access for non-core properties Instead of allowing global read access to all properties, only allow read access to the properties which are part of core SELinux policy. Device-specific policies are no longer readable by default and need to be granted in device-specific policy. Grant read-access to any property where the person has write access. In most cases, anyone who wants to write a property needs read access to that property. Change-Id: I2bd24583067b79f31b3bb0940b4c07fc33d09918
2015-12-08 23:45:50 +01:00
type audio_prop, property_type, core_property_type;
limit shell's access to log.* properties Restrict the ability of the shell to set the log.* properties. Namely: only allow the shell to set such properities on eng and userdebug builds. The shell (and other domains) can continue to read log.* properties on all builds. While there: harmonize permissions for log.* and persist.log.tag. Doing so introduces two changes: - log.* is now writable from from |system_app|. This mirrors the behavior of persist.log.tag, which is writable to support "Developer options" -> "Logger buffer sizes" -> "Off". (Since this option is visible on user builds, the permission is enabled for all builds.) - persist.log.tag can now be set from |shell| on userdebug_or_eng(). BUG=28221972 TEST=manual (see below) Testing details - user build (log.tag) $ adb shell setprop log.tag.foo V $ adb shell getprop log.tag <blank line> $ adb bugreport | grep log.tag.foo [ 146.525836] init: avc: denied { set } for property=log.tag.foo pid=4644 uid=2000 gid=2000 scontext=u:r:shell:s0 tcontext=u:object_r:log_prop:s0 tclass=property_service permissive=0 [ 146.525878] init: sys_prop: permission denied uid:2000 name:log.tag.foo - userdebug build (log.tag) $ adb shell getprop log.tag.foo <blank line> $ adb shell setprop log.tag.foo V $ adb shell getprop log.tag.foo V - user build (persist.log.tag) $ adb shell getprop | grep log.tag <no match> - Developer options -> Logger buffer sizes -> Off $ adb shell getprop | grep log.tag [persist.log.tag]: [Settings] [persist.log.tag.snet_event_log]: [I] Change-Id: Idf00e7a623723a7c46bf6d01e386aeca92b2ad75
2016-04-15 20:10:06 +02:00
type log_prop, property_type, log_property_type;
Remove property read access for non-core properties Instead of allowing global read access to all properties, only allow read access to the properties which are part of core SELinux policy. Device-specific policies are no longer readable by default and need to be granted in device-specific policy. Grant read-access to any property where the person has write access. In most cases, anyone who wants to write a property needs read access to that property. Change-Id: I2bd24583067b79f31b3bb0940b4c07fc33d09918
2015-12-08 23:45:50 +01:00
type logd_prop, property_type, core_property_type;
persist.mmc.* only set in init Bug: 26976972 Change-Id: I0e44bfc6774807a3bd2ba05637a432675d855118
2016-02-04 19:55:43 +01:00
type mmc_prop, property_type;
Remove property read access for non-core properties Instead of allowing global read access to all properties, only allow read access to the properties which are part of core SELinux policy. Device-specific policies are no longer readable by default and need to be granted in device-specific policy. Grant read-access to any property where the person has write access. In most cases, anyone who wants to write a property needs read access to that property. Change-Id: I2bd24583067b79f31b3bb0940b4c07fc33d09918
2015-12-08 23:45:50 +01:00
type restorecon_prop, property_type, core_property_type;
type security_prop, property_type, core_property_type;
type bluetooth_prop, property_type, core_property_type;
type pan_result_prop, property_type, core_property_type;
type powerctl_prop, property_type, core_property_type;
type nfc_prop, property_type, core_property_type;
type dalvik_prop, property_type, core_property_type;
type config_prop, property_type, core_property_type;
SELinux rule for ro.device_owner and persist.logd.security They are introduced for the device owner process logging feature. That is, for enterprise-owned devices with device owner app provisioned, the device owner may choose to turn on additional device-wide logging for auditing and intrusion detection purposes. Logging includes histories of app process startup, commands issued over ADB and lockscreen unlocking attempts. These logs will available to the device owner for analysis, potentially shipped to a remote server if it chooses to. ro.device_owner will be a master switch to turn off logging, if the device has no device owner provisioned. persist.logd.security is a switch that device owner can toggle (via DevicePoliyManager) to enable/disable logging. Writing to both properties should be only allowed by the system server. Bug: 22860162 Change-Id: Iabfe2347b094914813b9d6e0c808877c25ccd038
2016-01-04 16:20:45 +01:00
type device_logging_prop, property_type;
Allow logd.auditd to reboot to safe mode Bug: 26902605 Change-Id: Ica825cf2af74f5624cf4091544bd24bb5482dbe7 (cherry picked from commit 9c168711d5f79642a5357cd4c58ad5e88a9795ba)
2016-02-06 00:42:32 +01:00
type safemode_prop, property_type;
Support fine grain read access control for properties Properties are now broken up from a single /dev/__properties__ file into multiple files, one per property label. This commit provides the mechanism to control read access to each of these files and therefore sets of properties. This allows full access for all domains to each of these new property files to match the current permissions of /dev/__properties__. Future commits will restrict the access. Bug: 21852512 Change-Id: Ie9e43968acc7ac3b88e354a0bdfac75b8a710094
2015-12-02 01:58:27 +01:00
allow property_type tmpfs:filesystem associate;
Reference in a new issue Copy permalink