tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/debuggerd.te

26 lines
1 KiB
Text
Raw Normal View History

SE Android policy.
2012-01-04 18:33:27 +01:00
# debugger interface
type debuggerd, domain;
type debuggerd_exec, exec_type, file_type;
init_daemon_domain(debuggerd)
Confine debuggerd, but leave it permissive for now. Change-Id: I09932cdd59f9d3a38e69df9fcfc34cc9cec1d8cd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:35 +01:00
typeattribute debuggerd mlstrustedsubject;
allow debuggerd self:capability { dac_override sys_ptrace chown kill fowner };
allow debuggerd self:capability2 { syslog };
allow debuggerd domain:dir r_dir_perms;
allow debuggerd domain:file r_file_perms;
Restrict ptrace access by debuggerd and unconfineddomain. Remove init, ueventd, watchdogd, healthd and adbd from the set of domains traceable by debuggerd. bionic/linker/debugger.cpp sets up handlers for all dynamically linked programs in Android but this should not apply for statically linked programs. Exclude ptrace access from unconfineddomain. Prohibit ptrace access to init via neverallow. Change-Id: I70d742233fbe40cb4d1772a4e6cd9f8f767f2c3a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-09 18:49:47 +01:00
allow debuggerd { domain -init -ueventd -watchdogd -healthd -adbd }:process ptrace;
Confine debuggerd, but leave it permissive for now. Change-Id: I09932cdd59f9d3a38e69df9fcfc34cc9cec1d8cd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:35 +01:00
security_access_policy(debuggerd)
allow debuggerd system_data_file:dir create_dir_perms;
allow debuggerd system_data_file:dir relabelfrom;
debuggerd.te: Fix relabelto policy denial In 0c9708b2af4ea345277a47ae7bc1ce890e90d2bc, we removed relabelto from unconfined.te. This broke debuggerd. Fixed. type=1400 audit(1373668537.550:5): avc: denied { relabelto } for pid=44 comm="debuggerd" name="tombstones" dev="mtdblock1" ino=71 scontext=u:r:debuggerd:s0 tcontext=u:object_r:tombstone_data_file:s0 tclass=dir Change-Id: Ic025cbc030d6e776d9d87b1df3240fdc5f0b53d5
2013-07-13 00:38:41 +02:00
relabelto_domain(debuggerd)
allow debuggerd tombstone_data_file:dir relabelto;
Confine debuggerd, but leave it permissive for now. Change-Id: I09932cdd59f9d3a38e69df9fcfc34cc9cec1d8cd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:35 +01:00
allow debuggerd tombstone_data_file:dir create_dir_perms;
allow debuggerd tombstone_data_file:file create_file_perms;
allow debuggerd domain:process { sigstop signal };
allow debuggerd exec_type:file r_file_perms;
# Access app library
allow debuggerd system_data_file:file open;
Label and allow access to /data/system/ndebugsocket. Otherwise it defaults to the label of /data/system and cannot be distinguished from any other socket in that directory. Also adds allow rule required for pre-existing wpa_socket transition to function without unconfined_domain. Change-Id: I57179aa18786bd56d247f397347e546cca978e41 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-09-27 16:24:49 +02:00
# Connect to system_server via /data/system/ndebugsocket.
unix_socket_connect(debuggerd, system_ndebug, system_server)
Reference in a new issue Copy permalink