tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/su.te

55 lines
1.9 KiB
Text
Raw Normal View History

Create new conditional userdebug_or_eng Create a new m4 macro called userdebug_or_eng. Arguments passed to this macro are only emitted if we're performing a userdebug or eng build. Merge shell.te and shell_user.te and eliminate duplicate lines. Same for su.te and su_user.te Change-Id: I8fbabca65ec392aeafd5b90cef57b5066033fad0
2014-01-10 00:25:36 +01:00
# File types must be defined for file_contexts.
Make sure exec_type is assigned to all entrypoint types. Some file types used as domain entrypoints were missing the exec_type attribute. Add it and add a neverallow rule to keep it that way. Change-Id: I7563f3e03940a27ae40ed4d6bb74181c26148849 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-09-27 16:38:14 +02:00
type su_exec, exec_type, file_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
Create new conditional userdebug_or_eng Create a new m4 macro called userdebug_or_eng. Arguments passed to this macro are only emitted if we're performing a userdebug or eng build. Merge shell.te and shell_user.te and eliminate duplicate lines. Same for su.te and su_user.te Change-Id: I8fbabca65ec392aeafd5b90cef57b5066033fad0
2014-01-10 00:25:36 +01:00
userdebug_or_eng(`
Clarify init_shell, shell, and su domain usage. init_shell domain is now only used for shell commands or scripts invoked by init*.rc files, never for an interactive shell. It was being used for console service for a while but console service is now assigned shell domain via seclabel in init.rc. We may want to reconsider the shelldomain rules for init_shell and whether they are still appropriate. shell domain is now used by both adb shell and console service, both of which also run in the shell UID. su domain is now used not only for /system/bin/su but also for adbd and its descendants after an adb root is performed. Change-Id: I502ab98aafab7dafb8920ccaa25e8fde14a8f572 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-21 19:45:29 +01:00
# Domain used for su processes, as well as for adbd and adb shell
# after performing an adb root command. The domain definition is
# wrapped to ensure that it does not exist at all on -user builds.
Create attribute for moving perms out of domain Motivation: Domain is overly permissive. Start removing permissions from domain and assign them to the domain_deprecated attribute. Domain_deprecated and domain can initially be assigned to all domains. The goal is to not assign domain_deprecated to new domains and to start removing domain_deprecated where it is not required or reassigning the appropriate permissions to the inheriting domain when necessary. Bug: 25433265 Change-Id: I8b11cb137df7bdd382629c98d916a73fe276413c
2015-11-03 18:54:39 +01:00
type su, domain, domain_deprecated, mlstrustedsubject;
Create new conditional userdebug_or_eng Create a new m4 macro called userdebug_or_eng. Arguments passed to this macro are only emitted if we're performing a userdebug or eng build. Merge shell.te and shell_user.te and eliminate duplicate lines. Same for su.te and su_user.te Change-Id: I8fbabca65ec392aeafd5b90cef57b5066033fad0
2014-01-10 00:25:36 +01:00
domain_auto_trans(shell, su_exec, su)
initial dumpstate domain Add the necessary rules to support dumpstate. Start off initially in permissive until it has more testing. Dumpstate is triggered by running "adb bugreport" Change-Id: Ic17a60cca1f6f40daa4f2c51e9ad6009ef36cfbd
2013-12-14 07:19:45 +01:00
Create new conditional userdebug_or_eng Create a new m4 macro called userdebug_or_eng. Arguments passed to this macro are only emitted if we're performing a userdebug or eng build. Merge shell.te and shell_user.te and eliminate duplicate lines. Same for su.te and su_user.te Change-Id: I8fbabca65ec392aeafd5b90cef57b5066033fad0
2014-01-10 00:25:36 +01:00
# Allow dumpstate to call su on userdebug / eng builds to collect
# additional information.
domain_auto_trans(dumpstate, su_exec, su)
Restrict the ability to set SELinux enforcing mode to init. Also make su and shell permissive in non-user builds to allow use of setenforce without violating the neverallow rule. Change-Id: Ie76ee04e90d5a76dfaa5f56e9e3eb7e283328a3f Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-02 20:18:11 +01:00
Dumpstate runs the same from shell as service. Without this change, any selinux warning you might get when running dumpstate from init do not show up when running from the shell as root. This change makes them run the same. Change-Id: I6b74e0f6f48f47952a2dbe7728b1853008f60dbb
2015-01-29 21:11:55 +01:00
# Make sure that dumpstate runs the same from the "su" domain as
# from the "init" domain.
domain_auto_trans(su, dumpstate_exec, dumpstate)
Create new conditional userdebug_or_eng Create a new m4 macro called userdebug_or_eng. Arguments passed to this macro are only emitted if we're performing a userdebug or eng build. Merge shell.te and shell_user.te and eliminate duplicate lines. Same for su.te and su_user.te Change-Id: I8fbabca65ec392aeafd5b90cef57b5066033fad0
2014-01-10 00:25:36 +01:00
# su is also permissive to permit setenforce.
permissive su;
Make su a net domain. Change-Id: Ied6e6eba4895524cf8b442694cc48ef2d6f9a811
2014-05-02 23:50:26 +02:00
Tweak rules for su domain. 1) Remove explicit allow statements. Since su is in permmissive, there's no need to ever specify allow statements for su. 2) Remove unconfined_domain(su). Su is already permissive, so there's no need to join the unconfined domain, and it just makes getting rid of unconfined more difficult. 3) Put su into app_domain(). This addresses, in a roundabout sorta way, the following denial: type=1400 audit(0.0:4): avc: denied { setsched } for scontext=u:r:system_server:s0 tcontext=u:r:su:s0 tclass=process permissive=0 which comes up while testing media processes as root. We already put the shell user into this domain, so adding su to this domain ensures other processes can communicate consistently with su spawned processes. Bug: 16261280 Bug: 16298582 Change-Id: I30b6d3cc186bda737a23c25f4fa2a577c2afd4d7
2014-07-12 21:46:58 +02:00
# Add su to various domains
Make su a net domain. Change-Id: Ied6e6eba4895524cf8b442694cc48ef2d6f9a811
2014-05-02 23:50:26 +02:00
net_domain(su)
Tweak rules for su domain. 1) Remove explicit allow statements. Since su is in permmissive, there's no need to ever specify allow statements for su. 2) Remove unconfined_domain(su). Su is already permissive, so there's no need to join the unconfined domain, and it just makes getting rid of unconfined more difficult. 3) Put su into app_domain(). This addresses, in a roundabout sorta way, the following denial: type=1400 audit(0.0:4): avc: denied { setsched } for scontext=u:r:system_server:s0 tcontext=u:r:su:s0 tclass=process permissive=0 which comes up while testing media processes as root. We already put the shell user into this domain, so adding su to this domain ensures other processes can communicate consistently with su spawned processes. Bug: 16261280 Bug: 16298582 Change-Id: I30b6d3cc186bda737a23c25f4fa2a577c2afd4d7
2014-07-12 21:46:58 +02:00
app_domain(su)
dontaudit su Denials generated from the su domain aren't meaningful security warnings, and just serve to confuse people. Don't log them. Change-Id: Id38314d4e7b45062c29bed63df4e50e05e4b131e
2014-05-28 00:46:39 +02:00
dontaudit su self:capability_class_set *;
dontaudit su kernel:security *;
dontaudit su kernel:system *;
dontaudit su self:memprotect *;
dontaudit su domain:process *;
dontaudit su domain:fd *;
dontaudit su domain:dir *;
dontaudit su domain:lnk_file *;
dontaudit su domain:{ fifo_file file } *;
dontaudit su domain:socket_class_set *;
dontaudit su domain:ipc_class_set *;
dontaudit su domain:key *;
dontaudit su fs_type:filesystem *;
dontaudit su {fs_type dev_type file_type}:dir_file_class_set *;
dontaudit su node_type:node *;
dontaudit su node_type:{ tcp_socket udp_socket rawip_socket } *;
dontaudit su netif_type:netif *;
dontaudit su port_type:socket_class_set *;
dontaudit su port_type:{ tcp_socket dccp_socket } *;
dontaudit su domain:peer *;
dontaudit su domain:binder *;
dontaudit su property_type:property_service *;
su.te: suppress service_manager related denials. The su domain is always permissive, and will always be permissive. It never makes sense to show su related denials, as they just cause a false sense of alarm. Suppress service_manager related denials. For example: SELinux : avc: denied { find } for service=SurfaceFlinger scontext=u:r:su:s0 tcontext=u:object_r:surfaceflinger_service:s0 tclass=service_manager SELinux : avc: denied { find } for service=activity scontext=u:r:su:s0 tcontext=u:object_r:system_server_service:s0 tclass=service_manager While I'm here, suppress other recent additionsl to security_classes as well (keystore_key, debuggerd, drmservice) Change-Id: I844ad8da5ada09775646b5f32c9405e7b73797f9
2015-01-06 21:50:19 +01:00
dontaudit su service_manager_type:service_manager *;
dontaudit su servicemanager:service_manager list Addresses the following denial: avc: denied { list } for service=NULL scontext=u:r:su:s0 tcontext=u:r:servicemanager:s0 tclass=service_manager Change-Id: I70449b93307378481c986a60ca593eb2fc2de2c5
2015-08-25 23:28:50 +02:00
dontaudit su servicemanager:service_manager list;
su.te: suppress service_manager related denials. The su domain is always permissive, and will always be permissive. It never makes sense to show su related denials, as they just cause a false sense of alarm. Suppress service_manager related denials. For example: SELinux : avc: denied { find } for service=SurfaceFlinger scontext=u:r:su:s0 tcontext=u:object_r:surfaceflinger_service:s0 tclass=service_manager SELinux : avc: denied { find } for service=activity scontext=u:r:su:s0 tcontext=u:object_r:system_server_service:s0 tclass=service_manager While I'm here, suppress other recent additionsl to security_classes as well (keystore_key, debuggerd, drmservice) Change-Id: I844ad8da5ada09775646b5f32c9405e7b73797f9
2015-01-06 21:50:19 +01:00
dontaudit su keystore:keystore_key *;
dontaudit su domain:debuggerd *;
dontaudit su domain:drmservice *;
su.te: add filesystem dontaudit rule Addresses su denials which occur when mounting filesystems not defined by policy. Addresses denials similar to: avc: denied { mount } for pid=12361 comm="mount" name="/" dev="binfmt_misc" ino=1 scontext=u:r:su:s0 tcontext=u:object_r:unlabeled:s0 tclass=filesystem permissive=1 Change-Id: Ifa0d7c781152f9ebdda9534ac3a04da151f8d78e
2015-04-16 02:58:08 +02:00
dontaudit su unlabeled:filesystem *;
Create new conditional userdebug_or_eng Create a new m4 macro called userdebug_or_eng. Arguments passed to this macro are only emitted if we're performing a userdebug or eng build. Merge shell.te and shell_user.te and eliminate duplicate lines. Same for su.te and su_user.te Change-Id: I8fbabca65ec392aeafd5b90cef57b5066033fad0
2014-01-10 00:25:36 +01:00
')
Reference in a new issue Copy permalink