tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/property.te

267 lines
11 KiB
Text
Raw Normal View History

Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
# Properties used only in /system
Move system property rules to private public/property split is landed to selectively export public types to vendors. So rules happening within system should be in private. This introduces private/property.te and moves all allow and neverallow rules from any coredomains to system defiend properties. Bug: 150331497 Test: system/sepolicy/tools/build_policies.sh Change-Id: I0d929024ae9f4ae3830d4bf3d59e999febb22cbe Merged-In: I0d929024ae9f4ae3830d4bf3d59e999febb22cbe (cherry picked from commit 42c7d8966cc5f76c84c001c5af787cbfade736c8)
2020-03-04 09:20:35 +01:00
#
# DO NOT ADD system_internal_prop here.
# Instead, add to private/property.te.
# TODO(b/150331497): move these to private/property.te
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
system_internal_prop(apexd_prop)
system_internal_prop(bootloader_boot_reason_prop)
system_internal_prop(device_config_activity_manager_native_boot_prop)
system_internal_prop(device_config_boot_count_prop)
system_internal_prop(device_config_input_native_boot_prop)
system_internal_prop(device_config_media_native_prop)
system_internal_prop(device_config_netd_native_prop)
system_internal_prop(device_config_reset_performed_prop)
system_internal_prop(device_config_runtime_native_boot_prop)
system_internal_prop(device_config_runtime_native_prop)
system_internal_prop(firstboot_prop)
Make public for exported properties on old devices Properties which are already allowed to be written by vendor_init can't be internal or restricted prop. This sets the properties as public except for forbidden ones on vendor_init.te. Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: Icc1e813e78a48856adee26fb20f01300713e1d30
2019-10-17 06:42:42 +02:00
compatible_property_only(`
# DO NOT ADD ANY PROPERTIES HERE
system_internal_prop(boottime_prop)
system_internal_prop(bpf_progs_loaded_prop)
system_internal_prop(charger_prop)
system_internal_prop(cold_boot_done_prop)
system_internal_prop(ctl_adbd_prop)
system_internal_prop(ctl_apexd_prop)
system_internal_prop(ctl_bootanim_prop)
system_internal_prop(ctl_bugreport_prop)
system_internal_prop(ctl_console_prop)
system_internal_prop(ctl_dumpstate_prop)
system_internal_prop(ctl_fuse_prop)
system_internal_prop(ctl_gsid_prop)
system_internal_prop(ctl_interface_restart_prop)
system_internal_prop(ctl_interface_stop_prop)
system_internal_prop(ctl_mdnsd_prop)
system_internal_prop(ctl_restart_prop)
system_internal_prop(ctl_rildaemon_prop)
system_internal_prop(ctl_sigstop_prop)
system_internal_prop(dynamic_system_prop)
system_internal_prop(heapprofd_enabled_prop)
system_internal_prop(llkd_prop)
system_internal_prop(lpdumpd_prop)
system_internal_prop(mmc_prop)
system_internal_prop(mock_ota_prop)
system_internal_prop(net_dns_prop)
system_internal_prop(overlay_prop)
system_internal_prop(persistent_properties_ready_prop)
system_internal_prop(safemode_prop)
system_internal_prop(system_lmk_prop)
system_internal_prop(system_trace_prop)
system_internal_prop(test_boot_reason_prop)
system_internal_prop(time_prop)
system_internal_prop(traced_enabled_prop)
system_internal_prop(traced_lazy_prop)
')
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
# Properties which can't be written outside system
Fix treble boundary neverallow to use attributes These neverallow rules are to prevent properties from crossing treble boundary. As attributes like internal / restricted / public has been landed, the neverallow rules are changed to use attributes to avoid endless manual maintaining of the list. Bug: 148181222 Test: system/sepolicy/tools/build_policies.sh Change-Id: I0ba930f6c78852e785858fb069faf4f984643e34
2020-01-28 06:43:57 +01:00
system_restricted_prop(binder_cache_bluetooth_server_prop)
system_restricted_prop(binder_cache_system_server_prop)
Use prefixes for binder cache SELinux properties. Adds a context for telephony related cache properties and changes the bluetooth and system_server properties to match off of prefix instead of exact string matches. Test: Flashed phone with PowerManager caches enabled and verified that the phone boots. Change-Id: I9110192a12bb6222e49a8fb6b266d6067ef2ea92
2020-01-28 22:08:28 +01:00
system_restricted_prop(binder_cache_telephony_server_prop)
Add boot_status_prop for boot completed props Assigning a new context boot_status_prop for following two properties: - sys.boot_completed - dev.bootcomplete Bug: 154885206 Test: boot cf_x86 and crosshatch, see no denials Change-Id: Ieadabf90a9a1b54b52a1283bd648c11c95d558dd Merged-In: Ieadabf90a9a1b54b52a1283bd648c11c95d558dd (cherry picked from commit 2973c9605555c119243ef85119576b2d01a12060)
2020-04-24 08:03:01 +02:00
system_restricted_prop(boot_status_prop)
selinux policy for buffer queue config Test: boot and check for no policy violations Change-Id: I1ea2a79b9a45b503dcb061c196c5af1d0ddab653
2020-01-20 06:11:07 +01:00
system_restricted_prop(bq_config_prop)
Rename sdkext sepolicy to sdkextensions The module is getting renamed, so rename all the policy relating to it at the same time. Bug: 137191822 Test: presubmit Change-Id: Ia9d966ca9884ce068bd96cf5734e4a459158c85b Merged-In: Ia9d966ca9884ce068bd96cf5734e4a459158c85b (cherry picked from commit 6505573c36dcc6153af37895e968400f722119ea)
2020-01-06 18:29:13 +01:00
system_restricted_prop(module_sdkextensions_prop)
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
system_restricted_prop(nnapi_ext_deny_product_prop)
system_restricted_prop(restorecon_prop)
Define sepolicy for redirect-socket-calls feature Define two property_context. 1. vendor_socket_hook_prop - for ro.vendor.redirect_socket_calls. The property set once in vendor_init context. It's evaluated at process start time and is cannot change at runtime on a given device. The set permission is restricted to vendor_init. The read permission is unrestricted. 2. socket_hook_prop - for net.redirect_socket_calls.hooked. The property can be changed by System Server at runtime. It's evaluated when shimmed socket functions is called. The set permission is restricted to System Server. The read permission is unrestricted. Bug: Bug: 141611769 Test: System Server can set net.redirect_socket_calls.hooked libnetd_client can read both properties libnetd_client can't set both properties Change-Id: Ic42269539923e6930cc0ee3df8ba032797212395
2020-02-10 10:43:15 +01:00
system_restricted_prop(socket_hook_prop)
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
system_restricted_prop(system_boot_reason_prop)
Revert^2 "SELinux policy for system server JVMTI" This reverts commit baa06ee2cd8b2f6c8bd0c2d873dc2888d6296353. Reason for revert: Added missing property name in vendor_init.te. Bug: none Test: none (other than neverallow checking) Change-Id: I9e93bf4ea6ca3a4634f8f4cbce2f13c5f410883b
2019-11-25 23:03:59 +01:00
system_restricted_prop(system_jvmti_agent_prop)
Add selinux rules for userspace reboot related properties By default sys.init.userspace_reboot.* properties are internal to /system partition. Only exception is sys.init.userspace_reboot.in_progress which signals to all native services (including vendor ones) that userspace reboot is happening, hence it should be a system_public_prop. Only init should be allowed to set userspace reboot related properties. Bug: 135984674 Test: builds Test: adb reboot userspace Change-Id: Ibb04965be2d5bf6e81b34569aaaa1014ff61e0d3
2019-11-14 13:59:15 +01:00
system_restricted_prop(userspace_reboot_exported_prop)
Rename exported and exported2 vold prop This is a subtask to clean up bad context names "exported*_prop". Bug: 152469526 Test: m Change-Id: Ie2d4046732e9d6562294fa664dcd7f019aa7c229
2020-04-06 13:49:17 +02:00
system_restricted_prop(vold_status_prop)
Make public for exported properties on old devices Properties which are already allowed to be written by vendor_init can't be internal or restricted prop. This sets the properties as public except for forbidden ones on vendor_init.te. Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: Icc1e813e78a48856adee26fb20f01300713e1d30
2019-10-17 06:42:42 +02:00
compatible_property_only(`
# DO NOT ADD ANY PROPERTIES HERE
system_restricted_prop(config_prop)
system_restricted_prop(cppreopt_prop)
system_restricted_prop(dalvik_prop)
system_restricted_prop(debuggerd_prop)
system_restricted_prop(default_prop)
system_restricted_prop(device_logging_prop)
system_restricted_prop(dhcp_prop)
system_restricted_prop(dumpstate_prop)
system_restricted_prop(exported2_default_prop)
system_restricted_prop(exported3_system_prop)
system_restricted_prop(exported_dumpstate_prop)
system_restricted_prop(exported_fingerprint_prop)
system_restricted_prop(exported_secure_prop)
system_restricted_prop(ffs_prop)
system_restricted_prop(fingerprint_prop)
system_restricted_prop(heapprofd_prop)
system_restricted_prop(net_radio_prop)
system_restricted_prop(pan_result_prop)
system_restricted_prop(persist_debug_prop)
system_restricted_prop(shell_prop)
system_restricted_prop(system_radio_prop)
system_restricted_prop(test_harness_prop)
system_restricted_prop(theme_prop)
system_restricted_prop(use_memfd_prop)
system_restricted_prop(vold_prop)
')
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
Move some properties to system_vendor_config_prop system_vendor_config_prop defines a property contexts which can only be set from vendor_init. It is one of the mostly used patterns of system properties. This migrates some properties to help readability and security. Bug: 148125056 Test: system/sepolicy/build_policies.sh Change-Id: I6b53ef520331b32417ad59f4daa04bdfc077f682
2020-02-08 00:34:17 +01:00
# Properties which can be written only by vendor_init
system_vendor_config_prop(apk_verity_prop)
system_vendor_config_prop(cpu_variant_prop)
Rename exported_dalvik_prop to dalvik_config_prop This is to clean up bad name "exported_dalvik_prop" Bug: 154465224 Test: sepolicy_tests Test: treble_sepolicy_tests 26.0 ~ 29.0 Change-Id: Ie5e738b5985c1db1bca7a857971d8490a7980b5b
2020-04-20 12:36:33 +02:00
system_vendor_config_prop(dalvik_config_prop)
Move some properties to system_vendor_config_prop system_vendor_config_prop defines a property contexts which can only be set from vendor_init. It is one of the mostly used patterns of system properties. This migrates some properties to help readability and security. Bug: 148125056 Test: system/sepolicy/build_policies.sh Change-Id: I6b53ef520331b32417ad59f4daa04bdfc077f682
2020-02-08 00:34:17 +01:00
system_vendor_config_prop(exported_audio_prop)
system_vendor_config_prop(exported_camera_prop)
system_vendor_config_prop(exported_config_prop)
system_vendor_config_prop(exported_default_prop)
system_vendor_config_prop(exported3_default_prop)
Allow XML file paths to be customized with sysprop Three properties are declared as vendor-init-settable: ro.media.xml_variant.codecs ro.media.xml_variant.codecs_performance ro.media.xml_variant.profiles media_codecs.xml can now be named media_codecs${ro.media.xml_variant.codecs}.xml media_codecs_performance.xml can now be named media_codecs_performance${ro.media.xml_variant.codecs_performance}.xml media_profiles_V1_0 can now be named media_profiles${ro.media.xml_variant.profiles}.xml Test: Rename "media_codecs.xml" to "media_codecs_test.xml", set ro.media.xml_variant.codecs to "_test", then call "stagefright -i". Test: Rename "media_codecs_performance.xml" to "media_codecs_performance_test.xml", set ro.media.xml_variant.codecs_performance to "_test", then run android.media.cts.VideoDecoderPerfTest. Test: Rename "media_profiles_V1_0.xml" to "media_profiles_test.xml", set ro.media.xml_variant.profiles to "_test", then run vts_mediaProfiles_validate_test. Bug: 142102953 Change-Id: I407a0a327fcc8e799bb4079b11048a497565be48
2020-03-07 13:15:38 +01:00
system_vendor_config_prop(media_variant_prop)
Add external_storage properties. Since these need to be set from a vendor context. Bug: 152170470 Bug: 153525566 Test: N/A Change-Id: I2e90ad08fa0a5bd2b4759d92f95d35cec2b316df
2020-04-10 14:11:49 +02:00
system_vendor_config_prop(storage_config_prop)
Create surfaceflinger_prop and migrate props This is a subtask of removing exported*_prop. Bug: 152468529 Test: m && boot crosshatch Change-Id: I9d6ec7ade96a3a53288f23d155cc829c2107bb6f
2020-04-02 08:55:07 +02:00
system_vendor_config_prop(surfaceflinger_prop)
Rename exported2_config_prop to systemsound_config_prop Fixing bad names (exported*_prop) on property contexts. Bug: 152468650 Test: m sepolicy_tests Change-Id: Ie98212ee0fa89966e70faa83322b65b613f3b3f5
2020-04-01 03:01:16 +02:00
system_vendor_config_prop(systemsound_config_prop)
Move some properties to system_vendor_config_prop system_vendor_config_prop defines a property contexts which can only be set from vendor_init. It is one of the mostly used patterns of system properties. This migrates some properties to help readability and security. Bug: 148125056 Test: system/sepolicy/build_policies.sh Change-Id: I6b53ef520331b32417ad59f4daa04bdfc077f682
2020-02-08 00:34:17 +01:00
system_vendor_config_prop(userspace_reboot_config_prop)
system_vendor_config_prop(vehicle_hal_prop)
system_vendor_config_prop(vendor_security_patch_level_prop)
Define sepolicy for redirect-socket-calls feature Define two property_context. 1. vendor_socket_hook_prop - for ro.vendor.redirect_socket_calls. The property set once in vendor_init context. It's evaluated at process start time and is cannot change at runtime on a given device. The set permission is restricted to vendor_init. The read permission is unrestricted. 2. socket_hook_prop - for net.redirect_socket_calls.hooked. The property can be changed by System Server at runtime. It's evaluated when shimmed socket functions is called. The set permission is restricted to System Server. The read permission is unrestricted. Bug: Bug: 141611769 Test: System Server can set net.redirect_socket_calls.hooked libnetd_client can read both properties libnetd_client can't set both properties Change-Id: Ic42269539923e6930cc0ee3df8ba032797212395
2020-02-10 10:43:15 +01:00
system_vendor_config_prop(vendor_socket_hook_prop)
Move some properties to system_vendor_config_prop system_vendor_config_prop defines a property contexts which can only be set from vendor_init. It is one of the mostly used patterns of system properties. This migrates some properties to help readability and security. Bug: 148125056 Test: system/sepolicy/build_policies.sh Change-Id: I6b53ef520331b32417ad59f4daa04bdfc077f682
2020-02-08 00:34:17 +01:00
system_vendor_config_prop(virtual_ab_prop)
Rename exported and exported2 vold prop This is a subtask to clean up bad context names "exported*_prop". Bug: 152469526 Test: m Change-Id: Ie2d4046732e9d6562294fa664dcd7f019aa7c229
2020-04-06 13:49:17 +02:00
system_vendor_config_prop(vndk_prop)
system_vendor_config_prop(vold_config_prop)
Move some properties to system_vendor_config_prop system_vendor_config_prop defines a property contexts which can only be set from vendor_init. It is one of the mostly used patterns of system properties. This migrates some properties to help readability and security. Bug: 148125056 Test: system/sepolicy/build_policies.sh Change-Id: I6b53ef520331b32417ad59f4daa04bdfc077f682
2020-02-08 00:34:17 +01:00
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
# Properties with no restrictions
system_public_prop(audio_prop)
system_public_prop(bluetooth_a2dp_offload_prop)
system_public_prop(bluetooth_audio_hal_prop)
system_public_prop(bluetooth_prop)
system_public_prop(ctl_default_prop)
system_public_prop(ctl_interface_start_prop)
system_public_prop(ctl_start_prop)
system_public_prop(ctl_stop_prop)
system_public_prop(debug_prop)
system_public_prop(dumpstate_options_prop)
system_public_prop(exported_system_prop)
system_public_prop(exported2_radio_prop)
system_public_prop(exported2_system_prop)
system_public_prop(exported3_radio_prop)
system_public_prop(exported_bluetooth_prop)
system_public_prop(exported_ffs_prop)
system_public_prop(exported_overlay_prop)
system_public_prop(exported_pm_prop)
system_public_prop(exported_radio_prop)
system_public_prop(exported_system_radio_prop)
system_public_prop(exported_wifi_prop)
Create new system property type for Factory OTA could write system property Due to Factory OTA client install in product partition but it also declare coredomian in its sepolicy setting. That will let Factory OTA unable to find a property type could write system property. But now Factory OTA have a restore NFC wake function need to write system property for communicate with bootloader. So we need to create a new property type in system framework which could allow Factory OTA client to write system property. Bug: 145178094 Test: Manual Change-Id: Ic549cc939893ec67a46bf28a23ebeb9f9b81bd0b
2019-12-06 08:59:58 +01:00
system_public_prop(sota_prop)
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
system_public_prop(hwservicemanager_prop)
system_public_prop(logd_prop)
system_public_prop(logpersistd_logging_prop)
system_public_prop(log_prop)
system_public_prop(log_tag_prop)
system_public_prop(lowpan_prop)
system_public_prop(nfc_prop)
Add a new context for property ota.warm_reset The property is set to inform kernel to do a warm_reset on the next reboot. This is useful to persist the logs to debug device boot failures. More details in http://go/rvc-ota-persist-logs. The property is set to 1 by update_engine after an OTA. And it's set to 0 by update_verifier or vold after we mark the current slot boot successful. The property is read by vendor_init. And according to its value, vendor_init writes a particular sysfs file to schedule a warm reset on the following reboot. Without the new context, the denial message says: [ 13.423163] audit: type=1107 audit(1746393.166:8): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { read } for property=ota.warm_reset pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0' [ 23.096497] init: Unable to set property 'OTA.warm_reset' from uid:0 gid:2001 pid:841: SELinux permission check failed [ 23.096574] type=1107 audit(1573768000.668:42): uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for property=OTA.warm_reset pid=841 uid=0 gid=2001 scontext=u:r:update_verifier:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service permissive=0' [ 23.108430] update_verifier: Failed to reset the warm reset flag Bug: 143489994 Test: check the property can be set by update_engine, and read by vendor_init Change-Id: I87c12a53a138b72ecfed3ab6a4d846c20f5a8484
2019-11-14 23:18:40 +01:00
system_public_prop(ota_prop)
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
system_public_prop(powerctl_prop)
system_public_prop(radio_prop)
system_public_prop(serialno_prop)
system_public_prop(system_prop)
system_public_prop(wifi_log_prop)
system_public_prop(wifi_prop)
rebootescrow: allow use of block file pmem uses a block file while access_ramoops uses a char file. Allow both for now until we can unify on pmem. Additionally allow the reading of vendor properties so it can read the path to the character or block device to open. Test: atest VtsHalRebootEscrowTargetTest Bug: 146400078 Change-Id: Ief61534e0946480a01c635ce1672579959ec8db5
2020-01-25 01:31:58 +01:00
# Properties used in default HAL implementations
vendor_internal_prop(rebootescrow_hal_prop)
Make public for exported properties on old devices Properties which are already allowed to be written by vendor_init can't be internal or restricted prop. This sets the properties as public except for forbidden ones on vendor_init.te. Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: Icc1e813e78a48856adee26fb20f01300713e1d30
2019-10-17 06:42:42 +02:00
# Properties which are public for devices launching with Android O or earlier
# This should not be used for any new properties.
not_compatible_property(`
# DO NOT ADD ANY PROPERTIES HERE
system_public_prop(boottime_prop)
system_public_prop(bpf_progs_loaded_prop)
system_public_prop(charger_prop)
system_public_prop(cold_boot_done_prop)
system_public_prop(ctl_adbd_prop)
system_public_prop(ctl_apexd_prop)
system_public_prop(ctl_bootanim_prop)
system_public_prop(ctl_bugreport_prop)
system_public_prop(ctl_console_prop)
system_public_prop(ctl_dumpstate_prop)
system_public_prop(ctl_fuse_prop)
system_public_prop(ctl_gsid_prop)
system_public_prop(ctl_interface_restart_prop)
system_public_prop(ctl_interface_stop_prop)
system_public_prop(ctl_mdnsd_prop)
system_public_prop(ctl_restart_prop)
system_public_prop(ctl_rildaemon_prop)
system_public_prop(ctl_sigstop_prop)
system_public_prop(dynamic_system_prop)
system_public_prop(heapprofd_enabled_prop)
system_public_prop(llkd_prop)
system_public_prop(lpdumpd_prop)
system_public_prop(mmc_prop)
system_public_prop(mock_ota_prop)
system_public_prop(net_dns_prop)
system_public_prop(overlay_prop)
system_public_prop(persistent_properties_ready_prop)
system_public_prop(safemode_prop)
system_public_prop(system_lmk_prop)
system_public_prop(system_trace_prop)
system_public_prop(test_boot_reason_prop)
system_public_prop(time_prop)
system_public_prop(traced_enabled_prop)
system_public_prop(traced_lazy_prop)
system_public_prop(config_prop)
system_public_prop(cppreopt_prop)
system_public_prop(dalvik_prop)
system_public_prop(debuggerd_prop)
system_public_prop(default_prop)
system_public_prop(device_logging_prop)
system_public_prop(dhcp_prop)
system_public_prop(dumpstate_prop)
system_public_prop(exported2_default_prop)
system_public_prop(exported3_system_prop)
system_public_prop(exported_dumpstate_prop)
system_public_prop(exported_fingerprint_prop)
system_public_prop(exported_secure_prop)
system_public_prop(ffs_prop)
system_public_prop(fingerprint_prop)
system_public_prop(heapprofd_prop)
system_public_prop(net_radio_prop)
system_public_prop(pan_result_prop)
system_public_prop(persist_debug_prop)
system_public_prop(shell_prop)
system_public_prop(system_radio_prop)
system_public_prop(test_harness_prop)
system_public_prop(theme_prop)
system_public_prop(use_memfd_prop)
system_public_prop(vold_prop)
')
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
type vendor_default_prop, property_type;
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
typeattribute log_prop log_property_type;
typeattribute log_tag_prop log_property_type;
typeattribute wifi_log_prop log_property_type;
Support fine grain read access control for properties Properties are now broken up from a single /dev/__properties__ file into multiple files, one per property label. This commit provides the mechanism to control read access to each of these files and therefore sets of properties. This allows full access for all domains to each of these new property files to match the current permissions of /dev/__properties__. Future commits will restrict the access. Bug: 21852512 Change-Id: Ie9e43968acc7ac3b88e354a0bdfac75b8a710094
2015-12-02 01:58:27 +01:00
allow property_type tmpfs:filesystem associate;
Do not allow new additions to core_property_type core_property_type is an attribute which was given to all existing properties known to core SELinux policy. Any property with this label is readable to all SELinux domains, which is overly broad. The long term goal is to remove the core_property_type attribute entirely. Add a neverallow rule prohibiting the introduction of new properties with the core_property_type attribute. Device specific properties, or new properties in core SELinux policy, should not have this attribute. Test: policy compiles Change-Id: Ie89a9f0d81c8561616001ff8451496ce2278dbb2
2016-12-14 00:59:33 +01:00
# core_property_type should not be used for new properties or
# device specific properties. Properties with this attribute
# are readable to everyone, which is overly broad and should
# be avoided.
# New properties should have appropriate read / write access
# control rules written.
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
typeattribute audio_prop core_property_type;
typeattribute config_prop core_property_type;
typeattribute cppreopt_prop core_property_type;
typeattribute dalvik_prop core_property_type;
typeattribute debuggerd_prop core_property_type;
typeattribute debug_prop core_property_type;
typeattribute default_prop core_property_type;
typeattribute dhcp_prop core_property_type;
typeattribute dumpstate_prop core_property_type;
typeattribute ffs_prop core_property_type;
typeattribute fingerprint_prop core_property_type;
typeattribute logd_prop core_property_type;
typeattribute net_radio_prop core_property_type;
typeattribute nfc_prop core_property_type;
Add a new context for property ota.warm_reset The property is set to inform kernel to do a warm_reset on the next reboot. This is useful to persist the logs to debug device boot failures. More details in http://go/rvc-ota-persist-logs. The property is set to 1 by update_engine after an OTA. And it's set to 0 by update_verifier or vold after we mark the current slot boot successful. The property is read by vendor_init. And according to its value, vendor_init writes a particular sysfs file to schedule a warm reset on the following reboot. Without the new context, the denial message says: [ 13.423163] audit: type=1107 audit(1746393.166:8): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { read } for property=ota.warm_reset pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0' [ 23.096497] init: Unable to set property 'OTA.warm_reset' from uid:0 gid:2001 pid:841: SELinux permission check failed [ 23.096574] type=1107 audit(1573768000.668:42): uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for property=OTA.warm_reset pid=841 uid=0 gid=2001 scontext=u:r:update_verifier:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service permissive=0' [ 23.108430] update_verifier: Failed to reset the warm reset flag Bug: 143489994 Test: check the property can be set by update_engine, and read by vendor_init Change-Id: I87c12a53a138b72ecfed3ab6a4d846c20f5a8484
2019-11-14 23:18:40 +01:00
typeattribute ota_prop core_property_type;
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
typeattribute pan_result_prop core_property_type;
typeattribute persist_debug_prop core_property_type;
typeattribute powerctl_prop core_property_type;
typeattribute radio_prop core_property_type;
typeattribute restorecon_prop core_property_type;
typeattribute shell_prop core_property_type;
typeattribute system_prop core_property_type;
typeattribute system_radio_prop core_property_type;
typeattribute vold_prop core_property_type;
Reference in a new issue Copy permalink