tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/wificond.te

32 lines
1.1 KiB
Text
Raw Normal View History

Sepolicy files for wificond This sepolicy change allows wificond to run as a deamon. BUG=28865186 TEST=compile TEST=compile with ag/1059605 Add wificond to '/target/product/base.mk' Adb shell ps -A | grep 'wificond' Change-Id: If1e4a8542ac03e8ae42371d75aa46b90c3d8545d (cherry picked from commit 4ef44a616ee5888023e5c53bbc2c4df6549f748a)
2016-05-20 04:31:20 +02:00
# wificond
type wificond, domain;
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type wificond_exec, system_file_type, exec_type, file_type;
Sepolicy files for wificond This sepolicy change allows wificond to run as a deamon. BUG=28865186 TEST=compile TEST=compile with ag/1059605 Add wificond to '/target/product/base.mk' Adb shell ps -A | grep 'wificond' Change-Id: If1e4a8542ac03e8ae42371d75aa46b90c3d8545d (cherry picked from commit 4ef44a616ee5888023e5c53bbc2c4df6549f748a)
2016-05-20 04:31:20 +02:00
sepolicy: add sepolicy binder support for wificond This allows wificond to publish binder interface using service manager. Denial warnings: wificond: type=1400 audit(0.0:8): avc: denied { call } for scontext=u:r:wificond:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=1 wificond: type=1400 audit(0.0:9): avc: denied { transfer } for scontext=u:r:wificond:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=1 servicemanager: type=1400 audit(0.0:10): avc: denied { search } for name="6085" dev="proc" ino=40626 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=dir permissive=1 servicemanager: type=1400 audit(0.0:11): avc: denied { read } for name="current" dev="proc" ino=40641 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=file permissive=1 servicemanager: type=1400 audit(0.0:12): avc: denied { open } for path="/proc/6085/attr/current" dev="proc" ino=40641 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=file permissive=1 servicemanager: type=1400 audit(0.0:13): avc: denied { getattr } for scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=process permissive=1 SELinux : avc: denied { add } for service=wificond pid=6085 uid=0 scontext=u:r:wificond:s0 tcontext=u:object_r:wifi_service:s0 tclass=service_manager permissive=1 BUG=28867093 TEST=compile TEST=use a client to call wificond service through binder Change-Id: I9312892caff171f17b04c30a415c07036b39ea7f (cherry picked from commit d56bcb1c5452c8dcdda7e4ef5d0f44b91b6bb08b)
2016-06-03 19:08:56 +02:00
binder_use(wificond)
binder_call(wificond, system_server)
te_macros: introduce add_service() macro Introduce the add_service() macro which wraps up add/find permissions for the source domain with a neverallow preventing others from adding it. Only a particular domain should add a particular service. Use the add_service() macro to automatically add a neverallow that prevents other domains from adding the service. mediadrmserver was adding services labeled mediaserver_service. Drop the add permission as it should just need the find permission. Additionally, the macro adds the { add find } permission which causes some existing neverallow's to assert. Adjust those neverallow's so "self" can always find. Test: compile and run on hikey and emulator. No new denials were found, and all services, where applicable, seem to be running OK. Change-Id: Ibbd2a5304edd5f8b877bc86852b0694732be993c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2017-01-19 22:23:52 +01:00
add_service(wificond, wificond_service)
Define explicit label for wlan sysfs fwpath avc: denied { write } for name="fwpath" dev="sysfs" ino=6863 scontext=u:r:wificond:s0 tcontext=u:object_r:sysfs_wlan_fwpath:s0 tclass=file permissive=0 Test: wificond and netd can write to this path, wifi works Test: `runtest frameworks-wifi` passes Bug: 29579539 Change-Id: Ia21c654b00b09b9fe3e50d564b82966c9c8e6994 (cherry picked from commit 7d13dd806f37523ba8164325fef9b000d6eacd7c)
2016-06-30 23:23:12 +02:00
Whitelist vendor-init-settable bluetooth_prop and wifi_prop Values of the following properties are set by SoC vendors on some devices including Pixels. - persist.bluetooth.a2dp_offload.cap - persist.bluetooth.a2dp_offload.enable - persist.vendor.bluetooth.a2dp_offload.enable - ro.bt.bdaddr_path - wlan.driver.status So they should be whitelisted for compatibility. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: Ib2b81bcc1fd70ddd571dc7fb2b923b576d62b7d5
2018-04-09 05:07:32 +02:00
set_prop(wificond, exported_wifi_prop)
Separate permissions to set WiFi related properties wificond would like to be able to set WiFi related properties without access to the rest of the system properties. Today, this only involves marking the driver as loaded or unloaded. avc: denied { write } for name="property_service" dev="tmpfs" ino=10100 scontext=u:r:wificond:s0 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=0 Bug: 29579539 Test: No avc denials related to system properties across various WiFi events. Change-Id: I6d9f1de3fbef04cb7750cc3753634f9e02fdb71f (cherry picked from commit 1ebfdd6a14fb21705664c8e144f151b39c3d73f8)
2016-06-29 20:28:20 +02:00
set_prop(wificond, wifi_prop)
Give wificond permission to start/stop init services Bug: 30292103 Change-Id: I433f2b8cc912b42bf026f6e908fd458a07c41fc2 Test: Integration tests reveal wificond can start/stop hostapd. (cherry picked from commit 1faa9c55daed010398bd2586e418b66f3c182a24)
2016-07-22 23:34:26 +02:00
set_prop(wificond, ctl_default_prop)
Allow wificond to mark interfaces up and down avc: denied { create } for scontext=u:r:wificond:s0 tcontext=u:r:wificond:s0 tclass=udp_socket permissive=0 avc: denied { net_raw } for capability=13 scontext=u:r:wificond:s0 tcontext=u:r:wificond:s0 tclass=capability permissive=0 avc: denied { read } for name="psched" dev="proc" ino=4026535377 scontext=u:r:wificond:s0 tcontext=u:object_r:proc_net:s0 tclass=file permissive=0 Test: fixes above avc denials Bug: 29579539 Change-Id: Ie1dff80103e81cfba8064a22b5dd3e1e8f29471b (cherry picked from commit b6a6561d0ef37ad86802ef1ceeefc59a42612435)
2016-07-01 02:48:12 +02:00
# create sockets to set interfaces up and down
allow wificond self:udp_socket create_socket_perms;
Allow wificond to set interfaces up and down This is apparently a privileged ioctl. Being able to do this allows us to no longer kill hostapd with SIGTERM, since we can cleanup after hard stops. Bug: 31023120 Test: wificond unit and integration tests pass Change-Id: Icdf2469d403f420c742871f54b9fb17432805991 (cherry picked from commit ca7b04ba525a61cb8663e5e6faf52bfcdb80dde8)
2016-08-23 02:47:13 +02:00
# setting interface state up/down is a privileged ioctl
MAC Anonymization: wificond SIOCSIFHWADDR sepolicy Add sepolicy rules to grant wificond permission to use SIOCSIFHWADDR ioctl. This permission is needed to dynamically change MAC address of the device when connecting to wifi networks. Bug: 63905794 Test: Verified manually that wificond can dynamically change MAC address. Change-Id: If2c6b955b0b792f706d8438e8e2e018c0b4cfc31
2018-01-23 05:42:12 +01:00
allowxperm wificond self:udp_socket ioctl { SIOCSIFFLAGS SIOCSIFHWADDR };
sepolicy: Add rules for non-init namespaces In kernel 4.7, the capability and capability2 classes were split apart from cap_userns and cap2_userns (see kernel commit 8e4ff6f228e4722cac74db716e308d1da33d744f). Since then, Android cannot be run in a container with SELinux in enforcing mode. This change applies the existing capability rules to user namespaces as well as the root namespace so that Android running in a container behaves the same on pre- and post-4.7 kernels. This is essentially: 1. New global_capability_class_set and global_capability2_class_set that match capability+cap_userns and capability2+cap2_userns, respectively. 2. s/self:capability/self:global_capability_class_set/g 3. s/self:capability2/self:global_capability2_class_set/g 4. Add cap_userns and cap2_userns to the existing capability_class_set so that it covers all capabilities. This set was used by several neverallow and dontaudit rules, and I confirmed that the new classes are still appropriate. Test: diff new policy against old and confirm that all new rules add only cap_userns or cap2_userns; Boot ARC++ on a device with the 4.12 kernel. Bug: crbug.com/754831 Change-Id: I4007eb3a2ecd01b062c4c78d9afee71c530df95f
2017-11-09 23:51:26 +01:00
allow wificond self:global_capability_class_set { net_admin net_raw };
Allow wificond to set interfaces up and down This is apparently a privileged ioctl. Being able to do this allows us to no longer kill hostapd with SIGTERM, since we can cleanup after hard stops. Bug: 31023120 Test: wificond unit and integration tests pass Change-Id: Icdf2469d403f420c742871f54b9fb17432805991 (cherry picked from commit ca7b04ba525a61cb8663e5e6faf52bfcdb80dde8)
2016-08-23 02:47:13 +02:00
# allow wificond to speak to nl80211 in the kernel
Enforce ioctl command whitelisting on all sockets Remove the ioctl permission for most socket types. For others, such as tcp/udp/rawip/unix_dgram/unix_stream set a default unprivileged whitelist that individual domains may extend (except where neverallowed like untrusted_app). Enforce via a neverallowxperm rule. Change-Id: I15548d830f8eff1fd4d64005c5769ca2be8d4ffe
2016-05-17 06:12:17 +02:00
allow wificond self:netlink_socket create_socket_perms_no_ioctl;
Fix wificond permissions for hikey Newer kernels apparently introduce a new SELinux label "netlink_generic_socket". AOSP is missing some patches for ioctl whitelisting and it was suggested we add unpriv_socket_ioctls as a stopgap. Bug: 31226503 Change-Id: Ie4dd499925f74747c0247e5d7ad0de0f673b5ed2
2016-09-01 02:46:42 +02:00
# newer kernels (e.g. 4.4 but not 4.1) have a new class for sockets
Enforce ioctl command whitelisting on all sockets Remove the ioctl permission for most socket types. For others, such as tcp/udp/rawip/unix_dgram/unix_stream set a default unprivileged whitelist that individual domains may extend (except where neverallowed like untrusted_app). Enforce via a neverallowxperm rule. Change-Id: I15548d830f8eff1fd4d64005c5769ca2be8d4ffe
2016-05-17 06:12:17 +02:00
allow wificond self:netlink_generic_socket create_socket_perms_no_ioctl;
Allow wificond to mark interfaces up and down avc: denied { create } for scontext=u:r:wificond:s0 tcontext=u:r:wificond:s0 tclass=udp_socket permissive=0 avc: denied { net_raw } for capability=13 scontext=u:r:wificond:s0 tcontext=u:r:wificond:s0 tclass=capability permissive=0 avc: denied { read } for name="psched" dev="proc" ino=4026535377 scontext=u:r:wificond:s0 tcontext=u:object_r:proc_net:s0 tclass=file permissive=0 Test: fixes above avc denials Bug: 29579539 Change-Id: Ie1dff80103e81cfba8064a22b5dd3e1e8f29471b (cherry picked from commit b6a6561d0ef37ad86802ef1ceeefc59a42612435)
2016-07-01 02:48:12 +02:00
Start the process of locking down proc/net Files in /proc/net leak information. This change is the first step in determining which files apps may use, whitelisting benign access, and otherwise removing access while providing safe alternative APIs. To that end, this change: * Introduces the proc_net_type attribute which will assigned to any new SELinux types in /proc/net to avoid removing access to privileged processes. These processes may be evaluated later, but are lower priority than apps. * Labels /proc/net/{tcp,tcp6,udp,udp6} as proc_net_vpn due to existing use by VPN apps. This may be replaced by an alternative API. * Audits all other proc/net access for apps. * Audits proc/net access for other processes which are currently granted broad read access to /proc/net but should not be including storaged, zygote, clatd, logd, preopt2cachename and vold. Bug: 9496886 Bug: 68016944 Test: Boot Taimen-userdebug. On both wifi and cellular: stream youtube navigate maps, send text message, make voice call, make video call. Verify no avc "granted" messages in the logs. Test: A few VPN apps including "VPN Monster", "Turbo VPN", and "Freighter". Verify no logspam with the current setup. Test: atest CtsNativeNetTestCases Test: atest netd_integration_test Test: atest QtaguidPermissionTest Test: atest FileSystemPermissionTest Change-Id: I7e49f796a25cf68bc698c6c9206e24af3ae11457 Merged-In: I7e49f796a25cf68bc698c6c9206e24af3ae11457 (cherry picked from commit 087318957f26e921d62f2e234fc14bff3c59030e)
2018-04-10 21:47:48 +02:00
r_dir_file(wificond, proc_net_type)
Allow wificond to write wifi component config files We need the ability to set file permissions, create files, write files, chown files. Test: integration tests that start/stop hostapd and write its config file via wificond pass without SELinux denials. Bug: 30040724 Change-Id: Iee15fb36a6a4a89009d4b45281060379d70cd53c (cherry picked from commit f83da1421b38b021d9c0b829e791c84a1c6d9e1e)
2016-07-21 18:12:28 +02:00
Allow wificond to find permission This is used for wificond to check if it is allowed to dump logs. Bug: 31336376 Test: compile, manual test Change-Id: I8a1b681255398f9a1f2cf79fd0891e58283aa747
2017-04-05 01:52:25 +02:00
# allow wificond to check permission for dumping logs
allow wificond permission_service:service_manager find;
dumpstate: Fix wificond access Bug: 31246864 Change-Id: I8319e632b3be1e558dfc550453b8298914c89064 Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2016-09-07 22:58:04 +02:00
# dumpstate support
allow wificond dumpstate:fd use;
Enforce ioctl command whitelisting on all sockets Remove the ioctl permission for most socket types. For others, such as tcp/udp/rawip/unix_dgram/unix_stream set a default unprivileged whitelist that individual domains may extend (except where neverallowed like untrusted_app). Enforce via a neverallowxperm rule. Change-Id: I15548d830f8eff1fd4d64005c5769ca2be8d4ffe
2016-05-17 06:12:17 +02:00
allow wificond dumpstate:fifo_file write;
Reference in a new issue Copy permalink