tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/genfs_contexts

268 lines
20 KiB
Text
Raw Normal View History

Support for ocontexts per device. ocontexts was split up into 4 files: 1.fs_use 2.genfs_contexts 3.initial_sid_contexts 4.port_contexts Each file has their respective declerations in them. Devices, in their respective device directory, can now specify sepolicy.fs_use, sepolicy.genfs_contexts, sepolicy.port_contexts, and sepolicy.initial_sid_contexts. These declerations will be added right behind their respective sepolicy counterparts in the concatenated configuration file.
2012-07-12 01:46:38 +02:00
# Label inodes with the fs label.
genfscon rootfs / u:object_r:rootfs:s0
# proc labeling can be further refined (longest matching prefix).
genfscon proc / u:object_r:proc:s0
Relabeling /proc/asound so everything has proc_asound label This is to simplify access for hal_audio Test: ls -Z in /proc/asound correctly shows everything with proc_asound selinux label Change-Id: I66ed8babf2363bee27a748147eb358d57a4594c4
2017-10-20 00:51:38 +02:00
genfscon proc /asound u:object_r:proc_asound:s0
dumpstate: remove access to 'proc' and 'sysfs' types. And grant appropriate permissions to more granular types. Bug: 29319732 Bug: 65643247 Test: adb bugreport; no new denials to /proc or /sys files. Change-Id: Ied99546164e79bfa6148822858c165177d3720a5
2018-01-18 00:59:48 +01:00
genfscon proc /buddyinfo u:object_r:proc_buddyinfo:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
genfscon proc /cmdline u:object_r:proc_cmdline:s0
Label /proc/config.gz Add a label to /proc/config.gz, so we can distinguish this file from other /proc files in security policy. For now, only init is allowed read access. All others are denied. TODO: clarify exactly who needs access. Further access will be granted in a future commit. Bug: 35126415 Test: policy compiles and no device boot problems. Change-Id: I8b480890495ce5b8aa3f8c7eb00e14159f177860
2017-02-16 21:04:40 +01:00
genfscon proc /config.gz u:object_r:config_gz:s0
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
genfscon proc /diskstats u:object_r:proc_diskstats:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
genfscon proc /filesystems u:object_r:proc_filesystems:s0
restrict access to timing information in /proc These APIs expose sensitive information via timing side channels. This leaves access via the adb shell intact along with the current uses by dumpstate, init and system_server. The /proc/interrupts and /proc/stat files were covered in this paper: https://www.lightbluetouchpaper.org/2016/07/29/yet-another-android-side-channel/ The /proc/softirqs, /proc/timer_list and /proc/timer_stats files are also relevant. Access to /proc has been greatly restricted since then, with untrusted apps no longer having direct access to these, but stricter restrictions beyond that would be quite useful. Change-Id: Ibed16674856569d26517e5729f0f194b830cfedd
2016-07-29 20:48:19 +02:00
genfscon proc /interrupts u:object_r:proc_interrupts:s0
Give /proc/iomem a more specific label. /proc/iomem is currently given the proc label but contains system information which should not be available to all processes. Bug: 22008387 Change-Id: I4f1821f40113a743ad986d13d8d130ed8b8abf2f
2015-07-13 17:39:17 +02:00
genfscon proc /iomem u:object_r:proc_iomem:s0
Explicitly label logd's dependencies in /proc. labeled /proc/kmsg as proc_kmsg, changed logd's access from proc to proc_kmsg, and added a compat mapping. Bug: 65643247 Test: device boots without selinux denials to the newly introduced proc_kmsg Test: logd-unit-tests passes Merged-In: I92c9f5694289eb6a94c4d90f14e2de4d46b5228e Change-Id: I92c9f5694289eb6a94c4d90f14e2de4d46b5228e (partial CP of commit 528da6fe3a0dbe4ae15355dff0152ab5f55197da)
2017-09-13 23:34:56 +02:00
genfscon proc /kmsg u:object_r:proc_kmsg:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
genfscon proc /loadavg u:object_r:proc_loadavg:s0
Label /proc/meminfo. Address the following denial: m.chrome.canary: type=1400 audit(0.0:15): avc: granted { read open } for path="/proc/meminfo" dev="proc" ino=4026544360 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:proc:s0 tclass=file (cherry-pick of internal commit: 971aeeda2138b27e3f8850f2fd7c95f60508154c) Bug: 22032619 Chromium Bug: 586021 Change-Id: I2dcb2d4800bbc92ea47c37d4fd7a10f827a0114c
2016-02-24 02:09:48 +01:00
genfscon proc /meminfo u:object_r:proc_meminfo:s0
Label /proc/misc Label /proc/misc and allow access to untrusted_apps targeting older API versions, as well as update_engine_common. /proc/misc is used by some banking apps to try to detect if they are running in an emulated environment. TODO: Remove access to proc:file from update_engine_common after more testing. Bug: 35917228 Test: Device boots and no new denials. Change-Id: If1b97a9c55a74cb74d1bb15137201ffb95b5bd75
2017-03-03 21:17:49 +01:00
genfscon proc /misc u:object_r:proc_misc:s0
enabled /sbin/modprobe for recovery mode This change defines new policy for modprobe (/sbin/modprobe) that should be used in both recovery and android mode. Denials: [ 16.986440] c0 437 audit: type=1400 audit(6138546.943:5): avc: denied { read } for pid=437 comm="modprobe" name="modules" dev="proc" ino=4026532405 scontext=u:object_r:modprobe:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 [ 16.986521] c0 437 audit: type=1400 audit(6138546.943:6): avc: denied { open } for pid=437 comm="modprobe" path="/proc/modules" dev="proc" ino=4026532405 scontext=u:object_r:modprobe:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 [ 16.986544] c0 437 audit: type=1400 audit(6138546.943:7): avc: denied { getattr } for pid=437 comm="modprobe" path="/proc/modules" dev="proc" ino=4026532405 scontext=u:object_r:modprobe:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 Bug: 35633646 Test: Build and tested it works in sailfish recovery. The modprobe is invoked in init.rc (at the end of 'on init') with following command line exec u:r:modprobe:s0 -- /sbin/modprobe -a nilfs2 ftl Change-Id: Ie70be6f918bea6059f806e2eb38cd48229facafa
2017-03-02 09:02:29 +01:00
genfscon proc /modules u:object_r:proc_modules:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
genfscon proc /mounts u:object_r:proc_mounts:s0
Make /proc/net a proc_net type. Change-Id: Iaee5e09712e7f27e0adf645f18554bf2ebd4e448 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-01-07 20:41:47 +01:00
genfscon proc /net u:object_r:proc_net:s0
Start the process of locking down proc/net Files in /proc/net leak information. This change is the first step in determining which files apps may use, whitelisting benign access, and otherwise removing access while providing safe alternative APIs. To that end, this change: * Introduces the proc_net_type attribute which will assigned to any new SELinux types in /proc/net to avoid removing access to privileged processes. These processes may be evaluated later, but are lower priority than apps. * Labels /proc/net/{tcp,tcp6,udp,udp6} as proc_net_vpn due to existing use by VPN apps. This may be replaced by an alternative API. * Audits all other proc/net access for apps. * Audits proc/net access for other processes which are currently granted broad read access to /proc/net but should not be including storaged, zygote, clatd, logd, preopt2cachename and vold. Bug: 9496886 Bug: 68016944 Test: Boot Taimen-userdebug. On both wifi and cellular: stream youtube navigate maps, send text message, make voice call, make video call. Verify no avc "granted" messages in the logs. Test: A few VPN apps including "VPN Monster", "Turbo VPN", and "Freighter". Verify no logspam with the current setup. Test: atest CtsNativeNetTestCases Test: atest netd_integration_test Test: atest QtaguidPermissionTest Test: atest FileSystemPermissionTest Change-Id: I7e49f796a25cf68bc698c6c9206e24af3ae11457 Merged-In: I7e49f796a25cf68bc698c6c9206e24af3ae11457 (cherry picked from commit 087318957f26e921d62f2e234fc14bff3c59030e)
2018-04-10 21:47:48 +02:00
genfscon proc /net/tcp u:object_r:proc_net_vpn:s0
genfscon proc /net/udp u:object_r:proc_net_vpn:s0
Rename qtaguid_proc to conform to name conventions Test: build Bug: 68774956 Change-Id: I0f9fd87eb41e67e14f35e49eba13e3d1de745250
2018-04-03 18:53:23 +02:00
genfscon proc /net/xt_qtaguid/ctrl u:object_r:proc_qtaguid_ctrl:s0
relabel files in /proc/net/xt_qtaguid/ /proc/net/xt_qtaguid is used by apps to track their network data use. Limit access to just zygote spawned processes - apps and system_server, omitting access to isolated_app which is not allowed to create network sockets. As Android moves to eBPF for app's network data stats, access to /proc/net/xt_qtaguid will be removed entirely. Segmenting access off is the first step. Bug: 68774956 This change also helps further segment and whitelist access to files in /proc/net and is a step in the lockdown of /proc/net. Bug: 9496886 Test: boot Taimen. Walk through setup-wizard. Make phone call and video call. Browse web. Watch youtube. Navigate in maps. Test: cts-tradefed run cts -m CtsAppSecurityHostTestCases -t \ android.appsecurity.cts.AppSecurityTests Test: cts-tradefed run cts -m CtsNativeNetTestCases Test: cts-tradefed run cts -m CtsIncidentHostTestCases -t \ com.android.server.cts.NetstatsIncidentTest Test: cts-tradefed run cts -m CtsOsTestCases -t \ android.os.cts.StrictModeTest Test: cts-tradefed run cts -m CtsNetTestCases -t \ android.net.cts.TrafficStatsTest Test: cts-tradefed run cts -m CtsUsageStatsTestCases -t \ android.app.usage.cts.NetworkUsageStatsTest Test: vts-tradefed run vts -m VtsQtaguidTest Change-Id: Idddd318c56b84564142d37b11dcc225a2f2800ea
2018-01-02 22:10:46 +01:00
genfscon proc /net/xt_qtaguid/ u:object_r:proc_qtaguid_stat:s0
zygote: allow replacing /proc/cpuinfo Android's native bridge functionality allows an Android native app written on one CPU architecture to run on a different architecture. For example, Android ARM apps may run on an x86 CPU. To support this, the native bridge functionality needs to replace /proc/cpuinfo with the version from /system/lib/<ISA>/cpuinfo using a bind mount. See commit ab0da5a9a6860046619629b8e6b83692d35dff86 in system/core. This change: 1) Creates a new label proc_cpuinfo, and assigns /proc/cpuinfo that label. 2) Grants read-only access to all SELinux domains, to avoid breaking pre-existing apps. 3) Grants zygote mounton capabilities for that file, so zygote can replace the file as necessary. Addresses the following denial: avc: denied { mounton } for path="/proc/cpuinfo" dev="proc" ino=4026532012 scontext=u:r:zygote:s0 tcontext=u:object_r:proc:s0 tclass=file Bug: 17671501 Change-Id: Ib70624fba2baeccafbc0a41369833f76b976ee20
2014-09-26 19:51:12 +02:00
genfscon proc /cpuinfo u:object_r:proc_cpuinfo:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
genfscon proc /pagetypeinfo u:object_r:proc_pagetypeinfo:s0
access to /proc/slabinfo init, dumpstate and shell Test: check avc for init is now gone Bug: 7232205 Bug: 109821005 Change-Id: I299a0ba29bcc97a97047f12a5c48f6056f5e6de5
2018-06-14 16:34:19 +02:00
genfscon proc /slabinfo u:object_r:proc_slabinfo:s0
restrict access to timing information in /proc These APIs expose sensitive information via timing side channels. This leaves access via the adb shell intact along with the current uses by dumpstate, init and system_server. The /proc/interrupts and /proc/stat files were covered in this paper: https://www.lightbluetouchpaper.org/2016/07/29/yet-another-android-side-channel/ The /proc/softirqs, /proc/timer_list and /proc/timer_stats files are also relevant. Access to /proc has been greatly restricted since then, with untrusted apps no longer having direct access to these, but stricter restrictions beyond that would be quite useful. Change-Id: Ibed16674856569d26517e5729f0f194b830cfedd
2016-07-29 20:48:19 +02:00
genfscon proc /softirqs u:object_r:proc_timer:s0
genfscon proc /stat u:object_r:proc_stat:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
genfscon proc /swaps u:object_r:proc_swaps:s0
Address system_server denials. Label /proc/sysrq-trigger and allow access. Label /dev/socket/mtpd and allow access. Resolves denials such as: avc: denied { getattr } for pid=12114 comm="Binder_2" path="socket:[219779]" dev="sockfs" ino=219779 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket avc: denied { call } for pid=1007 comm="Binder_8" scontext=u:r:system_server:s0 tcontext=u:r:su:s0 tclass=binder avc: denied { write } for pid=1024 comm="watchdog" name="sysrq-trigger" dev="proc" ino=4026533682 scontext=u:r:system_server:s0 tcontext=u:object_r:proc:s0 tclass=file avc: denied { write } for pid=11567 comm="LegacyVpnRunner" name="mtpd" dev="tmpfs" ino=36627 scontext=u:r:system_server:s0 tcontext=u:object_r:socket_device:s0 tclass=sock_file avc: denied { ptrace } for pid=10924 comm=5369676E616C2043617463686572 scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=process avc: denied { sigkill } for pid=26077 comm="NativeCrashRepo" scontext=u:r:system_server:s0 tcontext=u:r:zygote:s0 tclass=process avc: denied { write } for pid=1024 comm="android.bg" scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=netlink_socket avc: denied { getattr } for pid=473 comm="FinalizerDaemon" path="socket:[11467]" dev="sockfs" ino=11467 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=tcp_socket avc: denied { getattr } for pid=473 comm="FinalizerDaemon" path="socket:[12076]" dev="sockfs" ino=12076 scontext=u:r:system_server:s0 tcontext=u:r:mediaserv er:s0 tclass=udp_socket avc: denied { getopt } for pid=473 comm="FinalizerDaemon" laddr=192.168.159.172 lport=51576 faddr=93.127.173.40 fport=554 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=tcp_socket avc: denied { getopt } for pid=473 comm="FinalizerDaemon" lport=15658 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=udp_socket avc: denied { read write } for pid=21384 comm="rtsp" path="socket:[443742]" dev="sockfs" ino=443742 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s 0 tclass=tcp_socket avc: denied { read write } for pid=21384 comm="rtsp" path="socket:[444842]" dev="sockfs" ino=444842 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=udp_socket avc: denied { setopt } for pid=1326 comm="Binder_9" lport=16216 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=udp_socket avc: denied { setopt } for pid=1676 comm="Binder_6" laddr=192.168.156.130 lport=51044 faddr=74.125.214.81 fport=554 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=tcp_socket avc: denied { getattr } for pid=10915 comm="system_server" path="/dev/mdm" dev="tmpfs" ino=7484 scontext=u:r:system_server:s0 tcontext=u:object_r:radio_device:s0 tclass=chr_file avc: denied { read } for pid=10915 comm="system_server" name="mdm" dev="tmpfs" ino=7484 scontext=u:r:system_server:s0 tcontext=u:object_r:radio_device:s0 tclass=chr_file avc: denied { unlink } for pid=14866 comm="system_server" name="wallpaper" dev="mmcblk0p9" ino=285715 scontext=u:r:system_server:s0 tcontext=u:object_r:wallpaper_file:s0 tclass=file avc: denied { getattr } for pid=12114 comm="Binder_2" path="socket:[219779]" dev="sockfs" ino=219779 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket avc: denied { getopt } for pid=32300 comm="Binder_1" laddr=::ffff:127.0.0.1 lport=4939 faddr=::ffff:127.0.0.1 fport=53318 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket avc: denied { read write } for pid=10840 comm="pool-17-thread-" path="socket:[205990]" dev="sockfs" ino=205990 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket avc: denied { write } for pid=20817 comm="dumpsys" path="/mnt/shell/emulated/0/aupt-output/bugreport-2014-02-22-11-17-16.txt.tmp" dev="fuse" ino=3100784040 scontext=u:r:system_server:s0 tcontext=u:object_r:sdcard_internal:s0 tclass=file Change-Id: I481ac26667b487031a5d3317b0a028a027a8e641 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-03-05 15:50:08 +01:00
genfscon proc /sysrq-trigger u:object_r:proc_sysrq:s0
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
genfscon proc /sys/abi/swp u:object_r:proc_abi:s0
system_server: access to /proc/sys/fs/pipe-max-size Label /proc/sys/fs/pipe-max-size with new type proc_pipe_conf and give system_server access to it. Addresses this denial: avc: denied { read } for name="pipe-max-size" dev="proc" ino=93817 scontext=u:r:system_server:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=0 Bug: 69175449 Bug: 69324398 Test: sailfish boots Test: adb bugreport Test: craft an unresponsive app, trigger ANR, make sure traces are dumped into /data/anr Above denial from system_server not observed, no denials to proc_pipe_conf observed. Change-Id: I7c71f05820a4945ba982e29f76e9d9f4458b2b59
2017-11-15 01:32:36 +01:00
genfscon proc /sys/fs/pipe-max-size u:object_r:proc_pipe_conf:s0
Restrict the ability to set usermodehelpers and proc security settings. Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06 15:31:40 +01:00
genfscon proc /sys/fs/protected_hardlinks u:object_r:proc_security:s0
genfscon proc /sys/fs/protected_symlinks u:object_r:proc_security:s0
genfscon proc /sys/fs/suid_dumpable u:object_r:proc_security:s0
genfscon proc /sys/kernel/core_pattern u:object_r:usermodehelper:s0
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
genfscon proc /sys/kernel/core_pipe_limit u:object_r:usermodehelper:s0
genfscon proc /sys/kernel/domainname u:object_r:proc_hostname:s0
Restrict the ability to set usermodehelpers and proc security settings. Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06 15:31:40 +01:00
genfscon proc /sys/kernel/dmesg_restrict u:object_r:proc_security:s0
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
genfscon proc /sys/kernel/hostname u:object_r:proc_hostname:s0
Restrict the ability to set usermodehelpers and proc security settings. Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06 15:31:40 +01:00
genfscon proc /sys/kernel/hotplug u:object_r:usermodehelper:s0
llkd: add live-lock daemon Introduce a standalone live-lock daemon (llkd), to catch kernel or native user space deadlocks and take mitigating actions. Test: llkd_unit_test Bug: 33808187 Bug: 72838192 Change-Id: If869ecd06e5ce7b04bba1dafd0a77971b71aa517
2018-02-20 20:02:39 +01:00
genfscon proc /sys/kernel/hung_task_ u:object_r:proc_hung_task:s0
Restrict the ability to set usermodehelpers and proc security settings. Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06 15:31:40 +01:00
genfscon proc /sys/kernel/kptr_restrict u:object_r:proc_security:s0
genfscon proc /sys/kernel/modprobe u:object_r:usermodehelper:s0
genfscon proc /sys/kernel/modules_disabled u:object_r:proc_security:s0
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
genfscon proc /sys/kernel/panic_on_oops u:object_r:proc_panic:s0
Make /proc/sys/kernel/perf_event_max_sample_rate accessible to untrusted_app. perf_event_max_sample_rate is needed to be read for native profiling, otherwise CTS test can fail on devices with kernel >= 4.4. Before this CL, the file is not readable from untrusted_app domain. This CL makes it readable from both shell domain and untrusted_app domain. Bug: http://b/35554543 Test: build and test on marlin. Change-Id: Id118e06e3c800b70a749ab112e07a4ec24bb5975
2017-03-07 02:27:54 +01:00
genfscon proc /sys/kernel/perf_event_max_sample_rate u:object_r:proc_perf:s0
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
genfscon proc /sys/kernel/perf_event_paranoid u:object_r:proc_perf:s0
Export more files in proc_perf. Export /proc/sys/kernel/perf_cpu_time_max_percent and /proc/sys/kernel/perf_event_mlock_kb in proc_perf. So they can be read in shell and written by init. This is needed by simpleperf to control cpu percent and memory used for profiling. Bug: 110706031 Test: build and boot hikey960 successfully. Change-Id: I2a01f583508003ab73427bab30a7982a27dfa677
2018-06-29 23:53:34 +02:00
genfscon proc /sys/kernel/perf_cpu_time_max_percent u:object_r:proc_perf:s0
genfscon proc /sys/kernel/perf_event_mlock_kb u:object_r:proc_perf:s0
Label /proc/sys/kernel/pid_max as proc_pid_max. And give shell domain read access to /proc/sys/kernel/pic_max. Bug: 69569397 Test: adb shell /data/nativetest/bionic-unit-tests/bionic-unit-tests --gtest_filter=pthread.pthread_mutex_owner_tid_limit Change-Id: Ib56c18ed553ad2c2113e6913788a4c00965483cc
2017-11-28 17:42:40 +01:00
genfscon proc /sys/kernel/pid_max u:object_r:proc_pid_max:s0
Restrict the ability to set usermodehelpers and proc security settings. Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06 15:31:40 +01:00
genfscon proc /sys/kernel/poweroff_cmd u:object_r:usermodehelper:s0
/proc, /sys access from uncrypt, update_engine, postinstall_dexopt New types: 1. proc_random 2. sysfs_dt_firmware_android Labeled: 1. /proc/sys/kernel/random as proc_random. 2. /sys/firmware/devicetree/base/firmware/android/{compatible, fstab, vbmeta} as sysfs_dt_firmware_android. Changed access: 1. uncrypt, update_engine, postinstall_dexopt have access to generic proc and sysfs labels removed. 2. appropriate permissions were added to uncrypt, update_engine, update_engine_common, postinstall_dexopt. Bug: 67416435 Bug: 67416336 Test: fake ota go/manual-ab-ota runs without denials Test: adb sideload runs without denials to new types Change-Id: Id31310ceb151a18652fcbb58037a0b90c1f6505a
2017-10-04 19:34:11 +02:00
genfscon proc /sys/kernel/random u:object_r:proc_random:s0
Restrict the ability to set usermodehelpers and proc security settings. Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06 15:31:40 +01:00
genfscon proc /sys/kernel/randomize_va_space u:object_r:proc_security:s0
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
genfscon proc /sys/kernel/sched_child_runs_first u:object_r:proc_sched:s0
genfscon proc /sys/kernel/sched_latency_ns u:object_r:proc_sched:s0
genfscon proc /sys/kernel/sched_rt_period_us u:object_r:proc_sched:s0
genfscon proc /sys/kernel/sched_rt_runtime_us u:object_r:proc_sched:s0
Label /proc/sys/kernel/sched_schedstats. This allows init to write to it, which it does for atrace. Bug: 72643420 Test: Boot two devices, observe no denials, test atrace. Change-Id: I6810e5dcdfaff176bd944317e66d4fe612ccebed (cherry picked from commit dce07413bc7380c45c85b26c71afe14849a96fae)
2018-03-29 21:15:48 +02:00
genfscon proc /sys/kernel/sched_schedstats u:object_r:proc_sched:s0
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
genfscon proc /sys/kernel/sched_tunable_scaling u:object_r:proc_sched:s0
genfscon proc /sys/kernel/sched_wakeup_granularity_ns u:object_r:proc_sched:s0
genfscon proc /sys/kernel/sysrq u:object_r:proc_sysrq:s0
Restrict the ability to set usermodehelpers and proc security settings. Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06 15:31:40 +01:00
genfscon proc /sys/kernel/usermodehelper u:object_r:usermodehelper:s0
Create proc_net type for /proc/sys/net entries. /proc/sys/net could use its own type to help distinguish among some of the proc access rules. Fix dhcp and netd because of this. Change-Id: I6e16cba660f07bc25f437bf43e1eba851a88d538 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-01-07 19:46:56 +01:00
genfscon proc /sys/net u:object_r:proc_net:s0
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
genfscon proc /sys/vm/dirty_background_ratio u:object_r:proc_dirty:s0
genfscon proc /sys/vm/dirty_expire_centisecs u:object_r:proc_dirty:s0
genfscon proc /sys/vm/extra_free_kbytes u:object_r:proc_extra_free_kbytes:s0
genfscon proc /sys/vm/max_map_count u:object_r:proc_max_map_count:s0
Restrict mapping low memory. Label /proc/sys/vm/mmap_min_addr with proc_security to prevent writing it by any domain other than init. Also remove memprotect mmap_zero permission from unconfineddomain so that it cannot pass the SELinux check over mapping low memory. Change-Id: Idc189feeb325a4aea26c93396fd0fa7225e79586 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-09 19:24:25 +01:00
genfscon proc /sys/vm/mmap_min_addr u:object_r:proc_security:s0
Restrict /proc/sys/vm/mmap_rnd_bits Label /proc/sys/vm/mmap_rnd_bits so it is only readable and writable by init. This also tightens the neverallow restrictions for proc_security. Bug: 33563834 Test: run cts -m CtsPermissionTestCases -t \ android.permission.cts.FileSystemPermissionTest#testProcfsMmapRndBitsExistsAndSane Change-Id: Ie7af39ddbf23806d4ffa35e7b19d30fec7b6d410
2017-02-23 23:40:56 +01:00
genfscon proc /sys/vm/mmap_rnd_bits u:object_r:proc_security:s0
genfscon proc /sys/vm/mmap_rnd_compat_bits u:object_r:proc_security:s0
Add label for /proc/sys/vm/page-cluster Test: boot sailfish with no audit when writing to page-cluster Change-Id: I2bfebdf9342594d66d95daaec92d71195c93ffc8
2017-10-24 22:17:46 +02:00
genfscon proc /sys/vm/page-cluster u:object_r:proc_page_cluster:s0
drop_caches label, vold scratch space on expanded. Define an explicit label for /proc/sys/vm/drop_caches and grant to the various people who need it, including vold which uses it when performing storage benchmarks. Also let vold create new directories under it's private storage area where the benchmarks will be carried out. Mirror the definition of the private storage area on expanded media. avc: denied { write } for name="drop_caches" dev="proc" ino=20524 scontext=u:r:vold:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=0 Bug: 21172095 Change-Id: I300b1cdbd235ff60e64064d3ba6e5ea783baf23f
2015-05-15 05:55:31 +02:00
genfscon proc /sys/vm/drop_caches u:object_r:proc_drop_caches:s0
domain: allow reading /proc/sys/vm/overcommit_memory Needed for jemalloc commit: 2f970c32b527660a33fa513a76d913c812dcf7c Modify pages_map() to support mapping uncommitted virtual memory. avc: denied { read } for name="overcommit_memory" dev="proc" ino=10544 scontext=u:r:wificond:s0 tcontext=u:object_r:proc:s0 tclass=file Bug: 29773242 Change-Id: I78054c1ed576a7998c4ee1d1beca2f610c589c3a
2016-06-28 00:38:25 +02:00
genfscon proc /sys/vm/overcommit_memory u:object_r:proc_overcommit_memory:s0
Fix init error trying to access file. Init tries to write /proc/sys/vm/min_free_order_shift but fails due to a SELinux denial. This gives the file a new label and gives init the ability to write it. Test: Build and booted Sailfish (a couple of days ago). Change-Id: Ic93862b85c468afccff2019d84b927af9ed2a84d
2018-01-24 02:32:16 +01:00
genfscon proc /sys/vm/min_free_order_shift u:object_r:proc_min_free_order_shift:s0
restrict access to timing information in /proc These APIs expose sensitive information via timing side channels. This leaves access via the adb shell intact along with the current uses by dumpstate, init and system_server. The /proc/interrupts and /proc/stat files were covered in this paper: https://www.lightbluetouchpaper.org/2016/07/29/yet-another-android-side-channel/ The /proc/softirqs, /proc/timer_list and /proc/timer_stats files are also relevant. Access to /proc has been greatly restricted since then, with untrusted apps no longer having direct access to these, but stricter restrictions beyond that would be quite useful. Change-Id: Ibed16674856569d26517e5729f0f194b830cfedd
2016-07-29 20:48:19 +02:00
genfscon proc /timer_list u:object_r:proc_timer:s0
genfscon proc /timer_stats u:object_r:proc_timer:s0
untrusted_app: allow access to /proc/tty/drivers /proc/tty/drivers is read by applications to figure out if they are running in an emulated environment. Specifically, they look for the string "goldfish" within that file. Arguably this is not an Android API, and really shouldn't be exposed to applications, but: 1) A largish number of applications break if they can't read this file; 2) The information here isn't particularly sensitive While we could spend a bunch of time trying to get applications fixed, there are bigger fish to fry. It's not worth the battle. Test: "ls -laZ /proc/tty/drivers" is labeled properly. Bug: 33214085 Bug: 33814662 Bug: 33791054 Bug: 33211769 Bug: 26813932 Change-Id: Icc05bdc1c917547a6dca7d76636a1009369bde49
2017-01-04 17:43:09 +01:00
genfscon proc /tty/drivers u:object_r:proc_tty_drivers:s0
selinux: set proc_uid_time_in_state type for /proc/uid /proc/uid/ provides the same per-uid time_in_state data as /proc/uid_time_in_state, so apply the same type and let system_server read directories of this type. Bug: 66953705 Test: system_server can read /proc/uid/*/time_in_state files without denials on sailfish Change-Id: Iab7fd018c5296e8c0140be81c14e5bae9e0acb0b Signed-off-by: Connor O'Brien <connoro@google.com>
2017-11-18 00:40:51 +01:00
genfscon proc /uid/ u:object_r:proc_uid_time_in_state:s0
Allow system_server to read/write /proc/uid_cputime/ module Bug:20182139 Change-Id: I1829a83c7d8e2698715e424a688a2753d65de868
2015-05-13 02:14:35 +02:00
genfscon proc /uid_cputime/show_uid_stat u:object_r:proc_uid_cputime_showstat:s0
genfscon proc /uid_cputime/remove_uid_range u:object_r:proc_uid_cputime_removeuid:s0
Define policy for /proc/uid_io/stats New procfs file read by storaged to dump fg/bg IO usage. Remove kmsg rule since it's no longer used by storaged. Allow storaged to find permission_service to translate UID to package name. Test: adb shell storaged -u Bug: 34198239 Change-Id: I74654662c75571cbe166cf2b8cbab84828218cbd
2017-01-12 01:20:49 +01:00
genfscon proc /uid_io/stats u:object_r:proc_uid_io_stats:s0
Define policy for /proc/uid_procstat/set. New procfs file written by the system_server to communicate fg/bg state of UIDs to switch the statistics counter sets used. avc: denied { write } for name="set" dev="proc" ino=4026531862 scontext=u:r:system_server:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 Test: builds, boots, counter sets updated Bug: 34360629 Change-Id: I2efbfbba9e73f50ce50a80a3dffd3b14fa55c048
2017-01-18 02:33:50 +01:00
genfscon proc /uid_procstat/set u:object_r:proc_uid_procstat_set:s0
Allow only system_server to read uid_time_in_state Bug: 62706738 Bug: 34133340 Test: Check that uid_time_in_state can't be read from the shell without root permissions and that "dumpsys batterystats --checkin| grep ctf" shows frequency data (system_server was able to read uid_time_in_state) Change-Id: Ic6a54da4ebcc9e10b0e3af8f14a45d7408e8686e (cherry picked from commit 4dc88795d0906148e3414688fa81481b4edaacff)
2017-06-07 19:39:11 +02:00
genfscon proc /uid_time_in_state u:object_r:proc_uid_time_in_state:s0
Restrict access to uid_concurrent_*_time Do not let apps read uid_concurrent_active_time and uid_concurrent_policy_time. b/68399339 Test: Check that they can't be read from the shell without root permissions and system_server was able to read them Change-Id: I6f09ef608607cb9f4084ba403a1e7254b8c49a06
2017-11-10 23:10:19 +01:00
genfscon proc /uid_concurrent_active_time u:object_r:proc_uid_concurrent_active_time:s0
genfscon proc /uid_concurrent_policy_time u:object_r:proc_uid_concurrent_policy_time:s0
sepolicy: restrict access to uid_cpupower files Do not let apps read /proc/uid_cpupower/time_in_state, /proc/uid_cpupower/concurrent_active_time, /proc/uid_cpupower/concurrent_policy_time. b/71718257 Test: Check that they can't be read from the shell without root permissions and system_server was able to read them Change-Id: I812694adfbb4630f7b56aa7096dc2e6dfb148b15
2018-01-19 22:48:31 +01:00
genfscon proc /uid_cpupower/ u:object_r:proc_uid_cpupower:s0
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
genfscon proc /uptime u:object_r:proc_uptime:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
genfscon proc /version u:object_r:proc_version:s0
genfscon proc /vmallocinfo u:object_r:proc_vmallocinfo:s0
Remove proc and sysfs access from system_app and platform_app. Bug: 65643247 Test: manual Test: browse internet Test: take a picture Change-Id: I9faff44b7a025c7422404d777113e40842ea26dd
2018-01-10 21:51:51 +01:00
genfscon proc /vmstat u:object_r:proc_vmstat:s0
fine-grained policy for access to /proc/zoneinfo Change-Id: Ica9a16311075f5cc3744d0e0833ed876e201029f
2016-08-08 19:48:01 +02:00
genfscon proc /zoneinfo u:object_r:proc_zoneinfo:s0
Allow system_server to read/write /proc/uid_cputime/ module Bug:20182139 Change-Id: I1829a83c7d8e2698715e424a688a2753d65de868
2015-05-13 02:14:35 +02:00
Support for ocontexts per device. ocontexts was split up into 4 files: 1.fs_use 2.genfs_contexts 3.initial_sid_contexts 4.port_contexts Each file has their respective declerations in them. Devices, in their respective device directory, can now specify sepolicy.fs_use, sepolicy.genfs_contexts, sepolicy.port_contexts, and sepolicy.initial_sid_contexts. These declerations will be added right behind their respective sepolicy counterparts in the concatenated configuration file.
2012-07-12 01:46:38 +02:00
# selinuxfs booleans can be individually labeled.
genfscon selinuxfs / u:object_r:selinuxfs:s0
genfscon cgroup / u:object_r:cgroup:s0
sepolicy: Allow mount cgroupv2 and bpf fs Some necessary sepolicy rule changes for init process to create directory, mount cgroupv2 module and mount bpf filesystem. Also allow netd to create and pin bpf object as files and read it back from file under the directory where bpf filesystem is mounted. Test: bpf maps show up under /sys/fs/bpf/ Change-Id: I579d04f60d7e20bd800d970cd28cd39fda9d20a0
2017-08-02 03:06:18 +02:00
genfscon cgroup2 / u:object_r:cgroup_bpf:s0
Support for ocontexts per device. ocontexts was split up into 4 files: 1.fs_use 2.genfs_contexts 3.initial_sid_contexts 4.port_contexts Each file has their respective declerations in them. Devices, in their respective device directory, can now specify sepolicy.fs_use, sepolicy.genfs_contexts, sepolicy.port_contexts, and sepolicy.initial_sid_contexts. These declerations will be added right behind their respective sepolicy counterparts in the concatenated configuration file.
2012-07-12 01:46:38 +02:00
# sysfs labels can be set by userspace.
genfscon sysfs / u:object_r:sysfs:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
genfscon sysfs /devices/system/cpu u:object_r:sysfs_devices_system_cpu:s0
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
genfscon sysfs /class/android_usb u:object_r:sysfs_android_usb:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
genfscon sysfs /class/leds u:object_r:sysfs_leds:s0
Label /sys/class/net as sysfs_net. We already expect contents of /sys/class/net to be labeled as sysfs_net. Also label the directory for consistensy since we usually label /sys/class/foo directories as sysfs_foo. Bug: 65643247 Test: netd_integration_test Test: can browse internet without denials to sysfs_net Change-Id: I9d28ab4baf71df99ae966276532f14684d1abca6
2017-12-09 00:47:21 +01:00
genfscon sysfs /class/net u:object_r:sysfs_net:s0
btlinux: Move HAL definitions from system/bt Test: ls -laZ /vendor/bin/hw/android.hardware.bluetooth* Change-Id: I394594ad041f87583ca6b5b44d836cfab5da8103 Signed-off-by: Dmitry Shmidt <dimitrysh@google.com> Merged-In: I394594ad041f87583ca6b5b44d836cfab5da8103
2018-04-05 21:46:05 +02:00
genfscon sysfs /class/rfkill/rfkill0/state u:object_r:sysfs_bluetooth_writable:s0
genfscon sysfs /class/rfkill/rfkill1/state u:object_r:sysfs_bluetooth_writable:s0
genfscon sysfs /class/rfkill/rfkill2/state u:object_r:sysfs_bluetooth_writable:s0
genfscon sysfs /class/rfkill/rfkill3/state u:object_r:sysfs_bluetooth_writable:s0
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
genfscon sysfs /class/rtc u:object_r:sysfs_rtc:s0
genfscon sysfs /class/switch u:object_r:sysfs_switch:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
genfscon sysfs /devices/platform/nfc-power/nfc_power u:object_r:sysfs_nfc_power_writable:s0
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
genfscon sysfs /devices/virtual/android_usb u:object_r:sysfs_android_usb:s0
Create sysfs_dm label. Prior to this CL, /sys/devices/virtual/block/dm-X was using the generic sysfs label. This CL creates sysfs_dm label and grants the following accesses: - update_verifier to read sysfs_dm dir and file at /sys/devices/virtual/block/dm-X. - vold to write sysfs_dm. Bug: 63440407 Test: update_verifier successfully triggers blocks verification and marks a sucessful boot; Test: No sysfs_dm related denials on sailfish. Change-Id: I6349412707800f1bd3a2fb94d4fe505558400c95
2017-10-05 22:50:07 +02:00
genfscon sysfs /devices/virtual/block/dm- u:object_r:sysfs_dm:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
genfscon sysfs /devices/virtual/block/zram0 u:object_r:sysfs_zram:s0
genfscon sysfs /devices/virtual/block/zram1 u:object_r:sysfs_zram:s0
genfscon sysfs /devices/virtual/block/zram0/uevent u:object_r:sysfs_zram_uevent:s0
genfscon sysfs /devices/virtual/block/zram1/uevent u:object_r:sysfs_zram_uevent:s0
genfscon sysfs /devices/virtual/misc/hw_random u:object_r:sysfs_hwrandom:s0
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
genfscon sysfs /devices/virtual/switch u:object_r:sysfs_switch:s0
/proc, /sys access from uncrypt, update_engine, postinstall_dexopt New types: 1. proc_random 2. sysfs_dt_firmware_android Labeled: 1. /proc/sys/kernel/random as proc_random. 2. /sys/firmware/devicetree/base/firmware/android/{compatible, fstab, vbmeta} as sysfs_dt_firmware_android. Changed access: 1. uncrypt, update_engine, postinstall_dexopt have access to generic proc and sysfs labels removed. 2. appropriate permissions were added to uncrypt, update_engine, update_engine_common, postinstall_dexopt. Bug: 67416435 Bug: 67416336 Test: fake ota go/manual-ab-ota runs without denials Test: adb sideload runs without denials to new types Change-Id: Id31310ceb151a18652fcbb58037a0b90c1f6505a
2017-10-04 19:34:11 +02:00
genfscon sysfs /firmware/devicetree/base/firmware/android u:object_r:sysfs_dt_firmware_android:s0
allow init to run mke2fs tools to format partitions Test: let fs_mgr format a damaged /data partition Bug: 35219933 Change-Id: If92352ea7a70780e9d81ab10963d63e16b793792 (cherry picked from commit 5f573ab2aa8f566c723f4ddd576f8365dcaec191)
2017-05-02 22:45:08 +02:00
genfscon sysfs /fs/ext4/features u:object_r:sysfs_fs_ext4_features:s0
init: remove open, read, write access to 'sysfs' type. Add write access to: sysfs_android_usb sysfs_leds sysfs_power sysfs_zram Add setattr access to: sysfs_android_usb sysfs_devices_system_cpu sysfs_lowmemorykiller sysfs_power sysfs_leds sysfs_ipv4 Bug: 70040773 Bug: 65643247 Change-Id: I68e2e796f5599c9d281897759c8d8eef9363559a Test: walleye boots with no denials from init to sysfs.
2017-12-06 18:00:59 +01:00
genfscon sysfs /power/autosleep u:object_r:sysfs_power:s0
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
genfscon sysfs /power/state u:object_r:sysfs_power:s0
genfscon sysfs /power/wakeup_count u:object_r:sysfs_power:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
genfscon sysfs /power/wake_lock u:object_r:sysfs_wake_lock:s0
genfscon sysfs /power/wake_unlock u:object_r:sysfs_wake_lock:s0
Revert "Revert "Add /sys/kernel/memory_state_time to sysfs_power."" This reverts commit 12e73685b75905fa5afa62cd1fb3631f9f2af818. Reason for revert: Rolling original change forward again, more carefully. Change-Id: I266b181915c829d743c6d8d0b8c0d70b6bf3d620
2018-04-17 17:59:45 +02:00
genfscon sysfs /kernel/memory_state_time u:object_r:sysfs_power:s0
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
genfscon sysfs /kernel/ipv4 u:object_r:sysfs_ipv4:s0
Sepolicy: Label kernel notes Label /sys/kernel/notes. Bug: 70275668 Test: m Change-Id: Ieb666425d2db13f85225fb902fe06b0bf2335bef
2017-12-06 19:09:50 +01:00
genfscon sysfs /kernel/notes u:object_r:sysfs_kernel_notes:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
genfscon sysfs /kernel/uevent_helper u:object_r:sysfs_usermodehelper:s0
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
genfscon sysfs /kernel/wakeup_reasons u:object_r:sysfs_wakeup_reasons:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
genfscon sysfs /module/lowmemorykiller u:object_r:sysfs_lowmemorykiller:s0
genfscon sysfs /module/wlan/parameters/fwpath u:object_r:sysfs_wlan_fwpath:s0
genfscon sysfs /devices/virtual/timed_output/vibrator/enable u:object_r:sysfs_vibrator:s0
genfscon debugfs /mmc0 u:object_r:debugfs_mmc:s0
Use a whitelisting strategy for tracefs. This changes tracefs files to be default-enabled in debug mode, but default-disabled with specific files enabled in user mode. Bug: 64762598 Test: Successfully took traces in user mode. Change-Id: I572ea22253e0c1e42065fbd1d2fd7845de06fceb
2018-01-31 03:14:45 +01:00
genfscon debugfs /tracing u:object_r:debugfs_tracing_debug:s0
genfscon tracefs / u:object_r:debugfs_tracing_debug:s0
genfscon debugfs /tracing/tracing_on u:object_r:debugfs_tracing:s0
genfscon tracefs /tracing_on u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/trace u:object_r:debugfs_tracing:s0
genfscon tracefs /trace u:object_r:debugfs_tracing:s0
Allow perfetto traced_probes to access tracefs on user Allows the traced_probes daemon to access the core ftrace functionalities on user builds. Specifically this involves: - Whitelisting the per_cpu/ subdirectory to access: 1) trace_pipe_raw file to allow perfetto to read the raw ftrace buffer (rather than the text-based /trace endpoint) 2) cpuX/stats and cpuX/buffer_size_kb that allow to tune the buffer size per-cpu pipe and to get basic statistics about the ftrace buffer (#events, overruns) - Whitelistiing the full event directories rather than the /enable files. This gives also access to the /format files for the events that are already enabled on user builds. /format files simply describe the memory layout of the binary logs. Example: https://ghostbin.com/paste/f8m4k This still does NOT allow enabling the events labeled as "_debug" (mostly events that return activity on inodes). We'll deal with that separately as soon as we get a POC of inode resolution and a sensible blacklist/whitelist model. Bug: 70942310 Change-Id: Ic15cca0a9d7bc0e45aa48097a94eadef44c333f8
2018-02-09 12:15:22 +01:00
genfscon debugfs /tracing/per_cpu/cpu u:object_r:debugfs_tracing:s0
genfscon tracefs /per_cpu/cpu u:object_r:debugfs_tracing:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
genfscon debugfs /tracing/instances u:object_r:debugfs_tracing_instances:s0
genfscon tracefs /instances u:object_r:debugfs_tracing_instances:s0
genfscon debugfs /tracing/instances/wifi u:object_r:debugfs_wifi_tracing:s0
genfscon tracefs /instances/wifi u:object_r:debugfs_wifi_tracing:s0
genfscon debugfs /tracing/trace_marker u:object_r:debugfs_trace_marker:s0
genfscon tracefs /trace_marker u:object_r:debugfs_trace_marker:s0
Selinux permissions for incidentd project Bug: 64222712 Test: manual Change-Id: Ica77ae3c9e535eddac9fccf11710b0bcb3254ab3
2018-01-22 23:00:46 +01:00
genfscon debugfs /wakeup_sources u:object_r:debugfs_wakeup_sources:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
Allow perfetto traced_probes to access tracefs on user Allows the traced_probes daemon to access the core ftrace functionalities on user builds. Specifically this involves: - Whitelisting the per_cpu/ subdirectory to access: 1) trace_pipe_raw file to allow perfetto to read the raw ftrace buffer (rather than the text-based /trace endpoint) 2) cpuX/stats and cpuX/buffer_size_kb that allow to tune the buffer size per-cpu pipe and to get basic statistics about the ftrace buffer (#events, overruns) - Whitelistiing the full event directories rather than the /enable files. This gives also access to the /format files for the events that are already enabled on user builds. /format files simply describe the memory layout of the binary logs. Example: https://ghostbin.com/paste/f8m4k This still does NOT allow enabling the events labeled as "_debug" (mostly events that return activity on inodes). We'll deal with that separately as soon as we get a POC of inode resolution and a sensible blacklist/whitelist model. Bug: 70942310 Change-Id: Ic15cca0a9d7bc0e45aa48097a94eadef44c333f8
2018-02-09 12:15:22 +01:00
genfscon debugfs /tracing/events/workqueue/ u:object_r:debugfs_tracing_debug:s0
genfscon debugfs /tracing/events/regulator/ u:object_r:debugfs_tracing_debug:s0
genfscon debugfs /tracing/events/pagecache/ u:object_r:debugfs_tracing_debug:s0
genfscon debugfs /tracing/events/irq/ u:object_r:debugfs_tracing_debug:s0
genfscon debugfs /tracing/events/ipi/ u:object_r:debugfs_tracing_debug:s0
Allow to read events/header_page with debugfs_tracing Bug: 110900684 Change-Id: I9fd141e0d56d0135c563467b7ca2f08b6af6700b`
2018-06-28 15:57:18 +02:00
genfscon debugfs /tracing/events/header_page u:object_r:debugfs_tracing:s0
Expose filesystem read events in SELinux policy. Without this, we only have visibility into writes. Looking at traces, we realised for many of the files we care about (.dex, .apk) most filesystem events are actually reads. See aosp/661782 for matching filesystem permission change. Bug: 73625480 Change-Id: I6ec71d82fad8f4679c7b7d38e3cb90aff0b9e298
2018-04-10 17:12:54 +02:00
genfscon debugfs /tracing/events/f2fs/f2fs_get_data_block/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/f2fs/f2fs_iget/ u:object_r:debugfs_tracing:s0
SELinux changes for I/O tracing. See also go/perfetto-io-tracing-security. * Grant CAP_DAC_READ_SEARCH to traced_probes. * Allow traced_probes to list selected labels. * Change ext4 and f2fs events to be available on user builds. Bug: 74584014 Change-Id: I891a0209be981d760a828a69e4831e238248ebad
2018-03-02 11:52:56 +01:00
genfscon debugfs /tracing/events/f2fs/f2fs_sync_file_enter/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/f2fs/f2fs_sync_file_exit/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/f2fs/f2fs_write_begin/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/f2fs/f2fs_write_end/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/ext4/ext4_da_write_begin/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/ext4/ext4_da_write_end/ u:object_r:debugfs_tracing:s0
Expose filesystem read events in SELinux policy. Without this, we only have visibility into writes. Looking at traces, we realised for many of the files we care about (.dex, .apk) most filesystem events are actually reads. See aosp/661782 for matching filesystem permission change. Bug: 73625480 Change-Id: I6ec71d82fad8f4679c7b7d38e3cb90aff0b9e298
2018-04-10 17:12:54 +02:00
genfscon debugfs /tracing/events/ext4/ext4_es_lookup_extent_enter/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/ext4/ext4_es_lookup_extent_exit/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/ext4/ext4_load_inode/ u:object_r:debugfs_tracing:s0
SELinux changes for I/O tracing. See also go/perfetto-io-tracing-security. * Grant CAP_DAC_READ_SEARCH to traced_probes. * Allow traced_probes to list selected labels. * Change ext4 and f2fs events to be available on user builds. Bug: 74584014 Change-Id: I891a0209be981d760a828a69e4831e238248ebad
2018-03-02 11:52:56 +01:00
genfscon debugfs /tracing/events/ext4/ext4_sync_file_enter/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/ext4/ext4_sync_file_exit/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/block/block_rq_issue/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/block/block_rq_complete/ u:object_r:debugfs_tracing:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
Allow perfetto traced_probes to access tracefs on user Allows the traced_probes daemon to access the core ftrace functionalities on user builds. Specifically this involves: - Whitelisting the per_cpu/ subdirectory to access: 1) trace_pipe_raw file to allow perfetto to read the raw ftrace buffer (rather than the text-based /trace endpoint) 2) cpuX/stats and cpuX/buffer_size_kb that allow to tune the buffer size per-cpu pipe and to get basic statistics about the ftrace buffer (#events, overruns) - Whitelistiing the full event directories rather than the /enable files. This gives also access to the /format files for the events that are already enabled on user builds. /format files simply describe the memory layout of the binary logs. Example: https://ghostbin.com/paste/f8m4k This still does NOT allow enabling the events labeled as "_debug" (mostly events that return activity on inodes). We'll deal with that separately as soon as we get a POC of inode resolution and a sensible blacklist/whitelist model. Bug: 70942310 Change-Id: Ic15cca0a9d7bc0e45aa48097a94eadef44c333f8
2018-02-09 12:15:22 +01:00
genfscon tracefs /events/workqueue/ u:object_r:debugfs_tracing_debug:s0
genfscon tracefs /events/regulator/ u:object_r:debugfs_tracing_debug:s0
genfscon tracefs /events/pagecache/ u:object_r:debugfs_tracing_debug:s0
genfscon tracefs /events/irq/ u:object_r:debugfs_tracing_debug:s0
genfscon tracefs /events/ipi/ u:object_r:debugfs_tracing_debug:s0
Allow to read events/header_page with debugfs_tracing Bug: 110900684 Change-Id: I9fd141e0d56d0135c563467b7ca2f08b6af6700b`
2018-06-28 15:57:18 +02:00
genfscon tracefs /events/header_page u:object_r:debugfs_tracing:s0
Expose filesystem read events in SELinux policy. Without this, we only have visibility into writes. Looking at traces, we realised for many of the files we care about (.dex, .apk) most filesystem events are actually reads. See aosp/661782 for matching filesystem permission change. Bug: 73625480 Change-Id: I6ec71d82fad8f4679c7b7d38e3cb90aff0b9e298
2018-04-10 17:12:54 +02:00
genfscon tracefs /events/f2fs/f2fs_get_data_block/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/f2fs/f2fs_iget/ u:object_r:debugfs_tracing:s0
SELinux changes for I/O tracing. See also go/perfetto-io-tracing-security. * Grant CAP_DAC_READ_SEARCH to traced_probes. * Allow traced_probes to list selected labels. * Change ext4 and f2fs events to be available on user builds. Bug: 74584014 Change-Id: I891a0209be981d760a828a69e4831e238248ebad
2018-03-02 11:52:56 +01:00
genfscon tracefs /events/f2fs/f2fs_sync_file_enter/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/f2fs/f2fs_sync_file_exit/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/f2fs/f2fs_write_begin/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/f2fs/f2fs_write_end/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/ext4/ext4_da_write_begin/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/ext4/ext4_da_write_end/ u:object_r:debugfs_tracing:s0
Expose filesystem read events in SELinux policy. Without this, we only have visibility into writes. Looking at traces, we realised for many of the files we care about (.dex, .apk) most filesystem events are actually reads. See aosp/661782 for matching filesystem permission change. Bug: 73625480 Change-Id: I6ec71d82fad8f4679c7b7d38e3cb90aff0b9e298
2018-04-10 17:12:54 +02:00
genfscon tracefs /events/ext4/ext4_es_lookup_extent_enter/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/ext4/ext4_es_lookup_extent_exit/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/ext4/ext4_load_inode/ u:object_r:debugfs_tracing:s0
SELinux changes for I/O tracing. See also go/perfetto-io-tracing-security. * Grant CAP_DAC_READ_SEARCH to traced_probes. * Allow traced_probes to list selected labels. * Change ext4 and f2fs events to be available on user builds. Bug: 74584014 Change-Id: I891a0209be981d760a828a69e4831e238248ebad
2018-03-02 11:52:56 +01:00
genfscon tracefs /events/ext4/ext4_sync_file_enter/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/ext4/ext4_sync_file_exit/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/block/block_rq_issue/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/block/block_rq_complete/ u:object_r:debugfs_tracing:s0
Use a whitelisting strategy for tracefs. This changes tracefs files to be default-enabled in debug mode, but default-disabled with specific files enabled in user mode. Bug: 64762598 Test: Successfully took traces in user mode. Change-Id: I572ea22253e0c1e42065fbd1d2fd7845de06fceb
2018-01-31 03:14:45 +01:00
genfscon tracefs /trace_clock u:object_r:debugfs_tracing:s0
genfscon tracefs /buffer_size_kb u:object_r:debugfs_tracing:s0
genfscon tracefs /options/overwrite u:object_r:debugfs_tracing:s0
genfscon tracefs /options/print-tgid u:object_r:debugfs_tracing:s0
Add record-tgid tracefs support Bug: 110757800 Test: none Change-Id: I2627c43fc45a78c936fa4a7ca968c606c89b9728
2018-06-28 21:36:17 +02:00
genfscon tracefs /options/record-tgid u:object_r:debugfs_tracing:s0
Use a whitelisting strategy for tracefs. This changes tracefs files to be default-enabled in debug mode, but default-disabled with specific files enabled in user mode. Bug: 64762598 Test: Successfully took traces in user mode. Change-Id: I572ea22253e0c1e42065fbd1d2fd7845de06fceb
2018-01-31 03:14:45 +01:00
genfscon tracefs /saved_cmdlines_size u:object_r:debugfs_tracing:s0
Allow perfetto traced_probes to access tracefs on user Allows the traced_probes daemon to access the core ftrace functionalities on user builds. Specifically this involves: - Whitelisting the per_cpu/ subdirectory to access: 1) trace_pipe_raw file to allow perfetto to read the raw ftrace buffer (rather than the text-based /trace endpoint) 2) cpuX/stats and cpuX/buffer_size_kb that allow to tune the buffer size per-cpu pipe and to get basic statistics about the ftrace buffer (#events, overruns) - Whitelistiing the full event directories rather than the /enable files. This gives also access to the /format files for the events that are already enabled on user builds. /format files simply describe the memory layout of the binary logs. Example: https://ghostbin.com/paste/f8m4k This still does NOT allow enabling the events labeled as "_debug" (mostly events that return activity on inodes). We'll deal with that separately as soon as we get a POC of inode resolution and a sensible blacklist/whitelist model. Bug: 70942310 Change-Id: Ic15cca0a9d7bc0e45aa48097a94eadef44c333f8
2018-02-09 12:15:22 +01:00
genfscon tracefs /events/sched/sched_switch/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/sched/sched_wakeup/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/sched/sched_blocked_reason/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/sched/sched_cpu_hotplug/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/cgroup/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/power/cpu_frequency/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/power/cpu_idle/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/power/clock_set_rate/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/power/cpu_frequency_limits/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/cpufreq_interactive/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/vmscan/mm_vmscan_direct_reclaim_begin/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/vmscan/mm_vmscan_direct_reclaim_end/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/vmscan/mm_vmscan_kswapd_wake/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/vmscan/mm_vmscan_kswapd_sleep/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/binder/binder_transaction/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/binder/binder_transaction_received/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/binder/binder_lock/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/binder/binder_locked/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/binder/binder_unlock/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/lowmemorykiller/ u:object_r:debugfs_tracing:s0
Add sync and fence tracepoints to user-visible list of tracepoints. The 'sync' tracepoint was updated to be 'fence' in kernel 4.9, so this change also adds that one to the list. Bug: 79935503 Test: Took a trace using 'sync' in user mode and saw the tracepoints being saved. Change-Id: I793c6f54cd9364f33853983f8c5dfb28b98c2708 Merged-In: I793c6f54cd9364f33853983f8c5dfb28b98c2708
2018-05-17 03:47:42 +02:00
genfscon tracefs /events/sync/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/fence/ u:object_r:debugfs_tracing:s0
Use a whitelisting strategy for tracefs. This changes tracefs files to be default-enabled in debug mode, but default-disabled with specific files enabled in user mode. Bug: 64762598 Test: Successfully took traces in user mode. Change-Id: I572ea22253e0c1e42065fbd1d2fd7845de06fceb
2018-01-31 03:14:45 +01:00
genfscon debugfs /tracing/trace_clock u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/buffer_size_kb u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/options/overwrite u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/options/print-tgid u:object_r:debugfs_tracing:s0
Add record-tgid tracefs support Bug: 110757800 Test: none Change-Id: I2627c43fc45a78c936fa4a7ca968c606c89b9728
2018-06-28 21:36:17 +02:00
genfscon debugfs /tracing/options/record-tgid u:object_r:debugfs_tracing:s0
Use a whitelisting strategy for tracefs. This changes tracefs files to be default-enabled in debug mode, but default-disabled with specific files enabled in user mode. Bug: 64762598 Test: Successfully took traces in user mode. Change-Id: I572ea22253e0c1e42065fbd1d2fd7845de06fceb
2018-01-31 03:14:45 +01:00
genfscon debugfs /tracing/saved_cmdlines_size u:object_r:debugfs_tracing:s0
Allow perfetto traced_probes to access tracefs on user Allows the traced_probes daemon to access the core ftrace functionalities on user builds. Specifically this involves: - Whitelisting the per_cpu/ subdirectory to access: 1) trace_pipe_raw file to allow perfetto to read the raw ftrace buffer (rather than the text-based /trace endpoint) 2) cpuX/stats and cpuX/buffer_size_kb that allow to tune the buffer size per-cpu pipe and to get basic statistics about the ftrace buffer (#events, overruns) - Whitelistiing the full event directories rather than the /enable files. This gives also access to the /format files for the events that are already enabled on user builds. /format files simply describe the memory layout of the binary logs. Example: https://ghostbin.com/paste/f8m4k This still does NOT allow enabling the events labeled as "_debug" (mostly events that return activity on inodes). We'll deal with that separately as soon as we get a POC of inode resolution and a sensible blacklist/whitelist model. Bug: 70942310 Change-Id: Ic15cca0a9d7bc0e45aa48097a94eadef44c333f8
2018-02-09 12:15:22 +01:00
genfscon debugfs /tracing/events/sched/sched_switch/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/sched/sched_wakeup/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/sched/sched_blocked_reason/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/sched/sched_cpu_hotplug/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/cgroup/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/power/cpu_frequency/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/power/cpu_idle/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/power/clock_set_rate/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/power/cpu_frequency_limits/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/cpufreq_interactive/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/vmscan/mm_vmscan_direct_reclaim_begin/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/vmscan/mm_vmscan_direct_reclaim_end/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/vmscan/mm_vmscan_kswapd_wake/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/vmscan/mm_vmscan_kswapd_sleep/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/binder/binder_transaction/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/binder/binder_transaction_received/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/binder/binder_lock/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/binder/binder_locked/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/binder/binder_unlock/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/lowmemorykiller/ u:object_r:debugfs_tracing:s0
Add sync and fence tracepoints to user-visible list of tracepoints. The 'sync' tracepoint was updated to be 'fence' in kernel 4.9, so this change also adds that one to the list. Bug: 79935503 Test: Took a trace using 'sync' in user mode and saw the tracepoints being saved. Change-Id: I793c6f54cd9364f33853983f8c5dfb28b98c2708 Merged-In: I793c6f54cd9364f33853983f8c5dfb28b98c2708
2018-05-17 03:47:42 +02:00
genfscon debugfs /tracing/events/sync/ u:object_r:debugfs_tracing:s0
genfscon debugfs /tracing/events/fence/ u:object_r:debugfs_tracing:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
Support for ocontexts per device. ocontexts was split up into 4 files: 1.fs_use 2.genfs_contexts 3.initial_sid_contexts 4.port_contexts Each file has their respective declerations in them. Devices, in their respective device directory, can now specify sepolicy.fs_use, sepolicy.genfs_contexts, sepolicy.port_contexts, and sepolicy.initial_sid_contexts. These declerations will be added right behind their respective sepolicy counterparts in the concatenated configuration file.
2012-07-12 01:46:38 +02:00
genfscon inotifyfs / u:object_r:inotify:s0
Rename sdcard_internal/external types. Rename sdcard_internal/external types to fuse and vfat respectively to make it clear that they are assigned to any fuse or vfat filesystem by default (absent a context= mount option) and do not necessarily represent the SDcard. The sdcard_type attribute is still assigned to both types and can still be used in allow rules to permit access to either the internal or external SDcard. Define type aliases for the old names to preserve compatibility on policy reload and for device-specific policies that may not yet be updated. Change-Id: I8d91a8c4c1342b94e4f1bb62ca7ffd2ca4b06ba1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-07-08 20:45:09 +02:00
genfscon vfat / u:object_r:vfat:s0
Add exFAT support; unify behind "sdcard_type". We're adding support for OEMs to ship exFAT, which behaves identical to vfat. Some rules have been manually enumerating labels related to these "public" volumes, so unify them all behind "sdcard_type". Test: atest Bug: 67822822 Change-Id: I09157fd1fc666ec5d98082c6e2cefce7c8d3ae56
2018-03-30 20:22:54 +02:00
genfscon exfat / u:object_r:exfat:s0
Support for ocontexts per device. ocontexts was split up into 4 files: 1.fs_use 2.genfs_contexts 3.initial_sid_contexts 4.port_contexts Each file has their respective declerations in them. Devices, in their respective device directory, can now specify sepolicy.fs_use, sepolicy.genfs_contexts, sepolicy.port_contexts, and sepolicy.initial_sid_contexts. These declerations will be added right behind their respective sepolicy counterparts in the concatenated configuration file.
2012-07-12 01:46:38 +02:00
genfscon debugfs / u:object_r:debugfs:s0
Rename sdcard_internal/external types. Rename sdcard_internal/external types to fuse and vfat respectively to make it clear that they are assigned to any fuse or vfat filesystem by default (absent a context= mount option) and do not necessarily represent the SDcard. The sdcard_type attribute is still assigned to both types and can still be used in allow rules to permit access to either the internal or external SDcard. Define type aliases for the old names to preserve compatibility on policy reload and for device-specific policies that may not yet be updated. Change-Id: I8d91a8c4c1342b94e4f1bb62ca7ffd2ca4b06ba1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-07-08 20:45:09 +02:00
genfscon fuse / u:object_r:fuse:s0
sepolicy: Add policy for sdcardfs and configfs Change-Id: I4c318efba76e61b6ab0be9491c352f281b1c2bff Bug: 19160983
2016-03-02 01:13:50 +01:00
genfscon configfs / u:object_r:configfs:s0
genfscon sdcardfs / u:object_r:sdcardfs:s0
Label esdfs as sdcardfs Test: esdfs should be mountable and usable with selinux on Bug: 63876697 Change-Id: I7a1d96d3f0d0a6dbc1c98f0c4a96264938011b5e
2017-10-24 03:20:09 +02:00
genfscon esdfs / u:object_r:sdcardfs:s0
pstore file system labeling pstore(persistent store) have been applied since kernel 3.5 We need to label the pstore-fs in order to use Android with kernel 3.5 or upper version. My kernel version is 3.10 and I got the below denial log when I ran the "df" command on the adb shell. type=1400 msg=audit(1388540540.220:18): avc: denied { getattr } for pid=7296 comm="df" name="/" dev="pstore" ino=7703 scontext=u:r:init:s0 tcontext=u:object_r:unlabeled:s0 tclass=filesystem And the below log is also shown during booting type=1400 msg=audit(1388539193.750:4): avc: denied { mount } for pid=2844 comm="mount" name="/" dev="pstore" ino=11393 scontext=u:r:init_shell:s0 tcontext=u:object_r:unlabeled:s0 tclass=filesystem Change-Id: Iaba543d44565c4f20a77a95b9573a628bbd3fd34
2014-04-10 06:32:54 +02:00
genfscon pstore / u:object_r:pstorefs:s0
Label /dev/usb-ffs/adb functionfs Newer adbd versions use functionfs instead of a custom adb usb gadget. Make sure the functionfs filesystem is properly labeled, and that adbd has access to the functionfs files. Once labeled, this addresses the following denials: <12>[ 16.127191] type=1400 audit(949060866.189:4): avc: denied { read write } for pid=223 comm="adbd" name="ep0" dev="functionfs" ino=5489 scontext=u:r:adbd:s0 tcontext=u:object_r:functionfs:s0 tclass=file <12>[ 16.127406] type=1400 audit(949060866.189:5): avc: denied { open } for pid=223 comm="adbd" path="/dev/usb-ffs/adb/ep0" dev="functionfs" ino=5489 scontext=u:r:adbd:s0 tcontext=u:object_r:functionfs:s0 tclass=file <12>[ 377.366011] type=1400 audit(949061227.419:16): avc: denied { ioctl } for pid=225 comm="adbd" path="/dev/usb-ffs/adb/ep2" dev="functionfs" ino=5564 scontext=u:r:adbd:s0 tcontext=u:object_r:functionfs:s0 tclass=file Change-Id: Iee8b522e48b4d677fd12f7c83dbc7ffbc9543ad2
2014-04-15 23:53:05 +02:00
genfscon functionfs / u:object_r:functionfs:s0
label usbfs Right now usbfs doesn't have any labels, generating the following kernel warnings: <7>[ 3.009582] SELinux: initialized (dev usbfs, type usbfs), not configured for labeling and the occasional SELinux unlabeled auditallow logs: <4>[ 285.579254] type=1400 audit(1402010345.094:16): avc: granted { search } for pid=371 comm="qcks" name="/" dev="usbfs" ino=15794 scontext=u:r:kickstart:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir <4>[ 285.632354] type=1400 audit(1402010345.154:18): avc: granted { search } for pid=371 comm="qcks" name="001" dev="usbfs" ino=15796 scontext=u:r:kickstart:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir Make sure usbfs is assigned via genfscon Change-Id: I7191f2584014ba55a3c3a98e7efd0350dc958782
2014-06-07 16:31:31 +02:00
genfscon usbfs / u:object_r:usbfs:s0
genfs_contexts: provide a label for binfmt_misc Provide a default label for binfmt_misc. This is not used by the core policy, although it may be used in device specific policy. Bug: 20152930 Change-Id: Id51d69333bfeda40720d0e65e1539fab0b6e1e95
2015-04-11 02:42:49 +02:00
genfscon binfmt_misc / u:object_r:binfmt_miscfs:s0
sepolicy: Allow mount cgroupv2 and bpf fs Some necessary sepolicy rule changes for init process to create directory, mount cgroupv2 module and mount bpf filesystem. Also allow netd to create and pin bpf object as files and read it back from file under the directory where bpf filesystem is mounted. Test: bpf maps show up under /sys/fs/bpf/ Change-Id: I579d04f60d7e20bd800d970cd28cd39fda9d20a0
2017-08-02 03:06:18 +02:00
genfscon bpf / u:object_r:fs_bpf:s0
Reference in a new issue Copy permalink