platform_system_sepolicy/private/su.te

userdebug_or_eng(`
  typeattribute su coredomain;

  domain_auto_trans(shell, su_exec, su)
  # Allow dumpstate to call su on userdebug / eng builds to collect
  # additional information.
  domain_auto_trans(dumpstate, su_exec, su)

  # Make sure that dumpstate runs the same from the "su" domain as
  # from the "init" domain.
  domain_auto_trans(su, dumpstate_exec, dumpstate)

  # Put the incident command into its domain so it is the same on user, userdebug and eng.
  domain_auto_trans(su, incident_exec, incident)

  # Put the perfetto command into its domain so it is the same on user, userdebug and eng.
  domain_auto_trans(su, perfetto_exec, perfetto)

  # su is also permissive to permit setenforce.
  permissive su;

  app_domain(su)
')
Create new conditional userdebug_or_eng Create a new m4 macro called userdebug_or_eng. Arguments passed to this macro are only emitted if we're performing a userdebug or eng build. Merge shell.te and shell_user.te and eliminate duplicate lines. Same for su.te and su_user.te Change-Id: I8fbabca65ec392aeafd5b90cef57b5066033fad0 2014-01-10 00:25:36 +01:00			userdebug_or_eng(`
su and perfprofd are coredomain too This is a follow-up to f5446eb1486816c00136b2b5f0a3cc4a01706000 where I forgot to associate su and perfprofd domains with coredomain. Test: mmm system/sepolicy sepolicy-analyze $OUT/root/sepolicy attribute coredomain Bug: 35870313 Change-Id: I13f90693843f7c6fe9fea8e5332aa6dd9558478a 2017-03-24 17:30:19 +01:00			`typeattribute su coredomain;`

Create new conditional userdebug_or_eng Create a new m4 macro called userdebug_or_eng. Arguments passed to this macro are only emitted if we're performing a userdebug or eng build. Merge shell.te and shell_user.te and eliminate duplicate lines. Same for su.te and su_user.te Change-Id: I8fbabca65ec392aeafd5b90cef57b5066033fad0 2014-01-10 00:25:36 +01:00			`domain_auto_trans(shell, su_exec, su)`
			`# Allow dumpstate to call su on userdebug / eng builds to collect`
			`# additional information.`
			`domain_auto_trans(dumpstate, su_exec, su)`
Restrict the ability to set SELinux enforcing mode to init. Also make su and shell permissive in non-user builds to allow use of setenforce without violating the neverallow rule. Change-Id: Ie76ee04e90d5a76dfaa5f56e9e3eb7e283328a3f Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-12-02 20:18:11 +01:00
Dumpstate runs the same from shell as service. Without this change, any selinux warning you might get when running dumpstate from init do not show up when running from the shell as root. This change makes them run the same. Change-Id: I6b74e0f6f48f47952a2dbe7728b1853008f60dbb 2015-01-29 21:11:55 +01:00			`# Make sure that dumpstate runs the same from the "su" domain as`
			`# from the "init" domain.`
			`domain_auto_trans(su, dumpstate_exec, dumpstate)`

Add incident command and incidentd daemon se policy. Test: adb shell incident Bug: 31122534 Change-Id: I4ac9c9ab86867f09b63550707673149fe60f1906 2016-11-21 08:23:04 +01:00			`# Put the incident command into its domain so it is the same on user, userdebug and eng.`
			`domain_auto_trans(su, incident_exec, incident)`

SELinux policies for Perfetto cmdline client (/system/bin/perfetto) Instead of having statsd linking the perfetto client library and talk directly to its socket, we let just statsd exec() the /system/bin/perfetto cmdline client. There are two reasons for this: 1) Simplify the interaction between statsd and perfetto, reduce dependencies, binary size bloat and isolate faults. 2) The cmdline client also takes care of handing the trace to Dropbox. This allows to expose the binder interaction surface to the short-lived cmdline client and avoid to grant binder access to the perfetto traced daemon. This cmdline client will be used by: - statsd - the shell user (for our UI and Studio) Bug: 70942310 Change-Id: I8cdde181481ad0a1a5cae5937ac446cedac54a1f 2018-01-24 17:07:09 +01:00			`# Put the perfetto command into its domain so it is the same on user, userdebug and eng.`
			`domain_auto_trans(su, perfetto_exec, perfetto)`

whitespace fix. Test: code compiles. Change-Id: I2677ebdaf7ca491c60697da9d3ebf5a5d8cb5036 2017-11-01 18:17:28 +01:00			`# su is also permissive to permit setenforce.`
Create new conditional userdebug_or_eng Create a new m4 macro called userdebug_or_eng. Arguments passed to this macro are only emitted if we're performing a userdebug or eng build. Merge shell.te and shell_user.te and eliminate duplicate lines. Same for su.te and su_user.te Change-Id: I8fbabca65ec392aeafd5b90cef57b5066033fad0 2014-01-10 00:25:36 +01:00			`permissive su;`
Make su a net domain. Change-Id: Ied6e6eba4895524cf8b442694cc48ef2d6f9a811 2014-05-02 23:50:26 +02:00
Restore app_domain macro and move to private use. app_domain was split up in commit: 2e00e6373faa6271d7839d33c5b9e69d998ff020 to enable compilation by hiding type_transition rules from public policy. These rules need to be hidden from public policy because they describe how objects are labeled, of which non-platform should be unaware. Instead of cutting apart the app_domain macro, which non-platform policy may rely on for implementing new app types, move all app_domain calls to private policy. (cherry-pick of commit: 76035ea01971156895cf0d8efc1876bfa2025bd6) Bug: 33428593 Test: bullhead and sailfish both boot. sediff shows no policy change. Change-Id: I4beead8ccc9b6e13c6348da98bb575756f539665 2016-12-08 20:23:34 +01:00			`app_domain(su)`
Create new conditional userdebug_or_eng Create a new m4 macro called userdebug_or_eng. Arguments passed to this macro are only emitted if we're performing a userdebug or eng build. Merge shell.te and shell_user.te and eliminate duplicate lines. Same for su.te and su_user.te Change-Id: I8fbabca65ec392aeafd5b90cef57b5066033fad0 2014-01-10 00:25:36 +01:00			`')`