platform_system_sepolicy/public/gatekeeperd.te

type gatekeeperd, domain;
type gatekeeperd_exec, exec_type, file_type;

# gatekeeperd
binder_service(gatekeeperd)
binder_use(gatekeeperd)

### Rules needed when Gatekeeper HAL runs inside gatekeeperd process.
### These rules should eventually be granted only when needed.
allow gatekeeperd tee_device:chr_file rw_file_perms;
allow gatekeeperd ion_device:chr_file r_file_perms;
# Load HAL implementation
allow gatekeeperd system_file:dir r_dir_perms;
###

### Rules needed when Gatekeeper HAL runs outside of gatekeeperd process.
### These rules should eventually be granted only when needed.
hal_client_domain(gatekeeperd, hal_gatekeeper)
###

# need to find KeyStore and add self
add_service(gatekeeperd, gatekeeper_service)

# Need to add auth tokens to KeyStore
use_keystore(gatekeeperd)
allow gatekeeperd keystore:keystore_key { add_auth };

# For permissions checking
allow gatekeeperd system_server:binder call;
allow gatekeeperd permission_service:service_manager find;

# for SID file access
allow gatekeeperd gatekeeper_data_file:dir rw_dir_perms;
allow gatekeeperd gatekeeper_data_file:file create_file_perms;

# For hardware properties retrieval
allow gatekeeperd hardware_properties_service:service_manager find;

r_dir_file(gatekeeperd, cgroup)
Grant rild and gatekeeperd access to hwservicemanager In my commit f41d89eb249ca1f9fce41d86852047f924b1714e I forgot to switch rild and gatekeeperd rules from explicitly associating these domains with the hal_telephony and hal_gatekeeper to using the hal_impl_domain macro. As a result, the recent commit a25192262b7bde0d480910b9662027c8617cccba inadvertently revoked HwBinder access from rild and gatekeeperd. This commit fixes the issue by switching rild and gatekeeperd to the hal_impl_domain macro. Test: "sepolicy-analyze out/target/product/bullhead/root/sepolicy attribute haldomain" now lists rild and gatekeeperd Test: "sepolicy-analyze out/target/product/bullhead/root/sepolicy attribute hal_telephony" still lists rild Test: "sepolicy-analyze out/target/product/bullhead/root/sepolicy attribute hal_gatekeeper" still lists gatekeeperd Bug: 34180936 Bug: 34470443 Change-Id: I7949556f58c36811205d5ea3ee78ea5708e95b45 2017-01-20 21:49:35 +01:00			`type gatekeeperd, domain;`
SELinux permissions for gatekeeper TEE proxy sets up: - execute permissions - binder permission (system_server->gatekeeper->keystore) - prevents dumpstate and shell from finding GK binder service - neverallow rules for prohibited clients Change-Id: I1817933a91de625db469a20c7a4c8e2ca46efa1e 2015-04-04 01:46:33 +02:00			`type gatekeeperd_exec, exec_type, file_type;`

			`# gatekeeperd`
Expand access to gatekeeperd. This enables access to gatekeeperd for anybody who invokes Android framework APIs. This is necessary because the AndroidKeyStore abstraction offered by the framework API occasionally communicates with gatekeeperd from the calling process. (cherry picked from commit effcac7d7eddded5fa31d294dfe3fd1757de51c7) Bug: 20526234 Change-Id: I450242cd085259b3f82f36f359ee65ff27bebd13 2015-04-29 01:51:26 +02:00			`binder_service(gatekeeperd)`
SELinux permissions for gatekeeper TEE proxy sets up: - execute permissions - binder permission (system_server->gatekeeper->keystore) - prevents dumpstate and shell from finding GK binder service - neverallow rules for prohibited clients Change-Id: I1817933a91de625db469a20c7a4c8e2ca46efa1e 2015-04-04 01:46:33 +02:00			`binder_use(gatekeeperd)`

Remove hal_gatekeeper from gatekeeperd domain HAL clients should not be annotated with hal_x and haldomain. This may grant them too much access. Instead, the policy needed for using in-process HALs should be directly embedded into the client's domain rules. This partially reverts the moving of rules out of gatekeeperd in commit a9ce208680b3a9c1ddcf9bfce886909b66297964. Test: Set up PIN-protected secure lock screen, unlock screen, reboot, unlock. No SELinux denials in gatekeeperd or hal_gatekeeper*. Bug: 34715716 Change-Id: If87c865461580ff861e7e228a96d315d319e1765 2017-01-25 21:39:35 +01:00			`### Rules needed when Gatekeeper HAL runs inside gatekeeperd process.`
			`### These rules should eventually be granted only when needed.`
			`allow gatekeeperd tee_device:chr_file rw_file_perms;`
			`allow gatekeeperd ion_device:chr_file r_file_perms;`
			`# Load HAL implementation`
			`allow gatekeeperd system_file:dir r_dir_perms;`
			`###`

			`### Rules needed when Gatekeeper HAL runs outside of gatekeeperd process.`
			`### These rules should eventually be granted only when needed.`
Annotate most remaining HALs with _client/_server This switches most remaining HALs to the _client/_server approach. To unblock efforts blocked on majority of HALs having to use this model, this change does not remove unnecessary rules from clients of these HALs. That work will be performed in follow-up commits. This commit only adds allow rules and thus does not break existing functionality. The HALs not yet on the _client/_server model after this commit are: * Allocator HAL, because it's non-trivial to declare all apps except isolated apps as clients of this HAL, which they are. * Boot HAL, because it's still on the non-attributized model and I'm waiting for update_engine folks to answer a couple of questions which will let me refactor the policy of this HAL. Test: mmm system/sepolicy Test: Device boots, no new denials Test: Device boots in recovery mode, no new denials Bug: 34170079 Change-Id: I03e6bcec2fa02f14bdf17d11f7367b62c68a14b9 2017-03-17 02:48:40 +01:00			`hal_client_domain(gatekeeperd, hal_gatekeeper)`
Remove hal_gatekeeper from gatekeeperd domain HAL clients should not be annotated with hal_x and haldomain. This may grant them too much access. Instead, the policy needed for using in-process HALs should be directly embedded into the client's domain rules. This partially reverts the moving of rules out of gatekeeperd in commit a9ce208680b3a9c1ddcf9bfce886909b66297964. Test: Set up PIN-protected secure lock screen, unlock screen, reboot, unlock. No SELinux denials in gatekeeperd or hal_gatekeeper*. Bug: 34715716 Change-Id: If87c865461580ff861e7e228a96d315d319e1765 2017-01-25 21:39:35 +01:00			`###`

Allow gatekeeperd to check Android permissions Change-Id: Ie88568c43642505f68d137843a1f6b7a3de481e5 2015-04-09 04:52:19 +02:00			`# need to find KeyStore and add self`
te_macros: introduce add_service() macro Introduce the add_service() macro which wraps up add/find permissions for the source domain with a neverallow preventing others from adding it. Only a particular domain should add a particular service. Use the add_service() macro to automatically add a neverallow that prevents other domains from adding the service. mediadrmserver was adding services labeled mediaserver_service. Drop the add permission as it should just need the find permission. Additionally, the macro adds the { add find } permission which causes some existing neverallow's to assert. Adjust those neverallow's so "self" can always find. Test: compile and run on hikey and emulator. No new denials were found, and all services, where applicable, seem to be running OK. Change-Id: Ibbd2a5304edd5f8b877bc86852b0694732be993c Signed-off-by: William Roberts <william.c.roberts@intel.com> 2017-01-19 22:23:52 +01:00			`add_service(gatekeeperd, gatekeeper_service)`
SELinux permissions for gatekeeper TEE proxy sets up: - execute permissions - binder permission (system_server->gatekeeper->keystore) - prevents dumpstate and shell from finding GK binder service - neverallow rules for prohibited clients Change-Id: I1817933a91de625db469a20c7a4c8e2ca46efa1e 2015-04-04 01:46:33 +02:00
Allow gatekeeperd to check Android permissions Change-Id: Ie88568c43642505f68d137843a1f6b7a3de481e5 2015-04-09 04:52:19 +02:00			`# Need to add auth tokens to KeyStore`
Allow gatekeeperd to use keystore needs to call addAuthToken Change-Id: If519df61448f19dfafab254668c17eea6c161ea4 2015-04-13 21:21:08 +02:00			`use_keystore(gatekeeperd)`
SELinux permissions for gatekeeper TEE proxy sets up: - execute permissions - binder permission (system_server->gatekeeper->keystore) - prevents dumpstate and shell from finding GK binder service - neverallow rules for prohibited clients Change-Id: I1817933a91de625db469a20c7a4c8e2ca46efa1e 2015-04-04 01:46:33 +02:00			`allow gatekeeperd keystore:keystore_key { add_auth };`

Allow gatekeeperd to check Android permissions Change-Id: Ie88568c43642505f68d137843a1f6b7a3de481e5 2015-04-09 04:52:19 +02:00			`# For permissions checking`
			`allow gatekeeperd system_server:binder call;`
			`allow gatekeeperd permission_service:service_manager find;`
gatekeeper HAL service: add security policy Change-Id: I79a305407c3a362d7be11f4c026f31f1e9666f1c Signed-off-by: Alexey Polyudov <apolyudov@google.com> 2016-10-20 20:20:25 +02:00
New rules for SID access Change-Id: Ia9df151cc64ad74133db2095a935220ef9f3ea8e 2015-04-16 22:40:57 +02:00			`# for SID file access`
gatekeeperd: use more specific label for /data file Use a more specific label for /data/misc/gatekeeper Rearrange some other rules. Change-Id: Ib634e52526cf31a8f0a0e6d12bbf0f69dff8f6b5 2015-04-18 02:56:31 +02:00			`allow gatekeeperd gatekeeper_data_file:dir rw_dir_perms;`
			`allow gatekeeperd gatekeeper_data_file:file create_file_perms;`
New rules for SID access Change-Id: Ia9df151cc64ad74133db2095a935220ef9f3ea8e 2015-04-16 22:40:57 +02:00
Allow gatekeeper to find hardwareproperties service. Bug: 26945055 Change-Id: I5745d02be9889f6a0e02de12bd8d8f2808de9ce0 2016-02-12 20:21:06 +01:00			`# For hardware properties retrieval`
Renamed hardwareproperties to hardware_properties Bug: 27531271 Change-Id: I3c5eee86d09696373ab155f93ba6c85da224cb51 2016-03-09 18:13:11 +01:00			`allow gatekeeperd hardware_properties_service:service_manager find;`
Allow gatekeeper to find hardwareproperties service. Bug: 26945055 Change-Id: I5745d02be9889f6a0e02de12bd8d8f2808de9ce0 2016-02-12 20:21:06 +01:00
audit domain_deprecated perms for removal Grant permissions observed. Bug: 28760354 Change-Id: Ie63cda709319bbf635ef7bffbba3477c2cccc11b 2016-09-10 01:27:17 +02:00			`r_dir_file(gatekeeperd, cgroup)`