platform_system_sepolicy/public/idmap.te

# idmap, when executed by installd
type idmap, domain;
type idmap_exec, system_file_type, exec_type, file_type;

# system/sepolicy/public is for vendor-facing type and attribute definitions.
# DO NOT ADD allow, neverallow, or dontaudit statements here.
# Instead, add such policy rules to system/sepolicy/private/*.te.
Run idmap in its own domain. Run idmap in its own domain rather than leaving it in installd's domain. This prevents misuse of installd's permissions by idmap. zygote also needs to run idmap. For now, just run it in zygote's domain as it was previously since that is what is done for dex2oat invocation by zygote. zygote appears to run idmap with system uid while installd runs it with app UIDs, so using different domains seems appropriate. Remove system_file execute_no_trans from both installd and zygote; this should no longer be needed with explicit labels for dex2oat and idmap. Change-Id: If47e2c1326b84c20e94a20f5e699300dce12bdfe Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2015-06-19 19:47:26 +02:00			`# idmap, when executed by installd`
remove more domain_deprecated Test: no denials showing up in log collection Test: device boots Bug: 28760354 Change-Id: I089cfcf486464952fcbb52cce9f6152caf662c23 2016-12-10 04:30:39 +01:00			`type idmap, domain;`
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5 2018-09-27 19:21:37 +02:00			`type idmap_exec, system_file_type, exec_type, file_type;`
Add "DO NOT ADD statements" comments to public For visibility Bug: 232023812 Test: N/A Change-Id: I0bc6dc568210b81ba1f52acb18afd4bcc454ea1c 2024-03-28 02:37:28 +01:00
			`# system/sepolicy/public is for vendor-facing type and attribute definitions.`
			`# DO NOT ADD allow, neverallow, or dontaudit statements here.`
			`# Instead, add such policy rules to system/sepolicy/private/*.te.`