platform_system_sepolicy/public/su.te

# Domain used for su processes, as well as for adbd and adb shell
# after performing an adb root command.

# All types must be defined regardless of build variant to ensure
# policy compilation succeeds with userdebug/user combination at boot
type su, domain;

# File types must be defined for file_contexts.
type su_exec, system_file_type, exec_type, file_type;

# system/sepolicy/public is for vendor-facing type and attribute definitions.
# DO NOT ADD allow, neverallow, or dontaudit statements here.
# Instead, add such policy rules to system/sepolicy/private/*.te.
Remove redundant sepolicy We don't use MLS in Microdroid, so we don't need MLS rules, nor mlstrusted[subject\|object] labels. (We keep one MLS rule to satisfy checkpolicy.) A lot of attributes are unused in Microdroid, so we can remove their declarations and any references to them. (That may not make the compiled policy smaller, since hopefully they get optimised out anyway, but it means there is less policy for humans to deal with.) Remove labels that relate only to apps, which we don't have - MAC permissions, run-as, seapp_contexts. In passing, fix a comment snafu in both system & microdroid policy. Bug: 223596375 Test: Run staged-apex-compile & compos_verify, no denials Test: atest MicrodroidTests MicrodroidHostTestCases Change-Id: Ifd3589945a2d8b4c0361e00eec5678795513fd8c 2022-03-09 17:41:06 +01:00			`# Domain used for su processes, as well as for adbd and adb shell`
			`# after performing an adb root command.`

Make sure all public types are defined regardless of build variants The types need to be exported so userdebug system.img can still build the policy with a user vendor.img at boot time. All permissions and attributes for these types are still kept under conditional userdebug_or_eng macro Bug: 37433251 Test: Boot sailfish-user build with generic_arm64_ab system.img on sailfish and make sure sepolicy compilation succeeds Change-Id: I98e8428c414546dfc74641700d4846edcf9355b1 Signed-off-by: Sandeep Patil <sspatil@google.com> 2017-04-20 20:40:24 +02:00			`# All types must be defined regardless of build variant to ensure`
			`# policy compilation succeeds with userdebug/user combination at boot`
			`type su, domain;`

sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317 2016-10-12 23:58:09 +02:00			`# File types must be defined for file_contexts.`
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5 2018-09-27 19:21:37 +02:00			`type su_exec, system_file_type, exec_type, file_type;`
Add "DO NOT ADD statements" comments to public For visibility Bug: 232023812 Test: N/A Change-Id: I0bc6dc568210b81ba1f52acb18afd4bcc454ea1c 2024-03-28 02:37:28 +01:00
			`# system/sepolicy/public is for vendor-facing type and attribute definitions.`
			`# DO NOT ADD allow, neverallow, or dontaudit statements here.`
			`# Instead, add such policy rules to system/sepolicy/private/*.te.`