tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/rild.te

50 lines
1.7 KiB
Text
Raw Normal View History

SE Android policy.
2012-01-04 18:33:27 +01:00
# rild - radio interface layer daemon
Grant rild and gatekeeperd access to hwservicemanager In my commit f41d89eb249ca1f9fce41d86852047f924b1714e I forgot to switch rild and gatekeeperd rules from explicitly associating these domains with the hal_telephony and hal_gatekeeper to using the hal_impl_domain macro. As a result, the recent commit a25192262b7bde0d480910b9662027c8617cccba inadvertently revoked HwBinder access from rild and gatekeeperd. This commit fixes the issue by switching rild and gatekeeperd to the hal_impl_domain macro. Test: "sepolicy-analyze out/target/product/bullhead/root/sepolicy attribute haldomain" now lists rild and gatekeeperd Test: "sepolicy-analyze out/target/product/bullhead/root/sepolicy attribute hal_telephony" still lists rild Test: "sepolicy-analyze out/target/product/bullhead/root/sepolicy attribute hal_gatekeeper" still lists gatekeeperd Bug: 34180936 Bug: 34470443 Change-Id: I7949556f58c36811205d5ea3ee78ea5708e95b45
2017-01-20 21:49:35 +01:00
type rild, domain, domain_deprecated;
hal_impl_domain(rild, hal_telephony)
SE Android policy.
2012-01-04 18:33:27 +01:00
net_domain(rild)
Enforce ioctl command whitelisting on all sockets Remove the ioctl permission for most socket types. For others, such as tcp/udp/rawip/unix_dgram/unix_stream set a default unprivileged whitelist that individual domains may extend (except where neverallowed like untrusted_app). Enforce via a neverallowxperm rule. Change-Id: I15548d830f8eff1fd4d64005c5769ca2be8d4ffe
2016-05-17 06:12:17 +02:00
allowxperm rild self:udp_socket ioctl priv_sock_ioctls;
Clean up socket rules. Replace * or any permission set containing create with create_socket_perms or create_stream_socket_perms. Add net_domain() to all domains using network sockets and delete rules already covered by domain.te or net.te. For netlink_route_socket, only nlmsg_write needs to be separately granted to specific domains that are permitted to modify the routing table. Clarification: read/write permissions are just ability to perform read/recv() or write/send() on the socket, whereas nlmsg_read/ nlmsg_write permissions control ability to observe or modify the underlying kernel state accessed via the socket. See security/selinux/nlmsgtab.c in the kernel for the mapping of netlink message types to nlmsg_read or nlmsg_write. Delete legacy rule for b/12061011. This change does not touch any rules where only read/write were allowed to a socket created by another domain (inherited across exec or received across socket or binder IPC). We may wish to rewrite some or all of those rules with the rw_socket_perms macro but that is a separate change. Change-Id: Ib0637ab86f6d388043eff928e5d96beb02e5450e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 21:06:11 +01:00
allow rild self:netlink_route_socket nlmsg_write;
Confine rild, but leave it permissive for now. Change-Id: I6df9981b2af0150c6379a0ebdbe0a8597c994f4a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:39 +01:00
allow rild kernel:system module_request;
Fix rild policy to accomodate minijail Fix denials related to lack of setgid and setpcap priviledges. These were introduced when minijail was used to do sandboxing. Bug: 28178548 Change-Id: I85fd4abbe55258de61d20d827baf59bbca0679e7 Test: rild no longer crash loops
2016-05-17 17:59:37 +02:00
allow rild self:capability { setpcap setgid setuid net_admin net_raw };
Confine rild, but leave it permissive for now. Change-Id: I6df9981b2af0150c6379a0ebdbe0a8597c994f4a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:39 +01:00
allow rild alarm_device:chr_file rw_file_perms;
allow rild cgroup:dir create_dir_perms;
audit domain_deprecated perms for removal Grant permissions observed. Bug: 28760354 Change-Id: Ie63cda709319bbf635ef7bffbba3477c2cccc11b
2016-09-10 01:27:17 +02:00
allow rild cgroup:{ file lnk_file } r_file_perms;
Confine rild, but leave it permissive for now. Change-Id: I6df9981b2af0150c6379a0ebdbe0a8597c994f4a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:39 +01:00
allow rild radio_device:chr_file rw_file_perms;
allow rild radio_device:blk_file r_file_perms;
allow rild mtd_device:dir search;
allow rild efs_file:dir create_dir_perms;
allow rild efs_file:file create_file_perms;
allow rild shell_exec:file rx_file_perms;
allow rild bluetooth_efs_file:file r_file_perms;
allow rild bluetooth_efs_file:dir r_dir_perms;
allow rild radio_data_file:dir rw_dir_perms;
allow rild radio_data_file:file create_file_perms;
allow rild sdcard_type:dir r_dir_perms;
Remove write access to system_data_file from rild. Anything writable by rild should be in radio_data_file or efs_file. System data should be read-only. Change-Id: I442a253c22f567a147d0591d623e97a6ee8b76e3 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-03-18 19:01:27 +01:00
allow rild system_data_file:dir r_dir_perms;
allow rild system_data_file:file r_file_perms;
Confine rild, but leave it permissive for now. Change-Id: I6df9981b2af0150c6379a0ebdbe0a8597c994f4a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:39 +01:00
allow rild system_file:file x_file_perms;
# property service
Replace unix_socket_connect() and explicit property sets with macro A common source of mistakes when authoring sepolicy is properly setting up property sets. This is a 3 part step of: 1. Allowing the unix domain connection to the init/property service 2. Allowing write on the property_socket file 3. Allowing the set on class property_service The macro unix_socket_connect() handled 1 and 2, but could be confusing for first time policy authors. 3 had to be explicitly added. To correct this, we introduce a new macros: set_prop(sourcedomain, targetprop) This macro handles steps 1, 2 and 3. No difference in sediff is expected. Change-Id: I630ba0178439c935d08062892990d43a3cc1239e Signed-off-by: William Roberts <william.c.roberts@linux.intel.com>
2015-05-05 03:22:45 +02:00
set_prop(rild, radio_prop)
Confine rild, but leave it permissive for now. Change-Id: I6df9981b2af0150c6379a0ebdbe0a8597c994f4a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:39 +01:00
allow rild tty_device:chr_file rw_file_perms;
Clean up socket rules. Replace * or any permission set containing create with create_socket_perms or create_stream_socket_perms. Add net_domain() to all domains using network sockets and delete rules already covered by domain.te or net.te. For netlink_route_socket, only nlmsg_write needs to be separately granted to specific domains that are permitted to modify the routing table. Clarification: read/write permissions are just ability to perform read/recv() or write/send() on the socket, whereas nlmsg_read/ nlmsg_write permissions control ability to observe or modify the underlying kernel state accessed via the socket. See security/selinux/nlmsgtab.c in the kernel for the mapping of netlink message types to nlmsg_read or nlmsg_write. Delete legacy rule for b/12061011. This change does not touch any rules where only read/write were allowed to a socket created by another domain (inherited across exec or received across socket or binder IPC). We may wish to rewrite some or all of those rules with the rw_socket_perms macro but that is a separate change. Change-Id: Ib0637ab86f6d388043eff928e5d96beb02e5450e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 21:06:11 +01:00
# Allow rild to create and use netlink sockets.
Enforce ioctl command whitelisting on all sockets Remove the ioctl permission for most socket types. For others, such as tcp/udp/rawip/unix_dgram/unix_stream set a default unprivileged whitelist that individual domains may extend (except where neverallowed like untrusted_app). Enforce via a neverallowxperm rule. Change-Id: I15548d830f8eff1fd4d64005c5769ca2be8d4ffe
2016-05-17 06:12:17 +02:00
allow rild self:netlink_socket create_socket_perms_no_ioctl;
allow rild self:netlink_generic_socket create_socket_perms_no_ioctl;
allow rild self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
Introduce controls on wake lock interface Change-Id: Ie0ee266e9e6facb2ab2abd652f68765239a41af1
2013-09-29 00:46:21 +02:00
# Access to wake locks
Introduce wakelock_use() Introduce wakelock_use(). This macro declares that a domain uses wakelocks. Wakelocks require both read-write access to files in /sys/power, and CAP_BLOCK_SUSPEND. This macro helps ensure that both capabilities and file access are granted at the same time. Still TODO: fix device specific wakelock use. Change-Id: Ib98ff374a73f89e403acd9f5e024988f59f08115
2014-05-23 22:33:32 +02:00
wakelock_use(rild)
Fix new rild denials. Denials seen on hammerhead but seem appropriate for general policy. <5>[ 8.339347] type=1400 audit(3731546.390:17): avc: denied { ioctl } for pid=314 comm="rild" path="socket:[7996]" dev="sockfs" ino=7996 scontext=u:r:rild:s0 tcontext=u:r:rild:s0 tclass=socket <5>[ 8.339065] type=1400 audit(3731546.390:16): avc: denied { create } for pid=314 comm="rild" scontext=u:r:rild:s0 tcontext=u:r:rild:s0 tclass=socket <5>[ 11.232121] type=1400 audit(3731549.289:22): avc: denied { read } for pid=620 comm="rild" scontext=u:r:rild:s0 tcontext=u:r:rild:s0 tclass=socket Change-Id: Ieaca5360afbb44d5da21c7c24bdd5e7c5758f0a2
2013-12-05 23:24:03 +01:00
audit domain_deprecated perms for removal Grant permissions observed. Bug: 28760354 Change-Id: Ie63cda709319bbf635ef7bffbba3477c2cccc11b
2016-09-10 01:27:17 +02:00
r_dir_file(rild, proc)
domain_deprecated.te: remove /proc/net access Remove /proc/net access to domain_deprecated. Add it to domains where it was missing before. Other than these domains, SELinux denial monitoring hasn't picked up any denials related to /proc/net Bug: 28760354 Test: Device boots Test: No unexpected denials in denial collection logs. Change-Id: Ie5bfa4bc0070793c1e8bf3b00676fd31c08d426a
2016-12-01 00:22:18 +01:00
r_dir_file(rild, proc_net)
audit domain_deprecated perms for removal Grant permissions observed. Bug: 28760354 Change-Id: Ie63cda709319bbf635ef7bffbba3477c2cccc11b
2016-09-10 01:27:17 +02:00
r_dir_file(rild, sysfs_type)
r_dir_file(rild, system_file)
Enforce ioctl command whitelisting on all sockets Remove the ioctl permission for most socket types. For others, such as tcp/udp/rawip/unix_dgram/unix_stream set a default unprivileged whitelist that individual domains may extend (except where neverallowed like untrusted_app). Enforce via a neverallowxperm rule. Change-Id: I15548d830f8eff1fd4d64005c5769ca2be8d4ffe
2016-05-17 06:12:17 +02:00
# granting the ioctl permission for rild should be device specific
allow rild self:socket create_socket_perms_no_ioctl;
SEPolicy changes for radio hal. Test: none Bug: 32020264 Change-Id: If5f22dad672895b3684b8e44209c5a1eae16ba47
2016-12-01 20:36:44 +01:00
Reference in a new issue Copy permalink