tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/bluetooth.te

77 lines
2.8 KiB
Text
Raw Normal View History

Update policy for Android 4.2 / latest master. Update policy for Android 4.2 / latest master. Primarily this consists of changes around the bluetooth subsystem. The zygote also needs further permissions to set up /storage/emulated. adbd service now gets a socket under /dev/socket. keystore uses the binder. Change-Id: I8c5aeb8d100313c75169734a0fa614aa974b3bfc Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-11-16 15:06:47 +01:00
# bluetooth subsystem
Create attribute for moving perms out of domain Motivation: Domain is overly permissive. Start removing permissions from domain and assign them to the domain_deprecated attribute. Domain_deprecated and domain can initially be assigned to all domains. The goal is to not assign domain_deprecated to new domains and to start removing domain_deprecated where it is not required or reassigning the appropriate permissions to the inheriting domain when necessary. Bug: 25433265 Change-Id: I8b11cb137df7bdd382629c98d916a73fe276413c
2015-11-03 18:54:39 +01:00
type bluetooth, domain, domain_deprecated;
Update policy for Android 4.2 / latest master. Update policy for Android 4.2 / latest master. Primarily this consists of changes around the bluetooth subsystem. The zygote also needs further permissions to set up /storage/emulated. adbd service now gets a socket under /dev/socket. keystore uses the binder. Change-Id: I8c5aeb8d100313c75169734a0fa614aa974b3bfc Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-11-16 15:06:47 +01:00
app_domain(bluetooth)
Resolve overlapping rules between app.te and net.te. There is some overlap between socket rules in app.te and the net.te rules, but they aren't quite identical since not all app domains presently include the net_domain() macro and because the rules in app.te allow more permissions for netlink_route_socket and allow rawip_socket permissions for ping. The current app.te rules prevent one from ever creating a non-networked app domain. Resolve this overlap by: 1) Adding the missing permissions allowed by app.te to net.te for netlink_route_socket and rawip_socket. 2) Adding net_domain() calls to all existing app domains that do not already have it. 3) Deleting the redundant socket rules from app.te. Then we'll have no effective change in what is allowed for apps but allow one to define app domains in the future that are not allowed network access. Also cleanup net.te to use the create_socket_perms macro rather than * and add macros for stream socket permissions. Change-Id: I6e80d65b0ccbd48bd2b7272c083a4473e2b588a9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 16:48:03 +01:00
net_domain(bluetooth)
Enforce ioctl command whitelisting on all sockets Remove the ioctl permission for most socket types. For others, such as tcp/udp/rawip/unix_dgram/unix_stream set a default unprivileged whitelist that individual domains may extend (except where neverallowed like untrusted_app). Enforce via a neverallowxperm rule. Change-Id: I15548d830f8eff1fd4d64005c5769ca2be8d4ffe
2016-05-17 06:12:17 +02:00
# Allow access to net_admin ioctls
allowxperm bluetooth self:udp_socket ioctl priv_sock_ioctls;
Confine bluetooth app. Remove unconfined_domain() from the bluetooth app domain, restore the rules from our policy, and move the neverallow rule for bluetooth capabilities to bluetooth.te. Make the bluetooth domain permissive again until it has received sufficient testing. Change-Id: I3b3072d76e053eefd3d0e883a4fdb7c333bbfc09 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-22 18:56:32 +02:00
Minor cleanup to align the content with AOSP No functional changes. Change-Id: Ic9e5aae5b4a214f5dc4c710e7bdcd51eb7b63e75
2015-12-29 01:54:53 +01:00
wakelock_use(bluetooth);
Confine bluetooth app. Remove unconfined_domain() from the bluetooth app domain, restore the rules from our policy, and move the neverallow rule for bluetooth capabilities to bluetooth.te. Make the bluetooth domain permissive again until it has received sufficient testing. Change-Id: I3b3072d76e053eefd3d0e883a4fdb7c333bbfc09 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-22 18:56:32 +02:00
# Data file accesses.
allow bluetooth bluetooth_data_file:dir create_dir_perms;
allow bluetooth bluetooth_data_file:notdevfile_class_set create_file_perms;
Allow bluetooth service to access bluetooth directory and add /logs (6/6) Bug: 31466840 Change-Id: I3984754034349e6c41de6ae9cccbaab95ca5a918
2016-09-16 21:55:42 +02:00
allow bluetooth bluetooth_logs_data_file:dir rw_dir_perms;
allow bluetooth bluetooth_logs_data_file:file create_file_perms;
Confine bluetooth app. Remove unconfined_domain() from the bluetooth app domain, restore the rules from our policy, and move the neverallow rule for bluetooth capabilities to bluetooth.te. Make the bluetooth domain permissive again until it has received sufficient testing. Change-Id: I3b3072d76e053eefd3d0e883a4fdb7c333bbfc09 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-22 18:56:32 +02:00
Allow mediaserver to connect to bluetooth. Re-purpose the existing bluetooth_socket type, originally for /dev/socket/bluetooth used by bluetoothd in the old bluetooth stack, for sockets created by bluedroid under /data/misc/bluedroid, and allow mediaserver to connect to such sockets. This is required for playing audio on paired BT devices. Based on b/12417855. Change-Id: I24ecdf407d066e7c4939ed2a0edb97222a1879f6 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-01-13 15:14:15 +01:00
# Socket creation under /data/misc/bluedroid.
allow bluetooth bluetooth_socket:sock_file create_file_perms;
Confine bluetooth app. Remove unconfined_domain() from the bluetooth app domain, restore the rules from our policy, and move the neverallow rule for bluetooth capabilities to bluetooth.te. Make the bluetooth domain permissive again until it has received sufficient testing. Change-Id: I3b3072d76e053eefd3d0e883a4fdb7c333bbfc09 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-22 18:56:32 +02:00
# bluetooth factory file accesses.
r_dir_file(bluetooth, bluetooth_efs_file)
Further restrict access to tun_device Remove bluetooth's access to tun_device. Auditallow rule demonstrates that it's not used. Strengthen the neverallow on opening tun_device to include all Apps. Bug: 24744295 Change-Id: Iba85ba016b1e24c6c12d5b33e46fe8232908aac1
2015-12-04 00:56:04 +01:00
allow bluetooth { uhid_device hci_attach_dev }:chr_file rw_file_perms;
Confine bluetooth app. Remove unconfined_domain() from the bluetooth app domain, restore the rules from our policy, and move the neverallow rule for bluetooth capabilities to bluetooth.te. Make the bluetooth domain permissive again until it has received sufficient testing. Change-Id: I3b3072d76e053eefd3d0e883a4fdb7c333bbfc09 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-22 18:56:32 +02:00
# sysfs access.
audit domain_deprecated perms for removal Grant permissions observed. Bug: 28760354 Change-Id: Ie63cda709319bbf635ef7bffbba3477c2cccc11b
2016-09-10 01:27:17 +02:00
r_dir_file(bluetooth, sysfs_type)
Confine bluetooth app. Remove unconfined_domain() from the bluetooth app domain, restore the rules from our policy, and move the neverallow rule for bluetooth capabilities to bluetooth.te. Make the bluetooth domain permissive again until it has received sufficient testing. Change-Id: I3b3072d76e053eefd3d0e883a4fdb7c333bbfc09 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-22 18:56:32 +02:00
allow bluetooth sysfs_bluetooth_writable:file rw_file_perms;
allow bluetooth self:capability net_admin;
Grant Bluetooth CAP_WAKE_ALARM so it can use the POSIX timer API for wake alarms. Change-Id: Ic7b25e79116b90378e5e89a879d8e6b87e4f052e
2014-06-29 19:45:03 +02:00
allow bluetooth self:capability2 wake_alarm;
Confine bluetooth app. Remove unconfined_domain() from the bluetooth app domain, restore the rules from our policy, and move the neverallow rule for bluetooth capabilities to bluetooth.te. Make the bluetooth domain permissive again until it has received sufficient testing. Change-Id: I3b3072d76e053eefd3d0e883a4fdb7c333bbfc09 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-22 18:56:32 +02:00
# tethering
Enforce ioctl command whitelisting on all sockets Remove the ioctl permission for most socket types. For others, such as tcp/udp/rawip/unix_dgram/unix_stream set a default unprivileged whitelist that individual domains may extend (except where neverallowed like untrusted_app). Enforce via a neverallowxperm rule. Change-Id: I15548d830f8eff1fd4d64005c5769ca2be8d4ffe
2016-05-17 06:12:17 +02:00
allow bluetooth self:packet_socket create_socket_perms_no_ioctl;
Permit bluetooth to run DhcpClient Requires net_raw and net_bind_service. Bug: 26991160 Change-Id: I4cdd23f0d0c94c9b5126c821464aadc67cdb90c9
2016-02-18 12:52:22 +01:00
allow bluetooth self:capability { net_admin net_raw net_bind_service };
Enforce ioctl command whitelisting on all sockets Remove the ioctl permission for most socket types. For others, such as tcp/udp/rawip/unix_dgram/unix_stream set a default unprivileged whitelist that individual domains may extend (except where neverallowed like untrusted_app). Enforce via a neverallowxperm rule. Change-Id: I15548d830f8eff1fd4d64005c5769ca2be8d4ffe
2016-05-17 06:12:17 +02:00
allow bluetooth self:tun_socket create_socket_perms_no_ioctl;
Allow bluetooth access to the tun device. Bluetooth uses the tun device for tethering. Allow access. STEPS TO REPRODUCE: 0. Have two devices to test on, say Device A and Device B 1. On Device A, Go to settings ->Bluetooth . 2. Turn on the Bluetooth . 3. Pair it with device B 4. Tap on the paired device OBSERVED RESULTS: -Bluetooth share crash is observed with "Bluetooth share has stopped" error message -Unable to use Bluetooth tethering due to this issue EXPECTED RESULTS: No crash and Bluetooth devices should be able to connect for tethering Addresses the following denial: com.android.bluetooth: type=1400 audit(0.0:131): avc: denied { open } for comm=425420536572766963652043616C6C path="/dev/tun" dev="tmpfs" ino=12340 scontext=u:r:bluetooth:s0 tcontext=u:object_r:tun_device:s0 tclass=chr_file permissive=0 Bug: 27372573 (cherry picked from commit 9a1347eee668990a8fb357d0d088beb430a61c27) Change-Id: Ibd16e48c09fe80ebb4f3779214de3b4806c12497
2016-02-29 05:52:55 +01:00
allow bluetooth tun_device:chr_file rw_file_perms;
Confine bluetooth app. Remove unconfined_domain() from the bluetooth app domain, restore the rules from our policy, and move the neverallow rule for bluetooth capabilities to bluetooth.te. Make the bluetooth domain permissive again until it has received sufficient testing. Change-Id: I3b3072d76e053eefd3d0e883a4fdb7c333bbfc09 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-22 18:56:32 +02:00
allow bluetooth efs_file:dir search;
# proc access.
allow bluetooth proc_bluetooth_writable:file rw_file_perms;
Allow bluetooth to write to bluetooth properties Some bluetooth implementations write to bluetooth.* properties. It seems reasonable to allow this for all bluetooth implementations. This addresses the following denial (seen on mako): <4>[ 132.182755] avc: denied { set } for property=bluetooth.hciattach scontext=u:r:bluetooth:s0 tcontext=u:object_r:bluetooth_prop:s0 tclass=property_service Change-Id: I6d92c0ff108838dd1107c5fb3c436699ef824814
2013-10-29 20:45:10 +01:00
# Allow write access to bluetooth specific properties
Replace unix_socket_connect() and explicit property sets with macro A common source of mistakes when authoring sepolicy is properly setting up property sets. This is a 3 part step of: 1. Allowing the unix domain connection to the init/property service 2. Allowing write on the property_socket file 3. Allowing the set on class property_service The macro unix_socket_connect() handled 1 and 2, but could be confusing for first time policy authors. 3 had to be explicitly added. To correct this, we introduce a new macros: set_prop(sourcedomain, targetprop) This macro handles steps 1, 2 and 3. No difference in sediff is expected. Change-Id: I630ba0178439c935d08062892990d43a3cc1239e Signed-off-by: William Roberts <william.c.roberts@linux.intel.com>
2015-05-05 03:22:45 +02:00
set_prop(bluetooth, bluetooth_prop)
set_prop(bluetooth, pan_result_prop)
Allow bluetooth to write to bluetooth properties Some bluetooth implementations write to bluetooth.* properties. It seems reasonable to allow this for all bluetooth implementations. This addresses the following denial (seen on mako): <4>[ 132.182755] avc: denied { set } for property=bluetooth.hciattach scontext=u:r:bluetooth:s0 tcontext=u:object_r:bluetooth_prop:s0 tclass=property_service Change-Id: I6d92c0ff108838dd1107c5fb3c436699ef824814
2013-10-29 20:45:10 +01:00
Add rules for running audio services in audioserver audioserver has the same rules as mediaserver so there is no loss of rights or permissions. media.log moves to audioserver. TBD: Pare down permissions. Bug: 24511453 Change-Id: I0fff24c14b712bb3d498f75e8fd66c2eb795171d
2015-09-09 19:48:04 +02:00
allow bluetooth audioserver_service:service_manager find;
Restrict service_manager find and list access. All domains are currently granted list and find service_manager permissions, but this is not necessary. Pare the permissions which did not trigger any of the auditallow reporting. Bug: 18106000 Change-Id: Ie0ce8de2af8af2cbe4ce388a2dcf4534694c994a
2014-12-12 01:01:27 +01:00
allow bluetooth bluetooth_service:service_manager find;
Allow bluetooth to find the drmservice Address the following denial: SELinux E avc: denied { find } for service=drm.drmManager scontext=u:r:bluetooth:s0 tcontext=u:object_r:drmserver_service:s0 This denial is triggered by Bluetooth when MmsFileProvider.java is using the PduPersister which in turn is using DRM. Change-Id: I4c077635f8afa39e6bc5e10178c3a7ae3cb6a9ea
2015-10-07 14:42:37 +02:00
allow bluetooth drmserver_service:service_manager find;
Allow bluetooth mediaserver_service access. This was observed when attempting to change volume for a bluetooth device supporting AVRCP volume control. Addresses the following denials: avc: denied { find } for service=media.audio_flinger scontext=u:r:bluetooth:s0 tcontext=u:object_r:mediaserver_service:s0 tclass=service_manager avc: denied { find } for service=media.audio_policy scontext=u:r:bluetooth:s0 tcontext=u:object_r:mediaserver_service:s0 tclass=service_manager Bug: 19341236 Change-Id: If7f2ff1ea9fc694bad700cf59f400f2d2df8c2dd
2015-02-11 22:25:57 +01:00
allow bluetooth mediaserver_service:service_manager find;
Restrict service_manager find and list access. All domains are currently granted list and find service_manager permissions, but this is not necessary. Pare the permissions which did not trigger any of the auditallow reporting. Bug: 18106000 Change-Id: Ie0ce8de2af8af2cbe4ce388a2dcf4534694c994a
2014-12-12 01:01:27 +01:00
allow bluetooth radio_service:service_manager find;
Allow bluetooth surfaceflinger access. Address the following denial: 02-12 07:51:42.702: E/SELinux(158): avc: denied { find } for service=SurfaceFlinger scontext=u:r:bluetooth:s0 tcontext=u:object_r:surfaceflinger_service:s0 tclass=service_manager which occurs when the remote service starts up. 02-12 07:51:42.702: E/ServiceManager(158): find_service('SurfaceFlinger') uid=1002 - PERMISSION DENIED 02-12 07:51:42.702: I/ServiceManager(2827): Waiting for service SurfaceFlinger... 02-12 07:51:42.959: E/ActivityManager(469): ANR in com.google.android.remote.tv.services 02-12 07:51:42.959: E/ActivityManager(469): PID: 2827 02-12 07:51:42.959: E/ActivityManager(469): Reason: executing service com.google.android.tv.remote/.RemoteService Bug: 19268019 Change-Id: I2d415c2ea2f70cf71851147253cf6e1906fd0940
2015-02-12 18:50:20 +01:00
allow bluetooth surfaceflinger_service:service_manager find;
Add system_api_service and app_api_service attributes. System services differ in designed access level. Add attributes reflecting this distinction and label services appropriately. Begin moving access to the newly labeled services by removing them from tmp_system_server_service into the newly made system_server_service attribute. Reflect the move of system_server_service from a type to an attribute by removing access to system_server_service where appropriate. Change-Id: I7fd06823328daaea6d6f96e4d6bd00332382230b
2015-04-03 01:50:08 +02:00
allow bluetooth app_api_service:service_manager find;
allow bluetooth system_api_service:service_manager find;
Add access control for each service_manager action. Add SELinux MAC for the service manager actions list and find. Add the list and find verbs to the service_manager class. Add policy requirements for service_manager to enforce policies to binder_use macro. Change-Id: I224b1c6a6e21e3cdeb23badfc35c82a37558f964
2014-07-07 22:56:27 +02:00
Add permission for Bluetooth Sim Access Profile Added permission to SAP socket used to access the the RIL daemon Change-Id: Ifbfb764f0b8731e81fb3157955aa4fda6120d846 Signed-off-by: Casper Bonde <c.bonde@samsung.com>
2015-03-19 10:56:26 +01:00
# Bluetooth Sim Access Profile Socket to the RIL
unix_socket_connect(bluetooth, sap_uim, rild)
bluetooth: allow sending bugreports via bluetooth Bluetooth can receive bugreport data for beaming to another device. This comes across as an open file descriptor. Allow bluetooth access to bugreports. Addresses the following denial: avc: denied { read } for path="/data/data/com.android.shell/files/bugreports/bugreport-2014-12-19-15-35-32.txt" dev="dm-0" ino=662738 scontext=u:r:bluetooth:s0 tcontext=u:object_r:shell_data_file:s0 tclass=file permissive=0 Change-Id: I7be2ce2e0e48323c1e8f932be17b434b89daf085
2014-12-20 01:43:41 +01:00
# already open bugreport file descriptors may be shared with
# the bluetooth process, from a file in
# /data/data/com.android.shell/files/bugreports/bugreport-*.
allow bluetooth shell_data_file:file read;
Allow search/getattr access to media_rw_data_file for now. With sdcardfs, we no longer have a separate sdcardd acting as an intermediate between the outside world and /data/media. Unless we modify sdcardfs to change contexts, we need these. Added for: system_server, dumpstate, and bluetooth Remove this patch if sdcardfs is updated to change the secontext of fs accesses. Bug: 27932396 Change-Id: I294cfe23269b7959586252250f5527f13e60529b
2016-04-05 19:34:53 +02:00
# Access to /data/media.
# This should be removed if sdcardfs is modified to alter the secontext for its
# accesses to the underlying FS.
Expand bluetooth access to media_rw_data_file for now. With sdcardfs, we no longer have a separate sdcardd acting as an intermediate between the outside world and /data/media. Unless we modify sdcardfs to change contexts, we need these. Remove this patch if sdcardfs is updated to change the secontext of fs accesses. Bug: 28040634 Change-Id: I492c87e9f232c57f43abd09b7864b52847bc3555
2016-04-06 22:04:44 +02:00
allow bluetooth media_rw_data_file:dir create_dir_perms;
allow bluetooth media_rw_data_file:file create_file_perms;
Allow search/getattr access to media_rw_data_file for now. With sdcardfs, we no longer have a separate sdcardd acting as an intermediate between the outside world and /data/media. Unless we modify sdcardfs to change contexts, we need these. Added for: system_server, dumpstate, and bluetooth Remove this patch if sdcardfs is updated to change the secontext of fs accesses. Bug: 27932396 Change-Id: I294cfe23269b7959586252250f5527f13e60529b
2016-04-05 19:34:53 +02:00
Confine bluetooth app. Remove unconfined_domain() from the bluetooth app domain, restore the rules from our policy, and move the neverallow rule for bluetooth capabilities to bluetooth.te. Make the bluetooth domain permissive again until it has received sufficient testing. Change-Id: I3b3072d76e053eefd3d0e883a4fdb7c333bbfc09 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-22 18:56:32 +02:00
###
### Neverallow rules
###
### These are things that the bluetooth app should NEVER be able to do
###
# Superuser capabilities.
Permit bluetooth to run DhcpClient Requires net_raw and net_bind_service. Bug: 26991160 Change-Id: I4cdd23f0d0c94c9b5126c821464aadc67cdb90c9
2016-02-18 12:52:22 +01:00
# bluetooth requires net_{admin,raw,bind_service} and wake_alarm and block_suspend.
neverallow bluetooth self:capability ~{ net_admin net_raw net_bind_service };
Minor cleanup to align the content with AOSP No functional changes. Change-Id: Ic9e5aae5b4a214f5dc4c710e7bdcd51eb7b63e75
2015-12-29 01:54:53 +01:00
neverallow bluetooth self:capability2 ~{ wake_alarm block_suspend };
Reference in a new issue Copy permalink