tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/property.te

662 lines
18 KiB
Text
Raw Normal View History

Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
# Properties used only in /system
system_internal_prop(apexd_prop)
system_internal_prop(bootloader_boot_reason_prop)
system_internal_prop(device_config_activity_manager_native_boot_prop)
system_internal_prop(device_config_boot_count_prop)
system_internal_prop(device_config_input_native_boot_prop)
system_internal_prop(device_config_media_native_prop)
system_internal_prop(device_config_netd_native_prop)
system_internal_prop(device_config_reset_performed_prop)
system_internal_prop(device_config_runtime_native_boot_prop)
system_internal_prop(device_config_runtime_native_prop)
Add native flags namespace storage_native_boot Grant SEPolicy write permissions for device_config_storage_native_boot. Test: build and flash - device successfully boots Bug: 140803239 Change-Id: I6e4f5889aee9384b47faacb31e2b1938250428ef
2019-09-23 16:14:47 +02:00
system_internal_prop(device_config_storage_native_boot_prop)
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
system_internal_prop(device_config_sys_traced_prop)
system_internal_prop(firstboot_prop)
system_internal_prop(gsid_prop)
system_internal_prop(init_svc_debug_prop)
system_internal_prop(last_boot_reason_prop)
system_internal_prop(netd_stable_secret_prop)
system_internal_prop(pm_prop)
Add selinux rules for userspace reboot related properties By default sys.init.userspace_reboot.* properties are internal to /system partition. Only exception is sys.init.userspace_reboot.in_progress which signals to all native services (including vendor ones) that userspace reboot is happening, hence it should be a system_public_prop. Only init should be allowed to set userspace reboot related properties. Bug: 135984674 Test: builds Test: adb reboot userspace Change-Id: Ibb04965be2d5bf6e81b34569aaaa1014ff61e0d3
2019-11-14 13:59:15 +01:00
system_internal_prop(userspace_reboot_prop)
Make public for exported properties on old devices Properties which are already allowed to be written by vendor_init can't be internal or restricted prop. This sets the properties as public except for forbidden ones on vendor_init.te. Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: Icc1e813e78a48856adee26fb20f01300713e1d30
2019-10-17 06:42:42 +02:00
compatible_property_only(`
# DO NOT ADD ANY PROPERTIES HERE
system_internal_prop(boottime_prop)
system_internal_prop(bpf_progs_loaded_prop)
system_internal_prop(charger_prop)
system_internal_prop(cold_boot_done_prop)
system_internal_prop(ctl_adbd_prop)
system_internal_prop(ctl_apexd_prop)
system_internal_prop(ctl_bootanim_prop)
system_internal_prop(ctl_bugreport_prop)
system_internal_prop(ctl_console_prop)
system_internal_prop(ctl_dumpstate_prop)
system_internal_prop(ctl_fuse_prop)
system_internal_prop(ctl_gsid_prop)
system_internal_prop(ctl_interface_restart_prop)
system_internal_prop(ctl_interface_stop_prop)
system_internal_prop(ctl_mdnsd_prop)
system_internal_prop(ctl_restart_prop)
system_internal_prop(ctl_rildaemon_prop)
system_internal_prop(ctl_sigstop_prop)
system_internal_prop(dynamic_system_prop)
system_internal_prop(heapprofd_enabled_prop)
system_internal_prop(llkd_prop)
system_internal_prop(lpdumpd_prop)
system_internal_prop(mmc_prop)
system_internal_prop(mock_ota_prop)
system_internal_prop(net_dns_prop)
system_internal_prop(overlay_prop)
system_internal_prop(persistent_properties_ready_prop)
system_internal_prop(safemode_prop)
system_internal_prop(system_lmk_prop)
system_internal_prop(system_trace_prop)
system_internal_prop(test_boot_reason_prop)
system_internal_prop(time_prop)
system_internal_prop(traced_enabled_prop)
system_internal_prop(traced_lazy_prop)
system_internal_prop(virtual_ab_prop)
')
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
# Properties which can't be written outside system
system_restricted_prop(linker_prop)
system_restricted_prop(nnapi_ext_deny_product_prop)
system_restricted_prop(restorecon_prop)
system_restricted_prop(system_boot_reason_prop)
Add selinux rules for userspace reboot related properties By default sys.init.userspace_reboot.* properties are internal to /system partition. Only exception is sys.init.userspace_reboot.in_progress which signals to all native services (including vendor ones) that userspace reboot is happening, hence it should be a system_public_prop. Only init should be allowed to set userspace reboot related properties. Bug: 135984674 Test: builds Test: adb reboot userspace Change-Id: Ibb04965be2d5bf6e81b34569aaaa1014ff61e0d3
2019-11-14 13:59:15 +01:00
system_restricted_prop(userspace_reboot_exported_prop)
Make public for exported properties on old devices Properties which are already allowed to be written by vendor_init can't be internal or restricted prop. This sets the properties as public except for forbidden ones on vendor_init.te. Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: Icc1e813e78a48856adee26fb20f01300713e1d30
2019-10-17 06:42:42 +02:00
compatible_property_only(`
# DO NOT ADD ANY PROPERTIES HERE
system_restricted_prop(config_prop)
system_restricted_prop(cppreopt_prop)
system_restricted_prop(dalvik_prop)
system_restricted_prop(debuggerd_prop)
system_restricted_prop(default_prop)
system_restricted_prop(device_logging_prop)
system_restricted_prop(dhcp_prop)
system_restricted_prop(dumpstate_prop)
system_restricted_prop(exported2_default_prop)
system_restricted_prop(exported3_system_prop)
system_restricted_prop(exported_dumpstate_prop)
system_restricted_prop(exported_fingerprint_prop)
system_restricted_prop(exported_secure_prop)
system_restricted_prop(exported_vold_prop)
system_restricted_prop(ffs_prop)
system_restricted_prop(fingerprint_prop)
system_restricted_prop(heapprofd_prop)
system_restricted_prop(net_radio_prop)
system_restricted_prop(pan_result_prop)
system_restricted_prop(persist_debug_prop)
system_restricted_prop(shell_prop)
system_restricted_prop(system_radio_prop)
system_restricted_prop(test_harness_prop)
system_restricted_prop(theme_prop)
system_restricted_prop(use_memfd_prop)
system_restricted_prop(vold_prop)
')
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
# Properties with no restrictions
system_public_prop(audio_prop)
system_public_prop(bluetooth_a2dp_offload_prop)
system_public_prop(bluetooth_audio_hal_prop)
system_public_prop(bluetooth_prop)
system_public_prop(cpu_variant_prop)
system_public_prop(ctl_default_prop)
system_public_prop(ctl_interface_start_prop)
system_public_prop(ctl_start_prop)
system_public_prop(ctl_stop_prop)
system_public_prop(debug_prop)
system_public_prop(dumpstate_options_prop)
system_public_prop(exported_system_prop)
system_public_prop(exported2_config_prop)
system_public_prop(exported2_radio_prop)
system_public_prop(exported2_system_prop)
system_public_prop(exported2_vold_prop)
system_public_prop(exported3_default_prop)
system_public_prop(exported3_radio_prop)
system_public_prop(exported_audio_prop)
system_public_prop(exported_bluetooth_prop)
system_public_prop(exported_config_prop)
system_public_prop(exported_dalvik_prop)
system_public_prop(exported_default_prop)
system_public_prop(exported_ffs_prop)
system_public_prop(exported_overlay_prop)
system_public_prop(exported_pm_prop)
system_public_prop(exported_radio_prop)
system_public_prop(exported_system_radio_prop)
system_public_prop(exported_wifi_prop)
system_public_prop(hwservicemanager_prop)
system_public_prop(logd_prop)
system_public_prop(logpersistd_logging_prop)
system_public_prop(log_prop)
system_public_prop(log_tag_prop)
system_public_prop(lowpan_prop)
system_public_prop(nfc_prop)
Add a new context for property ota.warm_reset The property is set to inform kernel to do a warm_reset on the next reboot. This is useful to persist the logs to debug device boot failures. More details in http://go/rvc-ota-persist-logs. The property is set to 1 by update_engine after an OTA. And it's set to 0 by update_verifier or vold after we mark the current slot boot successful. The property is read by vendor_init. And according to its value, vendor_init writes a particular sysfs file to schedule a warm reset on the following reboot. Without the new context, the denial message says: [ 13.423163] audit: type=1107 audit(1746393.166:8): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { read } for property=ota.warm_reset pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0' [ 23.096497] init: Unable to set property 'OTA.warm_reset' from uid:0 gid:2001 pid:841: SELinux permission check failed [ 23.096574] type=1107 audit(1573768000.668:42): uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for property=OTA.warm_reset pid=841 uid=0 gid=2001 scontext=u:r:update_verifier:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service permissive=0' [ 23.108430] update_verifier: Failed to reset the warm reset flag Bug: 143489994 Test: check the property can be set by update_engine, and read by vendor_init Change-Id: I87c12a53a138b72ecfed3ab6a4d846c20f5a8484
2019-11-14 23:18:40 +01:00
system_public_prop(ota_prop)
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
system_public_prop(powerctl_prop)
system_public_prop(radio_prop)
system_public_prop(serialno_prop)
system_public_prop(system_prop)
system_public_prop(vendor_security_patch_level_prop)
system_public_prop(wifi_log_prop)
system_public_prop(wifi_prop)
Make public for exported properties on old devices Properties which are already allowed to be written by vendor_init can't be internal or restricted prop. This sets the properties as public except for forbidden ones on vendor_init.te. Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: Icc1e813e78a48856adee26fb20f01300713e1d30
2019-10-17 06:42:42 +02:00
# Properties which are public for devices launching with Android O or earlier
# This should not be used for any new properties.
not_compatible_property(`
# DO NOT ADD ANY PROPERTIES HERE
system_public_prop(boottime_prop)
system_public_prop(bpf_progs_loaded_prop)
system_public_prop(charger_prop)
system_public_prop(cold_boot_done_prop)
system_public_prop(ctl_adbd_prop)
system_public_prop(ctl_apexd_prop)
system_public_prop(ctl_bootanim_prop)
system_public_prop(ctl_bugreport_prop)
system_public_prop(ctl_console_prop)
system_public_prop(ctl_dumpstate_prop)
system_public_prop(ctl_fuse_prop)
system_public_prop(ctl_gsid_prop)
system_public_prop(ctl_interface_restart_prop)
system_public_prop(ctl_interface_stop_prop)
system_public_prop(ctl_mdnsd_prop)
system_public_prop(ctl_restart_prop)
system_public_prop(ctl_rildaemon_prop)
system_public_prop(ctl_sigstop_prop)
system_public_prop(dynamic_system_prop)
system_public_prop(heapprofd_enabled_prop)
system_public_prop(llkd_prop)
system_public_prop(lpdumpd_prop)
system_public_prop(mmc_prop)
system_public_prop(mock_ota_prop)
system_public_prop(net_dns_prop)
system_public_prop(overlay_prop)
system_public_prop(persistent_properties_ready_prop)
system_public_prop(safemode_prop)
system_public_prop(system_lmk_prop)
system_public_prop(system_trace_prop)
system_public_prop(test_boot_reason_prop)
system_public_prop(time_prop)
system_public_prop(traced_enabled_prop)
system_public_prop(traced_lazy_prop)
system_public_prop(virtual_ab_prop)
system_public_prop(config_prop)
system_public_prop(cppreopt_prop)
system_public_prop(dalvik_prop)
system_public_prop(debuggerd_prop)
system_public_prop(default_prop)
system_public_prop(device_logging_prop)
system_public_prop(dhcp_prop)
system_public_prop(dumpstate_prop)
system_public_prop(exported2_default_prop)
system_public_prop(exported3_system_prop)
system_public_prop(exported_dumpstate_prop)
system_public_prop(exported_fingerprint_prop)
system_public_prop(exported_secure_prop)
system_public_prop(exported_vold_prop)
system_public_prop(ffs_prop)
system_public_prop(fingerprint_prop)
system_public_prop(heapprofd_prop)
system_public_prop(net_radio_prop)
system_public_prop(pan_result_prop)
system_public_prop(persist_debug_prop)
system_public_prop(shell_prop)
system_public_prop(system_radio_prop)
system_public_prop(test_harness_prop)
system_public_prop(theme_prop)
system_public_prop(use_memfd_prop)
system_public_prop(vold_prop)
')
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
type vendor_default_prop, property_type;
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
typeattribute log_prop log_property_type;
typeattribute log_tag_prop log_property_type;
typeattribute wifi_log_prop log_property_type;
Support fine grain read access control for properties Properties are now broken up from a single /dev/__properties__ file into multiple files, one per property label. This commit provides the mechanism to control read access to each of these files and therefore sets of properties. This allows full access for all domains to each of these new property files to match the current permissions of /dev/__properties__. Future commits will restrict the access. Bug: 21852512 Change-Id: Ie9e43968acc7ac3b88e354a0bdfac75b8a710094
2015-12-02 01:58:27 +01:00
allow property_type tmpfs:filesystem associate;
Do not allow new additions to core_property_type core_property_type is an attribute which was given to all existing properties known to core SELinux policy. Any property with this label is readable to all SELinux domains, which is overly broad. The long term goal is to remove the core_property_type attribute entirely. Add a neverallow rule prohibiting the introduction of new properties with the core_property_type attribute. Device specific properties, or new properties in core SELinux policy, should not have this attribute. Test: policy compiles Change-Id: Ie89a9f0d81c8561616001ff8451496ce2278dbb2
2016-12-14 00:59:33 +01:00
###
### Neverallow rules
###
Add BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW A new sysprop neverallow rules are mandatory only for devices launching with R or later. For devices already launched, neverallow rules can be relaxed with adding following line to BoardConfig.mk: BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true Bug: 131162102 Test: Set PRODUCT_SHIPPING_API_LEVEL := 30 and try building with changing some system_public_prop to system_internal_prop Test: m cts sepolicy_tests Change-Id: Id978b4d81a8683a57304bb639961105e2d91fa9a Merged-In: Id978b4d81a8683a57304bb639961105e2d91fa9a (cherry picked from commit 3be11e7abb8f4fd651295f9ccb0ce087855c1cc0)
2019-09-26 08:14:55 +02:00
treble_sysprop_neverallow(`
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
# TODO(b/131162102): uncomment these after assigning ownership attributes to all properties
Add BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW A new sysprop neverallow rules are mandatory only for devices launching with R or later. For devices already launched, neverallow rules can be relaxed with adding following line to BoardConfig.mk: BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true Bug: 131162102 Test: Set PRODUCT_SHIPPING_API_LEVEL := 30 and try building with changing some system_public_prop to system_internal_prop Test: m cts sepolicy_tests Change-Id: Id978b4d81a8683a57304bb639961105e2d91fa9a Merged-In: Id978b4d81a8683a57304bb639961105e2d91fa9a (cherry picked from commit 3be11e7abb8f4fd651295f9ccb0ce087855c1cc0)
2019-09-26 08:14:55 +02:00
# neverallow domain {
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
# property_type
# -system_property_type
# -product_property_type
# -vendor_property_type
# }:file no_rw_file_perms;
neverallow { domain -coredomain } {
system_property_type
-system_restricted_property_type
-system_public_property_type
}:file no_rw_file_perms;
neverallow { domain -coredomain } {
system_property_type
-system_public_property_type
}:property_service set;
neverallow { domain -coredomain } {
system_internal_property_type
}:file no_rw_file_perms;
neverallow coredomain {
vendor_property_type
-vendor_restricted_property_type
-vendor_public_property_type
}:file no_rw_file_perms;
neverallow coredomain {
vendor_property_type
-vendor_public_property_type
}:property_service set;
neverallow coredomain {
vendor_internal_property_type
}:file no_rw_file_perms;
')
property files: remove ioctl and lock They are unneeded. Test: device boots and no obvious problems. Change-Id: Ib788a89645c893c8c36acbe7fb34ce93bf6a57d7
2018-10-10 18:02:12 +02:00
# There is no need to perform ioctl or advisory locking operations on
# property files. If this neverallow is being triggered, it is
# likely that the policy is using r_file_perms directly instead of
# the get_prop() macro.
neverallow domain property_type:file { ioctl lock };
Do not allow new additions to core_property_type core_property_type is an attribute which was given to all existing properties known to core SELinux policy. Any property with this label is readable to all SELinux domains, which is overly broad. The long term goal is to remove the core_property_type attribute entirely. Add a neverallow rule prohibiting the introduction of new properties with the core_property_type attribute. Device specific properties, or new properties in core SELinux policy, should not have this attribute. Test: policy compiles Change-Id: Ie89a9f0d81c8561616001ff8451496ce2278dbb2
2016-12-14 00:59:33 +01:00
# core_property_type should not be used for new properties or
# device specific properties. Properties with this attribute
# are readable to everyone, which is overly broad and should
# be avoided.
# New properties should have appropriate read / write access
# control rules written.
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
typeattribute audio_prop core_property_type;
typeattribute config_prop core_property_type;
typeattribute cppreopt_prop core_property_type;
typeattribute dalvik_prop core_property_type;
typeattribute debuggerd_prop core_property_type;
typeattribute debug_prop core_property_type;
typeattribute default_prop core_property_type;
typeattribute dhcp_prop core_property_type;
typeattribute dumpstate_prop core_property_type;
typeattribute ffs_prop core_property_type;
typeattribute fingerprint_prop core_property_type;
typeattribute logd_prop core_property_type;
typeattribute net_radio_prop core_property_type;
typeattribute nfc_prop core_property_type;
Add a new context for property ota.warm_reset The property is set to inform kernel to do a warm_reset on the next reboot. This is useful to persist the logs to debug device boot failures. More details in http://go/rvc-ota-persist-logs. The property is set to 1 by update_engine after an OTA. And it's set to 0 by update_verifier or vold after we mark the current slot boot successful. The property is read by vendor_init. And according to its value, vendor_init writes a particular sysfs file to schedule a warm reset on the following reboot. Without the new context, the denial message says: [ 13.423163] audit: type=1107 audit(1746393.166:8): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { read } for property=ota.warm_reset pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0' [ 23.096497] init: Unable to set property 'OTA.warm_reset' from uid:0 gid:2001 pid:841: SELinux permission check failed [ 23.096574] type=1107 audit(1573768000.668:42): uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for property=OTA.warm_reset pid=841 uid=0 gid=2001 scontext=u:r:update_verifier:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service permissive=0' [ 23.108430] update_verifier: Failed to reset the warm reset flag Bug: 143489994 Test: check the property can be set by update_engine, and read by vendor_init Change-Id: I87c12a53a138b72ecfed3ab6a4d846c20f5a8484
2019-11-14 23:18:40 +01:00
typeattribute ota_prop core_property_type;
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
typeattribute pan_result_prop core_property_type;
typeattribute persist_debug_prop core_property_type;
typeattribute powerctl_prop core_property_type;
typeattribute radio_prop core_property_type;
typeattribute restorecon_prop core_property_type;
typeattribute shell_prop core_property_type;
typeattribute system_prop core_property_type;
typeattribute system_radio_prop core_property_type;
typeattribute vold_prop core_property_type;
Do not allow new additions to core_property_type core_property_type is an attribute which was given to all existing properties known to core SELinux policy. Any property with this label is readable to all SELinux domains, which is overly broad. The long term goal is to remove the core_property_type attribute entirely. Add a neverallow rule prohibiting the introduction of new properties with the core_property_type attribute. Device specific properties, or new properties in core SELinux policy, should not have this attribute. Test: policy compiles Change-Id: Ie89a9f0d81c8561616001ff8451496ce2278dbb2
2016-12-14 00:59:33 +01:00
neverallow * {
core_property_type
-audio_prop
-config_prop
-cppreopt_prop
-dalvik_prop
-debuggerd_prop
-debug_prop
-default_prop
-dhcp_prop
-dumpstate_prop
-ffs_prop
-fingerprint_prop
-logd_prop
-net_radio_prop
-nfc_prop
Add a new context for property ota.warm_reset The property is set to inform kernel to do a warm_reset on the next reboot. This is useful to persist the logs to debug device boot failures. More details in http://go/rvc-ota-persist-logs. The property is set to 1 by update_engine after an OTA. And it's set to 0 by update_verifier or vold after we mark the current slot boot successful. The property is read by vendor_init. And according to its value, vendor_init writes a particular sysfs file to schedule a warm reset on the following reboot. Without the new context, the denial message says: [ 13.423163] audit: type=1107 audit(1746393.166:8): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { read } for property=ota.warm_reset pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0' [ 23.096497] init: Unable to set property 'OTA.warm_reset' from uid:0 gid:2001 pid:841: SELinux permission check failed [ 23.096574] type=1107 audit(1573768000.668:42): uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for property=OTA.warm_reset pid=841 uid=0 gid=2001 scontext=u:r:update_verifier:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service permissive=0' [ 23.108430] update_verifier: Failed to reset the warm reset flag Bug: 143489994 Test: check the property can be set by update_engine, and read by vendor_init Change-Id: I87c12a53a138b72ecfed3ab6a4d846c20f5a8484
2019-11-14 23:18:40 +01:00
-ota_prop
Do not allow new additions to core_property_type core_property_type is an attribute which was given to all existing properties known to core SELinux policy. Any property with this label is readable to all SELinux domains, which is overly broad. The long term goal is to remove the core_property_type attribute entirely. Add a neverallow rule prohibiting the introduction of new properties with the core_property_type attribute. Device specific properties, or new properties in core SELinux policy, should not have this attribute. Test: policy compiles Change-Id: Ie89a9f0d81c8561616001ff8451496ce2278dbb2
2016-12-14 00:59:33 +01:00
-pan_result_prop
-persist_debug_prop
-powerctl_prop
-radio_prop
-restorecon_prop
-shell_prop
-system_prop
-system_radio_prop
-vold_prop
}:file no_rw_file_perms;
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
Finer grained permissions for ctl. properties Currently, permissions for ctl. property apply to each action verb, so if a domain has permissions for controlling service 'foo', then it can start, stop, and restart foo. This change implements finer grainer permissions such that permission can be given to strictly start a given service, but not stop or restart it. This new permission scheme is mandatory for the new control functions, sigstop_on, sigstop_off, interface_start, interface_stop, interface_restart. Bug: 78511553 Test: see appropriate successes and failures based on permissions Change-Id: Ibe0cc0d6028fb0ed7d6bcba626721e0d84cc20fa
2018-05-04 02:00:16 +02:00
# sigstop property is only used for debugging; should only be set by su which is permissive
# for userdebug/eng
neverallow {
domain
-init
-vendor_init
} ctl_sigstop_prop:property_service set;
# Don't audit legacy ctl. property handling. We only want the newer permission check to appear
# in the audit log
dontaudit domain {
ctl_bootanim_prop
ctl_bugreport_prop
ctl_console_prop
ctl_default_prop
ctl_dumpstate_prop
ctl_fuse_prop
ctl_mdnsd_prop
ctl_rildaemon_prop
}:property_service set;
Define sepolicy with property for linker To support linker-specific property, sys.linker.* has been defined as linker_prop. This will have get_prop access from domain so all binaries can start with linker using proper property access level. Bug: 138920271 Test: m -j && Confirmed from cuttlefish that get_prop errors are no longer found Change-Id: Iaf584e0cbdd5bca3d5667e93cf9a6401e757a314
2019-08-09 07:20:34 +02:00
# Do now allow to modify linker properties except shell and init
neverallow {
domain
-init
userdebug_or_eng(`-shell')
} linker_prop:property_service set;
Adds new policy for init_svc_debug_prop. Used to restrict properties init.svc_debug_pid.* Bug: 138114550 Test: getprop | grep init.svc_debug_pid only shows results on root Change-Id: I0c10699deec4c548a2463a934e96b897ddee1678
2019-07-25 20:29:17 +02:00
neverallow {
domain
-init
} init_svc_debug_prop:property_service set;
neverallow {
domain
-init
-dumpstate
userdebug_or_eng(`-su')
} init_svc_debug_prop:file no_rw_file_perms;
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
compatible_property_only(`
Fix compatible property neverallows The current neverallow rules for compatible properties restrict domains from write file permissions to the various property files. This however is the wrong restriction, since only init actually writes to these property files. The correct restriction is to restrict 'set' for 'property_service' as this change does. Note there is already a restriction preventing {domain -init} from writing to these files in domain.te. Test: build Change-Id: I19e13b0d084a240185d0f3f5195e54065dc20e09
2018-01-24 20:20:35 +01:00
# Prevent properties from being set
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
neverallow {
domain
-coredomain
-appdomain
-vendor_init
} {
core_property_type
add extended_core_property_type The attribute is used to capture system properties added from outside of AOSP (e.g. by OEM), but are not device-specific and thus are used only inside the system partition. Access to the the system properties from outside of the system partition is prevented by the neverallow rule. Bug: 80382020 Bug: 78598545 Test: m -j selinux_policy Change-Id: I22c083dc195dab84c9c21a79fbe3ad823a3bbb46
2018-05-30 10:38:09 +02:00
extended_core_property_type
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
exported_config_prop
exported_dalvik_prop
exported_default_prop
exported_dumpstate_prop
exported_ffs_prop
Fix TODOs of duplicate property names for prefix and exact matching Duplicate property names are supported now for prefix and exact matching. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: Ifd9d32eaece7370d69f121e88d5541f7a2e34458
2018-01-12 02:19:48 +01:00
exported_fingerprint_prop
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
exported_system_prop
exported_system_radio_prop
exported_vold_prop
exported2_config_prop
exported2_default_prop
exported2_system_prop
exported2_vold_prop
exported3_default_prop
exported3_system_prop
Fix compatible property neverallows The current neverallow rules for compatible properties restrict domains from write file permissions to the various property files. This however is the wrong restriction, since only init actually writes to these property files. The correct restriction is to restrict 'set' for 'property_service' as this change does. Note there is already a restriction preventing {domain -init} from writing to these files in domain.te. Test: build Change-Id: I19e13b0d084a240185d0f3f5195e54065dc20e09
2018-01-24 20:20:35 +01:00
-nfc_prop
-powerctl_prop
-radio_prop
}:property_service set;
neverallow {
domain
-coredomain
-appdomain
Add tests for compatible property (1/2) The feature of compatible property has its own neverallow rules and it is enforced on devices launchig with Android P. This CL changes hal_nfc to hal_nfc_server in neverallow rules because sepolicy-analyze doesn't recognize it. Additionally one more neverallow rule is added to restrict reading nfc_prop. Bug: 72013705 Bug: 72678352 Test: 'run cts -m CtsSecurityHostTestCases' on walleye with ro.product.first_api_level=28 Change-Id: I753cc81f7ca0e4ad6a2434b2a047052678f57671
2018-01-30 09:23:58 +01:00
-hal_nfc_server
Fix compatible property neverallows The current neverallow rules for compatible properties restrict domains from write file permissions to the various property files. This however is the wrong restriction, since only init actually writes to these property files. The correct restriction is to restrict 'set' for 'property_service' as this change does. Note there is already a restriction preventing {domain -init} from writing to these files in domain.te. Test: build Change-Id: I19e13b0d084a240185d0f3f5195e54065dc20e09
2018-01-24 20:20:35 +01:00
} {
nfc_prop
}:property_service set;
neverallow {
domain
-coredomain
-appdomain
Revert "Revert "Move rild from public to vendor."" This reverts commit 016f0a58a9cd429f1986033f922d4bb7f58f5f3a. Reason for revert: Was temporarily reverted, merging back in with fix. Bug: 74486619 Bug: 36427227 Change-Id: Ide68726a90d5485c2758673079427407aee1e4f2
2018-03-12 18:12:09 +01:00
-hal_telephony_server
Fix compatible property neverallows The current neverallow rules for compatible properties restrict domains from write file permissions to the various property files. This however is the wrong restriction, since only init actually writes to these property files. The correct restriction is to restrict 'set' for 'property_service' as this change does. Note there is already a restriction preventing {domain -init} from writing to these files in domain.te. Test: build Change-Id: I19e13b0d084a240185d0f3f5195e54065dc20e09
2018-01-24 20:20:35 +01:00
-vendor_init
} {
exported_radio_prop
Allow vendor-init-settable to persist.radio.multisim.config A default value of persist.radio.multisim.config can be set by SoC vendors, and so vendor-init-settable should be allowed to it. Bug: 73871799 Test: succeeded building and tested with taimen Change-Id: Ie62b91e7e3d7e05425b742838417f1cab7b3fed4 Merged-In: Ie62b91e7e3d7e05425b742838417f1cab7b3fed4 (cherry picked from commit ac8c6e3d44ec55474759d99e58c9dbf034f4f815)
2018-03-27 06:41:47 +02:00
exported3_radio_prop
Neverallow unexpected domains to access bluetooth_prop and wifi_prop And this CL will remove unnecessary vendor-init exceptions for nfc_prop and radio_prop as well. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: I468b8fd907c6408f51419cfb58eb2b8da29118ae Merged-In: I468b8fd907c6408f51419cfb58eb2b8da29118ae (cherry picked from commit 41e42d63fecf9c237337acea7e21a5da0683debe)
2018-04-18 04:24:15 +02:00
}:property_service set;
neverallow {
domain
-coredomain
-appdomain
-hal_telephony_server
} {
exported2_radio_prop
Fix compatible property neverallows The current neverallow rules for compatible properties restrict domains from write file permissions to the various property files. This however is the wrong restriction, since only init actually writes to these property files. The correct restriction is to restrict 'set' for 'property_service' as this change does. Note there is already a restriction preventing {domain -init} from writing to these files in domain.te. Test: build Change-Id: I19e13b0d084a240185d0f3f5195e54065dc20e09
2018-01-24 20:20:35 +01:00
radio_prop
}:property_service set;
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
Neverallow unexpected domains to access bluetooth_prop and wifi_prop And this CL will remove unnecessary vendor-init exceptions for nfc_prop and radio_prop as well. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: I468b8fd907c6408f51419cfb58eb2b8da29118ae Merged-In: I468b8fd907c6408f51419cfb58eb2b8da29118ae (cherry picked from commit 41e42d63fecf9c237337acea7e21a5da0683debe)
2018-04-18 04:24:15 +02:00
neverallow {
domain
-coredomain
-bluetooth
Use non-expanded types in prop neverallows Using hal_foo attributes in neverallow rules does not work because they are auto-expanded to types. Use hal_foo_server types instead. Fixes the following error: unit.framework.AssertionFailedError: The following errors were encountered when validating the SELinuxneverallow rule: neverallow { domain -coredomain -bluetooth -hal_bluetooth } { bluetooth_prop }: property_service set; Warning! Type or attribute hal_bluetooth used in neverallow undefined in policy being checked. Test: CtsSecurityHostTestCases Bug: 80153368 Change-Id: I2baf9f66d2ff110a4f181423790a1160a6e138da
2018-05-23 16:21:32 +02:00
-hal_bluetooth_server
Neverallow unexpected domains to access bluetooth_prop and wifi_prop And this CL will remove unnecessary vendor-init exceptions for nfc_prop and radio_prop as well. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: I468b8fd907c6408f51419cfb58eb2b8da29118ae Merged-In: I468b8fd907c6408f51419cfb58eb2b8da29118ae (cherry picked from commit 41e42d63fecf9c237337acea7e21a5da0683debe)
2018-04-18 04:24:15 +02:00
} {
bluetooth_prop
}:property_service set;
neverallow {
domain
-coredomain
-bluetooth
Use non-expanded types in prop neverallows Using hal_foo attributes in neverallow rules does not work because they are auto-expanded to types. Use hal_foo_server types instead. Fixes the following error: unit.framework.AssertionFailedError: The following errors were encountered when validating the SELinuxneverallow rule: neverallow { domain -coredomain -bluetooth -hal_bluetooth } { bluetooth_prop }: property_service set; Warning! Type or attribute hal_bluetooth used in neverallow undefined in policy being checked. Test: CtsSecurityHostTestCases Bug: 80153368 Change-Id: I2baf9f66d2ff110a4f181423790a1160a6e138da
2018-05-23 16:21:32 +02:00
-hal_bluetooth_server
Neverallow unexpected domains to access bluetooth_prop and wifi_prop And this CL will remove unnecessary vendor-init exceptions for nfc_prop and radio_prop as well. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: I468b8fd907c6408f51419cfb58eb2b8da29118ae Merged-In: I468b8fd907c6408f51419cfb58eb2b8da29118ae (cherry picked from commit 41e42d63fecf9c237337acea7e21a5da0683debe)
2018-04-18 04:24:15 +02:00
-vendor_init
} {
exported_bluetooth_prop
}:property_service set;
neverallow {
domain
-coredomain
Use non-expanded types in prop neverallows Using hal_foo attributes in neverallow rules does not work because they are auto-expanded to types. Use hal_foo_server types instead. Fixes the following error: unit.framework.AssertionFailedError: The following errors were encountered when validating the SELinuxneverallow rule: neverallow { domain -coredomain -bluetooth -hal_bluetooth } { bluetooth_prop }: property_service set; Warning! Type or attribute hal_bluetooth used in neverallow undefined in policy being checked. Test: CtsSecurityHostTestCases Bug: 80153368 Change-Id: I2baf9f66d2ff110a4f181423790a1160a6e138da
2018-05-23 16:21:32 +02:00
-hal_wifi_server
Neverallow unexpected domains to access bluetooth_prop and wifi_prop And this CL will remove unnecessary vendor-init exceptions for nfc_prop and radio_prop as well. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: I468b8fd907c6408f51419cfb58eb2b8da29118ae Merged-In: I468b8fd907c6408f51419cfb58eb2b8da29118ae (cherry picked from commit 41e42d63fecf9c237337acea7e21a5da0683debe)
2018-04-18 04:24:15 +02:00
-wificond
} {
wifi_prop
}:property_service set;
neverallow {
domain
-coredomain
Use non-expanded types in prop neverallows Using hal_foo attributes in neverallow rules does not work because they are auto-expanded to types. Use hal_foo_server types instead. Fixes the following error: unit.framework.AssertionFailedError: The following errors were encountered when validating the SELinuxneverallow rule: neverallow { domain -coredomain -bluetooth -hal_bluetooth } { bluetooth_prop }: property_service set; Warning! Type or attribute hal_bluetooth used in neverallow undefined in policy being checked. Test: CtsSecurityHostTestCases Bug: 80153368 Change-Id: I2baf9f66d2ff110a4f181423790a1160a6e138da
2018-05-23 16:21:32 +02:00
-hal_wifi_server
Neverallow unexpected domains to access bluetooth_prop and wifi_prop And this CL will remove unnecessary vendor-init exceptions for nfc_prop and radio_prop as well. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: I468b8fd907c6408f51419cfb58eb2b8da29118ae Merged-In: I468b8fd907c6408f51419cfb58eb2b8da29118ae (cherry picked from commit 41e42d63fecf9c237337acea7e21a5da0683debe)
2018-04-18 04:24:15 +02:00
-wificond
-vendor_init
} {
exported_wifi_prop
}:property_service set;
Fix compatible property neverallows The current neverallow rules for compatible properties restrict domains from write file permissions to the various property files. This however is the wrong restriction, since only init actually writes to these property files. The correct restriction is to restrict 'set' for 'property_service' as this change does. Note there is already a restriction preventing {domain -init} from writing to these files in domain.te. Test: build Change-Id: I19e13b0d084a240185d0f3f5195e54065dc20e09
2018-01-24 20:20:35 +01:00
# Prevent properties from being read
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
neverallow {
domain
-coredomain
-appdomain
-vendor_init
} {
core_property_type
add extended_core_property_type The attribute is used to capture system properties added from outside of AOSP (e.g. by OEM), but are not device-specific and thus are used only inside the system partition. Access to the the system properties from outside of the system partition is prevented by the neverallow rule. Bug: 80382020 Bug: 78598545 Test: m -j selinux_policy Change-Id: I22c083dc195dab84c9c21a79fbe3ad823a3bbb46
2018-05-30 10:38:09 +02:00
extended_core_property_type
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
exported_dalvik_prop
exported_ffs_prop
exported_system_radio_prop
exported2_config_prop
exported2_system_prop
exported2_vold_prop
exported3_default_prop
exported3_system_prop
-debug_prop
-logd_prop
-nfc_prop
-powerctl_prop
-radio_prop
}:file no_rw_file_perms;
Add neverallow rules to restrict reading radio_prop This CL will allow only specific components to read radio_prop. Bug: 72459527 Test: tested with walleye Change-Id: I6b6c90870987de976187ff675005c5d964b48cda
2018-01-30 03:18:47 +01:00
Add tests for compatible property (1/2) The feature of compatible property has its own neverallow rules and it is enforced on devices launchig with Android P. This CL changes hal_nfc to hal_nfc_server in neverallow rules because sepolicy-analyze doesn't recognize it. Additionally one more neverallow rule is added to restrict reading nfc_prop. Bug: 72013705 Bug: 72678352 Test: 'run cts -m CtsSecurityHostTestCases' on walleye with ro.product.first_api_level=28 Change-Id: I753cc81f7ca0e4ad6a2434b2a047052678f57671
2018-01-30 09:23:58 +01:00
neverallow {
domain
-coredomain
-appdomain
-hal_nfc_server
} {
nfc_prop
}:file no_rw_file_perms;
Add neverallow rules to restrict reading radio_prop This CL will allow only specific components to read radio_prop. Bug: 72459527 Test: tested with walleye Change-Id: I6b6c90870987de976187ff675005c5d964b48cda
2018-01-30 03:18:47 +01:00
neverallow {
domain
-coredomain
-appdomain
Revert "Revert "Move rild from public to vendor."" This reverts commit 016f0a58a9cd429f1986033f922d4bb7f58f5f3a. Reason for revert: Was temporarily reverted, merging back in with fix. Bug: 74486619 Bug: 36427227 Change-Id: Ide68726a90d5485c2758673079427407aee1e4f2
2018-03-12 18:12:09 +01:00
-hal_telephony_server
Add neverallow rules to restrict reading radio_prop This CL will allow only specific components to read radio_prop. Bug: 72459527 Test: tested with walleye Change-Id: I6b6c90870987de976187ff675005c5d964b48cda
2018-01-30 03:18:47 +01:00
} {
radio_prop
}:file no_rw_file_perms;
Neverallow unexpected domains to access bluetooth_prop and wifi_prop And this CL will remove unnecessary vendor-init exceptions for nfc_prop and radio_prop as well. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: I468b8fd907c6408f51419cfb58eb2b8da29118ae Merged-In: I468b8fd907c6408f51419cfb58eb2b8da29118ae (cherry picked from commit 41e42d63fecf9c237337acea7e21a5da0683debe)
2018-04-18 04:24:15 +02:00
neverallow {
domain
-coredomain
-bluetooth
Use non-expanded types in prop neverallows Using hal_foo attributes in neverallow rules does not work because they are auto-expanded to types. Use hal_foo_server types instead. Fixes the following error: unit.framework.AssertionFailedError: The following errors were encountered when validating the SELinuxneverallow rule: neverallow { domain -coredomain -bluetooth -hal_bluetooth } { bluetooth_prop }: property_service set; Warning! Type or attribute hal_bluetooth used in neverallow undefined in policy being checked. Test: CtsSecurityHostTestCases Bug: 80153368 Change-Id: I2baf9f66d2ff110a4f181423790a1160a6e138da
2018-05-23 16:21:32 +02:00
-hal_bluetooth_server
Neverallow unexpected domains to access bluetooth_prop and wifi_prop And this CL will remove unnecessary vendor-init exceptions for nfc_prop and radio_prop as well. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: I468b8fd907c6408f51419cfb58eb2b8da29118ae Merged-In: I468b8fd907c6408f51419cfb58eb2b8da29118ae (cherry picked from commit 41e42d63fecf9c237337acea7e21a5da0683debe)
2018-04-18 04:24:15 +02:00
} {
bluetooth_prop
}:file no_rw_file_perms;
neverallow {
domain
-coredomain
Use non-expanded types in prop neverallows Using hal_foo attributes in neverallow rules does not work because they are auto-expanded to types. Use hal_foo_server types instead. Fixes the following error: unit.framework.AssertionFailedError: The following errors were encountered when validating the SELinuxneverallow rule: neverallow { domain -coredomain -bluetooth -hal_bluetooth } { bluetooth_prop }: property_service set; Warning! Type or attribute hal_bluetooth used in neverallow undefined in policy being checked. Test: CtsSecurityHostTestCases Bug: 80153368 Change-Id: I2baf9f66d2ff110a4f181423790a1160a6e138da
2018-05-23 16:21:32 +02:00
-hal_wifi_server
Neverallow unexpected domains to access bluetooth_prop and wifi_prop And this CL will remove unnecessary vendor-init exceptions for nfc_prop and radio_prop as well. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: I468b8fd907c6408f51419cfb58eb2b8da29118ae Merged-In: I468b8fd907c6408f51419cfb58eb2b8da29118ae (cherry picked from commit 41e42d63fecf9c237337acea7e21a5da0683debe)
2018-04-18 04:24:15 +02:00
-wificond
} {
wifi_prop
}:file no_rw_file_perms;
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
')
Revert "Remove neverallow coredomain to set vendor prop." Bug: 80466516 Bug: 78598545 This reverts commit 6f6fbebcefc8f38dbb13b648dbab7589f1880981. Change-Id: I3c0f374b846241571b5db6f061503f0ea2d6396a
2018-06-01 18:36:51 +02:00
compatible_property_only(`
# Neverallow coredomain to set vendor properties
neverallow {
coredomain
-init
-system_writes_vendor_properties_violators
} {
property_type
apexd exports its status via sysprop A sysprop apexd.status is set by apexd, to that other components (i.e. init) can determine whether APEXs are all successfully mounted or no (i.e., being mounted). The sysprop is only writable by apexd. Bug: 117403679 Test: adb shell getprop apexd.status returns 'ready'. Change-Id: I81bcb96e6c5cb9d899f29ffa84f91eab3820be25
2018-11-01 12:05:20 +01:00
-apexd_prop
Revert "Remove neverallow coredomain to set vendor prop." Bug: 80466516 Bug: 78598545 This reverts commit 6f6fbebcefc8f38dbb13b648dbab7589f1880981. Change-Id: I3c0f374b846241571b5db6f061503f0ea2d6396a
2018-06-01 18:36:51 +02:00
-audio_prop
-bluetooth_a2dp_offload_prop
Add rules for accessing the related bluetooth_audio_hal_prop This change allows those daemons of the audio and Bluetooth which include HALs to access the bluetooth_audio_hal_prop. This property is used to force disable the new BluetoothAudio HAL. - persist.bluetooth.bluetooth_audio_hal.disabled Bug: 128825244 Test: audio HAL can access the property Change-Id: I87a8ba57cfbcd7d3e4548aa96bc915d0cc6b2b74
2019-03-18 04:07:32 +01:00
-bluetooth_audio_hal_prop
Revert "Remove neverallow coredomain to set vendor prop." Bug: 80466516 Bug: 78598545 This reverts commit 6f6fbebcefc8f38dbb13b648dbab7589f1880981. Change-Id: I3c0f374b846241571b5db6f061503f0ea2d6396a
2018-06-01 18:36:51 +02:00
-bluetooth_prop
-bootloader_boot_reason_prop
-boottime_prop
Add permissions for bpf.progs_loaded property Change-Id: If4e550e4186415c5a1088bb53b0755b69f92560a Signed-off-by: Joel Fernandes <joelaf@google.com>
2019-01-11 14:32:45 +01:00
-bpf_progs_loaded_prop
Use a property instead of file to communicate cold boot done Ueventd can't set properties currently, but this is an artificial limitation, since ueventd communicates to init that it has finished cold boot via a file, and init polls this file instead of returning to the epoll loop, where properties are handled. A related change replaces that file with a property and thus frees ueventd to be able to set properties. This change creates the cold_boot_done property type for this property and gives only ueventd permissions to set it. Bug: 62301678 Test: boot, check that properties are set Change-Id: I40843b423b192ea841db6a82f648e5bab9738e0e
2019-06-18 18:53:51 +02:00
-cold_boot_done_prop
Revert "Remove neverallow coredomain to set vendor prop." Bug: 80466516 Bug: 78598545 This reverts commit 6f6fbebcefc8f38dbb13b648dbab7589f1880981. Change-Id: I3c0f374b846241571b5db6f061503f0ea2d6396a
2018-06-01 18:36:51 +02:00
-config_prop
-cppreopt_prop
Revert "Revert "Reduce the number of processes that can start adbd"" This reverts commit b5dc6137adf0c5ced252c6bedc48b00317e0a4e0. Reason for revert: Reverted incorrect change Change-Id: Ieafa3338e28ffeed40bcceb73486cffbfbd08b9d
2018-06-26 21:52:21 +02:00
-ctl_adbd_prop
Allow apexd to stop itself apexd stops itself when it finds that it is running on a device with flattened APEXes (i.e. ro.apex.updatable = false). Bug: 133907211 Test: launch sdk_phone_x86_64 adb logcat -d | grep apexd | wc -l returns 3 Change-Id: I7fa161b069aa34adb028194b55f367fe740a0cfc
2019-06-13 02:45:05 +02:00
-ctl_apexd_prop
Revert "Remove neverallow coredomain to set vendor prop." Bug: 80466516 Bug: 78598545 This reverts commit 6f6fbebcefc8f38dbb13b648dbab7589f1880981. Change-Id: I3c0f374b846241571b5db6f061503f0ea2d6396a
2018-06-01 18:36:51 +02:00
-ctl_bootanim_prop
-ctl_bugreport_prop
-ctl_console_prop
-ctl_default_prop
-ctl_dumpstate_prop
-ctl_fuse_prop
Allow system_server and shell to start gsid on-demand. gsid is started lazily to reduce memory pressure. It can be started either via gsi_tool (invoked by adb shell), or by DynamicAndroidService via system_server. Bug: 126622385 Test: no denials running "gsi_tool status" Change-Id: I90a5f3f28fe4f294fb60e7c87a62e76716fbd5c0
2019-02-28 03:31:11 +01:00
-ctl_gsid_prop
Revert "Remove neverallow coredomain to set vendor prop." Bug: 80466516 Bug: 78598545 This reverts commit 6f6fbebcefc8f38dbb13b648dbab7589f1880981. Change-Id: I3c0f374b846241571b5db6f061503f0ea2d6396a
2018-06-01 18:36:51 +02:00
-ctl_interface_restart_prop
-ctl_interface_start_prop
-ctl_interface_stop_prop
-ctl_mdnsd_prop
-ctl_restart_prop
-ctl_rildaemon_prop
-ctl_sigstop_prop
-ctl_start_prop
-ctl_stop_prop
-dalvik_prop
-debug_prop
-debuggerd_prop
-default_prop
-device_logging_prop
-dhcp_prop
-dumpstate_options_prop
-dumpstate_prop
-exported2_config_prop
-exported2_default_prop
-exported2_radio_prop
-exported2_system_prop
-exported2_vold_prop
-exported3_default_prop
-exported3_radio_prop
-exported3_system_prop
-exported_bluetooth_prop
-exported_config_prop
-exported_dalvik_prop
-exported_default_prop
-exported_dumpstate_prop
-exported_ffs_prop
-exported_fingerprint_prop
-exported_overlay_prop
-exported_pm_prop
-exported_radio_prop
-exported_secure_prop
-exported_system_prop
-exported_system_radio_prop
-exported_vold_prop
-exported_wifi_prop
-extended_core_property_type
-ffs_prop
-fingerprint_prop
-firstboot_prop
Update sepolicy with new native boot flag for activity_manager Whitelist the persistent system properties that will be used as flags in activity manager experiments. Bug: 120794810 Test: m, flash, test getting flag value in ActivityManagerService.java Change-Id: I90a10bc87d6db3a64347b62fd02e6f0b12ac9fa8
2019-01-17 22:30:05 +01:00
-device_config_activity_manager_native_boot_prop
Sepolicies for server configural flags reset Test: m -j succeeded and manual tested on device Change-Id: I3415c58335361a9da4ef2368e61bc4e0250a91bb
2018-11-09 01:46:19 +01:00
-device_config_reset_performed_prop
sepolicy for server configurable flags Test: manual on device Change-Id: Ibafe1b345489c88a49a7ed3e2e61e5cc5e1880a1
2018-10-26 05:09:55 +02:00
-device_config_boot_count_prop
Permissions for input_native_boot flags For input experiments that are enabled at boot time, allow system_server to read and write the device config flags. Bug: 120794829 Test: presubmit Change-Id: I0f075a7579c593d4e07c3e31be529e34554068a6
2019-01-14 23:18:38 +01:00
-device_config_input_native_boot_prop
SEPolicy updates for adding native flag namespace(netd). For experiment flag testing, we add a flag netd and have SEPolicy updates. Test: add sepolicy, m -j, check GetServerConfigurableFlag function in netd Bug:122050512 Change-Id: I21c844c277afc358085d80447f16e4c0d4eba5b3
2018-12-27 11:01:25 +01:00
-device_config_netd_native_prop
Add device_config_runtime_native_boot_prop Some runtime properties require reboots and should be in the native_boot namespace instead of native. Bug: 120794191 Bug: 123524494 Test: set a property and ensure it can be read in AndroidRuntime.cpp Change-Id: I1d1e984dcba26dd04d34a7d30fc63e1b75a8a311
2019-02-01 22:43:11 +01:00
-device_config_runtime_native_boot_prop
Rename runtime -> runtime_native property namespace The convention for native properties is to use _native suffix. Bug: 123524494 Bug: 120794191 Test: set a property and ensure it can be read in AndroidRuntime.cpp Change-Id: I69feab9be78f24d812b8f953d3ec06a5d8d18f15
2019-01-29 18:57:11 +01:00
-device_config_runtime_native_prop
SEPolicy updates for adding native flag namespace(media). Test: add sepolicy, build, check GetServerConfigurableFlag function Bug: 123658514 Change-Id: I798b0ef901068c53070e768305acd38118a7e886
2019-01-31 00:28:31 +01:00
-device_config_media_native_prop
Add native flags namespace storage_native_boot Grant SEPolicy write permissions for device_config_storage_native_boot. Test: build and flash - device successfully boots Bug: 140803239 Change-Id: I6e4f5889aee9384b47faacb31e2b1938250428ef
2019-09-23 16:14:47 +02:00
-device_config_storage_native_boot_prop
Re-add sys_traced prop Add permissions for: persist.device_config.global_settings.sys_traced Bug: b/71737179 Test: As follows: patch aosp/891475 patch aosp/891853 patch ag/6224352 $ adb shell walleye:/ $ ps -A | grep traced nobody 1135 1 52288 2200 0 0 S traced nobody 1136 1 52288 2256 0 0 S traced_probes walleye:/ $ settings put global sys_traced 0 walleye:/ $ ps -A | grep traced 1|walleye:/ $ walleye:/ $ settings put global sys_traced 1 1|walleye:/ $ ps -A | grep traced nobody 12386 1 52288 2208 0 0 S traced nobody 12387 1 52288 2248 0 0 S traced_probes Change-Id: I8898672c8fdc9c5d87a31b90f6c7d5c03bef78ed
2019-04-05 17:41:30 +02:00
-device_config_sys_traced_prop
Sepolicy: add dynamic_system_prop and allow shell and system_app (Settings) to set it to enable Dynamic System Update. Also allow priv_app (user of the API) to read it. Bug: 119647479 Bug: 129060539 Test: run the following command on crosshatch-user: adb shell setprop persist.sys.fflag.override.settings_dynamic_system 1 Change-Id: I24a5382649c64d36fd05a59bc87faca87e6f0eb8 Merged-In: I24a5382649c64d36fd05a59bc87faca87e6f0eb8
2019-04-26 10:14:52 +02:00
-dynamic_system_prop
Add sepolicy for gsid properties, and allow system_server to read them. Bug: 123777418 Test: manual test Change-Id: I9f8c721dfd074e638573d85cf1d8045a69c3854e
2019-02-07 22:14:20 +01:00
-gsid_prop
Add persist.heapprofd.enable property. This is analoguous to what Perfetto does with persist.traced.enable. Test: m Test: flash walleye Test: setprop persist.heapprofd.enable 1 setprop persist.heapprofd.enable 0 Change-Id: I997272ef8c6fe078aca2388ed0cf2ecc3de612a5
2018-12-10 17:20:20 +01:00
-heapprofd_enabled_prop
Property to enable heap profile from process startup. This is world-readable so it can be checked in libc's process init. Test: m Test: flash sailfish Bug: 117821125 Change-Id: Iac7317ceb75b5ad9cfb9adabdf16929263fa8a9d
2018-11-08 14:58:13 +01:00
-heapprofd_prop
Revert "Remove neverallow coredomain to set vendor prop." Bug: 80466516 Bug: 78598545 This reverts commit 6f6fbebcefc8f38dbb13b648dbab7589f1880981. Change-Id: I3c0f374b846241571b5db6f061503f0ea2d6396a
2018-06-01 18:36:51 +02:00
-hwservicemanager_prop
-last_boot_reason_prop
Selinux: Allow lmkd write access to sys.lmk. properties Allow lmkd write access to sys.lmk. properties to be able to set sys.lmk.minfree_levels. Bug: 111521182 Test: getprop sys.lmk.minfree_levels returns value set by lmkd Change-Id: I86ff11d75917966857d3a76876a56799bb92a5ad Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2018-07-25 02:04:18 +02:00
-system_lmk_prop
Define sepolicy with property for linker To support linker-specific property, sys.linker.* has been defined as linker_prop. This will have get_prop access from domain so all binaries can start with linker using proper property access level. Bug: 138920271 Test: m -j && Confirmed from cuttlefish that get_prop errors are no longer found Change-Id: Iaf584e0cbdd5bca3d5667e93cf9a6401e757a314
2019-08-09 07:20:34 +02:00
-linker_prop
Revert "Remove neverallow coredomain to set vendor prop." Bug: 80466516 Bug: 78598545 This reverts commit 6f6fbebcefc8f38dbb13b648dbab7589f1880981. Change-Id: I3c0f374b846241571b5db6f061503f0ea2d6396a
2018-06-01 18:36:51 +02:00
-log_prop
-log_tag_prop
-logd_prop
-logpersistd_logging_prop
-lowpan_prop
Add rules for lpdump and lpdumpd - lpdump is a binary on the device that talks to lpdumpd via binder. - lpdumpd is a daemon on the device that actually reads dynamic partition metadata. Only lpdump can talk to it. Bug: 126233777 Test: boots (sanity) Test: lpdump Change-Id: I0e21f35ac136bcbb0603940364e8117f2d6ac438
2019-03-14 23:45:03 +01:00
-lpdumpd_prop
Revert "Remove neverallow coredomain to set vendor prop." Bug: 80466516 Bug: 78598545 This reverts commit 6f6fbebcefc8f38dbb13b648dbab7589f1880981. Change-Id: I3c0f374b846241571b5db6f061503f0ea2d6396a
2018-06-01 18:36:51 +02:00
-mmc_prop
Add label for persist.pm.mock-upgrade This property is used for testing purposes when verifying the behavior when an OTA occurs. It should be readable by the system server, and be settable by the shell. Test: Set property from shell, read with PackageManager Bug: 140992644 Change-Id: I39ad9b7961208f02fa45011215c2ff5ac03b7380
2019-10-09 18:09:48 +02:00
-mock_ota_prop
Revert "Remove neverallow coredomain to set vendor prop." Bug: 80466516 Bug: 78598545 This reverts commit 6f6fbebcefc8f38dbb13b648dbab7589f1880981. Change-Id: I3c0f374b846241571b5db6f061503f0ea2d6396a
2018-06-01 18:36:51 +02:00
-net_dns_prop
-net_radio_prop
-netd_stable_secret_prop
-nfc_prop
Add a new context for property ota.warm_reset The property is set to inform kernel to do a warm_reset on the next reboot. This is useful to persist the logs to debug device boot failures. More details in http://go/rvc-ota-persist-logs. The property is set to 1 by update_engine after an OTA. And it's set to 0 by update_verifier or vold after we mark the current slot boot successful. The property is read by vendor_init. And according to its value, vendor_init writes a particular sysfs file to schedule a warm reset on the following reboot. Without the new context, the denial message says: [ 13.423163] audit: type=1107 audit(1746393.166:8): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { read } for property=ota.warm_reset pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0' [ 23.096497] init: Unable to set property 'OTA.warm_reset' from uid:0 gid:2001 pid:841: SELinux permission check failed [ 23.096574] type=1107 audit(1573768000.668:42): uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for property=OTA.warm_reset pid=841 uid=0 gid=2001 scontext=u:r:update_verifier:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service permissive=0' [ 23.108430] update_verifier: Failed to reset the warm reset flag Bug: 143489994 Test: check the property can be set by update_engine, and read by vendor_init Change-Id: I87c12a53a138b72ecfed3ab6a4d846c20f5a8484
2019-11-14 23:18:40 +01:00
-ota_prop
Revert "Remove neverallow coredomain to set vendor prop." Bug: 80466516 Bug: 78598545 This reverts commit 6f6fbebcefc8f38dbb13b648dbab7589f1880981. Change-Id: I3c0f374b846241571b5db6f061503f0ea2d6396a
2018-06-01 18:36:51 +02:00
-overlay_prop
-pan_result_prop
-persist_debug_prop
-persistent_properties_ready_prop
-pm_prop
-powerctl_prop
-radio_prop
-restorecon_prop
-safemode_prop
-serialno_prop
-shell_prop
-system_boot_reason_prop
-system_prop
-system_radio_prop
Allow traced to notify traceur via property This CL introduces allows traced to set the sys.traceur.trace_end_signal property at the end of the tracer. In turn that property notifies the the Traceur app. This is to allowing Traceur to be killed during a long-trace and avoid wasting resources making it a persistent service. See aosp/886616 for the matching traceur change. Test: manual Bug: 116754732 Change-Id: I89e2f02b3f973813ce8ff3507d397a06502f84c1
2019-02-01 23:52:02 +01:00
-system_trace_prop
Revert "Remove neverallow coredomain to set vendor prop." Bug: 80466516 Bug: 78598545 This reverts commit 6f6fbebcefc8f38dbb13b648dbab7589f1880981. Change-Id: I3c0f374b846241571b5db6f061503f0ea2d6396a
2018-06-01 18:36:51 +02:00
-test_boot_reason_prop
Add the testharness service to sepolicy rules The testharness service will manage Test Harness Mode and provide a command-line interface for users to enable Test Harness Mode; however it does not directly provide a public API. Bug: 80137798 Test: make Test: flash crosshatch Change-Id: Ie396e40fcea8914b4dd2247f2314e029b66ad84e
2019-01-15 22:39:30 +01:00
-test_harness_prop
Add persist.sys.theme. This property will be set by system_server (to indicate the currently selected theme for device), and can be accessed by vendor init.rc. avc: denied { read } for property=persist.sys.theme pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:theme_prop:s0 tclass=file Bug: 113028175 Test: Set a vendor init trigger that waits on `persist.sys.theme`. Check that the trigger fires without denial. Change-Id: Ia85b1a8dfc118efdbb9337ca017c8fb7958dc386 Merged-In: Ibb4e392d5059b76059f36f7d11ba82cd65cbe970 (cherry picked from commit 75182a1ea645d3fa1e4c3e9f77851d90ff7cc803)
2019-06-15 02:00:16 +02:00
-theme_prop
Add label for time (zone) system properties This adds a label for system properties that will affect system-wide time / time detection logic. The first example will be something like: persist.time.detection_impl_version Bug: 78217059 Test: build Change-Id: I46044f1e28170760001da9acf2496a1e3037e48a
2018-06-25 16:36:51 +02:00
-time_prop
Revert "Remove neverallow coredomain to set vendor prop." Bug: 80466516 Bug: 78598545 This reverts commit 6f6fbebcefc8f38dbb13b648dbab7589f1880981. Change-Id: I3c0f374b846241571b5db6f061503f0ea2d6396a
2018-06-01 18:36:51 +02:00
-traced_enabled_prop
Allow traced to lazily start heapprofd. Bug: 126724929 Change-Id: I15f0ae10d5e45fc65850635230e377b6f77ad4d7
2019-03-13 19:22:23 +01:00
-traced_lazy_prop
Revert "Remove neverallow coredomain to set vendor prop." Bug: 80466516 Bug: 78598545 This reverts commit 6f6fbebcefc8f38dbb13b648dbab7589f1880981. Change-Id: I3c0f374b846241571b5db6f061503f0ea2d6396a
2018-06-01 18:36:51 +02:00
-vendor_default_prop
-vendor_security_patch_level_prop
-vold_prop
-wifi_log_prop
-wifi_prop
}:property_service set;
')
Reference in a new issue Copy permalink