tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/file.te

394 lines
17 KiB
Text
Raw Normal View History

SE Android policy.
2012-01-04 18:33:27 +01:00
# Filesystem types
type labeledfs, fs_type;
type pipefs, fs_type;
type sockfs, fs_type;
type rootfs, fs_type;
type proc, fs_type;
Restrict the ability to set usermodehelpers and proc security settings. Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06 15:31:40 +01:00
# Security-sensitive proc nodes that should not be writable to most.
type proc_security, fs_type;
drop_caches label, vold scratch space on expanded. Define an explicit label for /proc/sys/vm/drop_caches and grant to the various people who need it, including vold which uses it when performing storage benchmarks. Also let vold create new directories under it's private storage area where the benchmarks will be carried out. Mirror the definition of the private storage area on expanded media. avc: denied { write } for name="drop_caches" dev="proc" ino=20524 scontext=u:r:vold:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=0 Bug: 21172095 Change-Id: I300b1cdbd235ff60e64064d3ba6e5ea783baf23f
2015-05-15 05:55:31 +02:00
type proc_drop_caches, fs_type;
domain: allow reading /proc/sys/vm/overcommit_memory Needed for jemalloc commit: 2f970c32b527660a33fa513a76d913c812dcf7c Modify pages_map() to support mapping uncommitted virtual memory. avc: denied { read } for name="overcommit_memory" dev="proc" ino=10544 scontext=u:r:wificond:s0 tcontext=u:object_r:proc:s0 tclass=file Bug: 29773242 Change-Id: I78054c1ed576a7998c4ee1d1beca2f610c589c3a
2016-06-28 00:38:25 +02:00
type proc_overcommit_memory, fs_type;
Restrict the ability to set usermodehelpers and proc security settings. Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06 15:31:40 +01:00
# proc, sysfs, or other nodes that permit configuration of kernel usermodehelpers.
create separate usermodehelper type for sysfs Prevent files in /proc from incorrectly having sysfs_type attribute. Rework neverallows so that ueventd has write access to all of /sys which it needs to handle uevents. Bug: 63147833 Test: Build. Flash angler, verify files are correctly labeled and no new denials are in the logs. Change-Id: Ib94d44e78cee0e83e2ac924f1c72e611e8e73558
2017-07-12 19:37:57 +02:00
type usermodehelper, fs_type;
type sysfs_usermodehelper, fs_type, sysfs_type;
Target the denials/policies over qtaguid file and device: 1. Relabel /proc/net/xt_qtaguid/ctrl from "qtaguid" to "qtaguid_proc"; 2. Label /dev/xt_qtaguid with "qtaguid_device"; 3. Allow mediaserver read/[write] to qtaguid_proc and qtaguid_device; 4. Allow media apps read/[write] to qtaguid_proc and qtaguid_device; 5. Allow system read/[write] to qtaguid_proc and qtaguid_device. Actually, some of policies related to qtaguid have been there already, but we refind existing ones and add new ones.
2012-07-19 20:07:04 +02:00
type qtaguid_proc, fs_type, mlstrustedobject;
relabel files in /proc/net/xt_qtaguid/ /proc/net/xt_qtaguid is used by apps to track their network data use. Limit access to just zygote spawned processes - apps and system_server, omitting access to isolated_app which is not allowed to create network sockets. As Android moves to eBPF for app's network data stats, access to /proc/net/xt_qtaguid will be removed entirely. Segmenting access off is the first step. Bug: 68774956 This change also helps further segment and whitelist access to files in /proc/net and is a step in the lockdown of /proc/net. Bug: 9496886 Test: boot Taimen. Walk through setup-wizard. Make phone call and video call. Browse web. Watch youtube. Navigate in maps. Test: cts-tradefed run cts -m CtsAppSecurityHostTestCases -t \ android.appsecurity.cts.AppSecurityTests Test: cts-tradefed run cts -m CtsNativeNetTestCases Test: cts-tradefed run cts -m CtsIncidentHostTestCases -t \ com.android.server.cts.NetstatsIncidentTest Test: cts-tradefed run cts -m CtsOsTestCases -t \ android.os.cts.StrictModeTest Test: cts-tradefed run cts -m CtsNetTestCases -t \ android.net.cts.TrafficStatsTest Test: cts-tradefed run cts -m CtsUsageStatsTestCases -t \ android.app.usage.cts.NetworkUsageStatsTest Test: vts-tradefed run vts -m VtsQtaguidTest Change-Id: Idddd318c56b84564142d37b11dcc225a2f2800ea
2018-01-02 22:10:46 +01:00
type proc_qtaguid_stat, fs_type, mlstrustedobject;
Various policy updates. Assortment of policy changes include: * Bluetooth domain to talk to init and procfs. * New device node domains. * Allow zygote to talk to its executable. * Update system domain access to new device node domains. * Create a post-process sepolicy with dontaudits removed. * Allow rild to use the tty device. Change-Id: Ibb96b590d0035b8f6d1606cd5e4393c174d10ffb Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2013-03-27 11:30:25 +01:00
type proc_bluetooth_writable, fs_type;
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
type proc_abi, fs_type;
Extend access to proc/asound/* Renamed this type: proc_asound_cards -> proc_asound Labeled /proc/asound/devices as proc_asound. We now use proc_asound type to label files under /proc/asound which we want to expose to system components. Bug: 66988327 Test: Pixel 2 boots, can play sound with or without headphones, and selinux denials to proc_asound are not seen. Change-Id: I453d9bfdd70eb80931ec9e80f17c8fd0629db3d0
2017-10-06 19:20:53 +02:00
type proc_asound, fs_type;
Explicitly label vold dependecies in /proc 1. Labeled: /proc/cmdline -> proc_cmdline 2. Removed access to proc label from vold domain. 3. Added access proc_cmdline to these domains: init, kernel, vold 4. Also, added proc_drop_caches access to vold. Bug: 66497047 Test: device boots without selinux denials to new labels Change-Id: Ic88d11b7e56b07c0e8bd874e7f72788922a218e3
2017-09-21 22:18:00 +02:00
type proc_cmdline, fs_type;
zygote: allow replacing /proc/cpuinfo Android's native bridge functionality allows an Android native app written on one CPU architecture to run on a different architecture. For example, Android ARM apps may run on an x86 CPU. To support this, the native bridge functionality needs to replace /proc/cpuinfo with the version from /system/lib/<ISA>/cpuinfo using a bind mount. See commit ab0da5a9a6860046619629b8e6b83692d35dff86 in system/core. This change: 1) Creates a new label proc_cpuinfo, and assigns /proc/cpuinfo that label. 2) Grants read-only access to all SELinux domains, to avoid breaking pre-existing apps. 3) Grants zygote mounton capabilities for that file, so zygote can replace the file as necessary. Addresses the following denial: avc: denied { mounton } for path="/proc/cpuinfo" dev="proc" ino=4026532012 scontext=u:r:zygote:s0 tcontext=u:object_r:proc:s0 tclass=file Bug: 17671501 Change-Id: Ib70624fba2baeccafbc0a41369833f76b976ee20
2014-09-26 19:51:12 +02:00
type proc_cpuinfo, fs_type;
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
type proc_dirty, fs_type;
type proc_diskstats, fs_type;
type proc_extra_free_kbytes, fs_type;
Explicitly label filesystem files in /proc proc files needed by fwk that were labeled: /proc/filesystems -> proc_filesystems /proc/mounts -> proc_mounts /proc/swaps -> proc_mounts Removed access to proc label from these domains: e2fs, fsck, fsck_untrusted, sdcardd e2fs: added access to proc_filesystems, proc_mounts, proc_swaps fsck: added access to proc_mounts, proc_swaps fsck_untrusted: added access to proc_mounts sdcardd: added access to proc_filesystems vold: added access to proc_filesystems, proc_mounts Bug: 66199084 Test: device boots without selinux denials to new labels or proc label. Change-Id: If0f19e22074419dab0b3a0c6f3a300ea8cb94523
2017-09-20 21:51:57 +02:00
type proc_filesystems, fs_type;
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
type proc_hostname, fs_type;
type proc_hung_task, fs_type;
restrict access to timing information in /proc These APIs expose sensitive information via timing side channels. This leaves access via the adb shell intact along with the current uses by dumpstate, init and system_server. The /proc/interrupts and /proc/stat files were covered in this paper: https://www.lightbluetouchpaper.org/2016/07/29/yet-another-android-side-channel/ The /proc/softirqs, /proc/timer_list and /proc/timer_stats files are also relevant. Access to /proc has been greatly restricted since then, with untrusted apps no longer having direct access to these, but stricter restrictions beyond that would be quite useful. Change-Id: Ibed16674856569d26517e5729f0f194b830cfedd
2016-07-29 20:48:19 +02:00
type proc_interrupts, fs_type;
Give /proc/iomem a more specific label. /proc/iomem is currently given the proc label but contains system information which should not be available to all processes. Bug: 22008387 Change-Id: I4f1821f40113a743ad986d13d8d130ed8b8abf2f
2015-07-13 17:39:17 +02:00
type proc_iomem, fs_type;
Explicitly label logd's dependencies in /proc. labeled /proc/kmsg as proc_kmsg, changed logd's access from proc to proc_kmsg, and added a compat mapping. Bug: 65643247 Test: device boots without selinux denials to the newly introduced proc_kmsg Test: logd-unit-tests passes Change-Id: I92c9f5694289eb6a94c4d90f14e2de4d46b5228e
2017-09-13 23:34:56 +02:00
type proc_kmsg, fs_type;
Explicitly label system_server's dependencies in /proc Labeled: /proc/asound/cards -> proc_asound_cards /proc/loadavg -> proc_loadavg /proc/pagetypeinfo -> proc_pagetypeinfo /proc/version -> proc_version /proc/vmallocinfo -> proc_vmallocinfo system_server: added access to all new types and removed access to proc label. init: added access to proc_version. dumpstate: added access to proc_pagetypeinfo, proc_version, proc_vmallocinfo. hal_audio: added access to proc_asound_cards. all_untrusted_apps: extended neverallow rule to include new labels. Bug: 65980789 Test: device boots without selinux denials to the newly introduced labels. Test: "adb shell dumpstate" throws no violations to new labels. Change-Id: Ic60facd3d4776e38d5e3ba003d06ada4e52c7dca
2017-09-14 22:59:09 +02:00
type proc_loadavg, fs_type;
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
type proc_max_map_count, fs_type;
Label /proc/meminfo. Address the following denial: m.chrome.canary: type=1400 audit(0.0:15): avc: granted { read open } for path="/proc/meminfo" dev="proc" ino=4026544360 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:proc:s0 tclass=file Bug: 22032619 Chromium Bug: 586021 Change-Id: I584345c84d870c313da69ec97a0b1e54c0eb9ee1
2016-02-24 02:09:48 +01:00
type proc_meminfo, fs_type;
Label /proc/misc Label /proc/misc and allow access to untrusted_apps targeting older API versions, as well as update_engine_common. /proc/misc is used by some banking apps to try to detect if they are running in an emulated environment. TODO: Remove access to proc:file from update_engine_common after more testing. Bug: 35917228 Test: Device boots and no new denials. Change-Id: If1b97a9c55a74cb74d1bb15137201ffb95b5bd75
2017-03-03 21:17:49 +01:00
type proc_misc, fs_type;
enabled /sbin/modprobe for recovery mode This change defines new policy for modprobe (/sbin/modprobe) that should be used in both recovery and android mode. Denials: [ 16.986440] c0 437 audit: type=1400 audit(6138546.943:5): avc: denied { read } for pid=437 comm="modprobe" name="modules" dev="proc" ino=4026532405 scontext=u:object_r:modprobe:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 [ 16.986521] c0 437 audit: type=1400 audit(6138546.943:6): avc: denied { open } for pid=437 comm="modprobe" path="/proc/modules" dev="proc" ino=4026532405 scontext=u:object_r:modprobe:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 [ 16.986544] c0 437 audit: type=1400 audit(6138546.943:7): avc: denied { getattr } for pid=437 comm="modprobe" path="/proc/modules" dev="proc" ino=4026532405 scontext=u:object_r:modprobe:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 Bug: 35633646 Test: Build and tested it works in sailfish recovery. The modprobe is invoked in init.rc (at the end of 'on init') with following command line exec u:r:modprobe:s0 -- /sbin/modprobe -a nilfs2 ftl Change-Id: Ie70be6f918bea6059f806e2eb38cd48229facafa
2017-03-02 09:02:29 +01:00
type proc_modules, fs_type;
Explicitly label filesystem files in /proc proc files needed by fwk that were labeled: /proc/filesystems -> proc_filesystems /proc/mounts -> proc_mounts /proc/swaps -> proc_mounts Removed access to proc label from these domains: e2fs, fsck, fsck_untrusted, sdcardd e2fs: added access to proc_filesystems, proc_mounts, proc_swaps fsck: added access to proc_mounts, proc_swaps fsck_untrusted: added access to proc_mounts sdcardd: added access to proc_filesystems vold: added access to proc_filesystems, proc_mounts Bug: 66199084 Test: device boots without selinux denials to new labels or proc label. Change-Id: If0f19e22074419dab0b3a0c6f3a300ea8cb94523
2017-09-20 21:51:57 +02:00
type proc_mounts, fs_type;
Create proc_net type for /proc/sys/net entries. /proc/sys/net could use its own type to help distinguish among some of the proc access rules. Fix dhcp and netd because of this. Change-Id: I6e16cba660f07bc25f437bf43e1eba851a88d538 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-01-07 19:46:56 +01:00
type proc_net, fs_type;
Add label for /proc/sys/vm/page-cluster Test: boot sailfish with no audit when writing to page-cluster Change-Id: I2bfebdf9342594d66d95daaec92d71195c93ffc8
2017-10-24 22:17:46 +02:00
type proc_page_cluster, fs_type;
Explicitly label system_server's dependencies in /proc Labeled: /proc/asound/cards -> proc_asound_cards /proc/loadavg -> proc_loadavg /proc/pagetypeinfo -> proc_pagetypeinfo /proc/version -> proc_version /proc/vmallocinfo -> proc_vmallocinfo system_server: added access to all new types and removed access to proc label. init: added access to proc_version. dumpstate: added access to proc_pagetypeinfo, proc_version, proc_vmallocinfo. hal_audio: added access to proc_asound_cards. all_untrusted_apps: extended neverallow rule to include new labels. Bug: 65980789 Test: device boots without selinux denials to the newly introduced labels. Test: "adb shell dumpstate" throws no violations to new labels. Change-Id: Ic60facd3d4776e38d5e3ba003d06ada4e52c7dca
2017-09-14 22:59:09 +02:00
type proc_pagetypeinfo, fs_type;
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
type proc_panic, fs_type;
Make /proc/sys/kernel/perf_event_max_sample_rate accessible to untrusted_app. perf_event_max_sample_rate is needed to be read for native profiling, otherwise CTS test can fail on devices with kernel >= 4.4. Before this CL, the file is not readable from untrusted_app domain. This CL makes it readable from both shell domain and untrusted_app domain. Bug: http://b/35554543 Test: build and test on marlin. Change-Id: Id118e06e3c800b70a749ab112e07a4ec24bb5975
2017-03-07 02:27:54 +01:00
type proc_perf, fs_type;
Label /proc/sys/kernel/pid_max as proc_pid_max. And give shell domain read access to /proc/sys/kernel/pic_max. Bug: 69569397 Test: adb shell /data/nativetest/bionic-unit-tests/bionic-unit-tests --gtest_filter=pthread.pthread_mutex_owner_tid_limit Change-Id: Ib56c18ed553ad2c2113e6913788a4c00965483cc
2017-11-28 17:42:40 +01:00
type proc_pid_max, fs_type;
system_server: access to /proc/sys/fs/pipe-max-size Label /proc/sys/fs/pipe-max-size with new type proc_pipe_conf and give system_server access to it. Addresses this denial: avc: denied { read } for name="pipe-max-size" dev="proc" ino=93817 scontext=u:r:system_server:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=0 Bug: 69175449 Bug: 69324398 Test: sailfish boots Test: adb bugreport Test: craft an unresponsive app, trigger ANR, make sure traces are dumped into /data/anr Above denial from system_server not observed, no denials to proc_pipe_conf observed. Change-Id: I7c71f05820a4945ba982e29f76e9d9f4458b2b59
2017-11-15 01:32:36 +01:00
type proc_pipe_conf, fs_type;
/proc, /sys access from uncrypt, update_engine, postinstall_dexopt New types: 1. proc_random 2. sysfs_dt_firmware_android Labeled: 1. /proc/sys/kernel/random as proc_random. 2. /sys/firmware/devicetree/base/firmware/android/{compatible, fstab, vbmeta} as sysfs_dt_firmware_android. Changed access: 1. uncrypt, update_engine, postinstall_dexopt have access to generic proc and sysfs labels removed. 2. appropriate permissions were added to uncrypt, update_engine, update_engine_common, postinstall_dexopt. Bug: 67416435 Bug: 67416336 Test: fake ota go/manual-ab-ota runs without denials Test: adb sideload runs without denials to new types Change-Id: Id31310ceb151a18652fcbb58037a0b90c1f6505a
2017-10-04 19:34:11 +02:00
type proc_random, fs_type;
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
type proc_sched, fs_type;
restrict access to timing information in /proc These APIs expose sensitive information via timing side channels. This leaves access via the adb shell intact along with the current uses by dumpstate, init and system_server. The /proc/interrupts and /proc/stat files were covered in this paper: https://www.lightbluetouchpaper.org/2016/07/29/yet-another-android-side-channel/ The /proc/softirqs, /proc/timer_list and /proc/timer_stats files are also relevant. Access to /proc has been greatly restricted since then, with untrusted apps no longer having direct access to these, but stricter restrictions beyond that would be quite useful. Change-Id: Ibed16674856569d26517e5729f0f194b830cfedd
2016-07-29 20:48:19 +02:00
type proc_stat, fs_type;
Explicitly label filesystem files in /proc proc files needed by fwk that were labeled: /proc/filesystems -> proc_filesystems /proc/mounts -> proc_mounts /proc/swaps -> proc_mounts Removed access to proc label from these domains: e2fs, fsck, fsck_untrusted, sdcardd e2fs: added access to proc_filesystems, proc_mounts, proc_swaps fsck: added access to proc_mounts, proc_swaps fsck_untrusted: added access to proc_mounts sdcardd: added access to proc_filesystems vold: added access to proc_filesystems, proc_mounts Bug: 66199084 Test: device boots without selinux denials to new labels or proc label. Change-Id: If0f19e22074419dab0b3a0c6f3a300ea8cb94523
2017-09-20 21:51:57 +02:00
type proc_swaps, fs_type;
Address system_server denials. Label /proc/sysrq-trigger and allow access. Label /dev/socket/mtpd and allow access. Resolves denials such as: avc: denied { getattr } for pid=12114 comm="Binder_2" path="socket:[219779]" dev="sockfs" ino=219779 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket avc: denied { call } for pid=1007 comm="Binder_8" scontext=u:r:system_server:s0 tcontext=u:r:su:s0 tclass=binder avc: denied { write } for pid=1024 comm="watchdog" name="sysrq-trigger" dev="proc" ino=4026533682 scontext=u:r:system_server:s0 tcontext=u:object_r:proc:s0 tclass=file avc: denied { write } for pid=11567 comm="LegacyVpnRunner" name="mtpd" dev="tmpfs" ino=36627 scontext=u:r:system_server:s0 tcontext=u:object_r:socket_device:s0 tclass=sock_file avc: denied { ptrace } for pid=10924 comm=5369676E616C2043617463686572 scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=process avc: denied { sigkill } for pid=26077 comm="NativeCrashRepo" scontext=u:r:system_server:s0 tcontext=u:r:zygote:s0 tclass=process avc: denied { write } for pid=1024 comm="android.bg" scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=netlink_socket avc: denied { getattr } for pid=473 comm="FinalizerDaemon" path="socket:[11467]" dev="sockfs" ino=11467 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=tcp_socket avc: denied { getattr } for pid=473 comm="FinalizerDaemon" path="socket:[12076]" dev="sockfs" ino=12076 scontext=u:r:system_server:s0 tcontext=u:r:mediaserv er:s0 tclass=udp_socket avc: denied { getopt } for pid=473 comm="FinalizerDaemon" laddr=192.168.159.172 lport=51576 faddr=93.127.173.40 fport=554 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=tcp_socket avc: denied { getopt } for pid=473 comm="FinalizerDaemon" lport=15658 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=udp_socket avc: denied { read write } for pid=21384 comm="rtsp" path="socket:[443742]" dev="sockfs" ino=443742 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s 0 tclass=tcp_socket avc: denied { read write } for pid=21384 comm="rtsp" path="socket:[444842]" dev="sockfs" ino=444842 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=udp_socket avc: denied { setopt } for pid=1326 comm="Binder_9" lport=16216 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=udp_socket avc: denied { setopt } for pid=1676 comm="Binder_6" laddr=192.168.156.130 lport=51044 faddr=74.125.214.81 fport=554 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=tcp_socket avc: denied { getattr } for pid=10915 comm="system_server" path="/dev/mdm" dev="tmpfs" ino=7484 scontext=u:r:system_server:s0 tcontext=u:object_r:radio_device:s0 tclass=chr_file avc: denied { read } for pid=10915 comm="system_server" name="mdm" dev="tmpfs" ino=7484 scontext=u:r:system_server:s0 tcontext=u:object_r:radio_device:s0 tclass=chr_file avc: denied { unlink } for pid=14866 comm="system_server" name="wallpaper" dev="mmcblk0p9" ino=285715 scontext=u:r:system_server:s0 tcontext=u:object_r:wallpaper_file:s0 tclass=file avc: denied { getattr } for pid=12114 comm="Binder_2" path="socket:[219779]" dev="sockfs" ino=219779 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket avc: denied { getopt } for pid=32300 comm="Binder_1" laddr=::ffff:127.0.0.1 lport=4939 faddr=::ffff:127.0.0.1 fport=53318 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket avc: denied { read write } for pid=10840 comm="pool-17-thread-" path="socket:[205990]" dev="sockfs" ino=205990 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket avc: denied { write } for pid=20817 comm="dumpsys" path="/mnt/shell/emulated/0/aupt-output/bugreport-2014-02-22-11-17-16.txt.tmp" dev="fuse" ino=3100784040 scontext=u:r:system_server:s0 tcontext=u:object_r:sdcard_internal:s0 tclass=file Change-Id: I481ac26667b487031a5d3317b0a028a027a8e641 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-03-05 15:50:08 +01:00
type proc_sysrq, fs_type;
restrict access to timing information in /proc These APIs expose sensitive information via timing side channels. This leaves access via the adb shell intact along with the current uses by dumpstate, init and system_server. The /proc/interrupts and /proc/stat files were covered in this paper: https://www.lightbluetouchpaper.org/2016/07/29/yet-another-android-side-channel/ The /proc/softirqs, /proc/timer_list and /proc/timer_stats files are also relevant. Access to /proc has been greatly restricted since then, with untrusted apps no longer having direct access to these, but stricter restrictions beyond that would be quite useful. Change-Id: Ibed16674856569d26517e5729f0f194b830cfedd
2016-07-29 20:48:19 +02:00
type proc_timer, fs_type;
untrusted_app: allow access to /proc/tty/drivers /proc/tty/drivers is read by applications to figure out if they are running in an emulated environment. Specifically, they look for the string "goldfish" within that file. Arguably this is not an Android API, and really shouldn't be exposed to applications, but: 1) A largish number of applications break if they can't read this file; 2) The information here isn't particularly sensitive While we could spend a bunch of time trying to get applications fixed, there are bigger fish to fry. It's not worth the battle. Test: "ls -laZ /proc/tty/drivers" is labeled properly. Bug: 33214085 Bug: 33814662 Bug: 33791054 Bug: 33211769 Bug: 26813932 Change-Id: Icc05bdc1c917547a6dca7d76636a1009369bde49
2017-01-04 17:43:09 +01:00
type proc_tty_drivers, fs_type;
Allow system_server to read/write /proc/uid_cputime/ module Bug:20182139 Change-Id: I1829a83c7d8e2698715e424a688a2753d65de868
2015-05-13 02:14:35 +02:00
type proc_uid_cputime_showstat, fs_type;
type proc_uid_cputime_removeuid, fs_type;
Define policy for /proc/uid_io/stats New procfs file read by storaged to dump fg/bg IO usage. Remove kmsg rule since it's no longer used by storaged. Allow storaged to find permission_service to translate UID to package name. Test: adb shell storaged -u Bug: 34198239 Change-Id: I74654662c75571cbe166cf2b8cbab84828218cbd
2017-01-12 01:20:49 +01:00
type proc_uid_io_stats, fs_type;
Define policy for /proc/uid_procstat/set. New procfs file written by the system_server to communicate fg/bg state of UIDs to switch the statistics counter sets used. avc: denied { write } for name="set" dev="proc" ino=4026531862 scontext=u:r:system_server:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 Test: builds, boots, counter sets updated Bug: 34360629 Change-Id: I2efbfbba9e73f50ce50a80a3dffd3b14fa55c048
2017-01-18 02:33:50 +01:00
type proc_uid_procstat_set, fs_type;
Allow only system_server to read uid_time_in_state Bug: 62706738 Bug: 34133340 Test: Check that uid_time_in_state can't be read from the shell without root permissions and that "dumpsys batterystats --checkin| grep ctf" shows frequency data (system_server was able to read uid_time_in_state) Change-Id: Ic6a54da4ebcc9e10b0e3af8f14a45d7408e8686e
2017-06-07 19:39:11 +02:00
type proc_uid_time_in_state, fs_type;
Restrict access to uid_concurrent_*_time Do not let apps read uid_concurrent_active_time and uid_concurrent_policy_time. b/68399339 Test: Check that they can't be read from the shell without root permissions and system_server was able to read them Change-Id: I6f09ef608607cb9f4084ba403a1e7254b8c49a06
2017-11-10 23:10:19 +01:00
type proc_uid_concurrent_active_time, fs_type;
type proc_uid_concurrent_policy_time, fs_type;
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
type proc_uptime, fs_type;
Explicitly label system_server's dependencies in /proc Labeled: /proc/asound/cards -> proc_asound_cards /proc/loadavg -> proc_loadavg /proc/pagetypeinfo -> proc_pagetypeinfo /proc/version -> proc_version /proc/vmallocinfo -> proc_vmallocinfo system_server: added access to all new types and removed access to proc label. init: added access to proc_version. dumpstate: added access to proc_pagetypeinfo, proc_version, proc_vmallocinfo. hal_audio: added access to proc_asound_cards. all_untrusted_apps: extended neverallow rule to include new labels. Bug: 65980789 Test: device boots without selinux denials to the newly introduced labels. Test: "adb shell dumpstate" throws no violations to new labels. Change-Id: Ic60facd3d4776e38d5e3ba003d06ada4e52c7dca
2017-09-14 22:59:09 +02:00
type proc_version, fs_type;
type proc_vmallocinfo, fs_type;
fine-grained policy for access to /proc/zoneinfo Change-Id: Ica9a16311075f5cc3744d0e0833ed876e201029f
2016-08-08 19:48:01 +02:00
type proc_zoneinfo, fs_type;
More MLS trusted subject/object annotations. dumpstate and lmkd need to act on apps running at any level. Various file types need to be writable by apps running at any level. Change-Id: Idf574d96ba961cc110a48d0a00d30807df6777ba Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-11 21:51:28 +02:00
type selinuxfs, fs_type, mlstrustedobject;
SE Android policy.
2012-01-04 18:33:27 +01:00
type cgroup, fs_type, mlstrustedobject;
sepolicy: Allow mount cgroupv2 and bpf fs Some necessary sepolicy rule changes for init process to create directory, mount cgroupv2 module and mount bpf filesystem. Also allow netd to create and pin bpf object as files and read it back from file under the directory where bpf filesystem is mounted. Test: bpf maps show up under /sys/fs/bpf/ Change-Id: I579d04f60d7e20bd800d970cd28cd39fda9d20a0
2017-08-02 03:06:18 +02:00
type cgroup_bpf, fs_type;
Add sysfs_type attribute to sysfs, coalesce ueventd rules. As per the discussion in: https://android-review.googlesource.com/#/c/92903/ Add sysfs_type attribute to sysfs type so that it is included in rules on sysfs_type, allow setattr to all sysfs_type for ueventd for chown/chmod, and get rid of redundant rules. Change-Id: I1228385d5703168c3852ec75605ed8da7c99b83d Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-08 19:18:52 +02:00
type sysfs, fs_type, sysfs_type, mlstrustedobject;
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
type sysfs_android_usb, fs_type, sysfs_type;
sysfs_uio: declare type in core policy /dev/uio uio_device is already declared. Accessing uio through /sys is also common. Bug: 26990688 Change-Id: I3db941161dae31d3b87f265708abbcd9171a2c1f
2016-03-25 15:52:22 +01:00
type sysfs_uio, sysfs_type, fs_type;
Add sysfs_batteryinfo label. Shell user needs to be able to get current device battery_level via /sys/class/power_supply/battery/capacity. Create a global label and corresponding policy for accessing this. Rely on each device to label the appropriate sysfs entry. Bug: 26219114 Change-Id: I2c5ef489a9db2fdf7bbd5afd04278214b814351c
2016-01-05 23:32:54 +01:00
type sysfs_batteryinfo, fs_type, sysfs_type;
Update policy for Android 4.2 / latest master. Update policy for Android 4.2 / latest master. Primarily this consists of changes around the bluetooth subsystem. The zygote also needs further permissions to set up /storage/emulated. adbd service now gets a socket under /dev/socket. keystore uses the binder. Change-Id: I8c5aeb8d100313c75169734a0fa614aa974b3bfc Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-11-16 15:06:47 +01:00
type sysfs_bluetooth_writable, fs_type, sysfs_type, mlstrustedobject;
Create sysfs_dm label. Prior to this CL, /sys/devices/virtual/block/dm-X was using the generic sysfs label. This CL creates sysfs_dm label and grants the following accesses: - update_verifier to read sysfs_dm dir and file at /sys/devices/virtual/block/dm-X. - vold to write sysfs_dm. Bug: 63440407 Test: update_verifier successfully triggers blocks verification and marks a sucessful boot; Test: No sysfs_dm related denials on sailfish. Change-Id: I6349412707800f1bd3a2fb94d4fe505558400c95
2017-10-05 22:50:07 +02:00
type sysfs_dm, fs_type, sysfs_type;
/proc, /sys access from uncrypt, update_engine, postinstall_dexopt New types: 1. proc_random 2. sysfs_dt_firmware_android Labeled: 1. /proc/sys/kernel/random as proc_random. 2. /sys/firmware/devicetree/base/firmware/android/{compatible, fstab, vbmeta} as sysfs_dt_firmware_android. Changed access: 1. uncrypt, update_engine, postinstall_dexopt have access to generic proc and sysfs labels removed. 2. appropriate permissions were added to uncrypt, update_engine, update_engine_common, postinstall_dexopt. Bug: 67416435 Bug: 67416336 Test: fake ota go/manual-ab-ota runs without denials Test: adb sideload runs without denials to new types Change-Id: Id31310ceb151a18652fcbb58037a0b90c1f6505a
2017-10-04 19:34:11 +02:00
type sysfs_dt_firmware_android, fs_type, sysfs_type;
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
type sysfs_ipv4, fs_type, sysfs_type;
Sepolicy: Label kernel notes Label /sys/kernel/notes. Bug: 70275668 Test: m Change-Id: Ieb666425d2db13f85225fb902fe06b0bf2335bef
2017-12-06 19:09:50 +01:00
type sysfs_kernel_notes, fs_type, sysfs_type, mlstrustedobject;
hal_light: add permission to sys/class/leds. /sys/class/leds is the standard location for linux files dealing with leds, however the exact contents of this directory is non-standard (hence the need for a hal). Bug: 32022100 Test: compiles and works for the subset of common files Change-Id: I7571d7267d5ed531c4cf95599d5f2acc22287ef4
2017-01-05 02:56:04 +01:00
type sysfs_leds, fs_type, sysfs_type;
Create sysfs_hwrandom type. HwRngTest needs access to the hwrandom sysfs files, but untrused_app does not have access to sysfs. Give these files their own label and allow the needed read access. Bug: 27263241 Change-Id: I718ba485e9e6627bac6e579f746658d85134b24b
2016-03-12 00:23:49 +01:00
type sysfs_hwrandom, fs_type, sysfs_type;
Integrate nfc_power and rild rules from tuna sepolicy by Bryan Hinton.
2012-03-19 20:56:01 +01:00
type sysfs_nfc_power_writable, fs_type, sysfs_type, mlstrustedobject;
Introduce controls on wake lock interface Change-Id: Ie0ee266e9e6facb2ab2abd652f68765239a41af1
2013-09-29 00:46:21 +02:00
type sysfs_wake_lock, fs_type, sysfs_type;
Do not allow apps to access network address file Bug: 18068520 Bug: 21852542 Change-Id: I876b37ac31dd44201ea1c1400a7c2c16c6a10049
2015-07-24 22:25:45 +02:00
type sysfs_mac_address, fs_type, sysfs_type;
Restrict netd fwk policy. Remove netd access to sysfs_type attribute. These were moved from vendor to fwk policy: 1. sysfs_net type declaration 2. labeling of /sys/devices/virtual/net with sysfs_net 3. netd access to sysfs_net Bug: 65643247 Test: can browse internet without netd denials Test: netd_unit_test, netd_integration_test without netd denials Change-Id: Ic1b95a098f438c4c6bc969bee801bf7dd1a13f6e
2017-10-02 00:53:01 +02:00
type sysfs_net, fs_type, sysfs_type;
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
type sysfs_power, fs_type, sysfs_type;
type sysfs_rtc, fs_type, sysfs_type;
type sysfs_switch, fs_type, sysfs_type;
Allow access to sysfs usb nodes. Some legitimate functionality currently requires direct sysfs access that is not otherwise possible via the android APIs. Specifically, isochronous USB transfers require this direct access, without which USB audio applications would noticibly suffer. Grant read access to the usb files under /sys/devices to prevent this regression. Bug: 28417852 Change-Id: I3424bf3498ffa0eb647a54cc962ab8c54f291728
2016-06-10 18:04:58 +02:00
type sysfs_usb, sysfs_type, file_type, mlstrustedobject;
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
type sysfs_wakeup_reasons, fs_type, sysfs_type;
allow init to run mke2fs tools to format partitions Test: let fs_mgr format a damaged /data partition Bug: 35219933 Change-Id: If92352ea7a70780e9d81ab10963d63e16b793792
2017-05-02 22:45:08 +02:00
type sysfs_fs_ext4_features, sysfs_type, fs_type;
sepolicy: Allow mount cgroupv2 and bpf fs Some necessary sepolicy rule changes for init process to create directory, mount cgroupv2 module and mount bpf filesystem. Also allow netd to create and pin bpf object as files and read it back from file under the directory where bpf filesystem is mounted. Test: bpf maps show up under /sys/fs/bpf/ Change-Id: I579d04f60d7e20bd800d970cd28cd39fda9d20a0
2017-08-02 03:06:18 +02:00
type fs_bpf, fs_type, sysfs_type;
sepolicy: Add policy for sdcardfs and configfs Change-Id: I4c318efba76e61b6ab0be9491c352f281b1c2bff Bug: 19160983
2016-03-02 01:13:50 +01:00
type configfs, fs_type;
sysfs_devices_system_cpu should be a sysfs_type Otherwise the following denials occur on mako: <5>[ 2.494246] type=1400 audit(1382544550.200:4): avc: denied { associate } for pid=1 comm="init" name="time_in_state" dev="sysfs" ino=17444 scontext=u:object_r:sy sfs_devices_system_cpu:s0 tcontext=u:object_r:sysfs:s0 tclass=filesystem <5>[ 2.494735] type=1400 audit(1382544550.200:5): avc: denied { associate } for pid=1 comm="init" name="total_trans" dev="sysfs" ino=17443 scontext=u:object_r:sysf s_devices_system_cpu:s0 tcontext=u:object_r:sysfs:s0 tclass=filesystem <5>[ 2.495162] type=1400 audit(1382544550.200:6): avc: denied { associate } for pid=1 comm="init" name="stats" dev="sysfs" ino=17442 scontext=u:object_r:sysfs_devi ces_system_cpu:s0 tcontext=u:object_r:sysfs:s0 tclass=filesystem <5>[ 2.495620] type=1400 audit(1382544550.200:7): avc: denied { associate } for pid=1 comm="init" name="scaling_governor" dev="sysfs" ino=17435 scontext=u:object_r :sysfs_devices_system_cpu:s0 tcontext=u:object_r:sysfs:s0 tclass=filesystem <5>[ 2.496047] type=1400 audit(1382544550.200:8): avc: denied { associate } for pid=1 comm="init" name="cpuinfo_transition_latency" dev="sysfs" ino=17429 scontext= u:object_r:sysfs_devices_system_cpu:s0 tcontext=u:object_r:sysfs:s0 tclass=filesystem <5>[ 2.496505] type=1400 audit(1382544550.200:9): avc: denied { associate } for pid=1 comm="init" name="scaling_available_frequencies" dev="sysfs" ino=17439 sconte xt=u:object_r:sysfs_devices_system_cpu:s0 tcontext=u:object_r:sysfs:s0 tclass=filesystem <5>[ 2.496963] type=1400 audit(1382544550.200:10): avc: denied { associate } for pid=1 comm="init" name="scaling_driver" dev="sysfs" ino=17436 scontext=u:object_r: sysfs_devices_system_cpu:s0 tcontext=u:object_r:sysfs:s0 tclass=filesystem Change-Id: I584a1cf61cb871a38be4d3b308cef03e64cfda8e
2013-10-23 18:08:23 +02:00
# /sys/devices/system/cpu
type sysfs_devices_system_cpu, fs_type, sysfs_type;
initial lmkd policy. * Allow writes to /proc/PID/oom_score_adj * Allow writes to /sys/module/lowmemorykiller/* Addresses the following denials: <5>[ 3.825371] type=1400 audit(9781555.430:5): avc: denied { write } for pid=176 comm="lmkd" name="minfree" dev="sysfs" ino=6056 scontext=u:r:lmkd:s0 tcontext=u:object_r:sysfs:s0 tclass=file <5>[ 48.874747] type=1400 audit(9781600.639:16): avc: denied { search } for pid=176 comm="lmkd" name="896" dev="proc" ino=9589 scontext=u:r:lmkd:s0 tcontext=u:r:system_server:s0 tclass=dir <5>[ 48.874889] type=1400 audit(9781600.639:17): avc: denied { dac_override } for pid=176 comm="lmkd" capability=1 scontext=u:r:lmkd:s0 tcontext=u:r:lmkd:s0 tclass=capability <5>[ 48.874982] type=1400 audit(9781600.639:18): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=8942 scontext=u:r:lmkd:s0 tcontext=u:r:system_server:s0 tclass=file <5>[ 48.875075] type=1400 audit(9781600.639:19): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=8942 scontext=u:r:lmkd:s0 tcontext=u:r:system_server:s0 tclass=file <5>[ 49.409231] type=1400 audit(9781601.169:20): avc: denied { write } for pid=176 comm="lmkd" name="minfree" dev="sysfs" ino=6056 scontext=u:r:lmkd:s0 tcontext=u:object_r:sysfs:s0 tclass=file <5>[ 209.081990] type=1400 audit(9781760.839:24): avc: denied { search } for pid=176 comm="lmkd" name="1556" dev="proc" ino=10961 scontext=u:r:lmkd:s0 tcontext=u:r:platform_app:s0 tclass=dir <5>[ 209.082240] type=1400 audit(9781760.839:25): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11654 scontext=u:r:lmkd:s0 tcontext=u:r:platform_app:s0 tclass=file <5>[ 209.082498] type=1400 audit(9781760.839:26): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11654 scontext=u:r:lmkd:s0 tcontext=u:r:platform_app:s0 tclass=file <5>[ 209.119673] type=1400 audit(9781760.879:27): avc: denied { search } for pid=176 comm="lmkd" name="1577" dev="proc" ino=12708 scontext=u:r:lmkd:s0 tcontext=u:r:release_app:s0 tclass=dir <5>[ 209.119937] type=1400 audit(9781760.879:28): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11657 scontext=u:r:lmkd:s0 tcontext=u:r:release_app:s0 tclass=file <5>[ 209.120105] type=1400 audit(9781760.879:29): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11657 scontext=u:r:lmkd:s0 tcontext=u:r:release_app:s0 tclass=file <5>[ 209.235597] type=1400 audit(9781760.999:30): avc: denied { search } for pid=176 comm="lmkd" name="1600" dev="proc" ino=11659 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=dir <5>[ 209.235798] type=1400 audit(9781760.999:31): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11667 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=file <5>[ 209.236006] type=1400 audit(9781760.999:32): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11667 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=file <5>[ 214.297283] type=1400 audit(9781766.059:64): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11211 scontext=u:r:lmkd:s0 tcontext=u:r:untrusted_app:s0 tclass=file <5>[ 214.297415] type=1400 audit(9781766.059:65): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11211 scontext=u:r:lmkd:s0 tcontext=u:r:untrusted_app:s0 tclass=file <5>[ 214.355060] type=1400 audit(9781766.119:66): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12907 scontext=u:r:lmkd:s0 tcontext=u:r:system_app:s0 tclass=file <5>[ 214.355236] type=1400 audit(9781766.119:67): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12907 scontext=u:r:lmkd:s0 tcontext=u:r:system_app:s0 tclass=file <5>[ 214.516920] type=1400 audit(9781766.279:68): avc: denied { search } for pid=176 comm="lmkd" name="1907" dev="proc" ino=11742 scontext=u:r:lmkd:s0 tcontext=u:r:media_app:s0 tclass=dir <5>[ 214.678861] type=1400 audit(9781766.439:69): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12915 scontext=u:r:lmkd:s0 tcontext=u:r:media_app:s0 tclass=file <5>[ 214.678992] type=1400 audit(9781766.439:70): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12915 scontext=u:r:lmkd:s0 tcontext=u:r:media_app:s0 tclass=file <5>[ 214.708284] type=1400 audit(9781766.469:71): avc: denied { search } for pid=176 comm="lmkd" name="1765" dev="proc" ino=12851 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=dir <5>[ 214.708435] type=1400 audit(9781766.469:72): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12870 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=file <5>[ 214.708648] type=1400 audit(9781766.469:73): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12870 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=file Change-Id: Ie3c1ab8ce9e77742d0cc3c73f40010afd018ccd4
2014-02-13 21:19:50 +01:00
# /sys/module/lowmemorykiller
type sysfs_lowmemorykiller, fs_type, sysfs_type;
Define explicit label for wlan sysfs fwpath avc: denied { write } for name="fwpath" dev="sysfs" ino=6863 scontext=u:r:wificond:s0 tcontext=u:object_r:sysfs_wlan_fwpath:s0 tclass=file permissive=0 Test: wificond and netd can write to this path, wifi works Test: `runtest frameworks-wifi` passes Bug: 29579539 Change-Id: Ia21c654b00b09b9fe3e50d564b82966c9c8e6994 (cherry picked from commit 7d13dd806f37523ba8164325fef9b000d6eacd7c)
2016-06-30 23:23:12 +02:00
# /sys/module/wlan/parameters/fwpath
type sysfs_wlan_fwpath, fs_type, sysfs_type;
sepolicy: Add policy for vibrator HIDL service Fixes the following denials: avc: denied { open } for pid=7530 comm="android.hardwar" path="/sys/devices/virtual/timed_output/vibrator/enable" dev="sysfs" ino=20519 scontext=u:r:android_hardware_vibrator_1_0_service:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 avc: denied { call } for pid=9173 comm="Binder:7735_C" scontext=u:r:system_server:s0 tcontext=u:r:android_hardware_vibrator_1_0_service:s0 tclass=binder permissive=1 Test: m Bug: 32021191 Change-Id: I243a86b449794e3c2f0abf91ddcf405eff548d0c
2016-10-11 20:01:49 +02:00
type sysfs_vibrator, fs_type, sysfs_type;
Move sysfs_thermal to global policy and grant access. sysfs_thermal nodes are common enough to warrant an entry in global policy and the new HardwarePropertiesManagerService exists explicitly to expose some of this information. Address the following denials: avc: denied { search } for name="thermal" dev="sysfs" ino=17509 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_thermal:s0 tclass=dir permissive=1 avc: denied { read } for name="temp" dev="sysfs" ino=17848 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_thermal:s0 tclass=file permissive=1 avc: denied { open } for path="/sys/devices/virtual/thermal/thermal_zone8/temp" dev="sysfs" ino=17848 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_thermal:s0 tclass=file permissive=1 avc: denied { getattr } for path="/sys/devices/virtual/thermal/thermal_zone8/temp" dev="sysfs" ino=17848 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_thermal:s0 tclass=file permissive=1 Bug: 27809332 Change-Id: I2dbc737971bf37d197adf0d5ff07cb611199300d
2016-03-24 17:23:54 +01:00
type sysfs_thermal, sysfs_type, fs_type;
Create sysfs_zram label. Address following denials: avc: denied { getattr } for path="/sys/devices/virtual/block/zram0/disksize" dev="sysfs" ino=14958 scontext=u:r:init:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=file permissive=0 avc: denied { search } for name="zram0" dev="sysfs" ino=14903 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=dir permissive=0 avc: denied { read } for name="mem_used_total" dev="sysfs" ino=14970 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=file permissive=0 avc: denied { write } for name="uevent" dev="sysfs" ino=14904 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=file permissive=0 avc: denied { open } for path="/sys/devices/virtual/block/zram0/uevent" dev="sysfs" ino=14904 scontext=u:r:ueventd:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=file permissive=0 avc: denied { read } for pid=348 comm="vold" name="zram0" dev="sysfs" ino=15223 scontext=u:r:vold:s0 tcontext=u:object_r:sysfs_zram:s0 tclass=dir permissive=0 avc: denied { search } for pid=3494 comm="ContactsProvide" name="zram0"dev="sysfs" ino=15223 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:sysfs_zram:s0 tclass=dir permissive=0 Bug: 22032619 Change-Id: I40cf918b7cafdba6cb3d42b04b1616a84e4ce158
2016-01-04 23:23:23 +01:00
type sysfs_zram, fs_type, sysfs_type;
type sysfs_zram_uevent, fs_type, sysfs_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
type inotify, fs_type, mlstrustedobject;
Add policy for run-as program. Add policy for run-as program and label it in file_contexts. Drop MLS constraints on local socket checks other than create/relabel as this interferes with connections with services, in particular for adb forward. Change-Id: Ib0c4abeb7cbef559e150a620c45a7c31e0531114 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-11-13 19:00:05 +01:00
type devpts, fs_type, mlstrustedobject;
SE Android policy.
2012-01-04 18:33:27 +01:00
type tmpfs, fs_type;
type shm, fs_type;
type mqueue, fs_type;
Rename sdcard_internal/external types. Rename sdcard_internal/external types to fuse and vfat respectively to make it clear that they are assigned to any fuse or vfat filesystem by default (absent a context= mount option) and do not necessarily represent the SDcard. The sdcard_type attribute is still assigned to both types and can still be used in allow rules to permit access to either the internal or external SDcard. Define type aliases for the old names to preserve compatibility on policy reload and for device-specific policies that may not yet be updated. Change-Id: I8d91a8c4c1342b94e4f1bb62ca7ffd2ca4b06ba1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-07-08 20:45:09 +02:00
type fuse, sdcard_type, fs_type, mlstrustedobject;
sepolicy: Add policy for sdcardfs and configfs Change-Id: I4c318efba76e61b6ab0be9491c352f281b1c2bff Bug: 19160983
2016-03-02 01:13:50 +01:00
type sdcardfs, sdcard_type, fs_type, mlstrustedobject;
Rename sdcard_internal/external types. Rename sdcard_internal/external types to fuse and vfat respectively to make it clear that they are assigned to any fuse or vfat filesystem by default (absent a context= mount option) and do not necessarily represent the SDcard. The sdcard_type attribute is still assigned to both types and can still be used in allow rules to permit access to either the internal or external SDcard. Define type aliases for the old names to preserve compatibility on policy reload and for device-specific policies that may not yet be updated. Change-Id: I8d91a8c4c1342b94e4f1bb62ca7ffd2ca4b06ba1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-07-08 20:45:09 +02:00
type vfat, sdcard_type, fs_type, mlstrustedobject;
Mark debugfs type with debugfs_type attribute Test: build policy Change-Id: If13838e8da6e3fe14bb5c7c7ade6f8ac0d5d1982
2017-06-26 00:35:54 +02:00
type debugfs, fs_type, debugfs_type;
Storaged permission setting Allowing storaged for reading from pseudo filesystems and debugfs. Bug: 32221677 Change-Id: I837cead9a68f0b399703b64d724cb9c4b205c335
2016-06-18 00:05:10 +02:00
type debugfs_mmc, fs_type, debugfs_type;
Add initial debugfs labeling support and label /sys/kernel/debug/tracing/trace_marker Add initial support for labeling files on /sys/kernel/debug. The kernel support was added in https://android-review.googlesource.com/122130 but the userspace portion of the change was never completed until now. Start labeling the file /sys/kernel/debug/tracing/trace_marker . This is the trace_marker file, which is written to by almost all processes in Android. Allow global write access to this file. This change should be submitted at the same time as the system/core commit with the same Change-Id as this patch. Change-Id: Id1d6a9ad6d0759d6de839458890e8cb24685db6d
2015-12-08 02:02:31 +01:00
type debugfs_trace_marker, fs_type, debugfs_type, mlstrustedobject;
label /sys/kernel/debug/tracing and remove debugfs write Start labeling the directory /sys/kernel/debug/tracing. The files in this directory need to be writable to the shell user. Remove global debugfs:file write access. This was added in the days before we could label individual debugfs files. Change-Id: I79c1fcb63b4b9b903dcabd99b6b25e201fe540a3
2015-12-14 22:57:26 +01:00
type debugfs_tracing, fs_type, debugfs_type;
Properly give some files the debugfs_tracing context only in debug mode. One of my previous commits removed this, so I am now restoring it. This commit also contains a bit of cleanup from previous commits by removing some unneeded types. It also fixes traceur by porting ag/2409144 to master. Bug: 62413700, 62547086 Test: Built, flashed, and booted Marlin. Verified that the files have the correct context. Verified that atrace and traceur work. Change-Id: I76fa0e9060aff554687d57ab3976c8704a4068f0
2017-06-13 19:08:54 +02:00
type debugfs_tracing_debug, fs_type, debugfs_type;
allow init and system_server access to tracing Revise policy, to allow init and system_server to configure, clear, and read kernel trace events. This will enable us to debug certain WiFi failures. Note that system_server is restricted to only accessing a wifi-specific trace instance. (Hence, system_server is not allowed to interfere with atrace.) Moreover, even for the wifi trace instance, system_server is granted limited permissions. (system_server can not, e.g., change which events are traced.) Note also that init and system_server are only granted these powers on userdebug or eng builds. The init.te and system_server.te changes resolve the following denials: // Denials when wifi-events.rc configures tracing { write } for pid=1 comm="init" name="instances" dev="debugfs" ino=755 scontext=u:r:init:s0 tcontext=u:object_r:debugfs_tracing_instances:s0 tclass=dir permissive=1 { add_name } for pid=1 comm="init" name="wifi" scontext=u:r:init:s0 tcontext=u:object_r:debugfs_tracing_instances:s0 tclass=dir permissive=1 { create } for pid=1 comm="init" name="wifi" scontext=u:r:init:s0 tcontext=u:object_r:debugfs_tracing_instances:s0 tclass=dir permissive=1 { write } for pid=1 comm="init" name="tracing_on" dev="debugfs" ino=18067 scontext=u:r:init:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1 { write } for pid=1 comm="init" name="buffer_size_kb" dev="debugfs" ino=18061 scontext=u:r:init:s0 tcontext=u:object_r:debugfs_tracing_instances:s0 tclass=file permissive=1 // Denials when system_server sets up fail-safe // (auto-terminate tracing if system_server dies) { search } for pid=882 comm="system_server" name="instances" dev="debugfs" ino=755 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_tracing_instances:s0 tclass=dir permissive=1 { read } for pid=882 comm="system_server" name="free_buffer" dev="debugfs" ino=18063 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1 { open } for pid=882 comm="system_server" path="/sys/kernel/debug/tracing/instances/wifi/free_buffer" dev="debugfs" ino=18063 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1 { getattr } for pid=882 comm="system_server" path="/sys/kernel/debug/tracing/instances/wifi/free_buffer" dev="debugfs" ino=18063 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1 // Denials when system_server toggles tracing on or off // (WifiStateMachine is a thread in system_server) { search } for pid=989 comm="WifiStateMachin" name="instances" dev="debugfs" ino=755 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_tracing_instances:s0 tclass=dir permissive=1 { write } for pid=989 comm="WifiStateMachin" name="tracing_on" dev="debugfs" ino=18067 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1 { open } for pid=989 comm="WifiStateMachin" path="/sys/kernel/debug/tracing/instances/wifi/tracing_on" dev="debugfs" ino=18067 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1 { getattr } for pid=989 comm="WifiStateMachin" path="/sys/kernel/debug/tracing/instances/wifi/tracing_on" dev="debugfs" ino=18067 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1 { write } for pid=989 comm="WifiStateMachin" name="tracing_on" dev="debugfs" ino=18067 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1 { open } for pid=989 comm="WifiStateMachin" path="/sys/kernel/debug/tracing/instances/wifi/tracing_on" dev="debugfs" ino=18067 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1 { getattr } for pid=989 comm="WifiStateMachin" path="/sys/kernel/debug/tracing/instances/wifi/tracing_on" dev="debugfs" ino=18067 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1 // Denials when system_server reads the event trace // (This happens in response to a dumpsys request) { search } for pid=3537 comm="Binder:882_B" name="instances" dev="debugfs" ino=755 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_tracing_instances:s0 tclass=dir permissive=1 { read } for pid=3537 comm="Binder:882_B" name="trace" dev="debugfs" ino=18059 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1 { open } for pid=3537 comm="Binder:882_B" path="/sys/kernel/debug/tracing/instances/wifi/trace" dev="debugfs" ino=18059 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1 { getattr } for pid=3537 comm="Binder:882_B" path="/sys/kernel/debug/tracing/instances/wifi/trace" dev="debugfs" ino=18059 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1 { write } for pid=3537 comm="Binder:882_B" name="trace" dev="debugfs" ino=18059 scontext=u:r:system_server:s0 tcontext=u:object_r:debugfs_wifi_tracing:s0 tclass=file permissive=1 Bug: 27254565 Test: manual Manual test: - Build this CL along with CL:322337 - Verify that system boots, and that we can connect to GoogleGuest. (Testing of actual trace functionality with require some more patches in frameworks/opt/net/wifi.) $ adb root && adb shell dmesg | egrep 'avc: denied.+debugfs' Change-Id: Ib6eb4116549277f85bd510d25fb30200f1752f4d
2016-05-18 00:32:04 +02:00
type debugfs_tracing_instances, fs_type, debugfs_type;
type debugfs_wifi_tracing, fs_type, debugfs_type;
Add selinux rules for additional file contexts in userdebug These rules allow the additional tracepoints we need for running traceur in userdebug builds to be writeable. Bug: 37110010 Test: I'm testing by running atrace -l and confirming that the tracepoints that I'm attempting to enable are available. Change-Id: Ia352100ed67819ae5acca2aad803fa392d8b80fd
2017-04-14 21:12:50 +02:00
pstore file system labeling pstore(persistent store) have been applied since kernel 3.5 We need to label the pstore-fs in order to use Android with kernel 3.5 or upper version. My kernel version is 3.10 and I got the below denial log when I ran the "df" command on the adb shell. type=1400 msg=audit(1388540540.220:18): avc: denied { getattr } for pid=7296 comm="df" name="/" dev="pstore" ino=7703 scontext=u:r:init:s0 tcontext=u:object_r:unlabeled:s0 tclass=filesystem And the below log is also shown during booting type=1400 msg=audit(1388539193.750:4): avc: denied { mount } for pid=2844 comm="mount" name="/" dev="pstore" ino=11393 scontext=u:r:init_shell:s0 tcontext=u:object_r:unlabeled:s0 tclass=filesystem Change-Id: Iaba543d44565c4f20a77a95b9573a628bbd3fd34
2014-04-10 06:32:54 +02:00
type pstorefs, fs_type;
Move MediaProvider to its own domain, add new MtpServer permissions Also move necessary priv_app permissions into MediaProvider domain and remove MediaProvider specific permissions from priv_app. The new MtpServer permissions fix the following denials: avc: denied { write } for comm=6D747020666673206F70656E name="ep0" dev="functionfs" ino=12326 scontext=u:r:priv_app:s0:c512,c768 tcontext=u:object_r:functionfs:s0 tclass=file permissive=1 denial from setting property sys.usb.ffs.mtp.ready, context priv_app Bug: 30976142 Test: Manual, verify permissions are allowed Change-Id: I4e66c5a8b36be21cdb726b5d00c1ec99c54a4aa4
2016-09-22 20:07:50 +02:00
type functionfs, fs_type, mlstrustedobject;
Define contextmount_type attribute and add it to oemfs. Several device-specific policy changes with the same Change-Id also add this attribute to device-specific types. Change-Id: I09e13839b1956f61875a38844fe4fc3c911ea60f Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-30 14:49:51 +02:00
type oemfs, fs_type, contextmount_type;
label usbfs Right now usbfs doesn't have any labels, generating the following kernel warnings: <7>[ 3.009582] SELinux: initialized (dev usbfs, type usbfs), not configured for labeling and the occasional SELinux unlabeled auditallow logs: <4>[ 285.579254] type=1400 audit(1402010345.094:16): avc: granted { search } for pid=371 comm="qcks" name="/" dev="usbfs" ino=15794 scontext=u:r:kickstart:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir <4>[ 285.632354] type=1400 audit(1402010345.154:18): avc: granted { search } for pid=371 comm="qcks" name="001" dev="usbfs" ino=15796 scontext=u:r:kickstart:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir Make sure usbfs is assigned via genfscon Change-Id: I7191f2584014ba55a3c3a98e7efd0350dc958782
2014-06-07 16:31:31 +02:00
type usbfs, fs_type;
genfs_contexts: provide a label for binfmt_misc Provide a default label for binfmt_misc. This is not used by the core policy, although it may be used in device specific policy. Bug: 20152930 Change-Id: Id51d69333bfeda40720d0e65e1539fab0b6e1e95
2015-04-11 02:42:49 +02:00
type binfmt_miscfs, fs_type;
Add SELinux label for app fuse. The labels for filesystem and files are assigned by vold with using context= mount option. Change-Id: I8a9d701a46a333093a27107fc3c52b17a2af1a94
2016-01-28 07:48:39 +01:00
type app_fusefs, fs_type, contextmount_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
# File types
type unlabeled, file_type;
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
SE Android policy.
2012-01-04 18:33:27 +01:00
# Default type for anything under /system.
type system_file, file_type;
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
# Default type for directories search for
# HAL implementations
type vendor_hal_file, vendor_file_type, file_type;
# Default type for under /vendor or /system/vendor
type vendor_file, vendor_file_type, file_type;
# Default type for everything in /vendor/app
type vendor_app_file, vendor_file_type, file_type;
# Default type for everything under /vendor/etc/
type vendor_configs_file, vendor_file_type, file_type;
# Default type for all *same process* HALs.
# e.g. libEGL_xxx.so, android.hardware.graphics.mapper@2.0-impl.so
type same_process_hal_file, vendor_file_type, file_type;
Rename vndk-stable to vndk-sp (SP=Same-process) The concept of VNDK-stable set is gone because they no longer need to be stable across several Android releases. Instead, they are just small set of system libraries (other than Low-Level NDK) that can be used by same-process HALs. They need to be stable only during an Android release as other VNDK libraries. However, since they are eligible for double loading, we still need to distinguish those libs from other VNDK libraries. So we give them a name vndk-sp, which means VNDK designed for same-process HALs. Bug: 37139956 Test: booting successful with vndk-sp libs in /vendor/lib(64)?/vndk-sp Change-Id: I892c4514deb3c6c8006e3659bed1ad3363420732
2017-04-10 06:37:40 +02:00
# Default type for vndk-sp libs. /vendor/lib/vndk-sp
type vndk_sp_file, vendor_file_type, file_type;
sepolicy: relabel /vendor The CL splits /vendor labeling from /system. Which was allowing all processes read, execute access to /vendor. Following directories will remain world readable /vendor/etc /vendor/lib(64)/hw/ Following are currently world readable but their scope will be minimized to platform processes that require access /vendor/app /vendor/framework/ /vendor/overlay Files labelled with 'same_process_hal_file' are allowed to be read + executed from by the world. This is for Same process HALs and their dependencies. Bug: 36527360 Bug: 36832490 Bug: 36681210 Bug: 36680116 Bug: 36690845 Bug: 36697328 Bug: 36696623 Bug: 36806861 Bug: 36656392 Bug: 36696623 Bug: 36792803 All of the tests were done on sailfish, angler, bullhead, dragon Test: Boot and connect to wifi Test: Run chrome and load websites, play video in youtube, load maps w/ current location, take pictures and record video in camera, playback recorded video. Test: Connect to BT headset and ensure BT audio playback works. Test: OTA sideload using recovery Test: CTS SELinuxHostTest pass Change-Id: I278435b72f7551a28f3c229f720ca608b77a7029 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-02 02:17:12 +02:00
# Default type for everything in /vendor/framework
type vendor_framework_file, vendor_file_type, file_type;
# Default type for everything in /vendor/overlay
type vendor_overlay_file, vendor_file_type, file_type;
logd: restrict access to /dev/event-log-tags Create an event_log_tags_file label and use it for /dev/event-log-tags. Only trusted system log readers are allowed direct read access to this file, no write access. Untrusted domain requests lack direct access, and are thus checked for credentials via the "plan b" long path socket to the event log tag service. Test: gTest logd-unit-tests, liblog-unit-tests and logcat-unit-tests Bug: 31456426 Bug: 30566487 Change-Id: Ib9b71ca225d4436d764c9bc340ff7b1c9c252a9e
2016-11-08 00:11:39 +01:00
# Speedup access for trusted applications to the runtime event tags
type runtime_event_log_tags_file, file_type;
Dependencies for new goldfish service domains. In order to support the new goldfish service domains in a change with the same Change-Id for the build project, we need the following changes in external/sepolicy: - /system/bin/logcat needs its own type so that it can be used as an entrypoint for the goldfish-logcat service. A neverallow rule prevents us from allowing entrypoint to any type not in exec_type. - The config. and dalvik. property namespaces need to be labeled with something other than default_prop so that the qemu-props service can set them. A neverallow rule prevents us from allowing qemu-props to set default_prop. We allow rx_file_perms to logcat_exec for any domain that was previously allowed read_logd() as many programs will read the logs by running logcat. We do not do this for all domains as it would violate a neverallow rule on the kernel domain executing any file without transitioning to another domain, and as we ultimately want to apply the same restriction to the init domain (and possibly others). Change-Id: Idce1fb5ed9680af84788ae69a5ace684c6663974 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-04 14:44:49 +02:00
# Type for /system/bin/logcat.
type logcat_exec, exec_type, file_type;
allow coredump functionality (cherrypick of commit d7e004ebf949ae21b299a49cff9917f6560200a3) Change-Id: I7993698ac96f21db0039681275280dbd43ff61ba
2014-10-31 20:40:12 +01:00
# /cores for coredumps on userdebug / eng builds
type coredump_file, file_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
# Default type for anything under /data.
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type system_data_file, file_type, data_file_type, core_data_file_type;
Adding e4crypt support Add selinux rules to allow file level encryption to work Change-Id: I1e4bba23e99cf5b2624a7df843688fba6f3c3209
2015-03-11 23:44:14 +01:00
# Unencrypted data
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type unencrypted_data_file, file_type, data_file_type, core_data_file_type;
Label /data/.layout_version with its own type. installd creates /data/.layout_version. Introduce a separate type for this file (and any other file created by installd under a directory labeled system_data_file) so that we can allow create/write access by installd without allowing it to any system data files created by other processes. This prevents installd from overwriting other system data files, and ensure that any files it creates will require explicit rules in order to access. Change-Id: Id04e49cd571390d18792949c8b2b13b1ac59c016 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-12 17:18:21 +02:00
# /data/.layout_version or other installd-created files that
# are created in a system_data_file directory.
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type install_data_file, file_type, data_file_type, core_data_file_type;
Policy changes to support running the latest CTS.
2012-03-07 20:59:01 +01:00
# /data/drm - DRM plugin data
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type drm_data_file, file_type, data_file_type, core_data_file_type;
Allow adbd to write to /data/adb adbd writes debugging information to /data/adb when persist.adb.trace_mask is set. Allow it. Bug: https://code.google.com/p/android/issues/detail?id=72895 Change-Id: Ia5af09045e9f72a95325b429c30a5ae78e104bdc
2014-10-21 06:56:02 +02:00
# /data/adb - adb debugging files
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type adb_data_file, file_type, data_file_type, core_data_file_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
# /data/anr - ANR traces
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type anr_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
SE Android policy.
2012-01-04 18:33:27 +01:00
# /data/tombstones - core dumps
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type tombstone_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Wifi hal - Firmware dump permissions we are aiming to improve logging performance by having wifi hal directly write to the flash. Wifi hal need to be able to create, write, and delete files in a directory. This will be restricted to userdebug and eng builds only. Bug: 70170285 Test: compile, run on device Change-Id: Id0cd317411f4c393d7529aa31b501046d7350edb
2017-12-15 23:01:44 +01:00
# /data/vendor/tombstones/wifi - vendor wifi dumps
type tombstone_wifi_data_file, file_type, data_file_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
# /data/app - user-installed apps
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type apk_data_file, file_type, data_file_type, core_data_file_type;
type apk_tmp_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Add new domains for private apps. /data/app-private is used when making an app purchase or forward locking. Provide a new label for the directory as well as the tmp files that appear under it. Change-Id: I910cd1aa63538253e10a8d80268212ad9fc9fca5 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2013-04-03 20:21:46 +02:00
# /data/app-private - forward-locked apps
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type apk_private_data_file, file_type, data_file_type, core_data_file_type;
type apk_private_tmp_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
SE Android policy.
2012-01-04 18:33:27 +01:00
# /data/dalvik-cache
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type dalvikcache_data_file, file_type, data_file_type, core_data_file_type;
Selinux: introduce policy for OTA preopt Add permissions to dex2oat, introduce otapreopt binary and otadexopt service. Bug: 25612095 Change-Id: I80fcba2785e80b2931d7d82bb07474f6cd0099f7
2015-12-03 06:23:30 +01:00
# /data/ota
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type ota_data_file, file_type, data_file_type, core_data_file_type;
Add ota_package_file label for OTA packages. (cherry picked from commit 6c3f2831aca571ec3b01f60996965a432aa8164d) Allow priv_app, uncrypt, update_engine to access the OTA packages at /data/ota_package (both A/B and non-A/B). GMSCore (priv_app) checks the existence of the folder, and downloads the package there if present. Bug: 28944800 Change-Id: I3c0717861fce7f93b33874a99f6a4a55567612a5
2016-05-25 06:07:48 +02:00
# /data/ota_package
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type ota_package_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Update permissions for the dedicated profile folders Bug: 26719109 Bug: 26563023 Change-Id: Ie0ca764467c874c061752cbbc73e1bacead9b995
2016-02-01 20:28:39 +01:00
# /data/misc/profiles
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type user_profile_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
SELinux policy for /data/misc/profman Bug: 28748264 Change-Id: I872c25666707beb737f3ce7a4f706c0135df7ad5
2016-05-27 21:41:35 +02:00
# /data/misc/profman
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type profman_dump_data_file, file_type, data_file_type, core_data_file_type;
Fix SELinux policies to allow resource overlays. The following commits added support for runtime resource overlays. New command line tool 'idmap' * 65a05fd56dbc9fd9c2511a97f49c445a748fb3c5 Runtime resource overlay, iteration 2 * 48d22323ce39f9aab003dce74456889b6414af55 Runtime resource overlay, iteration 2, test cases * ad6ed950dbfa152c193dd7e49c369d9e831f1591 During SELinux tightening, support for these runtime resource overlays was unknowingly broken. Fix it. This change has been tested by hackbod and she reports that everything is working after this change. I haven't independently verified the functionality. Test cases are available for this by running: * python frameworks/base/core/tests/overlaytests/testrunner.py Change-Id: I1c70484011fd9041bec4ef34f93f7a5509906f40
2014-06-16 23:19:31 +02:00
# /data/resource-cache
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type resourcecache_data_file, file_type, data_file_type, core_data_file_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
# /data/local - writable by shell
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type shell_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Protect /data/property. /data/property is only accessible by root and is used by the init property service for storing persistent property values. Create a separate type for it and only allow init to write to the directory and files within it. Ensure that we do not allow access to other domains in future changes or device-specific policy via a neverallow rule. Change-Id: Iff556b9606c5651c0f1bba902e30b59bdd6f063a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-29 15:22:16 +02:00
# /data/property
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type property_data_file, file_type, data_file_type, core_data_file_type;
bootchart: add policy rules for bootchart allow the bootchart to create dir and files at init, also allow user to create the stop and start file under /data/bootchart directory to start and stop bootchart Change-Id: Icfee8dcd17366383eef00fbe3139744bf4427a6b Signed-off-by: Yongqin Liu <yongqin.liu@linaro.org>
2014-12-05 06:40:22 +01:00
# /data/bootchart
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type bootchart_data_file, file_type, data_file_type, core_data_file_type;
Allow system_server to collect app heapdumps (debug builds only) On debuggable builds, system_server can request app heap dumps by running something similar to the following commands: % adb shell am set-watch-heap com.android.systemui 1048576 % adb shell dumpsys procstats --start-testing which will dump the app's heap to /data/system/heapdump. See framework/base commit b9a5e4ad30c9add140fd13491419ae66e947809d. Allow this behavior. Addresses the following denial: avc: denied { write } for path="/data/system/heapdump/javaheap.bin" dev="dm-0" ino=150747 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:system_data_file:s0 tclass=file permissive=0 Bug: 20073185 Change-Id: I4b925033a5456867caf2697de6c2d683d0743540
2015-04-08 01:40:44 +02:00
# /data/system/heapdump
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type heapdump_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Create a new SELinux type for /data/nativetest 1) Don't use the generic "system_data_file" for the files in /data/nativetest. Rather, ensure it has it's own special label. This allows us to distinguish these files from other files in SELinux policy. 2) Allow the shell user to execute files from /data/nativetest, on userdebug or eng builds only. 3) Add a neverallow rule (compile time assertion + CTS test) that nobody is allowed to execute these files on user builds, and only the shell user is allowed to execute these files on userdebug/eng builds. Bug: 25340994 Change-Id: I3e292cdd1908f342699d6c52f8bbbe6065359413
2015-10-29 00:45:58 +01:00
# /data/nativetest
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type nativetest_data_file, file_type, data_file_type, core_data_file_type;
Offer to cache ringtones in system DE storage. Ringtones often live on shared media, which is now encrypted with CE keys and not available until after the user is unlocked. To improve the user experience while locked, cache the default ringtone, notification sound, and alarm sound in a DE storage area. Also fix bug where wallpaper_file wasn't getting data_file_type. Bug: 26730753 Change-Id: Ib1f08d03eb734c3dce91daab41601d3ed14f4f0d
2016-02-23 01:50:01 +01:00
# /data/system_de/0/ringtones
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type ringtone_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
SELinux policies for /data/preloads directory A new directory is created in user data partition that contains preloaded content such as a retail mode demo video and pre-loaded APKs. The new directory is writable/deletable by system server. It can only be readable (including directory list) by privileged or platform apps Bug: 28855287 Change-Id: I3816cd3a1ed5b9a030965698a66265057214f037
2016-05-20 20:08:45 +02:00
# /data/preloads
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type preloads_data_file, file_type, data_file_type, core_data_file_type;
Split preloads into media_file and data_file Untrusted apps should only access /data/preloads/media and demo directory. Bug: 36197686 Test: Verified retail mode. Checked non-privileged APK cannot access /data/preloads Change-Id: I8e9c21ff6aba799aa31bf06893cdf60dafc04446
2017-03-14 19:42:03 +01:00
# /data/preloads/media
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type preloads_media_file, file_type, data_file_type, core_data_file_type;
Ban core components from accessing vendor data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open FD such as ioctl/stat/read/write/append. This commit asserts that core components marked with attribute coredomain may only access core data types marked with attribute core_data_file_type. A temporary exemption is granted to domains that currently rely on access. (cherry picked from commit cd97e71084b026b201f8d5a0bc08c283f8d673cd) Bug: 34980020 Test: build Marlin policy Change-Id: I2f0442f2628fbac1f2f7aa5ddf2a13e16b2546cc
2017-03-30 00:50:32 +02:00
# /data/misc/dhcp and /data/misc/dhcp-6.8.2
type dhcp_data_file, file_type, data_file_type, core_data_file_type;
alphabetize /data/misc entries. Alphabetize the entries for the /data/misc subdirectories. Change-Id: I3690085cbb99c225545545668dedd66341a14edb
2013-12-13 00:23:10 +01:00
Updated policy for external storage. An upcoming platform release is redesigning how external storage works. At a high level, vold is taking on a more active role in managing devices that dynamically appear. This change also creates further restricted domains for tools doing low-level access of external storage devices, including sgdisk and blkid. It also extends sdcardd to be launchable by vold, since launching by init will eventually go away. For compatibility, rules required to keep AOSP builds working are marked with "TODO" to eventually remove. Slightly relax system_server external storage rules to allow calls like statfs(). Still neverallow open file descriptors, since they can cause kernel to kill us. Here are the relevant violations that this CL is designed to allow: avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
# Mount locations managed by vold
type mnt_media_rw_file, file_type;
type mnt_user_file, file_type;
Initial policy for expanded storage. Expanded storage supports a subset of the features of the internal data partition. Mirror that policy for consistency. vold is also granted enough permissions to prepare initial directories. avc: denied { write } for name="ext" dev="tmpfs" ino=3130 scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { add_name } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { create } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { setattr } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" dev="tmpfs" ino=7243 scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { mounton } for path="/mnt/ext/57f8f4bc-abf4-655f-bf67-946fc0f9f25b" dev="tmpfs" ino=7243 scontext=u:r:vold:s0 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { getattr } for path="/mnt/ext" dev="tmpfs" ino=3130 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_ext_file:s0 tclass=dir permissive=1 avc: denied { setattr } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" dev="tmpfs" ino=4471 scontext=u:r:vold:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=1 avc: denied { getattr } for path="/mnt/expand/57f8f4bc-abf4-655f-bf67-946fc0f9f25b/media" dev="dm-0" ino=145153 scontext=u:r:vold:s0 tcontext=u:object_r:media_rw_data_file:s0 tclass=dir permissive=1 avc: denied { rmdir } for name="57f8f4bc-abf4-655f-bf67-946fc0f9f25b" dev="tmpfs" ino=6380 scontext=u:r:vold:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir permissive=1 avc: denied { create } for name="tmp" scontext=u:r:vold:s0 tcontext=u:object_r:shell_data_file:s0 tclass=dir permissive=1 avc: denied { setattr } for name="tmp" dev="dm-0" ino=72578 scontext=u:r:vold:s0 tcontext=u:object_r:shell_data_file:s0 tclass=dir permissive=1 Bug: 19993667 Change-Id: I73c98b36e7c066f21650a9e16ea82c5a0ef3d6c5
2015-04-07 01:21:54 +02:00
type mnt_expand_file, file_type;
Updated policy for external storage. An upcoming platform release is redesigning how external storage works. At a high level, vold is taking on a more active role in managing devices that dynamically appear. This change also creates further restricted domains for tools doing low-level access of external storage devices, including sgdisk and blkid. It also extends sdcardd to be launchable by vold, since launching by init will eventually go away. For compatibility, rules required to keep AOSP builds working are marked with "TODO" to eventually remove. Slightly relax system_server external storage rules to allow calls like statfs(). Still neverallow open file descriptors, since they can cause kernel to kill us. Here are the relevant violations that this CL is designed to allow: avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
type storage_file, file_type;
# Label for storage dirs which are just mount stubs
type mnt_media_rw_stub_file, file_type;
type storage_stub_file, file_type;
New postinstall domain and rules to run post-install program. When using the A/B updater, a device specific hook is sometimes needed to run after the new partitions are updated but before rebooting into the new image. This hook is referred to throughout the code as the "postinstall" step. This patch creates a new execution domain "postinstall" which update_engine will use to run said hook. Since the hook needs to run from the new image (namelly, slot "B"), update_engine needs to temporarly mount this B partition into /postinstall and then run a program from there. Since the new program in B runs from the old execution context in A, we can't rely on the labels set in the xattr in the new filesystem to enforce the policies baked into the old running image. Instead, when temporarily mounting the new filesystem in update_engine, we override all the new file attributes with the new postinstall_file type by passing "context=u:object_r:postinstall_file:s0" to the mount syscall. This allows us to set new rules specific to the postinstall environment that are consistent with the rules in the old system. Bug: 27177071 TEST=Deployed a payload with a trivial postinstall script to edison-eng. (cherry picked from commit 6cb2c893b12db00c73009f6ab1f6c69426b0cc05) Change-Id: I49a529eecf1ef0524819470876ef7c8c2659c7ef
2016-03-02 01:14:45 +01:00
# /postinstall: Mount point used by update_engine to run postinstall.
type postinstall_mnt_dir, file_type;
# Files inside the /postinstall mountpoint are all labeled as postinstall_file.
Allow postinstall_file to be an entrypoint. postinstall_file was an exec_type so it could be an entrypoint for the domain_auto_trans from update_engine domain to postinstall domain. This patch removes the exec_type from postinstall_file and exempts it from the neverallow rule to become an entrypoint. Bug: 28008031 TEST=postinstall_example still runs as the "postinstall" domain on edison-eng. Change-Id: Icbf5b262c6f971ce054f1b4896c611b32a6d66b5
2016-04-06 01:07:25 +02:00
type postinstall_file, file_type;
New postinstall domain and rules to run post-install program. When using the A/B updater, a device specific hook is sometimes needed to run after the new partitions are updated but before rebooting into the new image. This hook is referred to throughout the code as the "postinstall" step. This patch creates a new execution domain "postinstall" which update_engine will use to run said hook. Since the hook needs to run from the new image (namelly, slot "B"), update_engine needs to temporarly mount this B partition into /postinstall and then run a program from there. Since the new program in B runs from the old execution context in A, we can't rely on the labels set in the xattr in the new filesystem to enforce the policies baked into the old running image. Instead, when temporarily mounting the new filesystem in update_engine, we override all the new file attributes with the new postinstall_file type by passing "context=u:object_r:postinstall_file:s0" to the mount syscall. This allows us to set new rules specific to the postinstall environment that are consistent with the rules in the old system. Bug: 27177071 TEST=Deployed a payload with a trivial postinstall script to edison-eng. (cherry picked from commit 6cb2c893b12db00c73009f6ab1f6c69426b0cc05) Change-Id: I49a529eecf1ef0524819470876ef7c8c2659c7ef
2016-03-02 01:14:45 +01:00
SE Android policy.
2012-01-04 18:33:27 +01:00
# /data/misc subdirectories
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type adb_keys_file, file_type, data_file_type, core_data_file_type;
type audio_data_file, file_type, data_file_type, core_data_file_type;
type audioserver_data_file, file_type, data_file_type, core_data_file_type;
type bluetooth_data_file, file_type, data_file_type, core_data_file_type;
type bluetooth_logs_data_file, file_type, data_file_type, core_data_file_type;
type bootstat_data_file, file_type, data_file_type, core_data_file_type;
type boottrace_data_file, file_type, data_file_type, core_data_file_type;
type camera_data_file, file_type, data_file_type, core_data_file_type;
type gatekeeper_data_file, file_type, data_file_type, core_data_file_type;
type incident_data_file, file_type, data_file_type, core_data_file_type;
type keychain_data_file, file_type, data_file_type, core_data_file_type;
type keystore_data_file, file_type, data_file_type, core_data_file_type;
type media_data_file, file_type, data_file_type, core_data_file_type;
type media_rw_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
type misc_user_data_file, file_type, data_file_type, core_data_file_type;
type net_data_file, file_type, data_file_type, core_data_file_type;
Add Network Watchlist data file selinux policy(Used in ConfigUpdater) Bug: 63908748 Test: Able to boot Change-Id: I14d8856d7aac7be9d1f26ecf5bfff69ea5ee9607
2017-12-14 10:56:32 +01:00
type network_watchlist_data_file, file_type, data_file_type, core_data_file_type;
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type nfc_data_file, file_type, data_file_type, core_data_file_type;
type radio_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
type recovery_data_file, file_type, data_file_type, core_data_file_type;
type shared_relro_file, file_type, data_file_type, core_data_file_type;
type systemkeys_data_file, file_type, data_file_type, core_data_file_type;
SELinux configuration for TextClassifier model updates. Test: bit FrameworksCoreTests:android.view.textclassifier.TextClassificationManagerTest Bug: 34780396 Change-Id: I8b98fef913df571e55474ea2529f71750874941c
2017-04-26 22:20:20 +02:00
type textclassifier_data_file, file_type, data_file_type, core_data_file_type;
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type vpn_data_file, file_type, data_file_type, core_data_file_type;
type wifi_data_file, file_type, data_file_type, core_data_file_type;
type zoneinfo_data_file, file_type, data_file_type, core_data_file_type;
type vold_data_file, file_type, data_file_type, core_data_file_type;
type perfprofd_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
tee domain is a vendor domain As a result, Keymaster and DRM HALs are permitted to talk to tee domain over sockets. Unfortunately, the tee domain needs to remain on the exemptions list because drmserver, mediaserver, and surfaceflinger are currently permitted to talk to this domain over sockets. We need to figure out why global policy even defines a TEE domain... Test: mmm system/sepolicy Bug: 36601092 Bug: 36601602 Bug: 36714625 Bug: 36715266 Change-Id: I0b95e23361204bd046ae5ad22f9f953c810c1895
2017-03-29 06:59:24 +02:00
type tee_data_file, file_type, data_file_type;
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type update_engine_data_file, file_type, data_file_type, core_data_file_type;
Allow update_engine to access /data/misc/update_engine_log Add label update_engine_log_data_file for log files created by update engine in directory /data/misc/update_engine_log. Bug: 65568605 Test: manual Change-Id: I379db82a0ea540e41cb3b8e03f93d9ce64fac7c9
2017-11-06 12:56:00 +01:00
type update_engine_log_data_file, file_type, data_file_type, core_data_file_type;
Add SElinux rules for /data/misc/trace The directory is to be used in eng/userdebug build to store method traces (previously stored in /data/dalvik-cache/profiles). Bug: 25612377 Change-Id: Ia4365a8d1f13d33ee54115dc5e3bf62786503993
2015-11-10 19:49:57 +01:00
# /data/misc/trace for method traces on userdebug / eng builds
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type method_trace_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
alphabetize /data/misc entries. Alphabetize the entries for the /data/misc subdirectories. Change-Id: I3690085cbb99c225545545668dedd66341a14edb
2013-12-13 00:23:10 +01:00
SE Android policy.
2012-01-04 18:33:27 +01:00
# /data/data subdirectories - app sandboxes
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type app_data_file, file_type, data_file_type, core_data_file_type;
Label app data directories for system UID apps with a different type. We were using system_data_file for the /data/data directories of system UID apps to match the DAC ownership of system UID shared with other system files. However, we are seeing cases where files created in these directories must be writable by other apps, and we would like to avoid allowing write to system data files outside of these directories. So introduce a separate system_app_data_file type and assign it. This should also help protect against arbitrary writes by system UID apps to other system data directories. This resolves the following denial when cropping or taking a user photo for secondary users: avc: denied { write } for path="/data/data/com.android.settings/cache/TakeEditUserPhoto2.jpg" dev="mmcblk0p28" ino=82120 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:system_data_file:s0 tclass=file avc: denied { write } for path="/data/data/com.android.settings/cache/CropEditUserPhoto.jpg" dev="mmcblk0p30" ino=602905 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:system_data_file:s0 tclass=file Bug: 14604553 Change-Id: Ifa10e3283b07f6bd6ecc16eceeb663edfd756cea Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-07 19:10:02 +02:00
# /data/data subdirectory for system UID apps.
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type system_app_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Get rid of separate platform_app_data_file type. The original concept was to allow separation between /data/data/<pkgdir> files of "platform" apps (signed by one of the four build keys) and untrusted apps. But we had to allow read/write to support passing of open files via Binder or local socket for compatibilty, and it seems that direct open by pathname is in fact used in Android as well, only passing the pathname via Binder or local socket. So there is no real benefit to keeping it as a separate type. Retain a type alias for platform_app_data_file to app_data_file until restorecon /data/data support is in place to provide compatibility. Change-Id: Ic15066f48765322ad40500b2ba2801bb3ced5489 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-03-12 18:31:14 +01:00
# Compatibility with type name used in Android 4.3 and 4.4.
SE Android policy.
2012-01-04 18:33:27 +01:00
# Default type for anything under /cache
Annotate data types owned by the core platform This will be used to enforce data separation between platform and vendor. Test: build Bug: 34980020 Change-Id: Ia312f00068d3982c7aae7e35bd0c96a6eb9ea3be
2017-11-06 17:33:33 +01:00
type cache_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Move staged backup content to a specific cache subdir Also narrowly specify the domain for the local transport's bookkeeping. Bug 26834865 Change-Id: I2eea8a10f29356ffecabd8e102f7afa90123c535
2016-01-28 20:30:41 +01:00
# Type for /cache/backup_stage/* (fd interchange with apps)
Annotate data types owned by the core platform This will be used to enforce data separation between platform and vendor. Test: build Bug: 34980020 Change-Id: Ia312f00068d3982c7aae7e35bd0c96a6eb9ea3be
2017-11-06 17:33:33 +01:00
type cache_backup_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Move staged backup content to a specific cache subdir Also narrowly specify the domain for the local transport's bookkeeping. Bug 26834865 Change-Id: I2eea8a10f29356ffecabd8e102f7afa90123c535
2016-01-28 20:30:41 +01:00
# type for anything under /cache/backup (local transport storage)
Annotate data types owned by the core platform This will be used to enforce data separation between platform and vendor. Test: build Bug: 34980020 Change-Id: Ia312f00068d3982c7aae7e35bd0c96a6eb9ea3be
2017-11-06 17:33:33 +01:00
type cache_private_backup_file, file_type, data_file_type, core_data_file_type;
Creates a new permission for /cache/recovery This permission was created mostly for dumpstate (so it can include recovery files on bugreports when an OTA fails), but it was applied to uncrypt and recovery as well (since it had a wider access before). Grant access to cache_recovery_file where we previously granted access to cache_file. Add auditallow rules to determine if this is really needed. BUG: 25351711 Change-Id: I07745181dbb4f0bde75694ea31b3ab79a4682f18
2015-12-22 21:37:17 +01:00
# Type for anything under /cache/recovery
Annotate data types owned by the core platform This will be used to enforce data separation between platform and vendor. Test: build Bug: 34980020 Change-Id: Ia312f00068d3982c7aae7e35bd0c96a6eb9ea3be
2017-11-06 17:33:33 +01:00
type cache_recovery_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
SE Android policy.
2012-01-04 18:33:27 +01:00
# Default type for anything under /efs
type efs_file, file_type;
Introduce a separate wallpaper_file type for the wallpaper file.
2012-03-19 15:29:36 +01:00
# Type for wallpaper file.
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type wallpaper_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Allow "shortcut manager" icons to be returned to apps ... and client apps to read them. A full path looks like this: /data/system_ce/[user-id]/shortcut_service/bitmaps/[creator-app-package]/[timestamp].png System server will: - Create/delete the directories. - Write/remove PNG files in them. - Open the PNG files and return file descriptors to client apps Client apps will: - Receive file descriptors and read from them. Bug 27548047 Change-Id: I3d9ac6ab0c92b2953b84c3c5aabe1f653e6bea6b
2016-03-09 00:06:44 +01:00
# Type for shortcut manager icon file.
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type shortcut_manager_icons, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Modified security policy to allow user to get their own icon. BUG: 27583869 Change-Id: I0a25bd03f3998d48dba355b91140611e38ce7b0d
2016-02-25 16:37:06 +01:00
# Type for user icon file.
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type icon_file, file_type, data_file_type, core_data_file_type;
Add SELinux policy for asec containers. Creates 2 new types: - asec_apk_file : files found under /mnt/asec when the asec images are mounted - asec_image_file : the actual encrypted apks under /data/app-asec Change-Id: I963472add1980ac068d3a6d36a24f27233022832 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2012-10-22 19:50:01 +02:00
# /mnt/asec
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type asec_apk_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Introduce asec_public_file type. This new type will allow us to write finer-grained policy concerning asec containers. Some files of these containers need to be world readable. Change-Id: Iefee74214d664acd262edecbb4f981d633ff96ce Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-02-04 17:36:41 +01:00
# Elements of asec files (/mnt/asec) that are world readable
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type asec_public_file, file_type, data_file_type, core_data_file_type;
Add SELinux policy for asec containers. Creates 2 new types: - asec_apk_file : files found under /mnt/asec when the asec images are mounted - asec_image_file : the actual encrypted apks under /data/app-asec Change-Id: I963472add1980ac068d3a6d36a24f27233022832 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2012-10-22 19:50:01 +02:00
# /data/app-asec
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type asec_image_file, file_type, data_file_type, core_data_file_type;
App data backup security policy. Policy covers: * backup_data_file type for labeling all files/dirs under /data dealing with backup mechanism. * cache_backup_file type for labeling all files/dirs under /cache dealing with backup mechanism. This also covers the the use of LocalTransport for local archive and restore testing. * the use of 'adb shell bmgr' to initiate backup mechanism from shell. * the use of 'adb backup/restore' to archive and restore the device's data. Change-Id: I700a92d8addb9bb91474bc07ca4bb71eb4fc840e Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2012-12-04 14:13:58 +01:00
# /data/backup and /data/secure/backup
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type backup_data_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Policy for hci_attach service.
2012-05-31 15:40:12 +02:00
# All devices have bluetooth efs files. But they
# vary per device, so this type is used in per
Correct spelling mistake Change-Id: If4deccfe740c8de6b88929a0d0439667c3ea340d
2012-09-07 03:50:35 +02:00
# device policy
Policy for hci_attach service.
2012-05-31 15:40:12 +02:00
type bluetooth_efs_file, file_type;
New SeLinux policy for fingerprint HIDL Move from fingerprintd to new fingerprint_hal and update SeLinux policy. Test: Boot with no errors related to fingerprint sepolicy Bug: 33199080 Change-Id: Idfde0cb0530e75e705033042f64f3040f6df22d6
2016-12-16 04:46:43 +01:00
# Type for fingerprint template file
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type fingerprintd_data_file, file_type, data_file_type, core_data_file_type;
Add SELinux label for app fuse. The labels for filesystem and files are assigned by vold with using context= mount option. Change-Id: I8a9d701a46a333093a27107fc3c52b17a2af1a94
2016-01-28 07:48:39 +01:00
# Type for appfuse file.
Ban vendor components access to core data types Vendor and system components are only allowed to share files by passing open FDs over HIDL. Ban all directory access and all file accesses other than what can be applied to an open file: stat/read/write/append. This commit marks core data types as core_data_file_type and bans access to non-core domains with an exemption for apps. A temporary exemption is also granted to domains that currently rely on access with TODOs and bug number for each exemption. Bug: 34980020 Test: Build and boot Marlin. Make phone call, watch youtube video. No new denials observed. Change-Id: I320dd30f9f0a5bf2f9bb218776b4bccdb529b197
2017-03-28 07:44:40 +02:00
type app_fuse_file, file_type, data_file_type, core_data_file_type, mlstrustedobject;
Policy for hci_attach service.
2012-05-31 15:40:12 +02:00
SE Android policy.
2012-01-04 18:33:27 +01:00
# Socket types
Tighten restrictions on core <-> vendor socket comms This futher restricts neverallows for sockets which may be exposed as filesystem nodes. This is achieved by labelling all such sockets created by core/non-vendor domains using the new coredomain_socket attribute, and then adding neverallow rules targeting that attribute. This has now effect on what domains are permitted to do. This only changes neverallow rules. Test: mmm system/sepolicy Bug: 36577153 (cherry picked from commit cf2ffdf0d86f485dfff05a2f13819997bfd462e1) Change-Id: Iffeee571a2ff61fb9515fa6849d060649636524e
2017-03-31 02:39:00 +02:00
type adbd_socket, file_type, coredomain_socket;
Annotate data types owned by the core platform This will be used to enforce data separation between platform and vendor. Test: build Bug: 34980020 Change-Id: Ia312f00068d3982c7aae7e35bd0c96a6eb9ea3be
2017-11-06 17:33:33 +01:00
type bluetooth_socket, file_type, data_file_type, core_data_file_type, coredomain_socket;
Tighten restrictions on core <-> vendor socket comms This futher restricts neverallows for sockets which may be exposed as filesystem nodes. This is achieved by labelling all such sockets created by core/non-vendor domains using the new coredomain_socket attribute, and then adding neverallow rules targeting that attribute. This has now effect on what domains are permitted to do. This only changes neverallow rules. Test: mmm system/sepolicy Bug: 36577153 (cherry picked from commit cf2ffdf0d86f485dfff05a2f13819997bfd462e1) Change-Id: Iffeee571a2ff61fb9515fa6849d060649636524e
2017-03-31 02:39:00 +02:00
type dnsproxyd_socket, file_type, coredomain_socket, mlstrustedobject;
type dumpstate_socket, file_type, coredomain_socket;
type fwmarkd_socket, file_type, coredomain_socket, mlstrustedobject;
type lmkd_socket, file_type, coredomain_socket;
type logd_socket, file_type, coredomain_socket, mlstrustedobject;
type logdr_socket, file_type, coredomain_socket, mlstrustedobject;
type logdw_socket, file_type, coredomain_socket, mlstrustedobject;
type mdns_socket, file_type, coredomain_socket;
type mdnsd_socket, file_type, coredomain_socket, mlstrustedobject;
Annotate data types owned by the core platform This will be used to enforce data separation between platform and vendor. Test: build Bug: 34980020 Change-Id: Ia312f00068d3982c7aae7e35bd0c96a6eb9ea3be
2017-11-06 17:33:33 +01:00
type misc_logd_file, coredomain_socket, file_type, data_file_type, core_data_file_type;
Tighten restrictions on core <-> vendor socket comms This futher restricts neverallows for sockets which may be exposed as filesystem nodes. This is achieved by labelling all such sockets created by core/non-vendor domains using the new coredomain_socket attribute, and then adding neverallow rules targeting that attribute. This has now effect on what domains are permitted to do. This only changes neverallow rules. Test: mmm system/sepolicy Bug: 36577153 (cherry picked from commit cf2ffdf0d86f485dfff05a2f13819997bfd462e1) Change-Id: Iffeee571a2ff61fb9515fa6849d060649636524e
2017-03-31 02:39:00 +02:00
type mtpd_socket, file_type, coredomain_socket;
type netd_socket, file_type, coredomain_socket;
type property_socket, file_type, coredomain_socket, mlstrustedobject;
type racoon_socket, file_type, coredomain_socket;
SE Android policy.
2012-01-04 18:33:27 +01:00
type rild_socket, file_type;
type rild_debug_socket, file_type;
Files on /data must have the data_file_type attr This will be enforced by build-time and CTS tests. Test: build policy Change-Id: Ie852fa59670969a2352a97be357d37e420fb180e
2017-06-08 19:34:58 +02:00
type system_wpa_socket, file_type, data_file_type, coredomain_socket;
Annotate data types owned by the core platform This will be used to enforce data separation between platform and vendor. Test: build Bug: 34980020 Change-Id: Ia312f00068d3982c7aae7e35bd0c96a6eb9ea3be
2017-11-06 17:33:33 +01:00
type system_ndebug_socket, file_type, data_file_type, core_data_file_type, coredomain_socket, mlstrustedobject;
Tighten restrictions on core <-> vendor socket comms This futher restricts neverallows for sockets which may be exposed as filesystem nodes. This is achieved by labelling all such sockets created by core/non-vendor domains using the new coredomain_socket attribute, and then adding neverallow rules targeting that attribute. This has now effect on what domains are permitted to do. This only changes neverallow rules. Test: mmm system/sepolicy Bug: 36577153 (cherry picked from commit cf2ffdf0d86f485dfff05a2f13819997bfd462e1) Change-Id: Iffeee571a2ff61fb9515fa6849d060649636524e
2017-03-31 02:39:00 +02:00
type tombstoned_crash_socket, file_type, coredomain_socket, mlstrustedobject;
SEPolicy: Changes for new stack dumping scheme. Applications connect to tombstoned via a unix domain socket and request an open FD to which they can write their traces. This socket has a new label (tombstoned_java_trace_socket) and appdomain and system_server are given permissions to connect and write to it. Apps no longer need permissions to open files under /data/anr/ and these permissions will be withdrawn in a future change. Bug: 32064548 Test: Manual (cherry picked from commit a8832dabc7f3b7b2381760d2b95f81abf78db709) Change-Id: I70a3e6e230268d12b454e849fa88418082269c4f
2017-05-15 19:39:16 +02:00
type tombstoned_java_trace_socket, file_type, mlstrustedobject;
Tighten restrictions on core <-> vendor socket comms This futher restricts neverallows for sockets which may be exposed as filesystem nodes. This is achieved by labelling all such sockets created by core/non-vendor domains using the new coredomain_socket attribute, and then adding neverallow rules targeting that attribute. This has now effect on what domains are permitted to do. This only changes neverallow rules. Test: mmm system/sepolicy Bug: 36577153 (cherry picked from commit cf2ffdf0d86f485dfff05a2f13819997bfd462e1) Change-Id: Iffeee571a2ff61fb9515fa6849d060649636524e
2017-03-31 02:39:00 +02:00
type tombstoned_intercept_socket, file_type, coredomain_socket;
Perfetto SELinux policies Perfetto is a performance instrumentation and logging framework, living in AOSP's /external/pefetto. Perfetto introduces in the system one binary and two daemons (the binary can specialize in either depending on the cmdline). 1) traced: unprivileged daemon. This is architecturally similar to logd. It exposes two UNIX sockets: - /dev/socket/traced_producer : world-accessible, allows to stream tracing data. A tmpfs file descriptor is sent via SCM_RIGHTS from traced to each client process, which needs to be able to mmap it R/W (but not X) - /dev/socket/traced_consumer : privilege-accessible (only from: shell, statsd). It allows to configure tracing and read the trace buffer. 2) traced_probes: privileged daemon. This needs to: - access tracingfs (/d/tracing) to turn tracing on and off. - exec atrace - connect to traced_producer to stream data to traced. init.rc file: https://android-review.googlesource.com/c/platform/external/perfetto/+/575382/14/perfetto.rc Bug: 70942310 Change-Id: Ia3b5fdacbd5a8e6e23b82f1d6fabfa07e4abc405
2017-12-21 03:51:15 +01:00
type traced_producer_socket, file_type, coredomain_socket;
type traced_consumer_socket, file_type, coredomain_socket;
Tighten restrictions on core <-> vendor socket comms This futher restricts neverallows for sockets which may be exposed as filesystem nodes. This is achieved by labelling all such sockets created by core/non-vendor domains using the new coredomain_socket attribute, and then adding neverallow rules targeting that attribute. This has now effect on what domains are permitted to do. This only changes neverallow rules. Test: mmm system/sepolicy Bug: 36577153 (cherry picked from commit cf2ffdf0d86f485dfff05a2f13819997bfd462e1) Change-Id: Iffeee571a2ff61fb9515fa6849d060649636524e
2017-03-31 02:39:00 +02:00
type uncrypt_socket, file_type, coredomain_socket;
type webview_zygote_socket, file_type, coredomain_socket;
Files on /data must have the data_file_type attr This will be enforced by build-time and CTS tests. Test: build policy Change-Id: Ie852fa59670969a2352a97be357d37e420fb180e
2017-06-08 19:34:58 +02:00
type wpa_socket, file_type, data_file_type;
Tighten restrictions on core <-> vendor socket comms This futher restricts neverallows for sockets which may be exposed as filesystem nodes. This is achieved by labelling all such sockets created by core/non-vendor domains using the new coredomain_socket attribute, and then adding neverallow rules targeting that attribute. This has now effect on what domains are permitted to do. This only changes neverallow rules. Test: mmm system/sepolicy Bug: 36577153 (cherry picked from commit cf2ffdf0d86f485dfff05a2f13819997bfd462e1) Change-Id: Iffeee571a2ff61fb9515fa6849d060649636524e
2017-03-31 02:39:00 +02:00
type zygote_socket, file_type, coredomain_socket;
Corrected denials for LocationManager when accessing gps over uart.
2012-07-10 23:36:22 +02:00
# UART (for GPS) control proc file
type gps_control, file_type;
SELinux policies for PDX services Specify per-service rules for PDX transport. Now being able to grant permissions to individual services provided by processes, not all services of a process. Also tighter control over which permissions are required for client and server for individual components of IPC (endpoints, channels, etc). Bug: 37646189 Change-Id: I78eb8ae8b6e08105666445a66bfcbd2f1d69d0ea
2017-05-01 22:01:44 +02:00
# PDX endpoint types
type pdx_display_dir, pdx_endpoint_dir_type, file_type;
type pdx_performance_dir, pdx_endpoint_dir_type, file_type;
type pdx_bufferhub_dir, pdx_endpoint_dir_type, file_type;
pdx_service_socket_types(display_client, pdx_display_dir)
pdx_service_socket_types(display_manager, pdx_display_dir)
pdx_service_socket_types(display_screenshot, pdx_display_dir)
pdx_service_socket_types(display_vsync, pdx_display_dir)
pdx_service_socket_types(performance_client, pdx_performance_dir)
pdx_service_socket_types(bufferhub_client, pdx_bufferhub_dir)
file_context: explicitly label all file context files file_context files need to be explicitly labeled as they are now split across system and vendor and won't have the generic world readable 'system_file' label. Bug: 36002414 Test: no new 'file_context' denials at boot complete on sailfish Test: successfully booted into recovery without denials and sideloaded OTA update. Test: ./cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi \ arm64-v8a --module CtsSecurityHostTestCases -t \ android.security.cts.SELinuxHostTest#testAospFileContexts Change-Id: I603157e9fa7d1de3679d41e343de397631666273 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-24 23:02:13 +01:00
# file_contexts files
type file_contexts_file, file_type;
mac_permissions: explicitly label all mac_permissions files *mac_permissions.xml files need to be explicitly labeled as they are now split cross system and vendor and won't have the generic world readable 'system_file' or 'rootfs' label. Bug: 36003167 Test: no new 'mac_perms_file' denials at boot complete on sailfish Test: successfully booted into recovery without denials and sideloaded OTA update. Test: Launch 'chrome' and succesfully load a website. Test: Launch Camera and take a picture. Test: Launch Camera and record a video, succesfully playback recorded video Change-Id: I1c882872bb78d1242ba273756ef0dc27487f58fc Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-27 21:06:04 +02:00
# mac_permissions file
type mac_perms_file, file_type;
Support fine grain read access control for properties Properties are now broken up from a single /dev/__properties__ file into multiple files, one per property label. This commit provides the mechanism to control read access to each of these files and therefore sets of properties. This allows full access for all domains to each of these new property files to match the current permissions of /dev/__properties__. Future commits will restrict the access. Bug: 21852512 Change-Id: Ie9e43968acc7ac3b88e354a0bdfac75b8a710094
2015-12-02 01:58:27 +01:00
# property_contexts file
prop_context: correctly label all property_context files split property context file in vendor and sytem were left untouched by the recent changes. This was working accidentally because they were still accessible to all domains as 'system_file'. Bug: 36002573 Test: Boot sailfish to observe no new denials. Test: 'adb sideload' OTA on sailfish successfully Change-Id: I5bec058b59db83d2a431e9f7e91c5a09af7d2942 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-24 18:22:14 +01:00
type property_contexts_file, file_type;
Support fine grain read access control for properties Properties are now broken up from a single /dev/__properties__ file into multiple files, one per property label. This commit provides the mechanism to control read access to each of these files and therefore sets of properties. This allows full access for all domains to each of these new property files to match the current permissions of /dev/__properties__. Future commits will restrict the access. Bug: 21852512 Change-Id: Ie9e43968acc7ac3b88e354a0bdfac75b8a710094
2015-12-02 01:58:27 +01:00
seapp_context: explicitly label all seapp context files seapp_context files need to be explicitly labeled as they are now split cross system and vendor and won't have the generic world readable 'system_file' label. Bug: 36002414 Test: no new 'seapp_context' denials at boot complete on sailfish Test: successfully booted into recovery without denials and sideloaded OTA update. Test: ./cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check --abi \ arm64-v8a --module CtsSecurityHostTestCases -t \ android.security.cts.SELinuxHostTest#testAospSeappContexts Test: Launch 'chrome' and succesfully load a website. Test: Launch Camera and take a picture. Test: Launch Camera and record a video, succesfully playback recorded video Change-Id: I19b3e50c6a7c292713d3e56ef0448acf6e4270f7 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-27 19:57:07 +02:00
# seapp_contexts file
type seapp_contexts_file, file_type;
sepolicy: explicitly label all sepolicy files sepolicy files need to be explicitly labeled as they are now split cross system and vendor and won't have the generic world readable 'system_file' or 'rootfs' label. Bug: 36527360 Test: no new 'sepolicy_file' denials at boot complete on sailfish Test: successfully booted into recovery without denials and sideloaded OTA update. Test: Launch 'chrome' and succesfully load a website. Test: Launch Camera and take a picture. Test: Launch Camera and record a video, succesfully playback recorded video Change-Id: I6fe8ba31588c2d75521c6e2b0bf7e6d6eaf80a19 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-27 20:39:16 +02:00
# sepolicy files binary and others
type sepolicy_file, file_type;
service_contexts: label service_contexts explicitly The label applies to all service_contexts regardless of their location. This also lets us track the service_contexts usage and limit access to the files for the corresponding object manager alone. Bug: 36002427 Test: Boot sailfish and observe no denials for 'serice_contexts' Test: cts-tradefed run singleCommand cts --skip-device-info \ --skip-preconditions --skip-connectivity-check \ --abi arm64-v8a --module CtsSecurityHostTestCases \ -t android.security.cts.SELinuxHostTest#testAospServiceContexts Change-Id: I97fc8b24bc99ca5c00d010fb522cd39a35572858 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-03-24 20:24:43 +01:00
# service_contexts file
type service_contexts_file, file_type;
Support fine grain read access control for properties Properties are now broken up from a single /dev/__properties__ file into multiple files, one per property label. This commit provides the mechanism to control read access to each of these files and therefore sets of properties. This allows full access for all domains to each of these new property files to match the current permissions of /dev/__properties__. Future commits will restrict the access. Bug: 21852512 Change-Id: Ie9e43968acc7ac3b88e354a0bdfac75b8a710094
2015-12-02 01:58:27 +01:00
Prevent access to nonplat_service_contexts on full_treble. On Full Treble devices, servicemanager should only service services from the platform service_contexts file. Created new type to separate plat_ and nonplat_service_contexts, and added new type to mapping (although I don't think this type should have been used by vendors). Bug: 36866029 Test: Marlin/Taimen boot Change-Id: Ied112c64f22f8486a7415197660faa029add82d9
2017-08-11 14:49:56 +02:00
# nonplat service_contexts file (only accessible on non full-treble devices)
type nonplat_service_contexts_file, file_type;
Add hwservice_contexts and support for querying it. hwservicemanager can check hwservice_contexts files both from the framework and vendor partitions. Initially, have a wildcard '*' in hwservice_contexts that maps to a label that can be added/found from domain. This needs to be removed when the proper policy is in place. Also, grant su/shell access to hwservicemanager list operations, so tools like 'lshal' continue to work. Bug: 34454312 Test: Marlin boots Change-Id: I3a02d97a82458692b528d85c1b8e78b6f82ea1bc
2017-04-08 01:14:43 +02:00
# hwservice_contexts file
type hwservice_contexts_file, file_type;
Add target for vndservice_contexts. So we can limit vndservicemanager access to just vndservice_contexts. Bug: 36052864 Test: servicemanager,vndservicemanager work Change-Id: I7b132d4f616ba1edd0daf7be750d4b7174c4e188
2017-04-01 02:29:53 +02:00
# vndservice_contexts file
type vndservice_contexts_file, file_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
# Allow files to be created in their appropriate filesystems.
allow fs_type self:filesystem associate;
cgroup: allow associate to tmpfs Allows groups to be mounted at /dev/memcg Addresses: avc: denied { associate } for comm="init" name="memcg" scontext=u:object_r:cgroup:s0 tcontext=u:object_r:tmpfs:s0 tclass=filesystem permissive=0 Bug: 64067152 Test: build Change-Id: Ic8f641e841fe09c8f7fd487ed67cf0ab4860a1cc
2017-07-26 19:19:33 +02:00
allow cgroup tmpfs:filesystem associate;
sepolicy: Allow mount cgroupv2 and bpf fs Some necessary sepolicy rule changes for init process to create directory, mount cgroupv2 module and mount bpf filesystem. Also allow netd to create and pin bpf object as files and read it back from file under the directory where bpf filesystem is mounted. Test: bpf maps show up under /sys/fs/bpf/ Change-Id: I579d04f60d7e20bd800d970cd28cd39fda9d20a0
2017-08-02 03:06:18 +02:00
allow cgroup_bpf tmpfs:filesystem associate;
SE Android policy.
2012-01-04 18:33:27 +01:00
allow sysfs_type sysfs:filesystem associate;
sepolicy: add support for new tracefs Since kernel 4.1 ftrace is supported as a new separate filesystem. It gets automatically mounted by the kernel under the old path /sys/kernel/debug/tracing. Because it lives now on a separate device some sepolicy rules need to be updated. This patch is doing that. Most of the rules are created based on a conversation happened on the SELinux Android mailing list: http://comments.gmane.org/gmane.comp.security.seandroid/2799 Note, that this also needs 3a343a1 from the 4.4 branch in kernel/common. Also note that when tracefs is auto mounted by the kernel, the kernel does not use the "mode" parameter specified to mount debugfs for tracefs. So an extra line like chmod 0755 /sys/kernel/debug/tracing is necessary in init.${ro.hardware}.rc after debugfs was mounted. Change-Id: I60fb7a90e24628e0370c3bca57644451fce5646d Signed-off-by: Christian Poetzsch <christian.potzsch@imgtec.com>
2016-05-13 14:36:33 +02:00
allow debugfs_type { debugfs debugfs_tracing }:filesystem associate;
SE Android policy.
2012-01-04 18:33:27 +01:00
allow file_type labeledfs:filesystem associate;
allow file_type tmpfs:filesystem associate;
Allow file types to be associated with the rootfs. This is now possible due to the kernel change to support setting security contexts on rootfs inodes. Change-Id: I2a9aac1508eceabb92c3ae8eb5c63a16b28dda6f Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-05-10 17:29:35 +02:00
allow file_type rootfs:filesystem associate;
SE Android policy.
2012-01-04 18:33:27 +01:00
allow dev_type tmpfs:filesystem associate;
Add SELinux label for app fuse. The labels for filesystem and files are assigned by vold with using context= mount option. Change-Id: I8a9d701a46a333093a27107fc3c52b17a2af1a94
2016-01-28 07:48:39 +01:00
allow app_fuse_file app_fusefs:filesystem associate;
New postinstall domain and rules to run post-install program. When using the A/B updater, a device specific hook is sometimes needed to run after the new partitions are updated but before rebooting into the new image. This hook is referred to throughout the code as the "postinstall" step. This patch creates a new execution domain "postinstall" which update_engine will use to run said hook. Since the hook needs to run from the new image (namelly, slot "B"), update_engine needs to temporarly mount this B partition into /postinstall and then run a program from there. Since the new program in B runs from the old execution context in A, we can't rely on the labels set in the xattr in the new filesystem to enforce the policies baked into the old running image. Instead, when temporarily mounting the new filesystem in update_engine, we override all the new file attributes with the new postinstall_file type by passing "context=u:object_r:postinstall_file:s0" to the mount syscall. This allows us to set new rules specific to the postinstall environment that are consistent with the rules in the old system. Bug: 27177071 TEST=Deployed a payload with a trivial postinstall script to edison-eng. (cherry picked from commit 6cb2c893b12db00c73009f6ab1f6c69426b0cc05) Change-Id: I49a529eecf1ef0524819470876ef7c8c2659c7ef
2016-03-02 01:14:45 +01:00
allow postinstall_file self:filesystem associate;
Don't allow types which are both file_type and fs_type It's a bug to have a type with both the file_type and fs_type attribute. A type should be declared with either file_type, or fs_type, but not both. Create a neverallow rule which detects this situation. This works because we have the following allow rule: allow fs_type self:filesystem associate; If a type is a file_type and an fs_type, the associate allow rule will conflict with this neverallow rule. Not sure if this is the cleanest way to accomplish this, but it seems to work. Change-Id: Ida387b1df260efca15de38ae7a66ed25e353acaa
2014-06-15 17:41:55 +02:00
Sepolicy: Fix asanwrapper Add asanwrapper support for system server under sanitization. Bug: 36138508 Test: m && m SANITIZE_TARGET=address SANITIZE_LITE=true Test: adb root && adb shell setprop wrap.system_server asanwrapper Change-Id: Id930690d2cfd8334c933e0ec5ac62f88850331d0
2017-04-04 00:23:16 +02:00
# asanwrapper (run a sanitized app_process, to be used with wrap properties)
with_asan(`type asanwrapper_exec, exec_type, file_type;')
hal_audio: remove access to audiohal_data_file This is no longer used and violates Treble data separation. Bug: 68057930 Test: verify on Sailfish that /data/misc/audiohal doesn't exist This dir appears to be Qualcomm specific and should not have been defined in core policy. Change-Id: I55fba7564203a7f8a1d8612abd36ec1f89dc869d
2017-10-21 05:24:15 +02:00
# Deprecated in SDK version 28
type audiohal_data_file, file_type, data_file_type, core_data_file_type;
Don't allow types which are both file_type and fs_type It's a bug to have a type with both the file_type and fs_type attribute. A type should be declared with either file_type, or fs_type, but not both. Create a neverallow rule which detects this situation. This works because we have the following allow rule: allow fs_type self:filesystem associate; If a type is a file_type and an fs_type, the associate allow rule will conflict with this neverallow rule. Not sure if this is the cleanest way to accomplish this, but it seems to work. Change-Id: Ida387b1df260efca15de38ae7a66ed25e353acaa
2014-06-15 17:41:55 +02:00
# It's a bug to assign the file_type attribute and fs_type attribute
# to any type. Do not allow it.
#
# For example, the following is a bug:
# type apk_data_file, file_type, data_file_type, fs_type;
# Should be:
# type apk_data_file, file_type, data_file_type;
Fix neverallow rules to eliminate CTS SELinuxTest warnings. Fix two neverallow rules that yield Invalid SELinux context warnings from the CTS SELinuxTest. For transitions from app domains, we only need to check { domain -appdomain } (i.e. domains other than app domains), not ~appdomain (i.e. all types other than app domains). Otherwise SELinuxTest tries to generate contexts with the r role and non-domain types for testing since the target class is process, and such contexts are invalid. For keeping file_type and fs_type exclusive, we only need to check associate permission, not all filesystem permissions, as only associate takes a file type as the source context. Otherwise SELinuxTest tries to generate contexts with the r role and non-domain types for testing filesystem permissions other than associate, since the source of such checks is normally a process context. Change-Id: I6c2f63f4786d75294a6938613ba14b64212fc802 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-07-29 20:50:30 +02:00
neverallow fs_type file_type:filesystem associate;
Reference in a new issue Copy permalink