tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/file.te

117 lines
4.3 KiB
Text
Raw Normal View History

SE Android policy.
2012-01-04 18:33:27 +01:00
# Filesystem types
type labeledfs, fs_type;
type pipefs, fs_type;
type sockfs, fs_type;
type rootfs, fs_type;
type proc, fs_type;
Target the denials/policies over qtaguid file and device: 1. Relabel /proc/net/xt_qtaguid/ctrl from "qtaguid" to "qtaguid_proc"; 2. Label /dev/xt_qtaguid with "qtaguid_device"; 3. Allow mediaserver read/[write] to qtaguid_proc and qtaguid_device; 4. Allow media apps read/[write] to qtaguid_proc and qtaguid_device; 5. Allow system read/[write] to qtaguid_proc and qtaguid_device. Actually, some of policies related to qtaguid have been there already, but we refind existing ones and add new ones.
2012-07-19 20:07:04 +02:00
type qtaguid_proc, fs_type, mlstrustedobject;
Various policy updates. Assortment of policy changes include: * Bluetooth domain to talk to init and procfs. * New device node domains. * Allow zygote to talk to its executable. * Update system domain access to new device node domains. * Create a post-process sepolicy with dontaudits removed. * Allow rild to use the tty device. Change-Id: Ibb96b590d0035b8f6d1606cd5e4393c174d10ffb Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2013-03-27 11:30:25 +01:00
type proc_bluetooth_writable, fs_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
type selinuxfs, fs_type;
type cgroup, fs_type, mlstrustedobject;
type sysfs, fs_type, mlstrustedobject;
type sysfs_writable, fs_type, sysfs_type, mlstrustedobject;
Update policy for Android 4.2 / latest master. Update policy for Android 4.2 / latest master. Primarily this consists of changes around the bluetooth subsystem. The zygote also needs further permissions to set up /storage/emulated. adbd service now gets a socket under /dev/socket. keystore uses the binder. Change-Id: I8c5aeb8d100313c75169734a0fa614aa974b3bfc Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-11-16 15:06:47 +01:00
type sysfs_bluetooth_writable, fs_type, sysfs_type, mlstrustedobject;
Integrate nfc_power and rild rules from tuna sepolicy by Bryan Hinton.
2012-03-19 20:56:01 +01:00
type sysfs_nfc_power_writable, fs_type, sysfs_type, mlstrustedobject;
SE Android policy.
2012-01-04 18:33:27 +01:00
type inotify, fs_type, mlstrustedobject;
Add policy for run-as program. Add policy for run-as program and label it in file_contexts. Drop MLS constraints on local socket checks other than create/relabel as this interferes with connections with services, in particular for adb forward. Change-Id: Ib0c4abeb7cbef559e150a620c45a7c31e0531114 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-11-13 19:00:05 +01:00
type devpts, fs_type, mlstrustedobject;
SE Android policy.
2012-01-04 18:33:27 +01:00
type tmpfs, fs_type;
type shm, fs_type;
type mqueue, fs_type;
Split internal and external sdcards Two new types are introduced: sdcard_internal sdcard_external The existing type of sdcard, is dropped and a new attribute sdcard_type is introduced. The boolean app_sdcard_rw has also been changed to allow for controlling untrusted_app domain to use the internal and external sdcards. Change-Id: Ic7252a8e1703a43cb496413809d01cc6cacba8f5
2013-03-07 01:26:36 +01:00
type sdcard_internal, sdcard_type, fs_type, mlstrustedobject;
type sdcard_external, sdcard_type, fs_type, mlstrustedobject;
SE Android policy.
2012-01-04 18:33:27 +01:00
type debugfs, fs_type, mlstrustedobject;
# File types
type unlabeled, file_type;
# Default type for anything under /system.
type system_file, file_type;
# Default type for anything under /data.
type system_data_file, file_type, data_file_type;
Policy changes to support running the latest CTS.
2012-03-07 20:59:01 +01:00
# /data/drm - DRM plugin data
type drm_data_file, file_type, data_file_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
# /data/anr - ANR traces
Allow apps to write to anr_data_file for /data/anr/traces.txt.
2012-04-04 22:00:11 +02:00
type anr_data_file, file_type, data_file_type, mlstrustedobject;
SE Android policy.
2012-01-04 18:33:27 +01:00
# /data/tombstones - core dumps
type tombstone_data_file, file_type, data_file_type;
# /data/app - user-installed apps
Introduce a separate apk_tmp_file type for the vmdl.*\.tmp files.
2012-03-19 15:24:52 +01:00
type apk_data_file, file_type, data_file_type;
type apk_tmp_file, file_type, data_file_type, mlstrustedobject;
Add new domains for private apps. /data/app-private is used when making an app purchase or forward locking. Provide a new label for the directory as well as the tmp files that appear under it. Change-Id: I910cd1aa63538253e10a8d80268212ad9fc9fca5 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2013-04-03 20:21:46 +02:00
# /data/app-private - forward-locked apps
type apk_private_data_file, file_type, data_file_type;
type apk_private_tmp_file, file_type, data_file_type, mlstrustedobject;
SE Android policy.
2012-01-04 18:33:27 +01:00
# /data/dalvik-cache
type dalvikcache_data_file, file_type, data_file_type;
# /data/local - writable by shell
type shell_data_file, file_type, data_file_type;
# /data/gps
type gps_data_file, file_type, data_file_type;
# /data/misc subdirectories
type bluetooth_data_file, file_type, data_file_type;
type keystore_data_file, file_type, data_file_type;
type vpn_data_file, file_type, data_file_type;
type systemkeys_data_file, file_type, data_file_type;
type wifi_data_file, file_type, data_file_type;
type radio_data_file, file_type, data_file_type;
type nfc_data_file, file_type, data_file_type;
allow camera calibration
2012-07-19 19:34:39 +02:00
type camera_calibration_file, file_type, data_file_type;
Label adb keys file and allow access to it. The /adb_keys entry will only take effect if a restorecon is applied by init.rc on a kernel that includes the rootfs labeling support, but does no harm otherwise. The /data/misc/adb labeling ensures correct labeling of the adb_keys file created if the device has ro.adb.secure=1 set. Allow adbd to read the file. Change-Id: I97b3d86a69681330bba549491a2fb39df6cf20ef Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-09-30 19:54:09 +02:00
type adb_keys_file, file_type, data_file_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
# /data/data subdirectories - app sandboxes
type app_data_file, file_type, data_file_type;
Only enforce per-app process and file isolation via SELinux for third party apps, not platform apps. Platform (any of the apps signed by build keys, i.e. platform|release|shared|media) apps expect to be able to share files with each other or with third party apps by passing open files or pathnames over Binder. Therefore, we switch to only enforcing the per-app process and file isolation via SELinux on third party apps, not platform apps. Make the platform app domains mlstrustedsubjects so that they can access any files created by third party apps. Introduce a new platform_app_data_file type for platform apps so that we can mark it as a mlstrustedobject and allow third party apps to read/write files created by the platform apps. Specify this new type for the platform app entries in seapp_contexts. Remove levelFromUid=true for the platform apps in seapp_contexts since we are no longer enforcing per-app separation among them.
2012-07-27 17:07:09 +02:00
type platform_app_data_file, file_type, data_file_type, mlstrustedobject;
SE Android policy.
2012-01-04 18:33:27 +01:00
# Default type for anything under /cache
type cache_file, file_type, mlstrustedobject;
App data backup security policy. Policy covers: * backup_data_file type for labeling all files/dirs under /data dealing with backup mechanism. * cache_backup_file type for labeling all files/dirs under /cache dealing with backup mechanism. This also covers the the use of LocalTransport for local archive and restore testing. * the use of 'adb shell bmgr' to initiate backup mechanism from shell. * the use of 'adb backup/restore' to archive and restore the device's data. Change-Id: I700a92d8addb9bb91474bc07ca4bb71eb4fc840e Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2012-12-04 14:13:58 +01:00
# Type for /cache/.*\.{data|restore} and default
# type for anything under /cache/backup
type cache_backup_file, file_type, mlstrustedobject;
SE Android policy.
2012-01-04 18:33:27 +01:00
# Default type for anything under /efs
type efs_file, file_type;
Introduce a separate wallpaper_file type for the wallpaper file.
2012-03-19 15:29:36 +01:00
# Type for wallpaper file.
Make wallpaper_file a mlstrustedobject to permit writes from any app level.
2012-06-27 14:50:27 +02:00
type wallpaper_file, file_type, mlstrustedobject;
Add SELinux policy for asec containers. Creates 2 new types: - asec_apk_file : files found under /mnt/asec when the asec images are mounted - asec_image_file : the actual encrypted apks under /data/app-asec Change-Id: I963472add1980ac068d3a6d36a24f27233022832 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2012-10-22 19:50:01 +02:00
# /mnt/asec
type asec_apk_file, file_type, data_file_type;
# /data/app-asec
type asec_image_file, file_type, data_file_type;
App data backup security policy. Policy covers: * backup_data_file type for labeling all files/dirs under /data dealing with backup mechanism. * cache_backup_file type for labeling all files/dirs under /cache dealing with backup mechanism. This also covers the the use of LocalTransport for local archive and restore testing. * the use of 'adb shell bmgr' to initiate backup mechanism from shell. * the use of 'adb backup/restore' to archive and restore the device's data. Change-Id: I700a92d8addb9bb91474bc07ca4bb71eb4fc840e Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2012-12-04 14:13:58 +01:00
# /data/backup and /data/secure/backup
type backup_data_file, file_type, data_file_type, mlstrustedobject;
Move policy files Update the file_contexts for the new location of the policy files, as well as update the policy for the management of these types. Change-Id: Idc475901ed437efb325807897e620904f4ff03e9
2013-01-23 23:02:43 +01:00
# For /data/security
type security_file, file_type;
Policy for hci_attach service.
2012-05-31 15:40:12 +02:00
# All devices have bluetooth efs files. But they
# vary per device, so this type is used in per
Correct spelling mistake Change-Id: If4deccfe740c8de6b88929a0d0439667c3ea340d
2012-09-07 03:50:35 +02:00
# device policy
Policy for hci_attach service.
2012-05-31 15:40:12 +02:00
type bluetooth_efs_file, file_type;
Add downloaded file policy. Change-Id: I6f68323cddcf9e13b2a730b8d6b8730587fb4366
2013-04-04 02:41:22 +02:00
# Downloaded files
type download_file, file_type;
Stop breaking build by defining sysfs_devices_system_cpu. Change-Id: Ie96d573be971b2dcc3d60614794ba9ca13b31471
2013-04-26 01:32:57 +02:00
# /sys/devices/system/cpu
type sysfs_devices_system_cpu, file_type;
Policy for hci_attach service.
2012-05-31 15:40:12 +02:00
SE Android policy.
2012-01-04 18:33:27 +01:00
# Socket types
Update policy for Android 4.2 / latest master. Update policy for Android 4.2 / latest master. Primarily this consists of changes around the bluetooth subsystem. The zygote also needs further permissions to set up /storage/emulated. adbd service now gets a socket under /dev/socket. keystore uses the binder. Change-Id: I8c5aeb8d100313c75169734a0fa614aa974b3bfc Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-11-16 15:06:47 +01:00
type adbd_socket, file_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
type bluetooth_socket, file_type;
type dnsproxyd_socket, file_type, mlstrustedobject;
type gps_socket, file_type;
type installd_socket, file_type;
type keystore_socket, file_type;
Label /dev/socket/mdns with its own type. Otherwise it gets left in the general device type, and we get denials such as: type=1400 msg=audit(1379617262.940:102): avc: denied { write } for pid=579 comm="mDnsConnector" name="mdns" dev="tmpfs" ino=3213 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=sock_file This of course only shows up if using a confined system_server. Change-Id: I2456dd7aa4d72e6fd15b55c251245186eb54a80a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-09-19 21:09:38 +02:00
type mdns_socket, file_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
type netd_socket, file_type;
type property_socket, file_type;
type qemud_socket, file_type;
racoon policy. Initial policy for racoon (IKE key management). Signed-off-by: Robert Craig <rpcraig@tycho.ncsc.mil> Change-Id: If1e344f39ea914e42afbaa021b272ba1b7113479
2013-01-07 15:21:18 +01:00
type racoon_socket, file_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
type rild_socket, file_type;
type rild_debug_socket, file_type;
type system_wpa_socket, file_type;
Label and allow access to /data/system/ndebugsocket. Otherwise it defaults to the label of /data/system and cannot be distinguished from any other socket in that directory. Also adds allow rule required for pre-existing wpa_socket transition to function without unconfined_domain. Change-Id: I57179aa18786bd56d247f397347e546cca978e41 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-09-27 16:24:49 +02:00
type system_ndebug_socket, file_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
type vold_socket, file_type;
type wpa_socket, file_type;
type zygote_socket, file_type;
Corrected denials for LocationManager when accessing gps over uart.
2012-07-10 23:36:22 +02:00
# UART (for GPS) control proc file
type gps_control, file_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
# Allow files to be created in their appropriate filesystems.
allow fs_type self:filesystem associate;
allow sysfs_type sysfs:filesystem associate;
allow file_type labeledfs:filesystem associate;
allow file_type tmpfs:filesystem associate;
Allow file types to be associated with the rootfs. This is now possible due to the kernel change to support setting security contexts on rootfs inodes. Change-Id: I2a9aac1508eceabb92c3ae8eb5c63a16b28dda6f Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-05-10 17:29:35 +02:00
allow file_type rootfs:filesystem associate;
SE Android policy.
2012-01-04 18:33:27 +01:00
allow dev_type tmpfs:filesystem associate;
Reference in a new issue Copy permalink