tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/init.te

27 lines
876 B
Text
Raw Normal View History

Vendor domains must not use Binder On PRODUCT_FULL_TREBLE devices, non-vendor domains (except vendor apps) are not permitted to use Binder. This commit thus: * groups non-vendor domains using the new "coredomain" attribute, * adds neverallow rules restricting Binder use to coredomain and appdomain only, and * temporarily exempts the domains which are currently violating this rule from this restriction. These domains are grouped using the new "binder_in_vendor_violators" attribute. The attribute is needed because the types corresponding to violators are not exposed to the public policy where the neverallow rules are. Test: mmm system/sepolicy Test: Device boots, no new denials Test: In Chrome, navigate to ip6.me, play a YouTube video Test: YouTube: play a video Test: Netflix: play a movie Test: Google Camera: take a photo, take an HDR+ photo, record video with sound, record slow motion video with sound. Confirm videos play back fine and with sound. Bug: 35870313 Change-Id: I0cd1a80b60bcbde358ce0f7a47b90f4435a45c95
2017-03-23 22:27:32 +01:00
typeattribute init coredomain;
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
tmpfs_domain(init)
# Transitions to seclabel processes in init.rc
healthd: create SEPolicy for 'charger' and reduce healthd's scope healthd is being split into 'charger' and 'healthd' processes, that will never run together. 'charger' is to be run only in charge-only and recovery, while healthd runs with Android. While they both share much of battery monitoring code, they both now have reduced scope. E.g. 'charger', doesn't need to use binder anymore and healthd doesn't need to do charging ui animation. So, amend the SEPolicy for healthd to reduce it's scope and add a new one for charger. Test: Tested all modes {recovery, charger-only, android} with new policy Change-Id: If7f81875c605f7f07da4d23a313f308b9dde9ce8 Signed-off-by: Sandeep Patil <sspatil@google.com> (cherry picked from commit c73d0022ade4855ab72849e1fe97856c737fdcef)
2016-11-01 21:49:10 +01:00
domain_trans(init, rootfs, charger)
healthd: restore healthd sepolicy for charger mode Test: Boot charge-only and android on sailfish Bug: https://b/33672744 Change-Id: I6a25e90a716ec0ca46b5ba5edad860aa0eebafef Signed-off-by: Sandeep Patil <sspatil@google.com> (cherry picked from commit 3b25e384108c20741313fb356ed25e0c515e5b6b)
2016-12-15 21:36:45 +01:00
domain_trans(init, rootfs, healthd)
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
domain_trans(init, rootfs, slideshow)
allow init to run mke2fs tools to format partitions Test: let fs_mgr format a damaged /data partition Bug: 35219933 Change-Id: If92352ea7a70780e9d81ab10963d63e16b793792 (cherry picked from commit 5f573ab2aa8f566c723f4ddd576f8365dcaec191)
2017-05-02 22:45:08 +02:00
domain_auto_trans(init, e2fs_exec, e2fs)
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
recovery_only(`
Moving adbd from rootdir to system/bin Bug: 63910933 Test: boot sailfish in normal mode, checks adbd is started Test: boot sailfish in recovery mode, checks adbd is started Test: boot bullhead in normal mode, checks adbd is started Test: boot bullhead in recovery mode, checks adbd is started Change-Id: I35ed78a15a34626fbd3c21d030e2bf51033f7b79 Merged-In: I35ed78a15a34626fbd3c21d030e2bf51033f7b79 (cherry picked from commit e2423d149b6a5b9119965c097a2a75cb8d052763)
2017-07-31 12:38:28 +02:00
domain_trans(init, rootfs, adbd)
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
domain_trans(init, rootfs, recovery)
')
domain_trans(init, shell_exec, shell)
domain_trans(init, init_exec, ueventd)
add vendor_init.te First pass at adding vendor_init.te Bug: 62875318 Test: boot sailfish with vendor_init Change-Id: I35cc9be324075d8baae866d6de4166c37fddac68
2017-09-28 23:34:36 +02:00
domain_trans(init, init_exec, vendor_init)
Fix coredomain violation for modprobe modprobe domain was allowed to launch vendor toolbox even if its a coredomain. That violates the treble separation. Fix that by creating a separate 'vendor_modprobe' domain that init is allowed to transition to through vendor_toolbox. Bug: 37008075 Test: Build and boot sailfish Change-Id: Ic3331797691bb5d1fdc05a674aa4aa313e1f86b2 Signed-off-by: Sandeep Patil <sspatil@google.com> (cherry picked from commit 9e366a0e4959682713037f24af708cf22b9b53c7)
2017-06-03 01:09:26 +02:00
domain_trans(init, { rootfs toolbox_exec }, modprobe)
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
userdebug_or_eng(`
Allow init to execute services marked with seclabel u:r:su:s0 in userdebug/eng This is do aid developers pushing debug services to not need to modify the underlying SEPolicy avc: denied { transition } for comm="init" path="/system/bin/awk" dev="dm-0" ino=1934 scontext=u:r:init:s0 tcontext=u:r:su:s0 tclass=process avc: denied { rlimitinh } for comm="awk" scontext=u:r:init:s0 tcontext=u:r:su:s0 tclass=process avc: denied { siginh } for comm="awk" scontext=u:r:init:s0 tcontext=u:r:su:s0 tclass=process avc: denied { noatsecure } for comm="awk" scontext=u:r:init:s0 tcontext=u:r:su:s0 tclass=process Test: init can execute a system_file marked with seclabel u:r:su:s0 Change-Id: I85d9528341fe08dbb2fb9a91e34a41f41aa093be
2018-08-03 19:49:20 +02:00
# case where logpersistd is actually logcat -f in logd context (nee: logcatd)
logcat: introduce split to logd and logpersist domains - transition to logpersist from init - sort some overlapping negative references - intention is to allow logpersist to be used by vendor userdebug logging Test: gTest liblog-unit-tests, logd-unit-tests & logcat-unit-tests Bug: 30566487 Change-Id: I7806f5a2548cbe0c1f257a0ba2855f2eb69d8e7c
2016-08-10 20:10:02 +02:00
domain_auto_trans(init, logcat_exec, logpersist)
Allow init to execute services marked with seclabel u:r:su:s0 in userdebug/eng This is do aid developers pushing debug services to not need to modify the underlying SEPolicy avc: denied { transition } for comm="init" path="/system/bin/awk" dev="dm-0" ino=1934 scontext=u:r:init:s0 tcontext=u:r:su:s0 tclass=process avc: denied { rlimitinh } for comm="awk" scontext=u:r:init:s0 tcontext=u:r:su:s0 tclass=process avc: denied { siginh } for comm="awk" scontext=u:r:init:s0 tcontext=u:r:su:s0 tclass=process avc: denied { noatsecure } for comm="awk" scontext=u:r:init:s0 tcontext=u:r:su:s0 tclass=process Test: init can execute a system_file marked with seclabel u:r:su:s0 Change-Id: I85d9528341fe08dbb2fb9a91e34a41f41aa093be
2018-08-03 19:49:20 +02:00
# allow init to execute services marked with seclabel u:r:su:s0 in userdebug/eng
allow init su:process transition;
dontaudit init su:process noatsecure;
allow init su:process { siginh rlimitinh };
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
')
Reference in a new issue Copy permalink