tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/genfs_contexts

343 lines
24 KiB
Text
Raw Normal View History

Support for ocontexts per device. ocontexts was split up into 4 files: 1.fs_use 2.genfs_contexts 3.initial_sid_contexts 4.port_contexts Each file has their respective declerations in them. Devices, in their respective device directory, can now specify sepolicy.fs_use, sepolicy.genfs_contexts, sepolicy.port_contexts, and sepolicy.initial_sid_contexts. These declerations will be added right behind their respective sepolicy counterparts in the concatenated configuration file.
2012-07-12 01:46:38 +02:00
# Label inodes with the fs label.
genfscon rootfs / u:object_r:rootfs:s0
# proc labeling can be further refined (longest matching prefix).
genfscon proc / u:object_r:proc:s0
Relabeling /proc/asound so everything has proc_asound label This is to simplify access for hal_audio Test: ls -Z in /proc/asound correctly shows everything with proc_asound selinux label Change-Id: I66ed8babf2363bee27a748147eb358d57a4594c4
2017-10-20 00:51:38 +02:00
genfscon proc /asound u:object_r:proc_asound:s0
Add sepolicy for /proc/bootconfig Vendor boot hal, init, and vold processes all require permission. Test: build and boot aosp_cf_x86_64_phone Bug: 173815685 Change-Id: I15692dcd39dfc9c3a3b7d8c12d03eff0a7c96f72
2021-02-17 18:30:52 +01:00
genfscon proc /bootconfig u:object_r:proc_bootconfig:s0
dumpstate: remove access to 'proc' and 'sysfs' types. And grant appropriate permissions to more granular types. Bug: 29319732 Bug: 65643247 Test: adb bugreport; no new denials to /proc or /sys files. Change-Id: Ied99546164e79bfa6148822858c165177d3720a5
2018-01-18 00:59:48 +01:00
genfscon proc /buddyinfo u:object_r:proc_buddyinfo:s0
Allow shell read access to cgroup state at /proc/cgroups. Test: adb shell cat /proc/cgroups Bug: 335278695 Change-Id: I52773c63200a2a048a4c5497c338ddcbe0f23593
2024-04-26 20:28:28 +02:00
genfscon proc /cgroups u:object_r:proc_cgroups:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
genfscon proc /cmdline u:object_r:proc_cmdline:s0
Label /proc/config.gz Add a label to /proc/config.gz, so we can distinguish this file from other /proc files in security policy. For now, only init is allowed read access. All others are denied. TODO: clarify exactly who needs access. Further access will be granted in a future commit. Bug: 35126415 Test: policy compiles and no device boot problems. Change-Id: I8b480890495ce5b8aa3f8c7eb00e14159f177860
2017-02-16 21:04:40 +01:00
genfscon proc /config.gz u:object_r:config_gz:s0
Allow init to write to /proc/cpu/alignment The root init.rc does "write /proc/cpu/alignment 4", but we don't actually allow this write in core sepolicy. This seems to be a 32-bit ARM only proc file. Noticed when booting 32-bit ARM Cuttlefish. Bug: 145371497 Change-Id: Ic099395708f7236bcc2fc5c561809a7e129786de
2021-10-29 05:31:44 +02:00
genfscon proc /cpu/alignment u:object_r:proc_cpu_alignment:s0
Use /proc/device-tree for reading AVF DT Although /proc/device-tree is symlink to /sys/firmware/devicetree/base, /proc/device-tree is the stable API but the absolute path may be changed in the future. Bug: 322465386 Test: atest CustomPvmfwHostTestCases Change-Id: I81cbe8a4dddbac97e4fb94e6684d2a91127f3378
2024-01-31 06:56:43 +01:00
genfscon proc /device-tree/avf u:object_r:proc_dt_avf:s0
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
genfscon proc /diskstats u:object_r:proc_diskstats:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
genfscon proc /filesystems u:object_r:proc_filesystems:s0
restrict access to timing information in /proc These APIs expose sensitive information via timing side channels. This leaves access via the adb shell intact along with the current uses by dumpstate, init and system_server. The /proc/interrupts and /proc/stat files were covered in this paper: https://www.lightbluetouchpaper.org/2016/07/29/yet-another-android-side-channel/ The /proc/softirqs, /proc/timer_list and /proc/timer_stats files are also relevant. Access to /proc has been greatly restricted since then, with untrusted apps no longer having direct access to these, but stricter restrictions beyond that would be quite useful. Change-Id: Ibed16674856569d26517e5729f0f194b830cfedd
2016-07-29 20:48:19 +02:00
genfscon proc /interrupts u:object_r:proc_interrupts:s0
Give /proc/iomem a more specific label. /proc/iomem is currently given the proc label but contains system information which should not be available to all processes. Bug: 22008387 Change-Id: I4f1821f40113a743ad986d13d8d130ed8b8abf2f
2015-07-13 17:39:17 +02:00
genfscon proc /iomem u:object_r:proc_iomem:s0
Allow tracing service to access kallsyms on userdebug This CL allows the traced_probes service to temporarily lower kptr_restrict and read /proc/kallsyms. This is allowed only on userdebug/eng builds. The lowering of kptr_restrict is done via an init property because the kernel checks that the kptr_restrict writer is CAP_SYS_ADMIN, regardless of the /proc file ACLs [1]. [1] https://github.com/torvalds/linux/blob/4cbffc461ec91287c4cb1d0e27b01b988d0b8fba/kernel/sysctl.c#L2254 Bug: 136133013 Design doc: go/perfetto-kallsyms Test: perfetto_integrationtests --gtest_filter=PerfettoTest.KernelAddressSymbolization in r.android.com/1454882 Change-Id: Ic06e7a9a74c0f3e42fa63f7f41decc385c9fea2c
2020-10-09 10:15:10 +02:00
genfscon proc /kallsyms u:object_r:proc_kallsyms:s0
add selinux rules for mini-keyctl mini-keyctl is a binary used to load channel keys to .fsverity keyring. This CL creates a new domain for mini-keyctl and a type for /proc/keys and adds allow rules needed by this binary. Bug: 112038861 Test: manual Merged-In: I3b744d302859a02dfe63c81c7f33bb30912d7994 Change-Id: I3b744d302859a02dfe63c81c7f33bb30912d7994
2019-01-30 00:27:21 +01:00
genfscon proc /keys u:object_r:proc_keys:s0
Explicitly label logd's dependencies in /proc. labeled /proc/kmsg as proc_kmsg, changed logd's access from proc to proc_kmsg, and added a compat mapping. Bug: 65643247 Test: device boots without selinux denials to the newly introduced proc_kmsg Test: logd-unit-tests passes Merged-In: I92c9f5694289eb6a94c4d90f14e2de4d46b5228e Change-Id: I92c9f5694289eb6a94c4d90f14e2de4d46b5228e (partial CP of commit 528da6fe3a0dbe4ae15355dff0152ab5f55197da)
2017-09-13 23:34:56 +02:00
genfscon proc /kmsg u:object_r:proc_kmsg:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
genfscon proc /loadavg u:object_r:proc_loadavg:s0
sepolicy: allow system_server to read /proc/locks Access to /proc/locks is necessary to activity manager to determine wheter a process holds a lock or not prior freezing it. Test: verified access of /proc/locks while testing other CLs in the same topic. Bug: 176928302 Change-Id: I14a65da126ff26c6528edae137d3ee85d3611509
2021-01-07 00:14:24 +01:00
genfscon proc /locks u:object_r:proc_locks:s0
lmkd: grant access to /proc/lowmemorykiller lmkd needs to read /proc/lowmemorykiller to send statslog events in response to applications being killed. Bug: 130017100 Change-Id: I929d5a372e1b2f63b7b5ed421f1898ebddaec01c
2019-04-26 18:27:58 +02:00
genfscon proc /lowmemorykiller u:object_r:proc_lowmemorykiller:s0
Label /proc/meminfo. Address the following denial: m.chrome.canary: type=1400 audit(0.0:15): avc: granted { read open } for path="/proc/meminfo" dev="proc" ino=4026544360 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:proc:s0 tclass=file (cherry-pick of internal commit: 971aeeda2138b27e3f8850f2fd7c95f60508154c) Bug: 22032619 Chromium Bug: 586021 Change-Id: I2dcb2d4800bbc92ea47c37d4fd7a10f827a0114c
2016-02-24 02:09:48 +01:00
genfscon proc /meminfo u:object_r:proc_meminfo:s0
Label /proc/misc Label /proc/misc and allow access to untrusted_apps targeting older API versions, as well as update_engine_common. /proc/misc is used by some banking apps to try to detect if they are running in an emulated environment. TODO: Remove access to proc:file from update_engine_common after more testing. Bug: 35917228 Test: Device boots and no new denials. Change-Id: If1b97a9c55a74cb74d1bb15137201ffb95b5bd75
2017-03-03 21:17:49 +01:00
genfscon proc /misc u:object_r:proc_misc:s0
enabled /sbin/modprobe for recovery mode This change defines new policy for modprobe (/sbin/modprobe) that should be used in both recovery and android mode. Denials: [ 16.986440] c0 437 audit: type=1400 audit(6138546.943:5): avc: denied { read } for pid=437 comm="modprobe" name="modules" dev="proc" ino=4026532405 scontext=u:object_r:modprobe:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 [ 16.986521] c0 437 audit: type=1400 audit(6138546.943:6): avc: denied { open } for pid=437 comm="modprobe" path="/proc/modules" dev="proc" ino=4026532405 scontext=u:object_r:modprobe:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 [ 16.986544] c0 437 audit: type=1400 audit(6138546.943:7): avc: denied { getattr } for pid=437 comm="modprobe" path="/proc/modules" dev="proc" ino=4026532405 scontext=u:object_r:modprobe:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 Bug: 35633646 Test: Build and tested it works in sailfish recovery. The modprobe is invoked in init.rc (at the end of 'on init') with following command line exec u:r:modprobe:s0 -- /sbin/modprobe -a nilfs2 ftl Change-Id: Ie70be6f918bea6059f806e2eb38cd48229facafa
2017-03-02 09:02:29 +01:00
genfscon proc /modules u:object_r:proc_modules:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
genfscon proc /mounts u:object_r:proc_mounts:s0
Make /proc/net a proc_net type. Change-Id: Iaee5e09712e7f27e0adf645f18554bf2ebd4e448 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-01-07 20:41:47 +01:00
genfscon proc /net u:object_r:proc_net:s0
Remove access to /proc/net/{tcp,udp} Remove these files from proc_net_type. Domains that need access must have permission explicitly granted. Neverallow app access except the shell domain. Bug: 114475727 Test: atest CtsLibcoreOjTestCases Test: netstat, lsof Test: adb bugreport Change-Id: I2304e3e98c0d637af78a361569466aa2fbe79fa0
2018-09-28 19:55:14 +02:00
genfscon proc /net/tcp u:object_r:proc_net_tcp_udp:s0
genfscon proc /net/udp u:object_r:proc_net_tcp_udp:s0
Rename qtaguid_proc to conform to name conventions Test: build Bug: 68774956 Change-Id: I0f9fd87eb41e67e14f35e49eba13e3d1de745250
2018-04-03 18:53:23 +02:00
genfscon proc /net/xt_qtaguid/ctrl u:object_r:proc_qtaguid_ctrl:s0
relabel files in /proc/net/xt_qtaguid/ /proc/net/xt_qtaguid is used by apps to track their network data use. Limit access to just zygote spawned processes - apps and system_server, omitting access to isolated_app which is not allowed to create network sockets. As Android moves to eBPF for app's network data stats, access to /proc/net/xt_qtaguid will be removed entirely. Segmenting access off is the first step. Bug: 68774956 This change also helps further segment and whitelist access to files in /proc/net and is a step in the lockdown of /proc/net. Bug: 9496886 Test: boot Taimen. Walk through setup-wizard. Make phone call and video call. Browse web. Watch youtube. Navigate in maps. Test: cts-tradefed run cts -m CtsAppSecurityHostTestCases -t \ android.appsecurity.cts.AppSecurityTests Test: cts-tradefed run cts -m CtsNativeNetTestCases Test: cts-tradefed run cts -m CtsIncidentHostTestCases -t \ com.android.server.cts.NetstatsIncidentTest Test: cts-tradefed run cts -m CtsOsTestCases -t \ android.os.cts.StrictModeTest Test: cts-tradefed run cts -m CtsNetTestCases -t \ android.net.cts.TrafficStatsTest Test: cts-tradefed run cts -m CtsUsageStatsTestCases -t \ android.app.usage.cts.NetworkUsageStatsTest Test: vts-tradefed run vts -m VtsQtaguidTest Change-Id: Idddd318c56b84564142d37b11dcc225a2f2800ea
2018-01-02 22:10:46 +01:00
genfscon proc /net/xt_qtaguid/ u:object_r:proc_qtaguid_stat:s0
zygote: allow replacing /proc/cpuinfo Android's native bridge functionality allows an Android native app written on one CPU architecture to run on a different architecture. For example, Android ARM apps may run on an x86 CPU. To support this, the native bridge functionality needs to replace /proc/cpuinfo with the version from /system/lib/<ISA>/cpuinfo using a bind mount. See commit ab0da5a9a6860046619629b8e6b83692d35dff86 in system/core. This change: 1) Creates a new label proc_cpuinfo, and assigns /proc/cpuinfo that label. 2) Grants read-only access to all SELinux domains, to avoid breaking pre-existing apps. 3) Grants zygote mounton capabilities for that file, so zygote can replace the file as necessary. Addresses the following denial: avc: denied { mounton } for path="/proc/cpuinfo" dev="proc" ino=4026532012 scontext=u:r:zygote:s0 tcontext=u:object_r:proc:s0 tclass=file Bug: 17671501 Change-Id: Ib70624fba2baeccafbc0a41369833f76b976ee20
2014-09-26 19:51:12 +02:00
genfscon proc /cpuinfo u:object_r:proc_cpuinfo:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
genfscon proc /pagetypeinfo u:object_r:proc_pagetypeinfo:s0
sepolicy: Allow lmkd access to psi procfs nodes Lmkd needs read access to /proc/pressure/memory, proc/pressure/cpu and proc/pressure/io nodes to read current psi levels. Lmkd needs write access to /proc/pressure/memory to set psi monitor triggers. Bug: 111308141 Test: modified lmkd to use PSI and tested using lmkd_unit_test Signed-off-by: Suren Baghdasaryan <surenb@google.com> Merged-In: I9efd60c7fbb89cc08938fa5119b13d794813b52b Change-Id: I9efd60c7fbb89cc08938fa5119b13d794813b52b
2018-05-11 00:36:59 +02:00
genfscon proc /pressure/cpu u:object_r:proc_pressure_cpu:s0
genfscon proc /pressure/io u:object_r:proc_pressure_io:s0
genfscon proc /pressure/memory u:object_r:proc_pressure_mem:s0
access to /proc/slabinfo init, dumpstate and shell Test: check avc for init is now gone Bug: 7232205 Bug: 109821005 Change-Id: I299a0ba29bcc97a97047f12a5c48f6056f5e6de5
2018-06-14 16:34:19 +02:00
genfscon proc /slabinfo u:object_r:proc_slabinfo:s0
restrict access to timing information in /proc These APIs expose sensitive information via timing side channels. This leaves access via the adb shell intact along with the current uses by dumpstate, init and system_server. The /proc/interrupts and /proc/stat files were covered in this paper: https://www.lightbluetouchpaper.org/2016/07/29/yet-another-android-side-channel/ The /proc/softirqs, /proc/timer_list and /proc/timer_stats files are also relevant. Access to /proc has been greatly restricted since then, with untrusted apps no longer having direct access to these, but stricter restrictions beyond that would be quite useful. Change-Id: Ibed16674856569d26517e5729f0f194b830cfedd
2016-07-29 20:48:19 +02:00
genfscon proc /softirqs u:object_r:proc_timer:s0
genfscon proc /stat u:object_r:proc_stat:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
genfscon proc /swaps u:object_r:proc_swaps:s0
Address system_server denials. Label /proc/sysrq-trigger and allow access. Label /dev/socket/mtpd and allow access. Resolves denials such as: avc: denied { getattr } for pid=12114 comm="Binder_2" path="socket:[219779]" dev="sockfs" ino=219779 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket avc: denied { call } for pid=1007 comm="Binder_8" scontext=u:r:system_server:s0 tcontext=u:r:su:s0 tclass=binder avc: denied { write } for pid=1024 comm="watchdog" name="sysrq-trigger" dev="proc" ino=4026533682 scontext=u:r:system_server:s0 tcontext=u:object_r:proc:s0 tclass=file avc: denied { write } for pid=11567 comm="LegacyVpnRunner" name="mtpd" dev="tmpfs" ino=36627 scontext=u:r:system_server:s0 tcontext=u:object_r:socket_device:s0 tclass=sock_file avc: denied { ptrace } for pid=10924 comm=5369676E616C2043617463686572 scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=process avc: denied { sigkill } for pid=26077 comm="NativeCrashRepo" scontext=u:r:system_server:s0 tcontext=u:r:zygote:s0 tclass=process avc: denied { write } for pid=1024 comm="android.bg" scontext=u:r:system_server:s0 tcontext=u:r:system_server:s0 tclass=netlink_socket avc: denied { getattr } for pid=473 comm="FinalizerDaemon" path="socket:[11467]" dev="sockfs" ino=11467 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=tcp_socket avc: denied { getattr } for pid=473 comm="FinalizerDaemon" path="socket:[12076]" dev="sockfs" ino=12076 scontext=u:r:system_server:s0 tcontext=u:r:mediaserv er:s0 tclass=udp_socket avc: denied { getopt } for pid=473 comm="FinalizerDaemon" laddr=192.168.159.172 lport=51576 faddr=93.127.173.40 fport=554 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=tcp_socket avc: denied { getopt } for pid=473 comm="FinalizerDaemon" lport=15658 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=udp_socket avc: denied { read write } for pid=21384 comm="rtsp" path="socket:[443742]" dev="sockfs" ino=443742 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s 0 tclass=tcp_socket avc: denied { read write } for pid=21384 comm="rtsp" path="socket:[444842]" dev="sockfs" ino=444842 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=udp_socket avc: denied { setopt } for pid=1326 comm="Binder_9" lport=16216 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=udp_socket avc: denied { setopt } for pid=1676 comm="Binder_6" laddr=192.168.156.130 lport=51044 faddr=74.125.214.81 fport=554 scontext=u:r:system_server:s0 tcontext=u:r:mediaserver:s0 tclass=tcp_socket avc: denied { getattr } for pid=10915 comm="system_server" path="/dev/mdm" dev="tmpfs" ino=7484 scontext=u:r:system_server:s0 tcontext=u:object_r:radio_device:s0 tclass=chr_file avc: denied { read } for pid=10915 comm="system_server" name="mdm" dev="tmpfs" ino=7484 scontext=u:r:system_server:s0 tcontext=u:object_r:radio_device:s0 tclass=chr_file avc: denied { unlink } for pid=14866 comm="system_server" name="wallpaper" dev="mmcblk0p9" ino=285715 scontext=u:r:system_server:s0 tcontext=u:object_r:wallpaper_file:s0 tclass=file avc: denied { getattr } for pid=12114 comm="Binder_2" path="socket:[219779]" dev="sockfs" ino=219779 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket avc: denied { getopt } for pid=32300 comm="Binder_1" laddr=::ffff:127.0.0.1 lport=4939 faddr=::ffff:127.0.0.1 fport=53318 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket avc: denied { read write } for pid=10840 comm="pool-17-thread-" path="socket:[205990]" dev="sockfs" ino=205990 scontext=u:r:untrusted_app:s0 tcontext=u:r:system_server:s0 tclass=tcp_socket avc: denied { write } for pid=20817 comm="dumpsys" path="/mnt/shell/emulated/0/aupt-output/bugreport-2014-02-22-11-17-16.txt.tmp" dev="fuse" ino=3100784040 scontext=u:r:system_server:s0 tcontext=u:object_r:sdcard_internal:s0 tclass=file Change-Id: I481ac26667b487031a5d3317b0a028a027a8e641 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-03-05 15:50:08 +01:00
genfscon proc /sysrq-trigger u:object_r:proc_sysrq:s0
Relabel /proc/kpageflags and grant access to heapprofd. Bug: 132952543 Change-Id: I3d956ba7279af37d783515c0bf649e6fb94c3082
2019-05-16 20:47:04 +02:00
genfscon proc /kpageflags u:object_r:proc_kpageflags:s0
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
genfscon proc /sys/abi/swp u:object_r:proc_abi:s0
system_server: access to /proc/sys/fs/pipe-max-size Label /proc/sys/fs/pipe-max-size with new type proc_pipe_conf and give system_server access to it. Addresses this denial: avc: denied { read } for name="pipe-max-size" dev="proc" ino=93817 scontext=u:r:system_server:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=0 Bug: 69175449 Bug: 69324398 Test: sailfish boots Test: adb bugreport Test: craft an unresponsive app, trigger ANR, make sure traces are dumped into /data/anr Above denial from system_server not observed, no denials to proc_pipe_conf observed. Change-Id: I7c71f05820a4945ba982e29f76e9d9f4458b2b59
2017-11-15 01:32:36 +01:00
genfscon proc /sys/fs/pipe-max-size u:object_r:proc_pipe_conf:s0
Restrict the ability to set usermodehelpers and proc security settings. Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06 15:31:40 +01:00
genfscon proc /sys/fs/protected_hardlinks u:object_r:proc_security:s0
genfscon proc /sys/fs/protected_symlinks u:object_r:proc_security:s0
genfscon proc /sys/fs/suid_dumpable u:object_r:proc_security:s0
introduce new 'proc_bpf' for bpf related sysctls What to tag chosen based on output of: find /proc 2>/dev/null | egrep bpf on a 5.10 kernel. Tagged with prefixes to be more likely not require changes in the future $ adb root $ adb shell 'ls -lZ /proc/sys/net/core/bpf_* /proc/sys/kernel/*bpf*' Before: -rw-r--r-- 1 root root u:object_r:proc:s0 0 2021-11-11 02:11 /proc/sys/kernel/bpf_stats_enabled -rw-r--r-- 1 root root u:object_r:proc:s0 0 2021-11-11 02:11 /proc/sys/kernel/unprivileged_bpf_disabled -rw-r--r-- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_enable -rw------- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_harden -rw------- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_kallsyms -rw------- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_limit After: -rw-r--r-- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/kernel/bpf_stats_enabled -rw-r--r-- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/kernel/unprivileged_bpf_disabled -rw-r--r-- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_enable -rw------- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_harden -rw------- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_kallsyms -rw------- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_limit Test: TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I46ea81ff42d3b915cf7a96735dc2636d9808ead6
2021-11-11 10:51:15 +01:00
genfscon proc /sys/kernel/bpf_ u:object_r:proc_bpf:s0
Restrict the ability to set usermodehelpers and proc security settings. Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06 15:31:40 +01:00
genfscon proc /sys/kernel/core_pattern u:object_r:usermodehelper:s0
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
genfscon proc /sys/kernel/core_pipe_limit u:object_r:usermodehelper:s0
genfscon proc /sys/kernel/domainname u:object_r:proc_hostname:s0
Restrict the ability to set usermodehelpers and proc security settings. Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06 15:31:40 +01:00
genfscon proc /sys/kernel/dmesg_restrict u:object_r:proc_security:s0
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
genfscon proc /sys/kernel/hostname u:object_r:proc_hostname:s0
Restrict the ability to set usermodehelpers and proc security settings. Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06 15:31:40 +01:00
genfscon proc /sys/kernel/hotplug u:object_r:usermodehelper:s0
llkd: add live-lock daemon Introduce a standalone live-lock daemon (llkd), to catch kernel or native user space deadlocks and take mitigating actions. Test: llkd_unit_test Bug: 33808187 Bug: 72838192 Change-Id: If869ecd06e5ce7b04bba1dafd0a77971b71aa517
2018-02-20 20:02:39 +01:00
genfscon proc /sys/kernel/hung_task_ u:object_r:proc_hung_task:s0
Restrict the ability to set usermodehelpers and proc security settings. Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06 15:31:40 +01:00
genfscon proc /sys/kernel/kptr_restrict u:object_r:proc_security:s0
genfscon proc /sys/kernel/modprobe u:object_r:usermodehelper:s0
genfscon proc /sys/kernel/modules_disabled u:object_r:proc_security:s0
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
genfscon proc /sys/kernel/panic_on_oops u:object_r:proc_panic:s0
Make /proc/sys/kernel/perf_event_max_sample_rate accessible to untrusted_app. perf_event_max_sample_rate is needed to be read for native profiling, otherwise CTS test can fail on devices with kernel >= 4.4. Before this CL, the file is not readable from untrusted_app domain. This CL makes it readable from both shell domain and untrusted_app domain. Bug: http://b/35554543 Test: build and test on marlin. Change-Id: Id118e06e3c800b70a749ab112e07a4ec24bb5975
2017-03-07 02:27:54 +01:00
genfscon proc /sys/kernel/perf_event_max_sample_rate u:object_r:proc_perf:s0
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
genfscon proc /sys/kernel/perf_event_paranoid u:object_r:proc_perf:s0
Export more files in proc_perf. Export /proc/sys/kernel/perf_cpu_time_max_percent and /proc/sys/kernel/perf_event_mlock_kb in proc_perf. So they can be read in shell and written by init. This is needed by simpleperf to control cpu percent and memory used for profiling. Bug: 110706031 Test: build and boot hikey960 successfully. Change-Id: I2a01f583508003ab73427bab30a7982a27dfa677
2018-06-29 23:53:34 +02:00
genfscon proc /sys/kernel/perf_cpu_time_max_percent u:object_r:proc_perf:s0
genfscon proc /sys/kernel/perf_event_mlock_kb u:object_r:proc_perf:s0
Label /proc/sys/kernel/pid_max as proc_pid_max. And give shell domain read access to /proc/sys/kernel/pic_max. Bug: 69569397 Test: adb shell /data/nativetest/bionic-unit-tests/bionic-unit-tests --gtest_filter=pthread.pthread_mutex_owner_tid_limit Change-Id: Ib56c18ed553ad2c2113e6913788a4c00965483cc
2017-11-28 17:42:40 +01:00
genfscon proc /sys/kernel/pid_max u:object_r:proc_pid_max:s0
Restrict the ability to set usermodehelpers and proc security settings. Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06 15:31:40 +01:00
genfscon proc /sys/kernel/poweroff_cmd u:object_r:usermodehelper:s0
/proc, /sys access from uncrypt, update_engine, postinstall_dexopt New types: 1. proc_random 2. sysfs_dt_firmware_android Labeled: 1. /proc/sys/kernel/random as proc_random. 2. /sys/firmware/devicetree/base/firmware/android/{compatible, fstab, vbmeta} as sysfs_dt_firmware_android. Changed access: 1. uncrypt, update_engine, postinstall_dexopt have access to generic proc and sysfs labels removed. 2. appropriate permissions were added to uncrypt, update_engine, update_engine_common, postinstall_dexopt. Bug: 67416435 Bug: 67416336 Test: fake ota go/manual-ab-ota runs without denials Test: adb sideload runs without denials to new types Change-Id: Id31310ceb151a18652fcbb58037a0b90c1f6505a
2017-10-04 19:34:11 +02:00
genfscon proc /sys/kernel/random u:object_r:proc_random:s0
Restrict the ability to set usermodehelpers and proc security settings. Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06 15:31:40 +01:00
genfscon proc /sys/kernel/randomize_va_space u:object_r:proc_security:s0
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
genfscon proc /sys/kernel/sched_child_runs_first u:object_r:proc_sched:s0
genfscon proc /sys/kernel/sched_latency_ns u:object_r:proc_sched:s0
genfscon proc /sys/kernel/sched_rt_period_us u:object_r:proc_sched:s0
genfscon proc /sys/kernel/sched_rt_runtime_us u:object_r:proc_sched:s0
Label /proc/sys/kernel/sched_schedstats. This allows init to write to it, which it does for atrace. Bug: 72643420 Test: Boot two devices, observe no denials, test atrace. Change-Id: I6810e5dcdfaff176bd944317e66d4fe612ccebed (cherry picked from commit dce07413bc7380c45c85b26c71afe14849a96fae)
2018-03-29 21:15:48 +02:00
genfscon proc /sys/kernel/sched_schedstats u:object_r:proc_sched:s0
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
genfscon proc /sys/kernel/sched_tunable_scaling u:object_r:proc_sched:s0
sepolicy: Add uclamp file nodes to proc_sched The uclamp file nodes will be standard, so add to proc_sched. Bug: 176528637 Test: build pass Change-Id: I3c8e540f3d4bae260322aa6954e09930ffb307b3
2020-12-31 09:12:04 +01:00
genfscon proc /sys/kernel/sched_util_clamp_max u:object_r:proc_sched:s0
genfscon proc /sys/kernel/sched_util_clamp_min u:object_r:proc_sched:s0
genfscon proc /sys/kernel/sched_util_clamp_min_rt_default u:object_r:proc_sched:s0
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
genfscon proc /sys/kernel/sched_wakeup_granularity_ns u:object_r:proc_sched:s0
genfscon proc /sys/kernel/sysrq u:object_r:proc_sysrq:s0
introduce new 'proc_bpf' for bpf related sysctls What to tag chosen based on output of: find /proc 2>/dev/null | egrep bpf on a 5.10 kernel. Tagged with prefixes to be more likely not require changes in the future $ adb root $ adb shell 'ls -lZ /proc/sys/net/core/bpf_* /proc/sys/kernel/*bpf*' Before: -rw-r--r-- 1 root root u:object_r:proc:s0 0 2021-11-11 02:11 /proc/sys/kernel/bpf_stats_enabled -rw-r--r-- 1 root root u:object_r:proc:s0 0 2021-11-11 02:11 /proc/sys/kernel/unprivileged_bpf_disabled -rw-r--r-- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_enable -rw------- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_harden -rw------- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_kallsyms -rw------- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_limit After: -rw-r--r-- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/kernel/bpf_stats_enabled -rw-r--r-- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/kernel/unprivileged_bpf_disabled -rw-r--r-- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_enable -rw------- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_harden -rw------- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_kallsyms -rw------- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_limit Test: TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I46ea81ff42d3b915cf7a96735dc2636d9808ead6
2021-11-11 10:51:15 +01:00
genfscon proc /sys/kernel/unprivileged_bpf_ u:object_r:proc_bpf:s0
Restrict the ability to set usermodehelpers and proc security settings. Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06 15:31:40 +01:00
genfscon proc /sys/kernel/usermodehelper u:object_r:usermodehelper:s0
Create proc_net type for /proc/sys/net entries. /proc/sys/net could use its own type to help distinguish among some of the proc access rules. Fix dhcp and netd because of this. Change-Id: I6e16cba660f07bc25f437bf43e1eba851a88d538 Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-01-07 19:46:56 +01:00
genfscon proc /sys/net u:object_r:proc_net:s0
introduce new 'proc_bpf' for bpf related sysctls What to tag chosen based on output of: find /proc 2>/dev/null | egrep bpf on a 5.10 kernel. Tagged with prefixes to be more likely not require changes in the future $ adb root $ adb shell 'ls -lZ /proc/sys/net/core/bpf_* /proc/sys/kernel/*bpf*' Before: -rw-r--r-- 1 root root u:object_r:proc:s0 0 2021-11-11 02:11 /proc/sys/kernel/bpf_stats_enabled -rw-r--r-- 1 root root u:object_r:proc:s0 0 2021-11-11 02:11 /proc/sys/kernel/unprivileged_bpf_disabled -rw-r--r-- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_enable -rw------- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_harden -rw------- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_kallsyms -rw------- 1 root root u:object_r:proc_net:s0 0 2021-11-11 02:11 /proc/sys/net/core/bpf_jit_limit After: -rw-r--r-- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/kernel/bpf_stats_enabled -rw-r--r-- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/kernel/unprivileged_bpf_disabled -rw-r--r-- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_enable -rw------- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_harden -rw------- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_kallsyms -rw------- 1 root root u:object_r:proc_bpf:s0 0 2021-11-11 02:08 /proc/sys/net/core/bpf_jit_limit Test: TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I46ea81ff42d3b915cf7a96735dc2636d9808ead6
2021-11-11 10:51:15 +01:00
genfscon proc /sys/net/core/bpf_ u:object_r:proc_bpf:s0
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
genfscon proc /sys/vm/dirty_background_ratio u:object_r:proc_dirty:s0
genfscon proc /sys/vm/dirty_expire_centisecs u:object_r:proc_dirty:s0
genfscon proc /sys/vm/extra_free_kbytes u:object_r:proc_extra_free_kbytes:s0
genfscon proc /sys/vm/max_map_count u:object_r:proc_max_map_count:s0
Restrict mapping low memory. Label /proc/sys/vm/mmap_min_addr with proc_security to prevent writing it by any domain other than init. Also remove memprotect mmap_zero permission from unconfineddomain so that it cannot pass the SELinux check over mapping low memory. Change-Id: Idc189feeb325a4aea26c93396fd0fa7225e79586 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-09 19:24:25 +01:00
genfscon proc /sys/vm/mmap_min_addr u:object_r:proc_security:s0
Restrict /proc/sys/vm/mmap_rnd_bits Label /proc/sys/vm/mmap_rnd_bits so it is only readable and writable by init. This also tightens the neverallow restrictions for proc_security. Bug: 33563834 Test: run cts -m CtsPermissionTestCases -t \ android.permission.cts.FileSystemPermissionTest#testProcfsMmapRndBitsExistsAndSane Change-Id: Ie7af39ddbf23806d4ffa35e7b19d30fec7b6d410
2017-02-23 23:40:56 +01:00
genfscon proc /sys/vm/mmap_rnd_bits u:object_r:proc_security:s0
genfscon proc /sys/vm/mmap_rnd_compat_bits u:object_r:proc_security:s0
Add label for /proc/sys/vm/page-cluster Test: boot sailfish with no audit when writing to page-cluster Change-Id: I2bfebdf9342594d66d95daaec92d71195c93ffc8
2017-10-24 22:17:46 +02:00
genfscon proc /sys/vm/page-cluster u:object_r:proc_page_cluster:s0
drop_caches label, vold scratch space on expanded. Define an explicit label for /proc/sys/vm/drop_caches and grant to the various people who need it, including vold which uses it when performing storage benchmarks. Also let vold create new directories under it's private storage area where the benchmarks will be carried out. Mirror the definition of the private storage area on expanded media. avc: denied { write } for name="drop_caches" dev="proc" ino=20524 scontext=u:r:vold:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=0 Bug: 21172095 Change-Id: I300b1cdbd235ff60e64064d3ba6e5ea783baf23f
2015-05-15 05:55:31 +02:00
genfscon proc /sys/vm/drop_caches u:object_r:proc_drop_caches:s0
domain: allow reading /proc/sys/vm/overcommit_memory Needed for jemalloc commit: 2f970c32b527660a33fa513a76d913c812dcf7c Modify pages_map() to support mapping uncommitted virtual memory. avc: denied { read } for name="overcommit_memory" dev="proc" ino=10544 scontext=u:r:wificond:s0 tcontext=u:object_r:proc:s0 tclass=file Bug: 29773242 Change-Id: I78054c1ed576a7998c4ee1d1beca2f610c589c3a
2016-06-28 00:38:25 +02:00
genfscon proc /sys/vm/overcommit_memory u:object_r:proc_overcommit_memory:s0
Fix init error trying to access file. Init tries to write /proc/sys/vm/min_free_order_shift but fails due to a SELinux denial. This gives the file a new label and gives init the ability to write it. Test: Build and booted Sailfish (a couple of days ago). Change-Id: Ic93862b85c468afccff2019d84b927af9ed2a84d
2018-01-24 02:32:16 +01:00
genfscon proc /sys/vm/min_free_order_shift u:object_r:proc_min_free_order_shift:s0
allow init to access watermark_boost_factor Bug: 189938926 Test: boot Signed-off-by: Martin Liu <liumartin@google.com> Change-Id: I07c8490c94c837952921e95f12efa6213edbf056
2021-07-01 06:10:26 +02:00
genfscon proc /sys/vm/watermark_boost_factor u:object_r:proc_watermark_boost_factor:s0
Allow init to execute extra_free_kbytes.sh script extra_free_kbytes.sh is used by init to set /sys/vm/watermark_scale_factor value. Allow init to execute extra_free_kbytes.sh and the script to access /proc/sys/vm/watermark_scale_factor and /proc/sys/vm/extra_free_kbytes files. Bug: 109664768 Signed-off-by: Suren Baghdasaryan <surenb@google.com> Change-Id: I55ec07e12a1cc5322cfdd4a48d0bdc607f45d832
2021-07-29 23:29:47 +02:00
genfscon proc /sys/vm/watermark_scale_factor u:object_r:proc_watermark_scale_factor:s0
add percpu_pagelist_high_fraction type Bug: 309409009 Test: boot Change-Id: I04db2ab3a95a5427e6d89cf128ed953fdc823107 Signed-off-by: Martin Liu <liumartin@google.com>
2023-11-06 15:35:45 +01:00
genfscon proc /sys/vm/percpu_pagelist_high_fraction u:object_r:proc_percpu_pagelist_high_fraction:s0
add compaction_proactiveness type Bug: 332916849 Test: boot Change-Id: I41c0da22ed5ad738c75fb00e2ac8a22c35dff2d3 Signed-off-by: Martin Liu <liumartin@google.com>
2024-04-10 15:48:15 +02:00
genfscon proc /sys/vm/compaction_proactiveness u:object_r:proc_compaction_proactiveness:s0
restrict access to timing information in /proc These APIs expose sensitive information via timing side channels. This leaves access via the adb shell intact along with the current uses by dumpstate, init and system_server. The /proc/interrupts and /proc/stat files were covered in this paper: https://www.lightbluetouchpaper.org/2016/07/29/yet-another-android-side-channel/ The /proc/softirqs, /proc/timer_list and /proc/timer_stats files are also relevant. Access to /proc has been greatly restricted since then, with untrusted apps no longer having direct access to these, but stricter restrictions beyond that would be quite useful. Change-Id: Ibed16674856569d26517e5729f0f194b830cfedd
2016-07-29 20:48:19 +02:00
genfscon proc /timer_list u:object_r:proc_timer:s0
genfscon proc /timer_stats u:object_r:proc_timer:s0
untrusted_app: allow access to /proc/tty/drivers /proc/tty/drivers is read by applications to figure out if they are running in an emulated environment. Specifically, they look for the string "goldfish" within that file. Arguably this is not an Android API, and really shouldn't be exposed to applications, but: 1) A largish number of applications break if they can't read this file; 2) The information here isn't particularly sensitive While we could spend a bunch of time trying to get applications fixed, there are bigger fish to fry. It's not worth the battle. Test: "ls -laZ /proc/tty/drivers" is labeled properly. Bug: 33214085 Bug: 33814662 Bug: 33791054 Bug: 33211769 Bug: 26813932 Change-Id: Icc05bdc1c917547a6dca7d76636a1009369bde49
2017-01-04 17:43:09 +01:00
genfscon proc /tty/drivers u:object_r:proc_tty_drivers:s0
selinux: set proc_uid_time_in_state type for /proc/uid /proc/uid/ provides the same per-uid time_in_state data as /proc/uid_time_in_state, so apply the same type and let system_server read directories of this type. Bug: 66953705 Test: system_server can read /proc/uid/*/time_in_state files without denials on sailfish Change-Id: Iab7fd018c5296e8c0140be81c14e5bae9e0acb0b Signed-off-by: Connor O'Brien <connoro@google.com>
2017-11-18 00:40:51 +01:00
genfscon proc /uid/ u:object_r:proc_uid_time_in_state:s0
Allow system_server to read/write /proc/uid_cputime/ module Bug:20182139 Change-Id: I1829a83c7d8e2698715e424a688a2753d65de868
2015-05-13 02:14:35 +02:00
genfscon proc /uid_cputime/show_uid_stat u:object_r:proc_uid_cputime_showstat:s0
genfscon proc /uid_cputime/remove_uid_range u:object_r:proc_uid_cputime_removeuid:s0
Define policy for /proc/uid_io/stats New procfs file read by storaged to dump fg/bg IO usage. Remove kmsg rule since it's no longer used by storaged. Allow storaged to find permission_service to translate UID to package name. Test: adb shell storaged -u Bug: 34198239 Change-Id: I74654662c75571cbe166cf2b8cbab84828218cbd
2017-01-12 01:20:49 +01:00
genfscon proc /uid_io/stats u:object_r:proc_uid_io_stats:s0
Define policy for /proc/uid_procstat/set. New procfs file written by the system_server to communicate fg/bg state of UIDs to switch the statistics counter sets used. avc: denied { write } for name="set" dev="proc" ino=4026531862 scontext=u:r:system_server:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 Test: builds, boots, counter sets updated Bug: 34360629 Change-Id: I2efbfbba9e73f50ce50a80a3dffd3b14fa55c048
2017-01-18 02:33:50 +01:00
genfscon proc /uid_procstat/set u:object_r:proc_uid_procstat_set:s0
Allow only system_server to read uid_time_in_state Bug: 62706738 Bug: 34133340 Test: Check that uid_time_in_state can't be read from the shell without root permissions and that "dumpsys batterystats --checkin| grep ctf" shows frequency data (system_server was able to read uid_time_in_state) Change-Id: Ic6a54da4ebcc9e10b0e3af8f14a45d7408e8686e (cherry picked from commit 4dc88795d0906148e3414688fa81481b4edaacff)
2017-06-07 19:39:11 +02:00
genfscon proc /uid_time_in_state u:object_r:proc_uid_time_in_state:s0
Restrict access to uid_concurrent_*_time Do not let apps read uid_concurrent_active_time and uid_concurrent_policy_time. b/68399339 Test: Check that they can't be read from the shell without root permissions and system_server was able to read them Change-Id: I6f09ef608607cb9f4084ba403a1e7254b8c49a06
2017-11-10 23:10:19 +01:00
genfscon proc /uid_concurrent_active_time u:object_r:proc_uid_concurrent_active_time:s0
genfscon proc /uid_concurrent_policy_time u:object_r:proc_uid_concurrent_policy_time:s0
sepolicy: restrict access to uid_cpupower files Do not let apps read /proc/uid_cpupower/time_in_state, /proc/uid_cpupower/concurrent_active_time, /proc/uid_cpupower/concurrent_policy_time. b/71718257 Test: Check that they can't be read from the shell without root permissions and system_server was able to read them Change-Id: I812694adfbb4630f7b56aa7096dc2e6dfb148b15
2018-01-19 22:48:31 +01:00
genfscon proc /uid_cpupower/ u:object_r:proc_uid_cpupower:s0
init: label /proc dependencies and remove access to proc New types and files labeled with them: 1. proc_abi: /proc/sys/abi/swp 2. proc_dirty: /proc/sys/vm/dirty_background_ratio /proc/sys/vm/dirty_expire_centisecs 3. proc_diskstats: /proc/diskstats 4. proc_extra_free_kbytes: /proc/sys/vm/extra_free_kbytes 5. proc_hostname: /proc/sys/kernel/domainname /proc/sys/kernel/hostname 6. proc_hung_task: /proc/sys/kernel/hung_task_timeout_secs 7. proc_max_map_count: /proc/sys/vm/max_map_count 8. proc_panic: /proc/sys/kernel/panic_on_oops 9. proc_sched: /proc/sys/kernel/sched_child_runs_first /proc/sys/kernel/sched_latency_ns /proc/sys/kernel/sched_rt_period_us /proc/sys/kernel/sched_rt_runtime_us /proc/sys/kernel/sched_tunable_scaling /proc/sys/kernel/sched_wakeup_granularity_ns 10. proc_uptime: /proc/uptime Files labeled with already existing types: 1. proc_perf: /proc/sys/kernel/perf_event_paranoid 2. proc_sysrq: /proc/sys/kernel/sysrq 3. usermodehelper: /proc/sys/kernel/core_pipe_limit Changes to init domain: 1. Removed access to files with 'proc' label. 2. Added access to newly introduced types + proc_kmsg. Bug: 68949041 Test: walleye boots without denials from u:r:init:s0. Test: system/core/init/grab-bootchart.sh does not trigger denials from u:r:init:s0 Change-Id: If1715c3821e277679c320956df33dd273e750ea2
2017-11-06 00:35:16 +01:00
genfscon proc /uptime u:object_r:proc_uptime:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
genfscon proc /version u:object_r:proc_version:s0
genfscon proc /vmallocinfo u:object_r:proc_vmallocinfo:s0
Remove proc and sysfs access from system_app and platform_app. Bug: 65643247 Test: manual Test: browse internet Test: take a picture Change-Id: I9faff44b7a025c7422404d777113e40842ea26dd
2018-01-10 21:51:51 +01:00
genfscon proc /vmstat u:object_r:proc_vmstat:s0
fine-grained policy for access to /proc/zoneinfo Change-Id: Ica9a16311075f5cc3744d0e0833ed876e201029f
2016-08-08 19:48:01 +02:00
genfscon proc /zoneinfo u:object_r:proc_zoneinfo:s0
Move vendor_sched to common sepolicy Previously vendor_sched is put under product area which will be replaced by GSI. To solve it, move it to system/sepolicy. Bug: 194656257 Test: build pass Change-Id: Ia0b855e3a876a58b58f79b4fba09293419797b47
2021-07-29 15:24:38 +02:00
genfscon proc /vendor_sched u:object_r:proc_vendor_sched:s0
Allow system_server to read/write /proc/uid_cputime/ module Bug:20182139 Change-Id: I1829a83c7d8e2698715e424a688a2753d65de868
2015-05-13 02:14:35 +02:00
Add sepolicy for FUSE control filesystem. To allow vold to abort it. Bug: 153411204 Test: vold can access it Merged-In: I334eaf3459905c27d614db8eda18c27e62bea5fa Change-Id: I334eaf3459905c27d614db8eda18c27e62bea5fa
2020-05-28 15:04:48 +02:00
genfscon fusectl / u:object_r:fusectlfs:s0
Support for ocontexts per device. ocontexts was split up into 4 files: 1.fs_use 2.genfs_contexts 3.initial_sid_contexts 4.port_contexts Each file has their respective declerations in them. Devices, in their respective device directory, can now specify sepolicy.fs_use, sepolicy.genfs_contexts, sepolicy.port_contexts, and sepolicy.initial_sid_contexts. These declerations will be added right behind their respective sepolicy counterparts in the concatenated configuration file.
2012-07-12 01:46:38 +02:00
# selinuxfs booleans can be individually labeled.
genfscon selinuxfs / u:object_r:selinuxfs:s0
genfscon cgroup / u:object_r:cgroup:s0
sepolicy support for cgroup v2 cgroup v2 is going to be used for freezer v2 support. The cgroup v2 hiearchy will be mounted by init under /sys/fs/cgroup hence proper access rights are necessary for sysfs. After mounting, the cgroup v2 kernfs will use the label cgroup_v2 and system_manager will handle the freezer Bug: 154548692 Test: verified that files undes sysfs and cgroup v2 kernfs are accessed as required to allow proper functioning for the freezer. Change-Id: Idfb3f6e77b60dad032d1e306d2f9b58cd5775960
2020-05-27 23:10:39 +02:00
genfscon cgroup2 / u:object_r:cgroup_v2:s0
Support for ocontexts per device. ocontexts was split up into 4 files: 1.fs_use 2.genfs_contexts 3.initial_sid_contexts 4.port_contexts Each file has their respective declerations in them. Devices, in their respective device directory, can now specify sepolicy.fs_use, sepolicy.genfs_contexts, sepolicy.port_contexts, and sepolicy.initial_sid_contexts. These declerations will be added right behind their respective sepolicy counterparts in the concatenated configuration file.
2012-07-12 01:46:38 +02:00
# sysfs labels can be set by userspace.
genfscon sysfs / u:object_r:sysfs:s0
Add file context type for /sys/devices/cs_etm This is the cs_etm (Coresight ETM) sysfs directory. Bug: 79161490 Test: build Change-Id: I9a66bb4b2684ef8637106a36f7d490d8f805cabf
2020-08-31 09:24:40 +02:00
genfscon sysfs /devices/cs_etm u:object_r:sysfs_devices_cs_etm:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
genfscon sysfs /devices/system/cpu u:object_r:sysfs_devices_system_cpu:s0
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
genfscon sysfs /class/android_usb u:object_r:sysfs_android_usb:s0
Add sysfs_extcon for /sys/class/extcon Bug: 124364409 Change-Id: Idc33732454674bbdc7f4ff6eda173acc24e318b3 Test: cherry picked to pi-tv-dr-dev and tested on JBL Link bar
2019-02-15 21:15:21 +01:00
genfscon sysfs /class/extcon u:object_r:sysfs_extcon:s0
Adds GPU sepolicy to support devices with DRM gralloc/rendering ... such as Cuttlefish (Cloud Android virtual device) which has a DRM virtio-gpu based gralloc and (sometimes) DRM virtio-gpu based rendering (when forwarding rendering commands to the host machine with Mesa3D in the guest and virglrenderer on the host). After this change is submitted, changes such as aosp/1997572 can be submitted to removed sepolicy that is currently duplicated across device/google/cuttlefish and device/linaro/dragonboard as well. Adds a sysfs_gpu type (existing replicated sysfs_gpu definitions across several devices are removed in the attached topic). The uses of `sysfs_gpu:file` comes from Mesa using libdrm's `drmGetDevices2()` which calls into `drmParsePciDeviceInfo()` to get vendor id, device id, version etc. Bug: b/161819018 Test: launch_cvd Test: launch_cvd --gpu_mode=gfxstream Change-Id: I4f7d4b0fb90bfeef72f94396ff0c5fe44d53510c Merged-In: I4f7d4b0fb90bfeef72f94396ff0c5fe44d53510c
2022-02-24 19:32:16 +01:00
genfscon sysfs /class/gpu u:object_r:sysfs_gpu:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
genfscon sysfs /class/leds u:object_r:sysfs_leds:s0
Label /sys/class/net as sysfs_net. We already expect contents of /sys/class/net to be labeled as sysfs_net. Also label the directory for consistensy since we usually label /sys/class/foo directories as sysfs_foo. Bug: 65643247 Test: netd_integration_test Test: can browse internet without denials to sysfs_net Change-Id: I9d28ab4baf71df99ae966276532f14684d1abca6
2017-12-09 00:47:21 +01:00
genfscon sysfs /class/net u:object_r:sysfs_net:s0
btlinux: Move HAL definitions from system/bt Test: ls -laZ /vendor/bin/hw/android.hardware.bluetooth* Change-Id: I394594ad041f87583ca6b5b44d836cfab5da8103 Signed-off-by: Dmitry Shmidt <dimitrysh@google.com> Merged-In: I394594ad041f87583ca6b5b44d836cfab5da8103
2018-04-05 21:46:05 +02:00
genfscon sysfs /class/rfkill/rfkill0/state u:object_r:sysfs_bluetooth_writable:s0
genfscon sysfs /class/rfkill/rfkill1/state u:object_r:sysfs_bluetooth_writable:s0
genfscon sysfs /class/rfkill/rfkill2/state u:object_r:sysfs_bluetooth_writable:s0
genfscon sysfs /class/rfkill/rfkill3/state u:object_r:sysfs_bluetooth_writable:s0
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
genfscon sysfs /class/rtc u:object_r:sysfs_rtc:s0
genfscon sysfs /class/switch u:object_r:sysfs_switch:s0
system_suspend access to suspend, wakeup stats Android is moving away from debugfs. Information from /d/wakeup_sources and /d/suspend_stats is now also exposed in sysfs under /sys/class/wakeup/* and /sys/power/suspend_stats/* respectively: https://lkml.org/lkml/2019/7/31/1349 https://lkml.org/lkml/2019/8/6/1275 Allow SystemSuspend to read those sysfs nodes. One caveat is that /sys/class/wakeup/wakeupN can be a symlink to a device-specific location. In this case, device sepolicy should label that the files appropriately. This is similar to how device policy applies "sysfs_net" and "sysfs_batteryinfo" labels. Bug: 144095608 Bug: 129087298 Test: boot cuttlefish; system_suspend is able to read /sys/power/suspend_stats/* and /sys/class/wakeup/* Change-Id: I350c88a271c0f422d0557aeb5e05e1537dc97bc9
2019-11-07 22:37:34 +01:00
genfscon sysfs /class/wakeup u:object_r:sysfs_wakeup:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
genfscon sysfs /devices/platform/nfc-power/nfc_power u:object_r:sysfs_nfc_power_writable:s0
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
genfscon sysfs /devices/virtual/android_usb u:object_r:sysfs_android_usb:s0
Fix denials during bugreport. Bug: 124465994 Test: cts-tradefed run cts -m CtsSecurityHostTestCases -t android.security.cts.SELinuxHostTest#testNoBugreportDenials Test: Build all policies. Change-Id: Ic20b1e0fd3a8bdea408d66f33351b1f5ebc5d84c (cherry picked from commit f24854f8e859803600b34ecb07be8a449cacc0b0)
2019-03-01 21:35:48 +01:00
genfscon sysfs /devices/virtual/block/ u:object_r:sysfs_devices_block:s0
Create sysfs_dm label. Prior to this CL, /sys/devices/virtual/block/dm-X was using the generic sysfs label. This CL creates sysfs_dm label and grants the following accesses: - update_verifier to read sysfs_dm dir and file at /sys/devices/virtual/block/dm-X. - vold to write sysfs_dm. Bug: 63440407 Test: update_verifier successfully triggers blocks verification and marks a sucessful boot; Test: No sysfs_dm related denials on sailfish. Change-Id: I6349412707800f1bd3a2fb94d4fe505558400c95
2017-10-05 22:50:07 +02:00
genfscon sysfs /devices/virtual/block/dm- u:object_r:sysfs_dm:s0
Allow apexd to write to sysfs loop device parameters. To configure read-ahead on loop devices, eg. /sys/devices/virtual/block/loop0/queue/read_ahead_kb Bug: 120776455 Test: configuring read-ahead on loop devices works from apexd Change-Id: Ib25372358e8ca62fa634daf286e4b64e635fac58
2018-12-18 15:38:59 +01:00
genfscon sysfs /devices/virtual/block/loop u:object_r:sysfs_loop:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
genfscon sysfs /devices/virtual/block/zram0 u:object_r:sysfs_zram:s0
genfscon sysfs /devices/virtual/block/zram1 u:object_r:sysfs_zram:s0
genfscon sysfs /devices/virtual/block/zram0/uevent u:object_r:sysfs_zram_uevent:s0
genfscon sysfs /devices/virtual/block/zram1/uevent u:object_r:sysfs_zram_uevent:s0
genfscon sysfs /devices/virtual/misc/hw_random u:object_r:sysfs_hwrandom:s0
sepolicy: proper labelling of /sys/devices/virtual/net/... While we're at it also label /sys/module/tcp_cubic/parameters correctly. Before: [40/54] BinderTest#InterfaceSetMtu: FAILED (4ms) STACKTRACE: system/netd/tests/binder_test.cpp:2724: Failure Value of: status.isOk() Actual: false Expected: true Remote I/O error system/netd/tests/binder_test.cpp:2580: Failure Expected equality of these values: mtu Which is: 1200 mtuSize Which is: 1500 Summary ------- libbpf_android_test: Passed: 9, Failed: 0, Ignored: 0 libnetdbpf_test: Passed: 11, Failed: 0, Ignored: 0 netd_integration_test: Passed: 53, Failed: 1, Ignored: 0 netd_unit_test: Passed: 179, Failed: 0, Ignored: 0 netdutils_test: Passed: 68, Failed: 0, Ignored: 0 resolv_integration_test: Passed: 67, Failed: 0, Ignored: 0 resolv_unit_test: Passed: 67, Failed: 0, Ignored: 0 1 test failed ------------- BinderTest#InterfaceSetMtu Test: failing test now passes Bug: 130318253 Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I2f7e9824ccce9d1597a18400a9ddd74b53ded857 Merged-In: I2f7e9824ccce9d1597a18400a9ddd74b53ded857 (cherry picked from commit f4aeb81eec45af59b7e07b6d4b1cadb8624cefd4)
2019-04-11 21:28:25 +02:00
genfscon sysfs /devices/virtual/net u:object_r:sysfs_net:s0
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
genfscon sysfs /devices/virtual/switch u:object_r:sysfs_switch:s0
system_suspend access to suspend, wakeup stats Android is moving away from debugfs. Information from /d/wakeup_sources and /d/suspend_stats is now also exposed in sysfs under /sys/class/wakeup/* and /sys/power/suspend_stats/* respectively: https://lkml.org/lkml/2019/7/31/1349 https://lkml.org/lkml/2019/8/6/1275 Allow SystemSuspend to read those sysfs nodes. One caveat is that /sys/class/wakeup/wakeupN can be a symlink to a device-specific location. In this case, device sepolicy should label that the files appropriately. This is similar to how device policy applies "sysfs_net" and "sysfs_batteryinfo" labels. Bug: 144095608 Bug: 129087298 Test: boot cuttlefish; system_suspend is able to read /sys/power/suspend_stats/* and /sys/class/wakeup/* Change-Id: I350c88a271c0f422d0557aeb5e05e1537dc97bc9
2019-11-07 22:37:34 +01:00
genfscon sysfs /devices/virtual/wakeup u:object_r:sysfs_wakeup:s0
Allow virtualizationmanager to read AVF debug policy virtualizationmanager may handle some AVF debug policies for unproteted VM. Bug: 243630590 Test: Run unprotected VM with/without ramdump Change-Id: I2941761efe230a9925d1146f8ac55b50e984a4e9
2023-02-06 17:49:24 +01:00
genfscon sysfs /firmware/devicetree/base/avf u:object_r:sysfs_dt_avf:s0
/proc, /sys access from uncrypt, update_engine, postinstall_dexopt New types: 1. proc_random 2. sysfs_dt_firmware_android Labeled: 1. /proc/sys/kernel/random as proc_random. 2. /sys/firmware/devicetree/base/firmware/android/{compatible, fstab, vbmeta} as sysfs_dt_firmware_android. Changed access: 1. uncrypt, update_engine, postinstall_dexopt have access to generic proc and sysfs labels removed. 2. appropriate permissions were added to uncrypt, update_engine, update_engine_common, postinstall_dexopt. Bug: 67416435 Bug: 67416336 Test: fake ota go/manual-ab-ota runs without denials Test: adb sideload runs without denials to new types Change-Id: Id31310ceb151a18652fcbb58037a0b90c1f6505a
2017-10-04 19:34:11 +02:00
genfscon sysfs /firmware/devicetree/base/firmware/android u:object_r:sysfs_dt_firmware_android:s0
allow init to run mke2fs tools to format partitions Test: let fs_mgr format a damaged /data partition Bug: 35219933 Change-Id: If92352ea7a70780e9d81ab10963d63e16b793792 (cherry picked from commit 5f573ab2aa8f566c723f4ddd576f8365dcaec191)
2017-05-02 22:45:08 +02:00
genfscon sysfs /fs/ext4/features u:object_r:sysfs_fs_ext4_features:s0
Add Label to f2fs sysfs files Test: ls -lZ /sys/fs/f2fs Bug: 123367711 Change-Id: I0035feb8409b7ec8e11510795fb7d8845992694e
2019-02-15 23:29:05 +01:00
genfscon sysfs /fs/f2fs u:object_r:sysfs_fs_f2fs:s0
Allow bpfloader to read fuse's bpf_prog number Bug: 202785178 Test: Along with rest of topic, file /sys/fs/bpf/prog_fuse_media_fuse_media appears on boot with fuse-bpf in kernel Merged-In: Ibccdf177c75fef0314c86319be3f0b0f249ce59d Change-Id: Ibccdf177c75fef0314c86319be3f0b0f249ce59d
2021-11-12 01:53:26 +01:00
genfscon sysfs /fs/fuse/bpf_prog_type_fuse u:object_r:sysfs_fs_fuse_bpf:s0
Use kernel sys/fs/fuse/features/fuse_bpf flag to enable fuse_bpf Bug: 262887267 Test: ro.fuse.bpf.is_running is true Change-Id: I9c4a54e9ac232e9f35a6be5b3bcc3cc040d64b47
2023-03-01 23:32:25 +01:00
genfscon sysfs /fs/fuse/features u:object_r:sysfs_fs_fuse_features:s0
IncFS: update SE policies for the new API IncFS in S adds a bunch of new ioctls, and requires the users to read its features in sysfs directory. This change adds all the features, maps them into the processes that need to call into them, and allows any incfs user to query the features Bug: 170231230 Test: incremental unit tests Change-Id: Ieea6dca38ae9829230bc17d0c73f50c93c407d35
2021-01-15 06:01:25 +01:00
genfscon sysfs /fs/incremental-fs/features u:object_r:sysfs_fs_incfs_features:s0
[sepolicy] allow system server to read incfs metrics from sysfs Address denial messages like: 05-05 05:02:21.480 1597 1597 W Binder:1597_12: type=1400 audit(0.0:140): avc: denied { read } for name="reads_delayed_min" dev="sysfs" ino=107358 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=0 BUG: 184844615 Test: atest android.cts.statsdatom.incremental.AppErrorAtomTests#testAppCrashOnIncremental Change-Id: I201e27e48a08f99f41a030e06c6f22518294e056
2021-05-05 07:40:23 +02:00
genfscon sysfs /fs/incremental-fs/instances u:object_r:sysfs_fs_incfs_metrics:s0
init: remove open, read, write access to 'sysfs' type. Add write access to: sysfs_android_usb sysfs_leds sysfs_power sysfs_zram Add setattr access to: sysfs_android_usb sysfs_devices_system_cpu sysfs_lowmemorykiller sysfs_power sysfs_leds sysfs_ipv4 Bug: 70040773 Bug: 65643247 Change-Id: I68e2e796f5599c9d281897759c8d8eef9363559a Test: walleye boots with no denials from init to sysfs.
2017-12-06 18:00:59 +01:00
genfscon sysfs /power/autosleep u:object_r:sysfs_power:s0
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
genfscon sysfs /power/state u:object_r:sysfs_power:s0
system_suspend access to suspend, wakeup stats Android is moving away from debugfs. Information from /d/wakeup_sources and /d/suspend_stats is now also exposed in sysfs under /sys/class/wakeup/* and /sys/power/suspend_stats/* respectively: https://lkml.org/lkml/2019/7/31/1349 https://lkml.org/lkml/2019/8/6/1275 Allow SystemSuspend to read those sysfs nodes. One caveat is that /sys/class/wakeup/wakeupN can be a symlink to a device-specific location. In this case, device sepolicy should label that the files appropriately. This is similar to how device policy applies "sysfs_net" and "sysfs_batteryinfo" labels. Bug: 144095608 Bug: 129087298 Test: boot cuttlefish; system_suspend is able to read /sys/power/suspend_stats/* and /sys/class/wakeup/* Change-Id: I350c88a271c0f422d0557aeb5e05e1537dc97bc9
2019-11-07 22:37:34 +01:00
genfscon sysfs /power/suspend_stats u:object_r:sysfs_suspend_stats:s0
allow writes to /sys/power/sync_on_suspend from init When suspend.disable_sync_on_suspend is set init must write to /sys/power/sync_on_suspend. Bug: 285395636 Change-Id: Ica1b039c3192f08ec84aa07d35c2d0c61e7449c0
2023-10-04 00:31:22 +02:00
genfscon sysfs /power/sync_on_suspend u:object_r:sysfs_sync_on_suspend:s0
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
genfscon sysfs /power/wakeup_count u:object_r:sysfs_power:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
genfscon sysfs /power/wake_lock u:object_r:sysfs_wake_lock:s0
genfscon sysfs /power/wake_unlock u:object_r:sysfs_wake_lock:s0
Revert "Revert "Add /sys/kernel/memory_state_time to sysfs_power."" This reverts commit 12e73685b75905fa5afa62cd1fb3631f9f2af818. Reason for revert: Rolling original change forward again, more carefully. Change-Id: I266b181915c829d743c6d8d0b8c0d70b6bf3d620
2018-04-17 17:59:45 +02:00
genfscon sysfs /kernel/memory_state_time u:object_r:sysfs_power:s0
Allow dumpsys to read total DMA-BUF heap pool size These permissions are added to allow dumpsys to read /sys/kernel/dma_heap/total_pools_kb. Fixes the following sepolicy denials: avc: denied { read } for name="total_pools_kb" dev="sysfs" ino=3252 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 avc: denied { open } for path="/sys/kernel/dma_heap/total_pools_kb" dev="sysfs" ino=3252 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 avc: denied { getattr } for path="/sys/kernel/dma_heap/total_pools_kb" dev="sysfs" ino=3252 scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 Bug: 167709539 Test: dumpsys meminfo Change-Id: I1c15b41b067da84a7b629cafe27972f30c86ae27
2021-02-01 19:25:05 +01:00
genfscon sysfs /kernel/dma_heap u:object_r:sysfs_dma_heap:s0
allow system_server to access files under /sys/kernel/ion/ In order for system_server to report ION allocations in dumpsys meminfo report it needs access to ION sysfs nodes. Bug: 138148041 Test: dumpsys meminfo Change-Id: I8b1efebe8f4b06a3975e96ddd6a8cbcacdb52fb2 Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2019-11-17 23:41:33 +01:00
genfscon sysfs /kernel/ion u:object_r:sysfs_ion:s0
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
genfscon sysfs /kernel/ipv4 u:object_r:sysfs_ipv4:s0
Allow global read access to /sys/kernel/mm/transparent_hugepage/ If kernel is built with CONFIG_TRANSPARENT_HUGEPAGE optimization, libjemalloc5 will attempt to read /sys/kernel/mm/transparent_hugepage/enabled and hit an SELinux denial. Various denials similiar to the following are seen on cuttlefish: avc: denied { open } for comm="surfaceflinger" path="/sys/kernel/mm/transparent_hugepage/enabled" dev="sysfs" ino=776 scontext=u:r:surfaceflinger:s0 tcontext=u:object_r:sysfs:s0 tclass=file permissive=1 Bug: 28053261 Test: boot cuttlefish without above denials. Change-Id: Ic33f12d31aacc42d662a8c5c297fbb5f84d4deea
2019-03-13 20:06:01 +01:00
genfscon sysfs /kernel/mm/transparent_hugepage u:object_r:sysfs_transparent_hugepage:s0
Add sepolicy for Multi-Gen LRU sysfs control init is allowed to enable/disable MG-LRU. Bug: 227651406 Bug: 228525049 Test: setprop persist.device_config.mglru_native.lru_gen_config Test: verify no avc denials in logcat Change-Id: I20223f3628cb6909c3fd2eb2b821ff2d52202dd2
2022-04-07 01:36:58 +02:00
genfscon sysfs /kernel/mm/lru_gen/enabled u:object_r:sysfs_lru_gen_enabled:s0
sepolicy: Add rules for /sys/kernel/mm/pgsize_migration/enabled The dynamic linker needs to read this node to determine how it should load ELF files. Allow the node to be enabled/disabled by init. Bug: 330117029 Bug: 327600007 Bug: 330767927 Bug: 328266487 Bug: 329803029 Test: Free Fire Chaos App launches Test: no avc deined in logcat Change-Id: I2b35d6aebe39bf3e1e7489b47f23a817e477ef72
2024-04-10 01:24:48 +02:00
genfscon sysfs /kernel/mm/pgsize_migration/enabled u:object_r:sysfs_pgsize_migration:s0
Sepolicy: Label kernel notes Label /sys/kernel/notes. Bug: 70275668 Test: m Change-Id: Ieb666425d2db13f85225fb902fe06b0bf2335bef
2017-12-06 19:09:50 +01:00
genfscon sysfs /kernel/notes u:object_r:sysfs_kernel_notes:s0
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
genfscon sysfs /kernel/uevent_helper u:object_r:sysfs_usermodehelper:s0
Label system_server's dependencies in sysfs. New types: sysfs_android_usb sysfs_ipv4 sysfs_power sysfs_rtc sysfs_switch sysfs_wakeup_reasons Labeled: /sys/class/android_usb, /sys/devices/virtual/android_usb ->sysfs_android_usb /sys/class/rtc -> sysfs_rtc /sys/class/switch, /sys/devices/virtual/switch -> sysfs_switch /sys/power/state, /sys/power/wakeup_count -> sysfs_power /sys/kernel/ipv4 -> sysfs_ipv4 /sys/kernel/wakeup_reasons -> sysfs_wakeup_reasons Removed access to sysfs and sysfs_type from system_server and added appropriate access to new types. Bug: 65643247 Test: sailfish boots without violation from system_server or to new labels. Change-Id: I27250fd537d76c8226defa138d84fe2a4ce2d5d5
2017-10-10 05:39:34 +02:00
genfscon sysfs /kernel/wakeup_reasons u:object_r:sysfs_wakeup_reasons:s0
Allow dumpstate to read DMA-BUF sysfs stats These permissions are required for dumpstate to read the DMA-BUF sysfs stats present at /sys/kernel/dmabuf/buffers Bug: 167709539 Test: adb shell am bug-report Change-Id: I1c00843775452b7a7aa39b059e1d77d77aed1e9c
2021-01-11 06:09:37 +01:00
genfscon sysfs /kernel/dmabuf/buffers u:object_r:sysfs_dmabuf_stats:s0
Allow init to configure dm_verity kernel driver. To disable hash-tree prefetching. Bug: 136247322 Test: atest google/perf/boottime/boottime-test Change-Id: Ibdcb88d1014f58918119867c6d701dc58af0c049
2019-12-16 13:39:15 +01:00
genfscon sysfs /module/dm_verity/parameters/prefetch_cluster u:object_r:sysfs_dm_verity:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
genfscon sysfs /module/lowmemorykiller u:object_r:sysfs_lowmemorykiller:s0
sepolicy: proper labelling of /sys/devices/virtual/net/... While we're at it also label /sys/module/tcp_cubic/parameters correctly. Before: [40/54] BinderTest#InterfaceSetMtu: FAILED (4ms) STACKTRACE: system/netd/tests/binder_test.cpp:2724: Failure Value of: status.isOk() Actual: false Expected: true Remote I/O error system/netd/tests/binder_test.cpp:2580: Failure Expected equality of these values: mtu Which is: 1200 mtuSize Which is: 1500 Summary ------- libbpf_android_test: Passed: 9, Failed: 0, Ignored: 0 libnetdbpf_test: Passed: 11, Failed: 0, Ignored: 0 netd_integration_test: Passed: 53, Failed: 1, Ignored: 0 netd_unit_test: Passed: 179, Failed: 0, Ignored: 0 netdutils_test: Passed: 68, Failed: 0, Ignored: 0 resolv_integration_test: Passed: 67, Failed: 0, Ignored: 0 resolv_unit_test: Passed: 67, Failed: 0, Ignored: 0 1 test failed ------------- BinderTest#InterfaceSetMtu Test: failing test now passes Bug: 130318253 Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I2f7e9824ccce9d1597a18400a9ddd74b53ded857 Merged-In: I2f7e9824ccce9d1597a18400a9ddd74b53ded857 (cherry picked from commit f4aeb81eec45af59b7e07b6d4b1cadb8624cefd4)
2019-04-11 21:28:25 +02:00
genfscon sysfs /module/tcp_cubic/parameters u:object_r:sysfs_net:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
genfscon sysfs /module/wlan/parameters/fwpath u:object_r:sysfs_wlan_fwpath:s0
genfscon sysfs /devices/virtual/timed_output/vibrator/enable u:object_r:sysfs_vibrator:s0
Add SePolicy for system_server accessing sysfs uhid. Add SePolicy to allow Android input manager accessing sysfs uhid folder. Bug: 161633432 Test: dumpsys input and watch for input device battery status. Change-Id: I6ed1ab45f1cff409982c36627e12e62667819f37
2020-11-21 04:17:22 +01:00
genfscon sysfs /devices/virtual/misc/uhid u:object_r:sysfs_uhid:s0
Move vendor_sched to common sepolicy Previously vendor_sched is put under product area which will be replaced by GSI. To solve it, move it to system/sepolicy. Bug: 194656257 Test: build pass Change-Id: Ia0b855e3a876a58b58f79b4fba09293419797b47
2021-07-29 15:24:38 +02:00
genfscon sysfs /kernel/vendor_sched u:object_r:sysfs_vendor_sched:s0
Revert "Revert "SELinux policy changes for uprobe."" This reverts commit e2bd44d48d664b5aef5ed640419df98803628222. Reason for revert: 2nd attempt to add the policy change Test: m selinux_policy Change-Id: I5b9a102879a65917d496ba2194187ddd2b4545d1
2023-09-25 20:42:03 +02:00
genfscon sysfs /devices/uprobe u:object_r:sysfs_uprobe:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
Label kprobes and restrict access Bug: 149659981 Test: build Change-Id: I6abcd1bb9af15e7ba0f1f5e711ea9ac661bffc25
2020-06-10 12:27:12 +02:00
genfscon debugfs /kprobes u:object_r:debugfs_kprobes:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
genfscon debugfs /mmc0 u:object_r:debugfs_mmc:s0
Use a whitelisting strategy for tracefs. This changes tracefs files to be default-enabled in debug mode, but default-disabled with specific files enabled in user mode. Bug: 64762598 Test: Successfully took traces in user mode. Change-Id: I572ea22253e0c1e42065fbd1d2fd7845de06fceb
2018-01-31 03:14:45 +01:00
genfscon debugfs /tracing u:object_r:debugfs_tracing_debug:s0
genfscon tracefs / u:object_r:debugfs_tracing_debug:s0
genfscon tracefs /tracing_on u:object_r:debugfs_tracing:s0
genfscon tracefs /trace u:object_r:debugfs_tracing:s0
Allow perfetto traced_probes to access tracefs on user Allows the traced_probes daemon to access the core ftrace functionalities on user builds. Specifically this involves: - Whitelisting the per_cpu/ subdirectory to access: 1) trace_pipe_raw file to allow perfetto to read the raw ftrace buffer (rather than the text-based /trace endpoint) 2) cpuX/stats and cpuX/buffer_size_kb that allow to tune the buffer size per-cpu pipe and to get basic statistics about the ftrace buffer (#events, overruns) - Whitelistiing the full event directories rather than the /enable files. This gives also access to the /format files for the events that are already enabled on user builds. /format files simply describe the memory layout of the binary logs. Example: https://ghostbin.com/paste/f8m4k This still does NOT allow enabling the events labeled as "_debug" (mostly events that return activity on inodes). We'll deal with that separately as soon as we get a POC of inode resolution and a sensible blacklist/whitelist model. Bug: 70942310 Change-Id: Ic15cca0a9d7bc0e45aa48097a94eadef44c333f8
2018-02-09 12:15:22 +01:00
genfscon tracefs /per_cpu/cpu u:object_r:debugfs_tracing:s0
Add sepolicy rules for hyp ftrace instance We will start with simple sepolicy that applies debugfs_tracing label for any file under /sys/kernel/tracing/hyp (for tracefs) or /sys/kernel/debug/tracing/hyp (for debugfs), as so far everybody that can do tracing in Android should be able to also trace hypervisor. If in the future we decide that this is not the case, we can always introduce a new hyp-tracing specific label. Bug: 249050813 Test: adb shell -alZ /sys/kernel/tracing/hyp Test: collect hyp traces via perfetto Change-Id: I16d8faf212858eab0aab54c22d143461aae90482
2023-02-16 14:37:54 +01:00
genfscon tracefs /hyp u:object_r:debugfs_tracing:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
genfscon debugfs /tracing/instances u:object_r:debugfs_tracing_instances:s0
genfscon tracefs /instances u:object_r:debugfs_tracing_instances:s0
Selinux policy for bootreceiver tracing instance Create contexts for /sys/kernel/tracing/instances/bootreceiver Allow read access to files in this dir for system_server. Bug: 172316664 Bug: 181778620 Test: manual runs with KFENCE enabled Signed-off-by: Alexander Potapenko <glider@google.com> Change-Id: I7021a9f32b1392b9afb77294a1fd0a1be232b1f2
2021-03-02 16:46:50 +01:00
genfscon debugfs /tracing/instances/bootreceiver u:object_r:debugfs_bootreceiver_tracing:s0
genfscon tracefs /instances/bootreceiver u:object_r:debugfs_bootreceiver_tracing:s0
Sepolicy for mm events trace instance Allow traced_probes read write access to configure mm_events trace instance and poll trace_pipe_raw Bug: 155928119 Test: No denials in logcat Change-Id: Ib65ab2e7be8daa6b8c412ffea909072583db7002
2021-01-15 17:12:56 +01:00
genfscon debugfs /tracing/instances/mm_events u:object_r:debugfs_mm_events_tracing:s0
genfscon tracefs /instances/mm_events u:object_r:debugfs_mm_events_tracing:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
genfscon debugfs /tracing/instances/wifi u:object_r:debugfs_wifi_tracing:s0
genfscon tracefs /instances/wifi u:object_r:debugfs_wifi_tracing:s0
genfscon debugfs /tracing/trace_marker u:object_r:debugfs_trace_marker:s0
genfscon tracefs /trace_marker u:object_r:debugfs_trace_marker:s0
Selinux permissions for incidentd project Bug: 64222712 Test: manual Change-Id: Ica77ae3c9e535eddac9fccf11710b0bcb3254ab3
2018-01-22 23:00:46 +01:00
genfscon debugfs /wakeup_sources u:object_r:debugfs_wakeup_sources:s0
New type for printk_formats, allow traced_probes. Test: ls -lZ /sys/kernel/tracing/printk_formats [...] u:object_r:debugfs_tracing_printk_formats:s0 [...] Test: setenforce 0; runcon u:r:system_server:s0 cat /sys/kernel/tracing/printk_formats logcat complains about /sys/kernel/tracing/printk_formats Test: setenforce 0; runcon u:r:traced_probes:s0 cat /sys/kernel/tracing/printk_formats logcat does not complain about /sys/kernel/tracing/printk_formats (need to setenforce 0, because otherwise the exec of ls is denied). Bug: 70292203 Change-Id: I15ddef686f979c59daaba5263fa99aca3cd139e5
2020-11-05 13:54:52 +01:00
genfscon debugfs /tracing/printk_formats u:object_r:debugfs_tracing_printk_formats:s0
genfscon tracefs /printk_formats u:object_r:debugfs_tracing_printk_formats:s0
Move file labeling to genfs_contexts. This should improve performance, as file_contexts is slower than genfs_contexts. Bug: 62413700 Test: Built, flashed, and booted Sailfish. Verified that the files have the correct context and that wifi, web, and atrace work. Merged-In: Ia28707ec565a0792bc882fbffe9e8ab9968535f5 Change-Id: I9546f3af3c95e3443684ae4764881b69987611ef
2017-07-27 01:22:50 +02:00
Allow to read events/header_page with debugfs_tracing Bug: 110900684 Change-Id: I9fd141e0d56d0135c563467b7ca2f08b6af6700b`
2018-06-28 15:57:18 +02:00
genfscon tracefs /events/header_page u:object_r:debugfs_tracing:s0
Expose filesystem read events in SELinux policy. Without this, we only have visibility into writes. Looking at traces, we realised for many of the files we care about (.dex, .apk) most filesystem events are actually reads. See aosp/661782 for matching filesystem permission change. Bug: 73625480 Change-Id: I6ec71d82fad8f4679c7b7d38e3cb90aff0b9e298
2018-04-10 17:12:54 +02:00
genfscon tracefs /events/f2fs/f2fs_get_data_block/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/f2fs/f2fs_iget/ u:object_r:debugfs_tracing:s0
SELinux changes for I/O tracing. See also go/perfetto-io-tracing-security. * Grant CAP_DAC_READ_SEARCH to traced_probes. * Allow traced_probes to list selected labels. * Change ext4 and f2fs events to be available on user builds. Bug: 74584014 Change-Id: I891a0209be981d760a828a69e4831e238248ebad
2018-03-02 11:52:56 +01:00
genfscon tracefs /events/f2fs/f2fs_sync_file_enter/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/f2fs/f2fs_sync_file_exit/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/f2fs/f2fs_write_begin/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/f2fs/f2fs_write_end/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/ext4/ext4_da_write_begin/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/ext4/ext4_da_write_end/ u:object_r:debugfs_tracing:s0
Expose filesystem read events in SELinux policy. Without this, we only have visibility into writes. Looking at traces, we realised for many of the files we care about (.dex, .apk) most filesystem events are actually reads. See aosp/661782 for matching filesystem permission change. Bug: 73625480 Change-Id: I6ec71d82fad8f4679c7b7d38e3cb90aff0b9e298
2018-04-10 17:12:54 +02:00
genfscon tracefs /events/ext4/ext4_es_lookup_extent_enter/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/ext4/ext4_es_lookup_extent_exit/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/ext4/ext4_load_inode/ u:object_r:debugfs_tracing:s0
SELinux changes for I/O tracing. See also go/perfetto-io-tracing-security. * Grant CAP_DAC_READ_SEARCH to traced_probes. * Allow traced_probes to list selected labels. * Change ext4 and f2fs events to be available on user builds. Bug: 74584014 Change-Id: I891a0209be981d760a828a69e4831e238248ebad
2018-03-02 11:52:56 +01:00
genfscon tracefs /events/ext4/ext4_sync_file_enter/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/ext4/ext4_sync_file_exit/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/block/block_rq_issue/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/block/block_rq_complete/ u:object_r:debugfs_tracing:s0
Use a whitelisting strategy for tracefs. This changes tracefs files to be default-enabled in debug mode, but default-disabled with specific files enabled in user mode. Bug: 64762598 Test: Successfully took traces in user mode. Change-Id: I572ea22253e0c1e42065fbd1d2fd7845de06fceb
2018-01-31 03:14:45 +01:00
sepolicy: Allow creating synthetic trace events rss_stat will be throttled using histogram triggers and synthetic trace events. Add genfs context labels for the synthetic tracefs files. Bug: 145972256 Test: Check log cat for avc denials Change-Id: I7e183aa930bb6ee79613d011bed7174d553f9c1a
2021-11-05 04:47:29 +01:00
genfscon tracefs /synthetic_events u:object_r:debugfs_tracing:s0
SEPolicy for trace event suspend_resume_minimal This is a more lightweight version of built-in power/suspend_resume Bug: 277016923 Test: manual Change-Id: I71cefcab43a8119cfded52e55ebfaaf809e9f205
2023-04-05 09:15:19 +02:00
genfscon tracefs /events/synthetic/rss_stat_throttled u:object_r:debugfs_tracing:s0
genfscon tracefs /events/synthetic/suspend_resume_minimal u:object_r:debugfs_tracing:s0
sepolicy: Allow creating synthetic trace events rss_stat will be throttled using histogram triggers and synthetic trace events. Add genfs context labels for the synthetic tracefs files. Bug: 145972256 Test: Check log cat for avc denials Change-Id: I7e183aa930bb6ee79613d011bed7174d553f9c1a
2021-11-05 04:47:29 +01:00
Use a whitelisting strategy for tracefs. This changes tracefs files to be default-enabled in debug mode, but default-disabled with specific files enabled in user mode. Bug: 64762598 Test: Successfully took traces in user mode. Change-Id: I572ea22253e0c1e42065fbd1d2fd7845de06fceb
2018-01-31 03:14:45 +01:00
genfscon tracefs /trace_clock u:object_r:debugfs_tracing:s0
tracefs: allow using "/sys/kernel/tracing/buffer_percent" on release devices This is a tracing control file that userspace can read/write an ascii number (e.g. "50"). In turn, it controls the behaviour of blocking read(), splice(), and poll() on the tracing kernel ring buffer fds. A blocked syscall will only be woken up once the kernel fills the buffer past the "buffer_percent" watermark (so 50% -> half-full). We'll be using this file in perfetto's traced_probes, but it should also be safe to expose to other users of the tracing file system (aka debugfs_tracing in sepolicy) on release builds. Added to linux in: https://android.googlesource.com/kernel/common/+/03329f99 Change-Id: Ifcdc73cb0162e8cdadf2e7c16b0215410134ccae
2024-02-25 19:45:20 +01:00
genfscon tracefs /buffer_percent u:object_r:debugfs_tracing:s0
Use a whitelisting strategy for tracefs. This changes tracefs files to be default-enabled in debug mode, but default-disabled with specific files enabled in user mode. Bug: 64762598 Test: Successfully took traces in user mode. Change-Id: I572ea22253e0c1e42065fbd1d2fd7845de06fceb
2018-01-31 03:14:45 +01:00
genfscon tracefs /buffer_size_kb u:object_r:debugfs_tracing:s0
genfscon tracefs /options/overwrite u:object_r:debugfs_tracing:s0
genfscon tracefs /options/print-tgid u:object_r:debugfs_tracing:s0
Add record-tgid tracefs support Bug: 110757800 Test: none Change-Id: I2627c43fc45a78c936fa4a7ca968c606c89b9728
2018-06-28 21:36:17 +02:00
genfscon tracefs /options/record-tgid u:object_r:debugfs_tracing:s0
Use a whitelisting strategy for tracefs. This changes tracefs files to be default-enabled in debug mode, but default-disabled with specific files enabled in user mode. Bug: 64762598 Test: Successfully took traces in user mode. Change-Id: I572ea22253e0c1e42065fbd1d2fd7845de06fceb
2018-01-31 03:14:45 +01:00
genfscon tracefs /saved_cmdlines_size u:object_r:debugfs_tracing:s0
Allow perfetto traced_probes to access tracefs on user Allows the traced_probes daemon to access the core ftrace functionalities on user builds. Specifically this involves: - Whitelisting the per_cpu/ subdirectory to access: 1) trace_pipe_raw file to allow perfetto to read the raw ftrace buffer (rather than the text-based /trace endpoint) 2) cpuX/stats and cpuX/buffer_size_kb that allow to tune the buffer size per-cpu pipe and to get basic statistics about the ftrace buffer (#events, overruns) - Whitelistiing the full event directories rather than the /enable files. This gives also access to the /format files for the events that are already enabled on user builds. /format files simply describe the memory layout of the binary logs. Example: https://ghostbin.com/paste/f8m4k This still does NOT allow enabling the events labeled as "_debug" (mostly events that return activity on inodes). We'll deal with that separately as soon as we get a POC of inode resolution and a sensible blacklist/whitelist model. Bug: 70942310 Change-Id: Ic15cca0a9d7bc0e45aa48097a94eadef44c333f8
2018-02-09 12:15:22 +01:00
genfscon tracefs /events/sched/sched_switch/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/sched/sched_wakeup/ u:object_r:debugfs_tracing:s0
tracing: allow select tracepoints on release builds This primarily affects perfetto's traced_probes and shell-invoked binaries like atrace, but also anyone with access to "debugfs_tracing". These tracepoints are being actively collected in internal tracing, so we would like to also make them available on release builds, as they should be a source of useful system information there as well. The ones we definitely need: * sched_waking, sched_wakeup_new: both are similar to the already-allowed sched_wakeup. The first differs in which exact process context it occurs in, and the latter is the wakeup events of only the fresh tasks. * oom/mark_victim: contains only the pid of the victim. Useful for memory-related tracing and analysis. The other events in this patch are of lesser importance, but also are fairly straightforward - clocks and priority for frequency/power tracing. Small extra change: sched_process_free was only relabeled in the tracefs block, so I've added it to debugfs to keep them in sync. (I wonder whether debugfs is even necessary at this point... but that's outside of scope here.) See the attached bug for a longer explanation. There will also be a separate patch for system/frameworks/native/atrace/atrace.rc for the Unix file permissions of these files. Bug: 179788446 Tested: I did not have access to a "user" build, but I've manually checked the labels of events/.../enable tracefs files via ls -Z, and strace'd traced_probes on a hacky debug build where I commented out its SELinux allow-rule for debugfs_tracing_debug. Change-Id: I15a9cb33950718757e3ecbd7c71de23b25f85f1d
2021-02-14 15:26:35 +01:00
genfscon tracefs /events/sched/sched_wakeup_new/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/sched/sched_waking/ u:object_r:debugfs_tracing:s0
Allow perfetto traced_probes to access tracefs on user Allows the traced_probes daemon to access the core ftrace functionalities on user builds. Specifically this involves: - Whitelisting the per_cpu/ subdirectory to access: 1) trace_pipe_raw file to allow perfetto to read the raw ftrace buffer (rather than the text-based /trace endpoint) 2) cpuX/stats and cpuX/buffer_size_kb that allow to tune the buffer size per-cpu pipe and to get basic statistics about the ftrace buffer (#events, overruns) - Whitelistiing the full event directories rather than the /enable files. This gives also access to the /format files for the events that are already enabled on user builds. /format files simply describe the memory layout of the binary logs. Example: https://ghostbin.com/paste/f8m4k This still does NOT allow enabling the events labeled as "_debug" (mostly events that return activity on inodes). We'll deal with that separately as soon as we get a POC of inode resolution and a sensible blacklist/whitelist model. Bug: 70942310 Change-Id: Ic15cca0a9d7bc0e45aa48097a94eadef44c333f8
2018-02-09 12:15:22 +01:00
genfscon tracefs /events/sched/sched_blocked_reason/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/sched/sched_cpu_hotplug/ u:object_r:debugfs_tracing:s0
Ensure that memory and binder_driver tracepoints are available in user builds Bug: 123367055 Test: used Traceur to take a trace on a user build and verified the tracepoints are in the resultant trace Change-Id: I39e963762bf2b9f0e427ee217a3b2a246f970902
2019-01-24 22:55:21 +01:00
genfscon tracefs /events/sched/sched_process_exit/ u:object_r:debugfs_tracing:s0
Add sched_process_free to debugfs_tracing label Bug: 169279846 Test: atest bpf-time-in-state-tests Test: verified that the time-in-state BPF prog still loads into the kernel with no errors and gets attached without errors Change-Id: If74632ae6f72e0371fea844d4ba7bef9260d1bdb
2020-12-04 01:47:30 +01:00
genfscon tracefs /events/sched/sched_process_free/ u:object_r:debugfs_tracing:s0
tracing: allow select tracepoints on release builds This primarily affects perfetto's traced_probes and shell-invoked binaries like atrace, but also anyone with access to "debugfs_tracing". These tracepoints are being actively collected in internal tracing, so we would like to also make them available on release builds, as they should be a source of useful system information there as well. The ones we definitely need: * sched_waking, sched_wakeup_new: both are similar to the already-allowed sched_wakeup. The first differs in which exact process context it occurs in, and the latter is the wakeup events of only the fresh tasks. * oom/mark_victim: contains only the pid of the victim. Useful for memory-related tracing and analysis. The other events in this patch are of lesser importance, but also are fairly straightforward - clocks and priority for frequency/power tracing. Small extra change: sched_process_free was only relabeled in the tracefs block, so I've added it to debugfs to keep them in sync. (I wonder whether debugfs is even necessary at this point... but that's outside of scope here.) See the attached bug for a longer explanation. There will also be a separate patch for system/frameworks/native/atrace/atrace.rc for the Unix file permissions of these files. Bug: 179788446 Tested: I did not have access to a "user" build, but I've manually checked the labels of events/.../enable tracefs files via ls -Z, and strace'd traced_probes on a hacky debug build where I commented out its SELinux allow-rule for debugfs_tracing_debug. Change-Id: I15a9cb33950718757e3ecbd7c71de23b25f85f1d
2021-02-14 15:26:35 +01:00
genfscon tracefs /events/sched/sched_pi_setprio/ u:object_r:debugfs_tracing:s0
Allow perfetto traced_probes to access tracefs on user Allows the traced_probes daemon to access the core ftrace functionalities on user builds. Specifically this involves: - Whitelisting the per_cpu/ subdirectory to access: 1) trace_pipe_raw file to allow perfetto to read the raw ftrace buffer (rather than the text-based /trace endpoint) 2) cpuX/stats and cpuX/buffer_size_kb that allow to tune the buffer size per-cpu pipe and to get basic statistics about the ftrace buffer (#events, overruns) - Whitelistiing the full event directories rather than the /enable files. This gives also access to the /format files for the events that are already enabled on user builds. /format files simply describe the memory layout of the binary logs. Example: https://ghostbin.com/paste/f8m4k This still does NOT allow enabling the events labeled as "_debug" (mostly events that return activity on inodes). We'll deal with that separately as soon as we get a POC of inode resolution and a sensible blacklist/whitelist model. Bug: 70942310 Change-Id: Ic15cca0a9d7bc0e45aa48097a94eadef44c333f8
2018-02-09 12:15:22 +01:00
genfscon tracefs /events/cgroup/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/power/cpu_frequency/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/power/cpu_idle/ u:object_r:debugfs_tracing:s0
tracing: allow select tracepoints on release builds This primarily affects perfetto's traced_probes and shell-invoked binaries like atrace, but also anyone with access to "debugfs_tracing". These tracepoints are being actively collected in internal tracing, so we would like to also make them available on release builds, as they should be a source of useful system information there as well. The ones we definitely need: * sched_waking, sched_wakeup_new: both are similar to the already-allowed sched_wakeup. The first differs in which exact process context it occurs in, and the latter is the wakeup events of only the fresh tasks. * oom/mark_victim: contains only the pid of the victim. Useful for memory-related tracing and analysis. The other events in this patch are of lesser importance, but also are fairly straightforward - clocks and priority for frequency/power tracing. Small extra change: sched_process_free was only relabeled in the tracefs block, so I've added it to debugfs to keep them in sync. (I wonder whether debugfs is even necessary at this point... but that's outside of scope here.) See the attached bug for a longer explanation. There will also be a separate patch for system/frameworks/native/atrace/atrace.rc for the Unix file permissions of these files. Bug: 179788446 Tested: I did not have access to a "user" build, but I've manually checked the labels of events/.../enable tracefs files via ls -Z, and strace'd traced_probes on a hacky debug build where I commented out its SELinux allow-rule for debugfs_tracing_debug. Change-Id: I15a9cb33950718757e3ecbd7c71de23b25f85f1d
2021-02-14 15:26:35 +01:00
genfscon tracefs /events/power/clock_enable/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/power/clock_disable/ u:object_r:debugfs_tracing:s0
Allow perfetto traced_probes to access tracefs on user Allows the traced_probes daemon to access the core ftrace functionalities on user builds. Specifically this involves: - Whitelisting the per_cpu/ subdirectory to access: 1) trace_pipe_raw file to allow perfetto to read the raw ftrace buffer (rather than the text-based /trace endpoint) 2) cpuX/stats and cpuX/buffer_size_kb that allow to tune the buffer size per-cpu pipe and to get basic statistics about the ftrace buffer (#events, overruns) - Whitelistiing the full event directories rather than the /enable files. This gives also access to the /format files for the events that are already enabled on user builds. /format files simply describe the memory layout of the binary logs. Example: https://ghostbin.com/paste/f8m4k This still does NOT allow enabling the events labeled as "_debug" (mostly events that return activity on inodes). We'll deal with that separately as soon as we get a POC of inode resolution and a sensible blacklist/whitelist model. Bug: 70942310 Change-Id: Ic15cca0a9d7bc0e45aa48097a94eadef44c333f8
2018-02-09 12:15:22 +01:00
genfscon tracefs /events/power/clock_set_rate/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/power/cpu_frequency_limits/ u:object_r:debugfs_tracing:s0
Allow perfetto to access gpu_frequency tracepoint in user This will allow Perfetto to capture GPU frequency changes on the target, which is useful to graphics developers using Perfetto to profile graphics HW usage. Bug: 136062452 Change-Id: Idb7870b2f674f1359ef3b4487dbeff190b394248
2019-06-26 16:46:53 +02:00
genfscon tracefs /events/power/gpu_frequency/ u:object_r:debugfs_tracing:s0
Add additional sepolicy rules for gpuservice Allow gpuservice to access read/write BPF maps. Bug: b/213577594 Change-Id: I487754c008a53819715a6bfc5da10182d87de413
2022-01-17 17:34:03 +01:00
genfscon tracefs /events/power/gpu_work_period/ u:object_r:debugfs_tracing:s0
Allow Traceur to record the suspend_resume trace event This should be available in user and userdebug builds. Bug: 137289935 Test: Alongside atrace changes, recorded a trace using Traceur and verified that the tracepoints were included in the recorded trace in both user and userdebug builds. Change-Id: I6131557bdd0a298be9e75b39759599b189b9b988
2019-08-08 23:40:08 +02:00
genfscon tracefs /events/power/suspend_resume/ u:object_r:debugfs_tracing:s0
Allow perfetto traced_probes to access tracefs on user Allows the traced_probes daemon to access the core ftrace functionalities on user builds. Specifically this involves: - Whitelisting the per_cpu/ subdirectory to access: 1) trace_pipe_raw file to allow perfetto to read the raw ftrace buffer (rather than the text-based /trace endpoint) 2) cpuX/stats and cpuX/buffer_size_kb that allow to tune the buffer size per-cpu pipe and to get basic statistics about the ftrace buffer (#events, overruns) - Whitelistiing the full event directories rather than the /enable files. This gives also access to the /format files for the events that are already enabled on user builds. /format files simply describe the memory layout of the binary logs. Example: https://ghostbin.com/paste/f8m4k This still does NOT allow enabling the events labeled as "_debug" (mostly events that return activity on inodes). We'll deal with that separately as soon as we get a POC of inode resolution and a sensible blacklist/whitelist model. Bug: 70942310 Change-Id: Ic15cca0a9d7bc0e45aa48097a94eadef44c333f8
2018-02-09 12:15:22 +01:00
genfscon tracefs /events/cpufreq_interactive/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/vmscan/mm_vmscan_direct_reclaim_begin/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/vmscan/mm_vmscan_direct_reclaim_end/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/vmscan/mm_vmscan_kswapd_wake/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/vmscan/mm_vmscan_kswapd_sleep/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/binder/binder_transaction/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/binder/binder_transaction_received/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/binder/binder_lock/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/binder/binder_locked/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/binder/binder_unlock/ u:object_r:debugfs_tracing:s0
Ensure that memory and binder_driver tracepoints are available in user builds Bug: 123367055 Test: used Traceur to take a trace on a user build and verified the tracepoints are in the resultant trace Change-Id: I39e963762bf2b9f0e427ee217a3b2a246f970902
2019-01-24 22:55:21 +01:00
genfscon tracefs /events/binder/binder_transaction_alloc_buf/ u:object_r:debugfs_tracing:s0
tracing: allow select tracepoints on release builds This primarily affects perfetto's traced_probes and shell-invoked binaries like atrace, but also anyone with access to "debugfs_tracing". These tracepoints are being actively collected in internal tracing, so we would like to also make them available on release builds, as they should be a source of useful system information there as well. The ones we definitely need: * sched_waking, sched_wakeup_new: both are similar to the already-allowed sched_wakeup. The first differs in which exact process context it occurs in, and the latter is the wakeup events of only the fresh tasks. * oom/mark_victim: contains only the pid of the victim. Useful for memory-related tracing and analysis. The other events in this patch are of lesser importance, but also are fairly straightforward - clocks and priority for frequency/power tracing. Small extra change: sched_process_free was only relabeled in the tracefs block, so I've added it to debugfs to keep them in sync. (I wonder whether debugfs is even necessary at this point... but that's outside of scope here.) See the attached bug for a longer explanation. There will also be a separate patch for system/frameworks/native/atrace/atrace.rc for the Unix file permissions of these files. Bug: 179788446 Tested: I did not have access to a "user" build, but I've manually checked the labels of events/.../enable tracefs files via ls -Z, and strace'd traced_probes on a hacky debug build where I commented out its SELinux allow-rule for debugfs_tracing_debug. Change-Id: I15a9cb33950718757e3ecbd7c71de23b25f85f1d
2021-02-14 15:26:35 +01:00
genfscon tracefs /events/binder/binder_set_priority/ u:object_r:debugfs_tracing:s0
tracing: SELinux access to a couple of more binder events * `binder_command`: Reported by the kernel every time a userspace thread sends a binder command to the binder kernel driver. Only the command type (e.g. `BC_TRANSACTION`, `BC_REPLY`) is reported, the contents are not disclosed. * `binder_command`: Reported by the kernel every time the binder driver sends a command to a userspace thread. Only the command type (e.g. `BR_TRANSACTION_COMPLETE`, `BR_FAILED_REPLY`) is reported, the contents are not disclosed. Bug: 295124679 Change-Id: I0dcfda7eba892abca3145188b9168a6b3a2ee0e8
2023-09-25 11:10:55 +02:00
genfscon tracefs /events/binder/binder_command/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/binder/binder_return/ u:object_r:debugfs_tracing:s0
Allow perfetto traced_probes to access tracefs on user Allows the traced_probes daemon to access the core ftrace functionalities on user builds. Specifically this involves: - Whitelisting the per_cpu/ subdirectory to access: 1) trace_pipe_raw file to allow perfetto to read the raw ftrace buffer (rather than the text-based /trace endpoint) 2) cpuX/stats and cpuX/buffer_size_kb that allow to tune the buffer size per-cpu pipe and to get basic statistics about the ftrace buffer (#events, overruns) - Whitelistiing the full event directories rather than the /enable files. This gives also access to the /format files for the events that are already enabled on user builds. /format files simply describe the memory layout of the binary logs. Example: https://ghostbin.com/paste/f8m4k This still does NOT allow enabling the events labeled as "_debug" (mostly events that return activity on inodes). We'll deal with that separately as soon as we get a POC of inode resolution and a sensible blacklist/whitelist model. Bug: 70942310 Change-Id: Ic15cca0a9d7bc0e45aa48097a94eadef44c333f8
2018-02-09 12:15:22 +01:00
genfscon tracefs /events/lowmemorykiller/ u:object_r:debugfs_tracing:s0
Add sync and fence tracepoints to user-visible list of tracepoints. The 'sync' tracepoint was updated to be 'fence' in kernel 4.9, so this change also adds that one to the list. Bug: 79935503 Test: Took a trace using 'sync' in user mode and saw the tracepoints being saved. Change-Id: I793c6f54cd9364f33853983f8c5dfb28b98c2708 Merged-In: I793c6f54cd9364f33853983f8c5dfb28b98c2708
2018-05-17 03:47:42 +02:00
genfscon tracefs /events/sync/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/fence/ u:object_r:debugfs_tracing:s0
Update fence event path for kernel 4.10+ The sysfs path for controlling dma fence events changed yet again in Linux 4.10, see kernel commit f54d1867005c3. Test: adb shell atrace --list_categories | grep sync Change-Id: Id6332f794ee4e350c936e1e777e9d94fc7cd6d11
2019-03-01 00:22:00 +01:00
genfscon tracefs /events/dma_fence/ u:object_r:debugfs_tracing:s0
Add filemap events for iorapd iorapd needs to access these events on-device through perfetto. Bug: 122606712 Bug: 72170747 Change-Id: I819dc9b79e85c3e261859d125c680a50737351da
2019-01-16 00:13:27 +01:00
genfscon tracefs /events/filemap/mm_filemap_add_to_page_cache/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/filemap/mm_filemap_delete_from_page_cache/ u:object_r:debugfs_tracing:s0
Ensure that memory and binder_driver tracepoints are available in user builds Bug: 123367055 Test: used Traceur to take a trace on a user build and verified the tracepoints are in the resultant trace Change-Id: I39e963762bf2b9f0e427ee217a3b2a246f970902
2019-01-24 22:55:21 +01:00
genfscon tracefs /events/kmem/rss_stat/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/kmem/ion_heap_grow/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/kmem/ion_heap_shrink/ u:object_r:debugfs_tracing:s0
Enable tracing of the ion/ion_stat events These events supersede the ion_heap_grow / ion_heap_shrink events on 4.19+ kernels. Bug: 154302786 Test: build, run on cuttlefish with new kernel, ls -lZ /sys/kernel/tracing/events/ion/ion_stat/enable Change-Id: I262d8c3269d4261701361ad4b1bdc322f1f03969
2020-04-24 11:10:35 +02:00
genfscon tracefs /events/ion/ion_stat/ u:object_r:debugfs_tracing:s0
Allow Traceur record the mm_event trace event. Bug: 150130660 Test: Took a trace with Traceur and verified mm_event records were included when the memory category was enabled. Change-Id: Iea39467d0d37d12a78fbde57b8d9649fad45b652
2020-03-31 01:21:42 +02:00
genfscon tracefs /events/mm_event/mm_event_record/ u:object_r:debugfs_tracing:s0
Ensure that memory and binder_driver tracepoints are available in user builds Bug: 123367055 Test: used Traceur to take a trace on a user build and verified the tracepoints are in the resultant trace Change-Id: I39e963762bf2b9f0e427ee217a3b2a246f970902
2019-01-24 22:55:21 +01:00
genfscon tracefs /events/oom/oom_score_adj_update/ u:object_r:debugfs_tracing:s0
tracing: allow select tracepoints on release builds This primarily affects perfetto's traced_probes and shell-invoked binaries like atrace, but also anyone with access to "debugfs_tracing". These tracepoints are being actively collected in internal tracing, so we would like to also make them available on release builds, as they should be a source of useful system information there as well. The ones we definitely need: * sched_waking, sched_wakeup_new: both are similar to the already-allowed sched_wakeup. The first differs in which exact process context it occurs in, and the latter is the wakeup events of only the fresh tasks. * oom/mark_victim: contains only the pid of the victim. Useful for memory-related tracing and analysis. The other events in this patch are of lesser importance, but also are fairly straightforward - clocks and priority for frequency/power tracing. Small extra change: sched_process_free was only relabeled in the tracefs block, so I've added it to debugfs to keep them in sync. (I wonder whether debugfs is even necessary at this point... but that's outside of scope here.) See the attached bug for a longer explanation. There will also be a separate patch for system/frameworks/native/atrace/atrace.rc for the Unix file permissions of these files. Bug: 179788446 Tested: I did not have access to a "user" build, but I've manually checked the labels of events/.../enable tracefs files via ls -Z, and strace'd traced_probes on a hacky debug build where I commented out its SELinux allow-rule for debugfs_tracing_debug. Change-Id: I15a9cb33950718757e3ecbd7c71de23b25f85f1d
2021-02-14 15:26:35 +01:00
genfscon tracefs /events/oom/mark_victim/ u:object_r:debugfs_tracing:s0
Ensure that memory and binder_driver tracepoints are available in user builds Bug: 123367055 Test: used Traceur to take a trace on a user build and verified the tracepoints are in the resultant trace Change-Id: I39e963762bf2b9f0e427ee217a3b2a246f970902
2019-01-24 22:55:21 +01:00
genfscon tracefs /events/task/task_rename/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/task/task_newtask/ u:object_r:debugfs_tracing:s0
Allow reading /d/tracing/events/ftrace/print on user Allow traced to read the format file for the print event on user. This does not allow traced to enable any event it could not already as the events under /d/tracing/events/ftrace/ are special and are always enabled. Being able to read the format file means we don't have to speculate on the id and layout of the print event. Bug: 122471587 Test: atest CtsPerfettoTestCases:PerfettoTest#TestFtraceFlush Change-Id: I39379f2fa13ab80bf3d14e244066c2ba1bd4d11b
2019-02-01 17:38:23 +01:00
genfscon tracefs /events/ftrace/print/ u:object_r:debugfs_tracing:s0
GPU Memory: add sepolicy rules around bpf for gpuservice 1. Allow gpuservice to access tracepoint id 2. Allow gpuservice to access bpf program 3. Allow gpuservice to attach bpf program to tracepoint 4. Allow gpuservice to access bpf filesystem 5. Allow gpuservice to run bpf program and read map through bpfloader 6. Allow gpuservice to check a property to ensure bpf program loaded Bug: 136023082 Test: adb shell dumpsys gpu --gpumem Change-Id: Ic808a7e452b71c54908cdff806f41f51ab66ffd8
2020-02-19 07:58:26 +01:00
genfscon tracefs /events/gpu_mem/gpu_mem_total u:object_r:debugfs_tracing:s0
Allow thermal tracing in user build Bug: 160818586 Test: Build and check label Change-Id: I30b13af585daaf9a85f45ab3b41d0b5e060b4bf4
2020-07-13 19:24:29 +02:00
genfscon tracefs /events/thermal/thermal_temperature/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/thermal/cdev_update/ u:object_r:debugfs_tracing:s0
label cpuhp trace points Bug: 162568440 Test: Build Change-Id: Id8ed398b3fffd678fff253289674f8e2b9e906c1
2020-07-31 10:12:06 +02:00
genfscon tracefs /events/cpuhp/cpuhp_enter/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/cpuhp/cpuhp_exit/ u:object_r:debugfs_tracing:s0
Grant access to cpuhp_pause trace point Bug: 172971380 Test: Build Change-Id: If09139990ef396c8de4d8990aae45ae483f2fb31
2021-03-18 00:43:53 +01:00
genfscon tracefs /events/cpuhp/cpuhp_pause/ u:object_r:debugfs_tracing:s0
sepolicy: allow tracing access to irq/ipi irq and ipi tracepoint are required for Traceur's irq category. Bug: 153486528 Test: manually captured a Traceur trace on user builds, verified that the tracepoints were present. Change-Id: I2f42fc293e87e2a3567ab55f7533fe6a5d7852bf
2020-10-05 22:20:35 +02:00
genfscon tracefs /events/ipi/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/irq/ u:object_r:debugfs_tracing:s0
tracing: allow select tracepoints on release builds This primarily affects perfetto's traced_probes and shell-invoked binaries like atrace, but also anyone with access to "debugfs_tracing". These tracepoints are being actively collected in internal tracing, so we would like to also make them available on release builds, as they should be a source of useful system information there as well. The ones we definitely need: * sched_waking, sched_wakeup_new: both are similar to the already-allowed sched_wakeup. The first differs in which exact process context it occurs in, and the latter is the wakeup events of only the fresh tasks. * oom/mark_victim: contains only the pid of the victim. Useful for memory-related tracing and analysis. The other events in this patch are of lesser importance, but also are fairly straightforward - clocks and priority for frequency/power tracing. Small extra change: sched_process_free was only relabeled in the tracefs block, so I've added it to debugfs to keep them in sync. (I wonder whether debugfs is even necessary at this point... but that's outside of scope here.) See the attached bug for a longer explanation. There will also be a separate patch for system/frameworks/native/atrace/atrace.rc for the Unix file permissions of these files. Bug: 179788446 Tested: I did not have access to a "user" build, but I've manually checked the labels of events/.../enable tracefs files via ls -Z, and strace'd traced_probes on a hacky debug build where I commented out its SELinux allow-rule for debugfs_tracing_debug. Change-Id: I15a9cb33950718757e3ecbd7c71de23b25f85f1d
2021-02-14 15:26:35 +01:00
genfscon tracefs /events/clk/clk_enable/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/clk/clk_disable/ u:object_r:debugfs_tracing:s0
genfscon tracefs /events/clk/clk_set_rate/ u:object_r:debugfs_tracing:s0
Use a whitelisting strategy for tracefs. This changes tracefs files to be default-enabled in debug mode, but default-disabled with specific files enabled in user mode. Bug: 64762598 Test: Successfully took traces in user mode. Change-Id: I572ea22253e0c1e42065fbd1d2fd7845de06fceb
2018-01-31 03:14:45 +01:00
SEPolicy changes to allow kcov access in userdebug. This includes the SELinux policy changes to allow for kcov access in userdebug builds for coverage-guided kernel fuzzing. Bug: 117990869 Test: Ran syzkaller with Android untrusted_app sandbox with coverage. Change-Id: I1fcaad447c7cdc2a3360383b5dcd76e8a0f93f09
2018-11-29 19:37:18 +01:00
genfscon debugfs /kcov u:object_r:debugfs_kcov:s0
Add sepolicy for the securityfs mount type. See discussion in aosp/1233645. There was a concern about this filesystem automounting when enabled, so this change adds sepolicy to preemptively lock it down. I'm not confident it actually automounts. If it does, it'll land in /sys/kernel/security, which is also protected with the sysfs policy. Test: Builds Bug: 148102533 Change-Id: I78a246a5c18953f2471f84367ab383afb2742908
2020-02-19 00:26:44 +01:00
genfscon securityfs / u:object_r:securityfs:s0
Add sepolicy for binderfs /dev/binder, /dev/hwbinder and /dev/vndbinder are relocating to /dev/binderfs/binder /dev/binderfs/hwbinder and /dev/binderfs/vndbinder. This patch adds the sepolicy to allow the switch. The following are some of the denials that get taken care of by this patch(there are too many to copy). audit(1575835230.863:16): avc: denied { search } for comm="servicemanager" name="/" dev="binder" ino=1 scontext=u:r:servicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir permissive=1 audit(1575835230.863:16): avc: denied { read } for comm="servicemanager" name="binder" dev="binder" ino=4 scontext=u:r:servicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.863:17): avc: denied { write } for comm="servicemanager" name="binder" dev="binder" ino=4 scontext=u:r:servicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.863:17): avc: denied { open } for comm="servicemanager" path="/dev/binderfs/binder" dev="binder" ino=4 scontext=u:r:servicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.863:18): avc: denied { ioctl } for comm="servicemanager" path="/dev/binderfs/binder" dev="binder" ino=4 ioctlcmd=0x6209 scontext=u:r:servicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.863:19): avc: denied { map } for comm="servicemanager" path="/dev/binderfs/binder" dev="binder" ino=4 scontext=u:r:servicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.867:20): avc: denied { search } for comm="vndservicemanag" name="/" dev="binder" ino=1 scontext=u:r:vndservicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir permissive=1 audit(1575835230.867:20): avc: denied { read } for comm="vndservicemanag" name="vndbinder" dev="binder" ino=6 scontext=u:r:vndservicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.867:21): avc: denied { write } for comm="vndservicemanag" name="vndbinder" dev="binder" ino=6 scontext=u:r:vndservicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.867:21): avc: denied { open } for comm="vndservicemanag" path="/dev/binderfs/vndbinder" dev="binder" ino=6 scontext=u:r:vndservicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.867:22): avc: denied { ioctl } for comm="vndservicemanag" path="/dev/binderfs/vndbinder" dev="binder" ino=6 ioctlcmd=0x6209 scontext=u:r:vndservicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.867:23): avc: denied { map } for comm="vndservicemanag" path="/dev/binderfs/vndbinder" dev="binder" ino=6 scontext=u:r:vndservicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.871:25): avc: denied { search } for comm="hwservicemanage" name="/" dev="binder" ino=1 scontext=u:r:hwservicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir permissive=1 audit(1575835238.351:72): avc: denied { search } for comm="android.hardwar" name="proc" dev="binder" ino=1048586 scontext=u:r:hal_configstore_default:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir permissive=1 Test: boots without any issues when binderfs in enabled. Bug: 136497735 Change-Id: Ib0f8f2156c960eb7b394dd7c79ae96c7da8bc213
2019-12-08 21:11:01 +01:00
genfscon binder /binder u:object_r:binder_device:s0
genfscon binder /hwbinder u:object_r:hwbinder_device:s0
genfscon binder /vndbinder u:object_r:vndbinder_device:s0
genfscon binder /binder_logs u:object_r:binderfs_logs:s0
genfscon binder /binder_logs/proc u:object_r:binderfs_logs_proc:s0
Allow system server read binderfs stats When receiving the binder transaction errors reported by Android applications, AMS needs a way to verify that information. Currently Linux kernel doesn't provide such an API. Use binderfs instead until kernel binder driver adds that functionality in the future. Bug: 199336863 Test: send binder calls to frozen apps and check logcat Test: take bugreport and check binder stats logs Change-Id: I3bab3d4f35616b4a7b99d6ac6dc79fb86e7f28d4
2023-10-12 06:48:19 +02:00
genfscon binder /binder_logs/stats u:object_r:binderfs_logs_stats:s0
Allow system_server to read binderfs state file This is for more information on binder threads during ANRs. Test: adb shell am hang Bug: 316970771 Change-Id: I905c8b605540aabb7463cb0e1b3a9a8b07f8d5cb
2024-01-31 18:48:43 +01:00
genfscon binder /binder_logs/transactions u:object_r:binderfs_logs_transactions:s0
Update transaction log permissions. I locked down binderfs in Android V (this release still), but part of it was opened up too much, so transactions restricted to userdebug. transaction_log and failed_transaction_log are not used in AOSP, but they are requested by partners. Bug: 316970771 for transactions Bug: 336711420 for request to open up transaction history logs Test: boot, bugreport, also: :) adb shell ls -Z /dev/binderfs/binder_logs u:object_r:binderfs_logs_transaction_history:s0 failed_transaction_log u:object_r:binderfs_logs_proc:s0 proc u:object_r:binderfs_logs:s0 state u:object_r:binderfs_logs_stats:s0 stats u:object_r:binderfs_logs_transaction_history:s0 transaction_log u:object_r:binderfs_logs_transactions:s0 transactions :) adb shell cat /dev/binderfs/binder_logs/transaction_log 10058502: reply from 6450:8668 to 6766:6766 context binder node 0 handle -1 size 36:0 ret 0/0 l=0 10058503: call from 6766:6766 to 6450:0 context binder node 199747 handle 23 size 116:0 ret 0/0 l=0 10058504: reply from 6450:8668 to 6766:6766 context binder node 0 handle -1 size 12:0 ret 0/0 l=0 10058505: call from 6766:6766 to 6450:0 context binder node 199747 handle 23 size 84:0 ret 0/0 l=0 ... :) adb shell cat /dev/binderfs/binder_logs/failed_transaction_log 26418: reply from 584:1568 to 0:0 context binder node 0 handle -1 size 20:0 ret 29189/0 l=3194 57265: async from 2978:4304 to 3039:0 context binder node 40111 handle 6 size 96:0 ret 29189/-3 l=3465 57269: call from 4437:4613 to 670:0 context binder node 57183 handle 44 size 116:0 ret 29189/-3 l=3465 57288: async from 4252:4450 to 3039:0 context binder node 34895 handle 1 size 92:0 ret 29189/-3 l=3465 ... Change-Id: I73e570dee8e59e76acaf0def615701e0e85e207f
2024-05-18 00:30:40 +02:00
genfscon binder /binder_logs/transaction_log u:object_r:binderfs_logs_transaction_history:s0
genfscon binder /binder_logs/failed_transaction_log u:object_r:binderfs_logs_transaction_history:s0
sepolicy: allow access to binderfs feature files The binder driver now advertises the features it supports through individual files under /dev/binderfs/features/*. Let all domains have access to these files to determine how to interact with the driver. Bug: 191910201 Tested: clients are able to read feature files via libbinder Signed-off-by: Carlos Llamas <cmllamas@google.com> Change-Id: Ice5de9efee74e571ef0a23ce093af162fc3b276e
2022-02-24 17:15:56 +01:00
genfscon binder /features u:object_r:binderfs_features:s0
SEPolicy changes to allow kcov access in userdebug. This includes the SELinux policy changes to allow for kcov access in userdebug builds for coverage-guided kernel fuzzing. Bug: 117990869 Test: Ran syzkaller with Android untrusted_app sandbox with coverage. Change-Id: I1fcaad447c7cdc2a3360383b5dcd76e8a0f93f09
2018-11-29 19:37:18 +01:00
Support for ocontexts per device. ocontexts was split up into 4 files: 1.fs_use 2.genfs_contexts 3.initial_sid_contexts 4.port_contexts Each file has their respective declerations in them. Devices, in their respective device directory, can now specify sepolicy.fs_use, sepolicy.genfs_contexts, sepolicy.port_contexts, and sepolicy.initial_sid_contexts. These declerations will be added right behind their respective sepolicy counterparts in the concatenated configuration file.
2012-07-12 01:46:38 +02:00
genfscon inotifyfs / u:object_r:inotify:s0
Rename sdcard_internal/external types. Rename sdcard_internal/external types to fuse and vfat respectively to make it clear that they are assigned to any fuse or vfat filesystem by default (absent a context= mount option) and do not necessarily represent the SDcard. The sdcard_type attribute is still assigned to both types and can still be used in allow rules to permit access to either the internal or external SDcard. Define type aliases for the old names to preserve compatibility on policy reload and for device-specific policies that may not yet be updated. Change-Id: I8d91a8c4c1342b94e4f1bb62ca7ffd2ca4b06ba1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-07-08 20:45:09 +02:00
genfscon vfat / u:object_r:vfat:s0
Add sepolicy for binderfs /dev/binder, /dev/hwbinder and /dev/vndbinder are relocating to /dev/binderfs/binder /dev/binderfs/hwbinder and /dev/binderfs/vndbinder. This patch adds the sepolicy to allow the switch. The following are some of the denials that get taken care of by this patch(there are too many to copy). audit(1575835230.863:16): avc: denied { search } for comm="servicemanager" name="/" dev="binder" ino=1 scontext=u:r:servicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir permissive=1 audit(1575835230.863:16): avc: denied { read } for comm="servicemanager" name="binder" dev="binder" ino=4 scontext=u:r:servicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.863:17): avc: denied { write } for comm="servicemanager" name="binder" dev="binder" ino=4 scontext=u:r:servicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.863:17): avc: denied { open } for comm="servicemanager" path="/dev/binderfs/binder" dev="binder" ino=4 scontext=u:r:servicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.863:18): avc: denied { ioctl } for comm="servicemanager" path="/dev/binderfs/binder" dev="binder" ino=4 ioctlcmd=0x6209 scontext=u:r:servicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.863:19): avc: denied { map } for comm="servicemanager" path="/dev/binderfs/binder" dev="binder" ino=4 scontext=u:r:servicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.867:20): avc: denied { search } for comm="vndservicemanag" name="/" dev="binder" ino=1 scontext=u:r:vndservicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir permissive=1 audit(1575835230.867:20): avc: denied { read } for comm="vndservicemanag" name="vndbinder" dev="binder" ino=6 scontext=u:r:vndservicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.867:21): avc: denied { write } for comm="vndservicemanag" name="vndbinder" dev="binder" ino=6 scontext=u:r:vndservicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.867:21): avc: denied { open } for comm="vndservicemanag" path="/dev/binderfs/vndbinder" dev="binder" ino=6 scontext=u:r:vndservicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.867:22): avc: denied { ioctl } for comm="vndservicemanag" path="/dev/binderfs/vndbinder" dev="binder" ino=6 ioctlcmd=0x6209 scontext=u:r:vndservicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.867:23): avc: denied { map } for comm="vndservicemanag" path="/dev/binderfs/vndbinder" dev="binder" ino=6 scontext=u:r:vndservicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=chr_file permissive=1 audit(1575835230.871:25): avc: denied { search } for comm="hwservicemanage" name="/" dev="binder" ino=1 scontext=u:r:hwservicemanager:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir permissive=1 audit(1575835238.351:72): avc: denied { search } for comm="android.hardwar" name="proc" dev="binder" ino=1048586 scontext=u:r:hal_configstore_default:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir permissive=1 Test: boots without any issues when binderfs in enabled. Bug: 136497735 Change-Id: Ib0f8f2156c960eb7b394dd7c79ae96c7da8bc213
2019-12-08 21:11:01 +01:00
genfscon binder / u:object_r:binderfs:s0
Add exFAT support; unify behind "sdcard_type". We're adding support for OEMs to ship exFAT, which behaves identical to vfat. Some rules have been manually enumerating labels related to these "public" volumes, so unify them all behind "sdcard_type". Test: atest Bug: 67822822 Change-Id: I09157fd1fc666ec5d98082c6e2cefce7c8d3ae56
2018-03-30 20:22:54 +02:00
genfscon exfat / u:object_r:exfat:s0
Support for ocontexts per device. ocontexts was split up into 4 files: 1.fs_use 2.genfs_contexts 3.initial_sid_contexts 4.port_contexts Each file has their respective declerations in them. Devices, in their respective device directory, can now specify sepolicy.fs_use, sepolicy.genfs_contexts, sepolicy.port_contexts, and sepolicy.initial_sid_contexts. These declerations will be added right behind their respective sepolicy counterparts in the concatenated configuration file.
2012-07-12 01:46:38 +02:00
genfscon debugfs / u:object_r:debugfs:s0
Rename sdcard_internal/external types. Rename sdcard_internal/external types to fuse and vfat respectively to make it clear that they are assigned to any fuse or vfat filesystem by default (absent a context= mount option) and do not necessarily represent the SDcard. The sdcard_type attribute is still assigned to both types and can still be used in allow rules to permit access to either the internal or external SDcard. Define type aliases for the old names to preserve compatibility on policy reload and for device-specific policies that may not yet be updated. Change-Id: I8d91a8c4c1342b94e4f1bb62ca7ffd2ca4b06ba1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-07-08 20:45:09 +02:00
genfscon fuse / u:object_r:fuse:s0
Adds support for fuseblk binaries. This is a rather large, single change to the SEPolicies, as fuseblk required multiple new domains. The goal is to allow any fuseblk drivers to also use the same sepolicy. Note the compartmentalized domain for sys_admin and mount/unmount permissions. Bug: 254407246 Test: Extensive testing with an ADT-4 and NTFS USB drives. Change-Id: I6619ac77ce44ba60edd6ab10e8436a8712459b48
2023-01-17 18:22:34 +01:00
genfscon fuseblk / u:object_r:fuseblk:s0
sepolicy: Add policy for sdcardfs and configfs Change-Id: I4c318efba76e61b6ab0be9491c352f281b1c2bff Bug: 19160983
2016-03-02 01:13:50 +01:00
genfscon configfs / u:object_r:configfs:s0
genfscon sdcardfs / u:object_r:sdcardfs:s0
Label esdfs as sdcardfs Test: esdfs should be mountable and usable with selinux on Bug: 63876697 Change-Id: I7a1d96d3f0d0a6dbc1c98f0c4a96264938011b5e
2017-10-24 03:20:09 +02:00
genfscon esdfs / u:object_r:sdcardfs:s0
pstore file system labeling pstore(persistent store) have been applied since kernel 3.5 We need to label the pstore-fs in order to use Android with kernel 3.5 or upper version. My kernel version is 3.10 and I got the below denial log when I ran the "df" command on the adb shell. type=1400 msg=audit(1388540540.220:18): avc: denied { getattr } for pid=7296 comm="df" name="/" dev="pstore" ino=7703 scontext=u:r:init:s0 tcontext=u:object_r:unlabeled:s0 tclass=filesystem And the below log is also shown during booting type=1400 msg=audit(1388539193.750:4): avc: denied { mount } for pid=2844 comm="mount" name="/" dev="pstore" ino=11393 scontext=u:r:init_shell:s0 tcontext=u:object_r:unlabeled:s0 tclass=filesystem Change-Id: Iaba543d44565c4f20a77a95b9573a628bbd3fd34
2014-04-10 06:32:54 +02:00
genfscon pstore / u:object_r:pstorefs:s0
Label /dev/usb-ffs/adb functionfs Newer adbd versions use functionfs instead of a custom adb usb gadget. Make sure the functionfs filesystem is properly labeled, and that adbd has access to the functionfs files. Once labeled, this addresses the following denials: <12>[ 16.127191] type=1400 audit(949060866.189:4): avc: denied { read write } for pid=223 comm="adbd" name="ep0" dev="functionfs" ino=5489 scontext=u:r:adbd:s0 tcontext=u:object_r:functionfs:s0 tclass=file <12>[ 16.127406] type=1400 audit(949060866.189:5): avc: denied { open } for pid=223 comm="adbd" path="/dev/usb-ffs/adb/ep0" dev="functionfs" ino=5489 scontext=u:r:adbd:s0 tcontext=u:object_r:functionfs:s0 tclass=file <12>[ 377.366011] type=1400 audit(949061227.419:16): avc: denied { ioctl } for pid=225 comm="adbd" path="/dev/usb-ffs/adb/ep2" dev="functionfs" ino=5564 scontext=u:r:adbd:s0 tcontext=u:object_r:functionfs:s0 tclass=file Change-Id: Iee8b522e48b4d677fd12f7c83dbc7ffbc9543ad2
2014-04-15 23:53:05 +02:00
genfscon functionfs / u:object_r:functionfs:s0
label usbfs Right now usbfs doesn't have any labels, generating the following kernel warnings: <7>[ 3.009582] SELinux: initialized (dev usbfs, type usbfs), not configured for labeling and the occasional SELinux unlabeled auditallow logs: <4>[ 285.579254] type=1400 audit(1402010345.094:16): avc: granted { search } for pid=371 comm="qcks" name="/" dev="usbfs" ino=15794 scontext=u:r:kickstart:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir <4>[ 285.632354] type=1400 audit(1402010345.154:18): avc: granted { search } for pid=371 comm="qcks" name="001" dev="usbfs" ino=15796 scontext=u:r:kickstart:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir Make sure usbfs is assigned via genfscon Change-Id: I7191f2584014ba55a3c3a98e7efd0350dc958782
2014-06-07 16:31:31 +02:00
genfscon usbfs / u:object_r:usbfs:s0
genfs_contexts: provide a label for binfmt_misc Provide a default label for binfmt_misc. This is not used by the core policy, although it may be used in device specific policy. Bug: 20152930 Change-Id: Id51d69333bfeda40720d0e65e1539fab0b6e1e95
2015-04-11 02:42:49 +02:00
genfscon binfmt_misc / u:object_r:binfmt_miscfs:s0
add fs_bpf_loader selinux type To be used for things that only the bpfloader should be access. Expected use case is for programs that the bpfloader should load, pin into the filesystem, *and* attach. [ie. no need for anything else to attach the programs] Test: TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I035d3fcbf6cee523e41cdde23b8edc13311a45e8
2022-12-01 15:45:35 +01:00
sepolicy: Allow mount cgroupv2 and bpf fs Some necessary sepolicy rule changes for init process to create directory, mount cgroupv2 module and mount bpf filesystem. Also allow netd to create and pin bpf object as files and read it back from file under the directory where bpf filesystem is mounted. Test: bpf maps show up under /sys/fs/bpf/ Change-Id: I579d04f60d7e20bd800d970cd28cd39fda9d20a0
2017-08-02 03:06:18 +02:00
genfscon bpf / u:object_r:fs_bpf:s0
add fs_bpf_loader selinux type To be used for things that only the bpfloader should be access. Expected use case is for programs that the bpfloader should load, pin into the filesystem, *and* attach. [ie. no need for anything else to attach the programs] Test: TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I035d3fcbf6cee523e41cdde23b8edc13311a45e8
2022-12-01 15:45:35 +01:00
genfscon bpf /loader u:object_r:fs_bpf_loader:s0
lmkd: Add sepolicy rules around bpf for lmkd LMKD needs to be able to attach BPF tracepoints. It needs to be able to access tracefs, attach and run bpf programs. Test: m Test: Verified no denials with lmkd and libmemevents integration Bug: 244232958 Change-Id: I57248b729c0f011937bec139930ca9d24ba91c3b Signed-off-by: Carlos Galo <carlosgalo@google.com>
2024-03-12 21:04:41 +01:00
genfscon bpf /map_bpfMemEvents_lmkd_rb u:object_r:fs_bpf_lmkd_memevents_rb:s0
much more finegrained bpf selinux privs for networking mainline Goal is to gain a better handle on who has access to which maps and to allow (with bpfloader changes to create in one directory and move into the target directory) per-map selection of selinux context, while still having reasonable defaults for stuff pinned directly into the target location. BPFFS (ie. /sys/fs/bpf) labelling is as follows: subdirectory selinux context mainline usecase / usable by / fs_bpf no (*) core operating system (ie. platform) /net_private fs_bpf_net_private yes, T+ network_stack /net_shared fs_bpf_net_shared yes, T+ network_stack & system_server /netd_readonly fs_bpf_netd_readonly yes, T+ network_stack & system_server & r/o to netd /netd_shared fs_bpf_netd_shared yes, T+ network_stack & system_server & netd [**] /tethering fs_bpf_tethering yes, S+ network_stack /vendor fs_bpf_vendor no, T+ vendor * initial support for bpf was added back in P, but things worked differently back then with no bpfloader, and instead netd doing stuff by hand, bpfloader with pinning into /sys/fs/bpf was (I believe) added in Q (and was definitely there in R) ** additionally bpf programs are accesible to netutils_wrapper for use by iptables xt_bpf extensions 'mainline yes' currently means shipped by the com.android.tethering apex, but this is really another case of bad naming, as it's really the 'networking/connectivity/tethering' apex / mainline module. Long term the plan is to merge a few other networking mainline modules into it (and maybe give it a saner name...). The reason for splitting net_private vs tethering is that: S+ must support 4.9+ kernels and S era bpfloader v0.2+ T+ must support 4.14+ kernels and T beta3 era bpfloader v0.13+ The kernel affects the intelligence of the in-kernel bpf verifier and the available bpf helper functions. Older kernels have a tendency to reject programs that newer kernels allow. / && /vendor are not shipped via mainline, so only need to work with the bpfloader that's part of the core os. Bug: 218408035 Test: TreeHugger, manually on cuttlefish Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: I674866ebe32aca4fc851818c1ffcbec12ac4f7d4 (cherry picked from commit 15715aea32b85c933778b97a46de6ccab42ca7fb)
2022-05-21 14:03:29 +02:00
genfscon bpf /net_private u:object_r:fs_bpf_net_private:s0
genfscon bpf /net_shared u:object_r:fs_bpf_net_shared:s0
genfscon bpf /netd_readonly u:object_r:fs_bpf_netd_readonly:s0
genfscon bpf /netd_shared u:object_r:fs_bpf_netd_shared:s0
lmkd: Add sepolicy rules around bpf for lmkd LMKD needs to be able to attach BPF tracepoints. It needs to be able to access tracefs, attach and run bpf programs. Test: m Test: Verified no denials with lmkd and libmemevents integration Bug: 244232958 Change-Id: I57248b729c0f011937bec139930ca9d24ba91c3b Signed-off-by: Carlos Galo <carlosgalo@google.com>
2024-03-12 21:04:41 +01:00
genfscon bpf /prog_bpfMemEvents_tracepoint_vmscan_mm_vmscan_direct_reclaim_begin_lmkd u:object_r:fs_bpf_lmkd_memevents_prog:s0
genfscon bpf /prog_bpfMemEvents_tracepoint_vmscan_mm_vmscan_direct_reclaim_end_lmkd u:object_r:fs_bpf_lmkd_memevents_prog:s0
apply 'fs_bpf_tethering' label to /sys/fs/bpf/tethering We want to label /sys/fs/bpf/tethering/... with a new label distinct from /sys/fs/bpf, as this will allow locking down the programs/maps tighter then is currently possible with the existing system. These programs and maps are provided via the tethering mainline module, and as such their number, names, key/value types, etc. are all prone to be changed by a tethering mainline module update. Test: atest, TreeHugger Signed-off-by: Maciej Żenczykowski <maze@google.com> Change-Id: Ifc4108d76a1106a936b941a3dda1abc5a65c05b0
2021-01-29 23:36:32 +01:00
genfscon bpf /tethering u:object_r:fs_bpf_tethering:s0
Allow BPF programs from vendor. Who needs all those context switches? bpfloader controls which types of vendor programs can be used. Bug: 140330870 Bug: 162057235 Test: successfully load bpf programs from vendor Change-Id: I36e4f6550da33fea5bad509470dfd39f301f13c8
2019-12-14 00:18:32 +01:00
genfscon bpf /vendor u:object_r:fs_bpf_vendor:s0
Rename uprobe_private to uprobestats for BPFs. There will not be separate private/public BPF directories. All BPFs will be under a uprobestats/ directory. Bug: 296108553 Test: m selinux_policy Change-Id: I00934cb14ead44c457ccee6957763dc01370dac6
2024-01-16 23:02:59 +01:00
genfscon bpf /uprobestats u:object_r:fs_bpf_uprobestats:s0
Reference in a new issue Copy permalink