tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/debuggerd.te

43 lines
1.7 KiB
Text
Raw Normal View History

SE Android policy.
2012-01-04 18:33:27 +01:00
# debugger interface
Create attribute for moving perms out of domain Motivation: Domain is overly permissive. Start removing permissions from domain and assign them to the domain_deprecated attribute. Domain_deprecated and domain can initially be assigned to all domains. The goal is to not assign domain_deprecated to new domains and to start removing domain_deprecated where it is not required or reassigning the appropriate permissions to the inheriting domain when necessary. Bug: 25433265 Change-Id: I8b11cb137df7bdd382629c98d916a73fe276413c
2015-11-03 18:54:39 +01:00
type debuggerd, domain, domain_deprecated;
SE Android policy.
2012-01-04 18:33:27 +01:00
type debuggerd_exec, exec_type, file_type;
init_daemon_domain(debuggerd)
Confine debuggerd, but leave it permissive for now. Change-Id: I09932cdd59f9d3a38e69df9fcfc34cc9cec1d8cd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:35 +01:00
typeattribute debuggerd mlstrustedsubject;
allow debuggerd self:capability { dac_override sys_ptrace chown kill fowner };
allow debuggerd self:capability2 { syslog };
allow debuggerd domain:dir r_dir_perms;
allow debuggerd domain:file r_file_perms;
Allow readlink(2) of /proc from debuggerd. Bug: 15021938 Change-Id: Id815640302efde3ae089da33ff8e2cb7daee8bfd
2014-05-17 04:14:13 +02:00
allow debuggerd domain:lnk_file read;
Define debuggerd class, permissions, and rules. Define a new class, permissions, and rules for the debuggerd SELinux MAC checks. Used by Ib317564e54e07cc21f259e75124b762ad17c6e16 for debuggerd. Change-Id: I8e120d319512ff207ed22ed87cde4e0432a13dda Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-07-24 21:25:43 +02:00
allow debuggerd { domain -init -ueventd -watchdogd -healthd -adbd -keystore }:process { ptrace getattr };
Confine debuggerd, but leave it permissive for now. Change-Id: I09932cdd59f9d3a38e69df9fcfc34cc9cec1d8cd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:35 +01:00
security_access_policy(debuggerd)
allow debuggerd system_data_file:dir create_dir_perms;
allow debuggerd system_data_file:dir relabelfrom;
debuggerd.te: Fix relabelto policy denial In 0c9708b2af4ea345277a47ae7bc1ce890e90d2bc, we removed relabelto from unconfined.te. This broke debuggerd. Fixed. type=1400 audit(1373668537.550:5): avc: denied { relabelto } for pid=44 comm="debuggerd" name="tombstones" dev="mtdblock1" ino=71 scontext=u:r:debuggerd:s0 tcontext=u:object_r:tombstone_data_file:s0 tclass=dir Change-Id: Ic025cbc030d6e776d9d87b1df3240fdc5f0b53d5
2013-07-13 00:38:41 +02:00
allow debuggerd tombstone_data_file:dir relabelto;
Confine debuggerd, but leave it permissive for now. Change-Id: I09932cdd59f9d3a38e69df9fcfc34cc9cec1d8cd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:35 +01:00
allow debuggerd tombstone_data_file:dir create_dir_perms;
allow debuggerd tombstone_data_file:file create_file_perms;
Allow debuggerd read access to shared_relro files. Addresses the following denial when debuggerd attempts to stat Webview mmap'd shared relro files on process crash. Full read permissions may not be necessary: W/debuggerd( 185): type=1400 audit(0.0:97): avc: denied { search } for name="shared_relro" dev="mmcblk0p28" ino=618955 scontext=u:r:debuggerd:s0 tcontext=u:object_r:shared_relro_file:s0 tclass=dir Bug: 17101854 Change-Id: I11eea85668ba033c554e5aab99b70a454fb75164
2014-08-19 02:09:38 +02:00
allow debuggerd shared_relro_file:dir r_dir_perms;
allow debuggerd shared_relro_file:file r_file_perms;
Confine debuggerd, but leave it permissive for now. Change-Id: I09932cdd59f9d3a38e69df9fcfc34cc9cec1d8cd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:35 +01:00
allow debuggerd domain:process { sigstop signal };
allow debuggerd exec_type:file r_file_perms;
# Access app library
allow debuggerd system_data_file:file open;
Allow debuggerd to redirect requests. On 64 bit systems, all requests will first go to the 64 bit debuggerd which will redirect to the 32 bit debuggerd if necessary. This avoids any permissions problems where a java process needs to be able to read the elf data for executables. Instead the permissions are granted to debuggerd instead. Also remove the permissions to read the /system/bin executables from dumpstate since they aren't necessary any more. Bug: https://code.google.com/p/android/issues/detail?id=97024 Change-Id: I80ab1a177a110aa7381c2a4b516cfe71ef2a4808
2015-01-19 02:39:53 +01:00
# Allow debuggerd to redirect a dump_backtrace request to itself.
# This only happens on 64 bit systems, where all requests go to the 64 bit
# debuggerd and get redirected to the 32 bit debuggerd if the process is 32 bit.
allow debuggerd { drmserver mediaserver sdcardd surfaceflinger inputflinger }:debuggerd dump_backtrace;
Label and allow access to /data/system/ndebugsocket. Otherwise it defaults to the label of /data/system and cannot be distinguished from any other socket in that directory. Also adds allow rule required for pre-existing wpa_socket transition to function without unconfined_domain. Change-Id: I57179aa18786bd56d247f397347e546cca978e41 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-09-27 16:24:49 +02:00
# Connect to system_server via /data/system/ndebugsocket.
unix_socket_connect(debuggerd, system_ndebug, system_server)
sepolicy: Add write_logd, read_logd & control_logd - Add write_logd, read_logd and control_logd macros added along with contexts for user space logd. - Specify above on domain wide, or service-by-service basis - Add logd rules. - deprecate access_logcat as unused. - 'allow <domain> zygote:unix_dgram_socket write;' rule added to deal with fd inheritance. ToDo: investigate means to allow references to close, and reopen in context of application or call setsockcreatecon() to label them in child context. Change-Id: I35dbb9d5122c5ed9b8c8f128abf24a871d6b26d8
2013-11-13 00:34:52 +01:00
debuggerd: Allow "debug.db.uid" usage Allow the use of debug.db.uid on userdebug / eng builds. Setting this property allows debuggerd to suspend a process if it detects a crash. Make debug.db.uid only accessible to the su domain. This should not be used on a user build. Only support reading user input on userdebug / eng builds. Steps to reproduce with the "crasher" program: adb root adb shell setprop debug.db.uid 20000 mmm system/core/debuggerd adb sync adb shell crasher Addresses the following denials: <5>[ 580.637442] type=1400 audit(1392412124.612:149): avc: denied { read } for pid=182 comm="debuggerd" name="input" dev="tmpfs" ino=5665 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=dir <5>[ 580.637589] type=1400 audit(1392412124.612:150): avc: denied { open } for pid=182 comm="debuggerd" name="input" dev="tmpfs" ino=5665 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=dir <5>[ 580.637706] type=1400 audit(1392412124.612:151): avc: denied { read write } for pid=182 comm="debuggerd" name="event5" dev="tmpfs" ino=6723 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=chr_file <5>[ 580.637823] type=1400 audit(1392412124.612:152): avc: denied { open } for pid=182 comm="debuggerd" name="event5" dev="tmpfs" ino=6723 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=chr_file <5>[ 580.637958] type=1400 audit(1392412124.612:153): avc: denied { ioctl } for pid=182 comm="debuggerd" path="/dev/input/event5" dev="tmpfs" ino=6723 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=chr_file Bug: 12532622 Change-Id: I63486edb73efb1ca12e9eb1994ac9e389251a3f1
2014-02-06 01:36:25 +01:00
userdebug_or_eng(`
allow debuggerd input_device:dir r_dir_perms;
allow debuggerd input_device:chr_file rw_file_perms;
')
sepolicy: Add write_logd, read_logd & control_logd - Add write_logd, read_logd and control_logd macros added along with contexts for user space logd. - Specify above on domain wide, or service-by-service basis - Add logd rules. - deprecate access_logcat as unused. - 'allow <domain> zygote:unix_dgram_socket write;' rule added to deal with fd inheritance. ToDo: investigate means to allow references to close, and reopen in context of application or call setsockcreatecon() to label them in child context. Change-Id: I35dbb9d5122c5ed9b8c8f128abf24a871d6b26d8
2013-11-13 00:34:52 +01:00
# logd access
read_logd(debuggerd)
Define debuggerd class, permissions, and rules. Define a new class, permissions, and rules for the debuggerd SELinux MAC checks. Used by Ib317564e54e07cc21f259e75124b762ad17c6e16 for debuggerd. Change-Id: I8e120d319512ff207ed22ed87cde4e0432a13dda Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-07-24 21:25:43 +02:00
# Check SELinux permissions.
selinux_check_access(debuggerd)
Reference in a new issue Copy permalink