Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
# Rules for all domains.
|
|
|
|
|
|
|
|
# Allow reaping by init.
|
|
|
|
allow domain init:process sigchld;
|
|
|
|
|
|
|
|
# Read access to properties mapping.
|
|
|
|
allow domain kernel:fd use;
|
|
|
|
allow domain tmpfs:file { read getattr };
|
|
|
|
|
|
|
|
# Search /storage/emulated tmpfs mount.
|
|
|
|
allow domain tmpfs:dir r_dir_perms;
|
|
|
|
|
|
|
|
# Intra-domain accesses.
|
2014-06-18 16:09:35 +02:00
|
|
|
allow domain self:process {
|
|
|
|
fork
|
|
|
|
sigchld
|
|
|
|
sigkill
|
|
|
|
sigstop
|
|
|
|
signull
|
|
|
|
signal
|
|
|
|
getsched
|
|
|
|
setsched
|
|
|
|
getsession
|
|
|
|
getpgid
|
|
|
|
setpgid
|
|
|
|
getcap
|
|
|
|
setcap
|
|
|
|
getattr
|
|
|
|
setrlimit
|
|
|
|
};
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
allow domain self:fd use;
|
|
|
|
allow domain self:dir r_dir_perms;
|
|
|
|
allow domain self:lnk_file r_file_perms;
|
|
|
|
allow domain self:{ fifo_file file } rw_file_perms;
|
2014-02-24 21:06:11 +01:00
|
|
|
allow domain self:unix_dgram_socket { create_socket_perms sendto };
|
|
|
|
allow domain self:unix_stream_socket { create_stream_socket_perms connectto };
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
|
|
|
|
# Inherit or receive open files from others.
|
|
|
|
allow domain init:fd use;
|
2013-09-14 00:59:04 +02:00
|
|
|
allow domain system_server:fd use;
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
|
|
|
|
# Connect to adbd and use a socket transferred from it.
|
2014-01-03 20:38:41 +01:00
|
|
|
# This is used for e.g. adb backup/restore.
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
allow domain adbd:unix_stream_socket connectto;
|
|
|
|
allow domain adbd:fd use;
|
2014-01-03 20:38:41 +01:00
|
|
|
allow domain adbd:unix_stream_socket { getattr getopt read write shutdown };
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
|
2014-01-19 03:07:06 +01:00
|
|
|
userdebug_or_eng(`
|
|
|
|
# Same as adbd rules above, except allow su to do the same thing
|
|
|
|
allow domain su:unix_stream_socket connectto;
|
|
|
|
allow domain su:fd use;
|
|
|
|
allow domain su:unix_stream_socket { getattr getopt read write shutdown };
|
|
|
|
|
2014-08-22 01:26:23 +02:00
|
|
|
binder_call({ domain -init }, su)
|
2014-03-05 15:50:08 +01:00
|
|
|
|
2014-01-19 03:07:06 +01:00
|
|
|
# Running something like "pm dump com.android.bluetooth" requires
|
|
|
|
# fifo writes
|
|
|
|
allow domain su:fifo_file { write getattr };
|
|
|
|
|
|
|
|
# allow "gdbserver --attach" to work for su.
|
|
|
|
allow domain su:process sigchld;
|
2014-10-31 20:40:12 +01:00
|
|
|
|
|
|
|
# Allow writing coredumps to /cores/*
|
|
|
|
allow domain coredump_file:file create_file_perms;
|
|
|
|
allow domain coredump_file:dir ra_dir_perms;
|
2014-01-19 03:07:06 +01:00
|
|
|
')
|
|
|
|
|
2013-07-15 20:41:24 +02:00
|
|
|
###
|
|
|
|
### Talk to debuggerd.
|
|
|
|
###
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
allow domain debuggerd:process sigchld;
|
|
|
|
allow domain debuggerd:unix_stream_socket connectto;
|
|
|
|
|
|
|
|
# Root fs.
|
|
|
|
allow domain rootfs:dir r_dir_perms;
|
untrusted_app.te / isolated_app.te / app.te first pass
This is my first attempt at creating an enforcing SELinux domain for
apps, untrusted_apps, and isolated_apps. Much of these rules are based on the
contents of app.te as of commit 11153ef34928ab9d13658606695cba192aa03e21
with extensive modifications, some of which are included below.
* Allow communication with netd/dnsproxyd, to allow netd to handle
dns requests
* Allow binder communications with the DNS server
* Allow binder communications with surfaceflinger
* Allow an app to bind to tcp/udp ports
* Allow all domains to read files from the root partition, assuming
the DAC allows access.
In addition, I added a bunch of "neverallow" rules, to assert that
certain capabilities are never added.
This change has a high probability of breaking someone, somewhere.
If it does, then I'm happy to fix the breakage, rollback this change,
or put untrusted_app into permissive mode.
Change-Id: I83f220135d20ab4f70fbd7be9401b5b1def1fe35
2013-07-13 03:45:56 +02:00
|
|
|
allow domain rootfs:file r_file_perms;
|
2013-10-23 19:25:53 +02:00
|
|
|
allow domain rootfs:lnk_file r_file_perms;
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
|
|
|
|
# Device accesses.
|
|
|
|
allow domain device:dir search;
|
2013-10-23 19:25:53 +02:00
|
|
|
allow domain dev_type:lnk_file r_file_perms;
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
allow domain devpts:dir search;
|
|
|
|
allow domain device:file read;
|
2014-03-06 16:16:53 +01:00
|
|
|
allow domain socket_device:dir r_dir_perms;
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
allow domain owntty_device:chr_file rw_file_perms;
|
|
|
|
allow domain null_device:chr_file rw_file_perms;
|
2014-05-20 15:01:55 +02:00
|
|
|
allow domain zero_device:chr_file rw_file_perms;
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
allow domain ashmem_device:chr_file rw_file_perms;
|
|
|
|
allow domain binder_device:chr_file rw_file_perms;
|
|
|
|
allow domain ptmx_device:chr_file rw_file_perms;
|
|
|
|
allow domain alarm_device:chr_file r_file_perms;
|
2013-09-10 20:13:15 +02:00
|
|
|
allow domain urandom_device:chr_file rw_file_perms;
|
|
|
|
allow domain random_device:chr_file rw_file_perms;
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
allow domain properties_device:file r_file_perms;
|
|
|
|
|
2013-11-13 00:34:52 +01:00
|
|
|
# logd access
|
|
|
|
write_logd(domain)
|
|
|
|
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
# Filesystem accesses.
|
|
|
|
allow domain fs_type:filesystem getattr;
|
|
|
|
allow domain fs_type:dir getattr;
|
|
|
|
|
|
|
|
# System file accesses.
|
|
|
|
allow domain system_file:dir r_dir_perms;
|
|
|
|
allow domain system_file:file r_file_perms;
|
|
|
|
allow domain system_file:file execute;
|
2013-10-23 19:25:53 +02:00
|
|
|
allow domain system_file:lnk_file r_file_perms;
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
|
2014-09-23 15:11:30 +02:00
|
|
|
# Run toolbox.
|
|
|
|
# Kernel and init never run anything without changing domains.
|
|
|
|
allow { domain -kernel -init } toolbox_exec:file rx_file_perms;
|
|
|
|
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
# Read files already opened under /data.
|
|
|
|
allow domain system_data_file:dir { search getattr };
|
|
|
|
allow domain system_data_file:file { getattr read };
|
2013-10-23 19:25:53 +02:00
|
|
|
allow domain system_data_file:lnk_file r_file_perms;
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
|
|
|
|
# Read apk files under /data/app.
|
2013-08-30 22:02:30 +02:00
|
|
|
allow domain apk_data_file:dir { getattr search };
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
allow domain apk_data_file:file r_file_perms;
|
2014-05-31 00:21:22 +02:00
|
|
|
allow domain apk_data_file:lnk_file r_file_perms;
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
|
|
|
|
# Read /data/dalvik-cache.
|
|
|
|
allow domain dalvikcache_data_file:dir { search getattr };
|
|
|
|
allow domain dalvikcache_data_file:file r_file_perms;
|
|
|
|
|
|
|
|
# Read already opened /cache files.
|
|
|
|
allow domain cache_file:dir r_dir_perms;
|
|
|
|
allow domain cache_file:file { getattr read };
|
2013-10-23 19:25:53 +02:00
|
|
|
allow domain cache_file:lnk_file r_file_perms;
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
|
2013-12-13 00:32:42 +01:00
|
|
|
# Read timezone related information
|
|
|
|
r_dir_file(domain, zoneinfo_data_file)
|
|
|
|
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
# For /acct/uid/*/tasks.
|
|
|
|
allow domain cgroup:dir { search write };
|
|
|
|
allow domain cgroup:file w_file_perms;
|
|
|
|
|
|
|
|
#Allow access to ion memory allocation device
|
|
|
|
allow domain ion_device:chr_file rw_file_perms;
|
|
|
|
|
|
|
|
# Read access to pseudo filesystems.
|
|
|
|
r_dir_file(domain, proc)
|
|
|
|
r_dir_file(domain, sysfs)
|
2013-10-30 22:12:21 +01:00
|
|
|
r_dir_file(domain, sysfs_devices_system_cpu)
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
r_dir_file(domain, inotify)
|
|
|
|
r_dir_file(domain, cgroup)
|
2015-02-25 22:28:40 +01:00
|
|
|
r_dir_file(domain, proc_net)
|
2014-09-26 19:51:12 +02:00
|
|
|
allow domain proc_cpuinfo:file r_file_perms;
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
|
|
|
|
# debugfs access
|
|
|
|
allow domain debugfs:dir r_dir_perms;
|
2013-07-11 20:30:20 +02:00
|
|
|
allow domain debugfs:file w_file_perms;
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
|
2013-10-23 19:25:53 +02:00
|
|
|
# Get SELinux enforcing status.
|
2014-06-17 21:05:08 +02:00
|
|
|
allow domain selinuxfs:dir r_dir_perms;
|
|
|
|
allow domain selinuxfs:file r_file_perms;
|
2013-10-23 19:25:53 +02:00
|
|
|
|
2014-02-24 17:35:39 +01:00
|
|
|
# /data/security files
|
Enable SELinux protections for netd.
This change does several things:
1) Restore domain.te to the version present at
cd516a32663b4eb11b2e3356b86450020e59e279 . This is the version
currently being distributed in AOSP.
2) Add "allow domain properties_device:file r_file_perms;" to
domain.te, to allow all domains to read /dev/__properties__ .
This change was missing from AOSP.
3) Restore netd.te to the version present at
80c9ba5267f1a6ceffcf979471d101948b520ad6 . This is the version
currently being distributed in AOSP.
4) Remove anything involving module loading from netd.te. CTS
enforces that Android kernels can't have module loading enabled.
5) Add several new capabilities, plus data file rules, to
netd.te, since netd needs to write to files owned by wifi.
6) Add a new unconfined domain called dnsmasq.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the dnsmasq.te domain.
7) Add a new unconfined domain called hostapd.te, and allow
transitions from netd to that domain. Over time, we'll tighten up
the hostapd.te domain.
The net effect of these changes is to re-enable SELinux protections
for netd. The policy is FAR from perfect, and allows a lot of wiggle
room, but we can improve it over time.
Testing: as much as possible, I've exercised networking related
functionality, including turning on and off wifi, entering airplane
mode, and enabling tethering and portable wifi hotspots. It's quite
possible I've missed something, and if we experience problems, I
can roll back this change.
Bug: 9618347
Change-Id: I23ff3eebcef629bc7baabcf6962f25f116c4a3c0
2013-06-28 00:11:02 +02:00
|
|
|
allow domain security_file:dir { search getattr };
|
|
|
|
allow domain security_file:file getattr;
|
2014-02-24 17:35:39 +01:00
|
|
|
allow domain security_file:lnk_file r_file_perms;
|
2013-07-10 23:46:05 +02:00
|
|
|
|
2014-02-04 17:36:41 +01:00
|
|
|
# World readable asec image contents
|
|
|
|
allow domain asec_public_file:file r_file_perms;
|
|
|
|
allow domain { asec_public_file asec_apk_file }:dir r_dir_perms;
|
|
|
|
|
2014-12-17 00:45:26 +01:00
|
|
|
# log all access to specified system_server services
|
2015-02-06 23:35:47 +01:00
|
|
|
auditallow { domain -shell -service_manager_local_audit } tmp_system_server_service:service_manager {list find };
|
2014-12-17 00:45:26 +01:00
|
|
|
|
2013-07-16 02:10:35 +02:00
|
|
|
###
|
|
|
|
### neverallow rules
|
|
|
|
###
|
|
|
|
|
2014-10-21 16:09:33 +02:00
|
|
|
# Do not allow any domain other than init or recovery to create unlabeled files.
|
|
|
|
neverallow { domain -init -recovery } unlabeled:dir_file_class_set create;
|
2014-05-29 22:37:13 +02:00
|
|
|
|
2014-02-10 22:31:04 +01:00
|
|
|
# Limit ability to ptrace or read sensitive /proc/pid files of processes
|
|
|
|
# with other UIDs to these whitelisted domains.
|
|
|
|
neverallow { domain -debuggerd -vold -dumpstate -system_server } self:capability sys_ptrace;
|
|
|
|
|
2014-07-10 05:04:59 +02:00
|
|
|
# Limit device node creation to these whitelisted domains.
|
2015-02-18 14:59:38 +01:00
|
|
|
neverallow { domain -kernel -init -recovery -ueventd -watchdogd -healthd -vold -uncrypt -slideshow } self:capability mknod;
|
2014-07-10 05:04:59 +02:00
|
|
|
|
|
|
|
# Limit raw I/O to these whitelisted domains.
|
|
|
|
neverallow { domain -kernel -init -recovery -ueventd -watchdogd -healthd -vold -uncrypt -tee } self:capability sys_rawio;
|
2014-02-10 22:31:04 +01:00
|
|
|
|
2014-05-14 20:05:49 +02:00
|
|
|
# No process can map low memory (< CONFIG_LSM_MMAP_MIN_ADDR).
|
|
|
|
neverallow domain self:memprotect mmap_zero;
|
|
|
|
|
2014-02-10 22:31:04 +01:00
|
|
|
# No domain needs mac_override as it is unused by SELinux.
|
2014-01-30 19:23:08 +01:00
|
|
|
neverallow domain self:capability2 mac_override;
|
2014-02-10 22:31:04 +01:00
|
|
|
|
|
|
|
# Only recovery needs mac_admin to set contexts not defined in current policy.
|
2014-01-30 19:23:08 +01:00
|
|
|
neverallow { domain -recovery } self:capability2 mac_admin;
|
|
|
|
|
2013-12-06 14:05:53 +01:00
|
|
|
# Only init should be able to load SELinux policies.
|
|
|
|
# The first load technically occurs while still in the kernel domain,
|
|
|
|
# but this does not trigger a denial since there is no policy yet.
|
|
|
|
# Policy reload requires allowing this to the init domain.
|
|
|
|
neverallow { domain -init } kernel:security load_policy;
|
|
|
|
|
2014-05-30 16:25:00 +02:00
|
|
|
# Only init and the system_server can set selinux.reload_policy 1
|
|
|
|
# to trigger a policy reload.
|
|
|
|
neverallow { domain -init -system_server } security_prop:property_service set;
|
|
|
|
|
|
|
|
# Only init and system_server can write to /data/security, where runtime
|
|
|
|
# policy updates live.
|
|
|
|
# Only init can relabel /data/security (for init.rc restorecon_recursive /data).
|
|
|
|
neverallow { domain -init } security_file:{ dir file lnk_file } { relabelfrom relabelto };
|
|
|
|
# Only init and system_server can create/setattr directories with this type.
|
|
|
|
# init is for init.rc mkdir /data/security.
|
|
|
|
# system_server is for creating subdirectories under /data/security.
|
|
|
|
neverallow { domain -init -system_server } security_file:dir { create setattr };
|
|
|
|
# Only system_server can create subdirectories and files under /data/security.
|
|
|
|
neverallow { domain -system_server } security_file:dir { rename write add_name remove_name rmdir };
|
|
|
|
neverallow { domain -system_server } security_file:file { create setattr write append unlink link rename };
|
|
|
|
neverallow { domain -system_server } security_file:lnk_file { create setattr unlink rename };
|
|
|
|
|
2013-12-06 14:05:53 +01:00
|
|
|
# Only init prior to switching context should be able to set enforcing mode.
|
|
|
|
# init starts in kernel domain and switches to init domain via setcon in
|
|
|
|
# the init.rc, so the setenforce occurs while still in kernel. After
|
|
|
|
# switching domains, there is never any need to setenforce again by init.
|
2014-05-12 23:32:59 +02:00
|
|
|
neverallow domain kernel:security setenforce;
|
|
|
|
neverallow { domain -kernel } kernel:security setcheckreqprot;
|
2013-09-27 16:38:14 +02:00
|
|
|
|
2014-03-06 19:02:50 +01:00
|
|
|
# No booleans in AOSP policy, so no need to ever set them.
|
|
|
|
neverallow domain kernel:security setbool;
|
|
|
|
|
|
|
|
# Adjusting the AVC cache threshold.
|
|
|
|
# Not presently allowed to anything in policy, but possibly something
|
|
|
|
# that could be set from init.rc.
|
|
|
|
neverallow { domain -init } kernel:security setsecparam;
|
|
|
|
|
2013-10-06 21:36:11 +02:00
|
|
|
# Only init, ueventd and system_server should be able to access HW RNG
|
2014-10-21 16:09:33 +02:00
|
|
|
neverallow { domain -init -system_server -ueventd } hw_random_device:chr_file *;
|
2013-10-03 22:35:56 +02:00
|
|
|
|
2013-09-27 16:38:14 +02:00
|
|
|
# Ensure that all entrypoint executables are in exec_type.
|
|
|
|
neverallow domain { file_type -exec_type }:file entrypoint;
|
2013-10-31 19:17:23 +01:00
|
|
|
|
|
|
|
# Ensure that nothing in userspace can access /dev/mem or /dev/kmem
|
|
|
|
neverallow { domain -kernel -ueventd -init } kmem_device:chr_file *;
|
|
|
|
neverallow domain kmem_device:chr_file ~{ create relabelto unlink setattr };
|
2013-12-06 15:31:40 +01:00
|
|
|
|
|
|
|
# Only init should be able to configure kernel usermodehelpers or
|
|
|
|
# security-sensitive proc settings.
|
|
|
|
neverallow { domain -init } usermodehelper:file { append write };
|
|
|
|
neverallow { domain -init } proc_security:file { append write };
|
2013-12-09 18:49:47 +01:00
|
|
|
|
|
|
|
# No domain should be allowed to ptrace init.
|
|
|
|
neverallow domain init:process ptrace;
|
2014-01-04 05:44:07 +01:00
|
|
|
|
2014-08-22 01:26:23 +02:00
|
|
|
# Init can't do anything with binder calls. If this neverallow rule is being
|
2014-01-04 05:44:07 +01:00
|
|
|
# triggered, it's probably due to a service with no SELinux domain.
|
2014-08-22 01:26:23 +02:00
|
|
|
neverallow domain init:binder *;
|
2014-01-30 18:10:28 +01:00
|
|
|
|
|
|
|
# Don't allow raw read/write/open access to block_device
|
|
|
|
# Rather force a relabel to a more specific type
|
2015-02-25 00:07:15 +01:00
|
|
|
neverallow { domain -kernel -init -recovery -vold -uncrypt } block_device:blk_file { open read write };
|
2014-01-30 18:15:45 +01:00
|
|
|
|
|
|
|
# Don't allow raw read/write/open access to generic devices.
|
|
|
|
# Rather force a relabel to a more specific type.
|
2014-10-21 16:09:33 +02:00
|
|
|
# init is exempt from this as there are character devices that only it uses.
|
|
|
|
# ueventd is exempt from this, as it is managing these devices.
|
2014-11-07 21:02:27 +01:00
|
|
|
neverallow { domain -init -ueventd -recovery } device:chr_file { open read write };
|
2014-02-10 19:29:38 +01:00
|
|
|
|
|
|
|
# Limit what domains can mount filesystems or change their mount flags.
|
|
|
|
# sdcard_type / vfat is exempt as a larger set of domains need
|
|
|
|
# this capability, including device-specific domains.
|
|
|
|
neverallow { domain -kernel -init -recovery -vold -zygote } { fs_type -sdcard_type }:filesystem { mount remount relabelfrom relabelto };
|
2014-05-24 01:08:23 +02:00
|
|
|
|
|
|
|
#
|
|
|
|
# Assert that, to the extent possible, we're not loading executable content from
|
2014-07-21 16:21:20 +02:00
|
|
|
# outside the rootfs or /system partition except for a few whitelisted domains.
|
2014-05-24 01:08:23 +02:00
|
|
|
#
|
|
|
|
neverallow {
|
|
|
|
domain
|
|
|
|
-appdomain
|
|
|
|
-dumpstate
|
2014-06-11 13:10:09 +02:00
|
|
|
-shell
|
2014-05-24 01:08:23 +02:00
|
|
|
userdebug_or_eng(`-su')
|
|
|
|
-system_server
|
|
|
|
-zygote
|
|
|
|
} { file_type -system_file -exec_type }:file execute;
|
2014-07-21 16:21:20 +02:00
|
|
|
neverallow {
|
|
|
|
domain
|
|
|
|
-appdomain # for oemfs
|
|
|
|
-recovery # for /tmp/update_binary in tmpfs
|
|
|
|
} { fs_type -rootfs }:file execute;
|
2014-05-29 15:22:16 +02:00
|
|
|
|
|
|
|
# Only the init property service should write to /data/property.
|
2014-11-06 00:30:41 +01:00
|
|
|
neverallow { domain -init } property_data_file:dir no_w_dir_perms;
|
|
|
|
neverallow { domain -init } property_data_file:file no_w_file_perms;
|
2014-05-20 20:09:16 +02:00
|
|
|
|
|
|
|
# Only recovery should be doing writes to /system
|
|
|
|
neverallow { domain -recovery } { system_file exec_type }:dir_file_class_set
|
|
|
|
{ create write setattr relabelfrom relabelto append unlink link rename };
|
2014-06-16 19:05:38 +02:00
|
|
|
|
2015-02-05 18:23:13 +01:00
|
|
|
# Don't allow mounting on top of /system files or directories
|
|
|
|
neverallow domain { system_file exec_type }:dir_file_class_set mounton;
|
|
|
|
|
2014-06-19 17:26:22 +02:00
|
|
|
# Nothing should be writing to files in the rootfs.
|
2014-11-07 21:02:27 +01:00
|
|
|
neverallow { domain -recovery } rootfs:file { create write setattr relabelto append unlink link rename };
|
2014-06-19 17:26:22 +02:00
|
|
|
|
2014-06-16 19:05:38 +02:00
|
|
|
# Restrict context mounts to specific types marked with
|
|
|
|
# the contextmount_type attribute.
|
|
|
|
neverallow domain {fs_type -contextmount_type}:filesystem relabelto;
|
|
|
|
|
|
|
|
# Ensure that context mount types are not writable, to ensure that
|
|
|
|
# the write to /system restriction above is not bypassed via context=
|
|
|
|
# mount to another type.
|
|
|
|
neverallow { domain -recovery } contextmount_type:dir_file_class_set
|
|
|
|
{ create write setattr relabelfrom relabelto append unlink link rename };
|
2014-07-07 18:27:53 +02:00
|
|
|
|
|
|
|
# Do not allow service_manager add for default_android_service.
|
|
|
|
# Instead domains should use a more specific type such as
|
|
|
|
# system_app_service rather than the generic type.
|
|
|
|
# New service_types are defined in service.te and new mappings
|
|
|
|
# from service name to service_type are defined in service_contexts.
|
|
|
|
neverallow domain default_android_service:service_manager add;
|
2014-08-23 00:08:39 +02:00
|
|
|
|
|
|
|
# Require that domains explicitly label unknown properties, and do not allow
|
|
|
|
# anyone but init to modify unknown properties.
|
|
|
|
neverallow { domain -init } default_prop:property_service set;
|
2014-09-08 22:11:01 +02:00
|
|
|
|
|
|
|
neverallow { domain -init -recovery -system_server } frp_block_device:blk_file rw_file_perms;
|
2014-09-30 18:53:12 +02:00
|
|
|
|
|
|
|
# No domain other than recovery can write to system.
|
|
|
|
neverallow { domain -recovery } system_block_device:blk_file write;
|
|
|
|
|
|
|
|
# No domains other than install_recovery or recovery can write to recovery.
|
|
|
|
neverallow { domain -install_recovery -recovery } recovery_block_device:blk_file write;
|
2014-12-10 22:50:39 +01:00
|
|
|
|
|
|
|
# Only servicemanager should be able to register with binder as the context manager
|
|
|
|
neverallow { domain -servicemanager } *:binder set_context_mgr;
|
Add compile time checks for /data/dalvik-cache access
Add an SELinux neverallow rule (compile time assertion) that only
authorized SELinux domains are writing to files in /data/dalvik-cache.
Currently, SELinux policy only allows the following SELinux domains
to perform writes to files in /data/dalvik-cache
* init
* zygote
* installd
* dex2oat
For zygote, installd, and dex2oat, these accesses make sense.
For init, we could further restrict init to just relabelfrom
on /data/dalvik-cache files, and { create, write, setattr }
on /data/dalvik-cache directories. Currently init has full
write access, which can be reduced over time.
This change was motivated by the discussion
in https://android-review.googlesource.com/127582
Remove /data/dalvik-cache access from the unconfined domain.
This domain is only used by init, kernel, and fsck on user builds.
The kernel and fsck domains have no need to access files in
/data/dalvik-cache. Init has a need to relabel files, but
that rule is already granted in init.te.
The neverallow rule is intended to prevent regressions. Neverallow
rules are CTS tested, so regressions won't appear on our devices
or partner devices.
Change-Id: I15e7d17b1121c556463114d1c6c49557a57911cd
2015-01-30 19:29:30 +01:00
|
|
|
|
|
|
|
# Only authorized processes should be writing to files in /data/dalvik-cache
|
|
|
|
# (excluding /data/dalvik-cache/profiles, which is labeled differently)
|
|
|
|
neverallow {
|
|
|
|
domain
|
|
|
|
-init # TODO: limit init to relabelfrom for files
|
|
|
|
-zygote
|
|
|
|
-installd
|
|
|
|
-dex2oat
|
|
|
|
} dalvikcache_data_file:file no_w_file_perms;
|
2015-02-11 00:53:17 +01:00
|
|
|
|
|
|
|
# Android does not support System V IPCs.
|
|
|
|
#
|
|
|
|
# The reason for this is due to the fact that, by design, they lead to global
|
|
|
|
# kernel resource leakage.
|
|
|
|
#
|
|
|
|
# For example, there is no way to automatically release a SysV semaphore
|
|
|
|
# allocated in the kernel when:
|
|
|
|
#
|
|
|
|
# - a buggy or malicious process exits
|
|
|
|
# - a non-buggy and non-malicious process crashes or is explicitly killed.
|
|
|
|
#
|
|
|
|
# Killing processes automatically to make room for new ones is an
|
|
|
|
# important part of Android's application lifecycle implementation. This means
|
|
|
|
# that, even assuming only non-buggy and non-malicious code, it is very likely
|
|
|
|
# that over time, the kernel global tables used to implement SysV IPCs will fill
|
|
|
|
# up.
|
|
|
|
neverallow domain domain:{ shm sem msg msgq } *;
|
2015-02-23 21:33:34 +01:00
|
|
|
|
|
|
|
# Do not mount on top of symlinks, fifos, or sockets.
|
|
|
|
# Feature parity with Chromium LSM.
|
|
|
|
neverallow domain { file_type fs_type dev_type }:{ lnk_file fifo_file sock_file } mounton;
|