tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/property_contexts

227 lines
10 KiB
Text
Raw Normal View History

Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
##########################
# property service keys
#
#
Align SELinux property policy with init property_perms. Introduce a net_radio_prop type for net. properties that can be set by radio or system. Introduce a system_radio_prop type for sys. properties that can be set by radio or system. Introduce a dhcp_prop type for properties that can be set by dhcp or system. Drop the rild_prop vs radio_prop distinction; this was an early experiment to see if we could separate properties settable by rild versus other radio UID processes but it did not pan out. Remove the ability to set properties from unconfineddomain. Allow init to set any property. Allow recovery to set ctl_default_prop to restart adbd. Change-Id: I5ccafcb31ec4004dfefcec8718907f6b6f3e0dfd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-19 16:27:02 +02:00
net.rmnet u:object_r:net_radio_prop:s0
net.gprs u:object_r:net_radio_prop:s0
net.ppp u:object_r:net_radio_prop:s0
net.qmi u:object_r:net_radio_prop:s0
net.lte u:object_r:net_radio_prop:s0
net.cdma u:object_r:net_radio_prop:s0
Move net.dns* to it's own label. Move net.dns* from net_radio_prop to the newly created label net_dns_prop. This allows finer grain control over this specific property. Prior to this change, this property was readable to all SELinux domains, and writable by the following SELinux domains: * system_server * system_app (apps which run as UID=system) * netmgrd * radio This change: 1) Removes read access to this property to everyone EXCEPT untrusted_app and system_server. 2) Limit write access to system_server. In particular, this change removes read access to priv_apps. Any priv_app which ships with the system should not be reading this property. Bug: 34115651 Test: Device boots, wifi turns on, no problems browsing the internet Change-Id: I8a32e98c4f573d634485c4feac91baa35d021d38
2017-02-10 01:08:11 +01:00
net.dns u:object_r:net_dns_prop:s0
Fix TODOs of duplicate property names for prefix and exact matching Duplicate property names are supported now for prefix and exact matching. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: Ifd9d32eaece7370d69f121e88d5541f7a2e34458
2018-01-12 02:19:48 +01:00
sys.usb.config u:object_r:system_radio_prop:s0
Align SELinux property policy with init property_perms. Introduce a net_radio_prop type for net. properties that can be set by radio or system. Introduce a system_radio_prop type for sys. properties that can be set by radio or system. Introduce a dhcp_prop type for properties that can be set by dhcp or system. Drop the rild_prop vs radio_prop distinction; this was an early experiment to see if we could separate properties settable by rild versus other radio UID processes but it did not pan out. Remove the ability to set properties from unconfineddomain. Allow init to set any property. Allow recovery to set ctl_default_prop to restart adbd. Change-Id: I5ccafcb31ec4004dfefcec8718907f6b6f3e0dfd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-19 16:27:02 +02:00
ril. u:object_r:radio_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.ril. u:object_r:radio_prop:s0
Rework the radio vs rild property split. Only label properties with the ril. prefix with rild_prop. Allow rild and system (and radio) to set radio_prop. Only rild can set rild_prop presently.
2012-04-04 22:01:19 +02:00
gsm. u:object_r:radio_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
persist.radio u:object_r:radio_prop:s0
net. u:object_r:system_prop:s0
dev. u:object_r:system_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.runtime. u:object_r:system_prop:s0
Remove access to ro.runtime.firstboot from apps ro.runtime.firstboot system property is only used internally by system_server to distinguish between first start after boot from consecutive starts (for example, this happens when full-disk encryption is enabled). The value of the property is a millisecond-precise timestamp which can help track individual device. Thus apps should not have access to this property. Test: Device boots fine, reading ro.runtime.firstboot from an app results in an error and SELinux denial. Bug: 33700679 Change-Id: I4c3c26a35c5dd840bced3a3e53d071f45317f63c
2016-12-27 23:05:46 +01:00
ro.runtime.firstboot u:object_r:firstboot_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
hw. u:object_r:system_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.hw. u:object_r:system_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
sys. u:object_r:system_prop:s0
Add selinux rules for userspace reboot related properties By default sys.init.userspace_reboot.* properties are internal to /system partition. Only exception is sys.init.userspace_reboot.in_progress which signals to all native services (including vendor ones) that userspace reboot is happening, hence it should be a system_public_prop. Only init should be allowed to set userspace reboot related properties. Bug: 135984674 Test: builds Test: adb reboot userspace Change-Id: Ibb04965be2d5bf6e81b34569aaaa1014ff61e0d3
2019-11-14 13:59:15 +01:00
sys.init.userspace_reboot u:object_r:userspace_reboot_prop:s0
Allow cppreopts to work with selinux (cherry picked from commit d3edd6b577c1e40834af69420bd77b60c359ef8e) Bug: 29278988 Change-Id: I199572377a6b5c33116c718a545159ddcf50df30
2016-06-23 00:47:09 +02:00
sys.cppreopt u:object_r:cppreopt_prop:s0
Define sepolicy with property for linker To support linker-specific property, sys.linker.* has been defined as linker_prop. This will have get_prop access from domain so all binaries can start with linker using proper property access level. Bug: 138920271 Test: m -j && Confirmed from cuttlefish that get_prop errors are no longer found Change-Id: Iaf584e0cbdd5bca3d5667e93cf9a6401e757a314
2019-08-09 07:20:34 +02:00
sys.linker. u:object_r:linker_prop:s0
Add rules for lpdump and lpdumpd - lpdump is a binary on the device that talks to lpdumpd via binder. - lpdumpd is a daemon on the device that actually reads dynamic partition metadata. Only lpdump can talk to it. Bug: 126233777 Test: boots (sanity) Test: lpdump Change-Id: I0e21f35ac136bcbb0603940364e8117f2d6ac438
2019-03-14 23:45:03 +01:00
sys.lpdumpd u:object_r:lpdumpd_prop:s0
Enable SELinux on vold This change enables SELinux security enforcement on vold. For the vold.te file ONLY, this change is conceptually a revert of 77d4731e9d30c8971e076e2469d6957619019921 and 50e37b93ac97631dcac6961285b92af5026557af, with the following additional changes: 1) Removal of "allow vold proc:file write;" and "allow vold self:capability { sys_boot };". As of system/vold change adfba3626e76c1931649634275d241b226cd1b9a, vold no longer performs it's own reboots, so these capabilities are no longer needed. 2) Addition of the powerctl property, which vold contacts to tell init to reboot. 3) Removal of "allow vold kernel:system module_request;". As of CTS commit f2cfdf5c057140d9442fcfeb4e4a648e8258b659, Android devices no longer ship with loadable modules, hence we don't require this rule. 4) Removal of "fsetid" from "self:capability". Any setuid / setgid bits SHOULD be cleared if vold is able to change the permissions of files. IMHO, it was a mistake to ever include this capability in the first place. Testing: As much as possible, I've tested filesystem related functionality, including factory reset and device encryption. I wasn't able to test fstrim functionality, which is a fairly new feature. I didn't see any policy denials in dmesg. It's quite possible I've missed something. If we experience problems, I happy to roll back this change. Bug: 9629920 Change-Id: I683afa0dffe9f28952287bfdb7ee4e0423c2e97a
2013-06-29 05:15:37 +02:00
sys.powerctl u:object_r:powerctl_prop:s0
allow adbd to set sys.usb.ffs.ready Needed for https://android-review.googlesource.com/147730 Change-Id: Iceb87f210e4c5d0f39426cc6c96a216a4644eaa9
2015-04-24 04:42:25 +02:00
sys.usb.ffs. u:object_r:ffs_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
service. u:object_r:system_prop:s0
Align SELinux property policy with init property_perms. Introduce a net_radio_prop type for net. properties that can be set by radio or system. Introduce a system_radio_prop type for sys. properties that can be set by radio or system. Introduce a dhcp_prop type for properties that can be set by dhcp or system. Drop the rild_prop vs radio_prop distinction; this was an early experiment to see if we could separate properties settable by rild versus other radio UID processes but it did not pan out. Remove the ability to set properties from unconfineddomain. Allow init to set any property. Allow recovery to set ctl_default_prop to restart adbd. Change-Id: I5ccafcb31ec4004dfefcec8718907f6b6f3e0dfd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-19 16:27:02 +02:00
dhcp. u:object_r:dhcp_prop:s0
Allow Bluetooth app to initiate DHCP service on bt-pan interface. bug:15407087 Change-Id: I3dea9c1110583f11f093d048455a1cc739d05658
2014-06-18 15:20:36 +02:00
dhcp.bt-pan.result u:object_r:pan_result_prop:s0
SELinux policy for Bluetooth properties. Properties under bluetooth. and persist.service.bdroid. are considered Bluetooth-related properties. Change-Id: Iee937d9a1184c2494deec46f9ed7090c643acda7
2013-05-06 19:18:27 +02:00
bluetooth. u:object_r:bluetooth_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
Give system_server / system_app ability to write some properties Allow writing to persist.sys and debug. This addresses the following denials (which are actually being enforced): <4>[ 131.700473] avc: denied { set } for property=debug.force_rtl scontext=u:r:system_server:s0 tcontext=u:object_r:shell_prop:s0 tclass=property_service <3>[ 131.700625] init: sys_prop: permission denied uid:1000 name:debug.force_rtl <4>[ 132.630062] avc: denied { set } for property=persist.sys.dalvik.vm.lib scontext=u:r:system_app:s0 tcontext=u:object_r:system_prop:s0 tclass=property_service <3>[ 132.630184] init: sys_prop: permission denied uid:1000 name:persist.sys.dalvik.vm.lib Change-Id: I5d114c0d963bf393f49f1bf13d1ed84137fbcca6
2013-11-01 18:45:03 +01:00
debug. u:object_r:debug_prop:s0
debuggerd: Allow "debug.db.uid" usage Allow the use of debug.db.uid on userdebug / eng builds. Setting this property allows debuggerd to suspend a process if it detects a crash. Make debug.db.uid only accessible to the su domain. This should not be used on a user build. Only support reading user input on userdebug / eng builds. Steps to reproduce with the "crasher" program: adb root adb shell setprop debug.db.uid 20000 mmm system/core/debuggerd adb sync adb shell crasher Addresses the following denials: <5>[ 580.637442] type=1400 audit(1392412124.612:149): avc: denied { read } for pid=182 comm="debuggerd" name="input" dev="tmpfs" ino=5665 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=dir <5>[ 580.637589] type=1400 audit(1392412124.612:150): avc: denied { open } for pid=182 comm="debuggerd" name="input" dev="tmpfs" ino=5665 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=dir <5>[ 580.637706] type=1400 audit(1392412124.612:151): avc: denied { read write } for pid=182 comm="debuggerd" name="event5" dev="tmpfs" ino=6723 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=chr_file <5>[ 580.637823] type=1400 audit(1392412124.612:152): avc: denied { open } for pid=182 comm="debuggerd" name="event5" dev="tmpfs" ino=6723 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=chr_file <5>[ 580.637958] type=1400 audit(1392412124.612:153): avc: denied { ioctl } for pid=182 comm="debuggerd" path="/dev/input/event5" dev="tmpfs" ino=6723 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=chr_file Bug: 12532622 Change-Id: I63486edb73efb1ca12e9eb1994ac9e389251a3f1
2014-02-06 01:36:25 +01:00
debug.db. u:object_r:debuggerd_prop:s0
Increase communication surface between dumpstate and Shell: - Add a new 'dumpstate' context for system properties. This context will be used to share state between dumpstate and Shell. For example, as dumpstate progresses, it will update a system property, which Shell will use to display the progress in the UI as a system notification. The user could also rename the bugreport file, in which case Shell would use another system property to communicate such change to dumpstate. - Allow Shell to call 'ctl.bugreport stop' so the same system notification can be used to stop dumpstate. BUG: 25794470 Change-Id: I74b80bda07292a91358f2eea9eb8444caabc5895
2015-12-02 03:03:05 +01:00
dumpstate. u:object_r:dumpstate_prop:s0
Let system_server writes to dumpstate.options property. Currently, we define 4 hardcoded init services to launch dumpstate with different command-line options (since dumpstate must be launched by root): - bugreport - bugreportplus - bugreportwear - bugreportremote This approach does not scale well; a better option is to have just one service, and let the framework pass the extra arguments through a system property. BUG: 31649719 Test: manual Change-Id: I7ebbb7ce6a0fd3588baca6fd76653f87367ed0e5
2016-09-21 19:44:11 +02:00
dumpstate.options u:object_r:dumpstate_options_prop:s0
Adds new policy for init_svc_debug_prop. Used to restrict properties init.svc_debug_pid.* Bug: 138114550 Test: getprop | grep init.svc_debug_pid only shows results on root Change-Id: I0c10699deec4c548a2463a934e96b897ddee1678
2019-07-25 20:29:17 +02:00
init.svc_debug_pid. u:object_r:init_svc_debug_prop:s0
llkd: Add stack symbol checking llkd needs the ptrace capabilities and dac override to monitor for live lock conditions on the stack dumps. Test: compile Bug: 33808187 Change-Id: Ibc1e4cc10395fa9685c4ef0ca214daf212a5e126
2018-08-08 01:03:47 +02:00
llk. u:object_r:llkd_prop:s0
khungtask. u:object_r:llkd_prop:s0
ro.llk. u:object_r:llkd_prop:s0
ro.khungtask. u:object_r:llkd_prop:s0
limit shell's access to log.* properties Restrict the ability of the shell to set the log.* properties. Namely: only allow the shell to set such properities on eng and userdebug builds. The shell (and other domains) can continue to read log.* properties on all builds. While there: harmonize permissions for log.* and persist.log.tag. Doing so introduces two changes: - log.* is now writable from from |system_app|. This mirrors the behavior of persist.log.tag, which is writable to support "Developer options" -> "Logger buffer sizes" -> "Off". (Since this option is visible on user builds, the permission is enabled for all builds.) - persist.log.tag can now be set from |shell| on userdebug_or_eng(). BUG=28221972 TEST=manual (see below) Testing details - user build (log.tag) $ adb shell setprop log.tag.foo V $ adb shell getprop log.tag <blank line> $ adb bugreport | grep log.tag.foo [ 146.525836] init: avc: denied { set } for property=log.tag.foo pid=4644 uid=2000 gid=2000 scontext=u:r:shell:s0 tcontext=u:object_r:log_prop:s0 tclass=property_service permissive=0 [ 146.525878] init: sys_prop: permission denied uid:2000 name:log.tag.foo - userdebug build (log.tag) $ adb shell getprop log.tag.foo <blank line> $ adb shell setprop log.tag.foo V $ adb shell getprop log.tag.foo V - user build (persist.log.tag) $ adb shell getprop | grep log.tag <no match> - Developer options -> Logger buffer sizes -> Off $ adb shell getprop | grep log.tag [persist.log.tag]: [Settings] [persist.log.tag.snet_event_log]: [I] Change-Id: Idf00e7a623723a7c46bf6d01e386aeca92b2ad75
2016-04-15 20:10:06 +02:00
log. u:object_r:log_prop:s0
Regression for log.tag properties Allow log.tag and persist.log.tag as log_tag_prop Bug: 28942894 Change-Id: I05766b99b9535a79a39adc55cad004decd52956e
2016-06-06 21:10:00 +02:00
log.tag u:object_r:log_tag_prop:s0
allow system server to set log.tag.WifiHAL On eng and userdebug builds (only), allow system server to change the value of log.tag.WifiHAL. WifiStateMachine will set this property to 'D' by default. If/when a user enables "Developer options -> Enable Wi-Fi Verbose Logging", WifiStateMachine change log.tag.WifiHAL to 'V'. BUG=27857554 TEST=manual (see below) Test detail 1. on user build: $ adb shell setprop log.tag.WifiHAL V $ adb shell getprop log.tag.WifiHAL <blank line> $ adb bugreport | grep log.tag.WifiHAL <11>[ 141.918517] init: avc: denied { set } for property=log.tag.WifiHAL pid=4583 uid=2000 gid=2000 scontext=u:r:shell:s0 tcontext=u:object_r:wifi_log_prop:s0 tclass=property_service permissive=0 <11>[ 141.918566] init: sys_prop: permission denied uid:2000 name:log.tag.WifiHAL 2. on userdebug build: $ adb shell getprop log.tag.WifiHAL $ <blank line> $ adb shell setprop log.tag.WifiHAL V $ adb shell getprop log.tag.WifiHAL V 3. on userdebug build with modified WifiStateMachine: $ adb shell getprop log.tag.WifiHAL D Change-Id: I9cdd52a2b47a3dd1065262ea8c329130b7b044db
2016-04-15 20:10:39 +02:00
log.tag.WifiHAL u:object_r:wifi_log_prop:s0
expose control over unpriv perf access to shell This allows the shell user to control whether unprivileged access to perf events is allowed. To enable unprivileged access to perf: adb shell setprop security.perf_harden 0 To disable it again: adb shell setprop security.perf_harden 1 This allows Android to disable this kernel attack surface by default, while still allowing profiling tools to work automatically. It can also be manually toggled, but most developers won't ever need to do that if tools end up incorporating this. Bug: 29054680 Change-Id: Idcf6a2f6cbb35b405587deced7da1f6749b16a5f
2016-05-31 22:01:08 +02:00
security.perf_harden u:object_r:shell_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
service.adb.root u:object_r:shell_prop:s0
service.adb.tcp.port u:object_r:shell_prop:s0
Label persist audio properties label all persist.audio.* properties and allow mediaserver access to them. Change-Id: If5755d9783dce298e66a25bcb7f17ff17bd83ea7
2012-11-28 02:34:54 +01:00
persist.audio. u:object_r:audio_prop:s0
Allow system apps (Settings) to configure Bluetooth properties Bug: 27078729 Change-Id: I74115521e1def661dea5575eb532b93fe7f1f4ad
2016-02-09 00:39:00 +01:00
persist.bluetooth. u:object_r:bluetooth_prop:s0
Add SELinux settings to support tracing during boot. This CL adds the SELinux settings required to support tracing during boot. https://android-review.googlesource.com/#/c/157163/ BUG: 21739901 Change-Id: Ib3a7107776141ac8cf4f1ca06674f47a0d4b6ae0
2015-06-24 08:24:17 +02:00
persist.debug. u:object_r:persist_debug_prop:s0
selinux: logd Development settings - logd Development Settings failed to access persist.logd.size Change-Id: I0732b44fcbffbf3c187bcb23df2db807fa3e8fde
2014-06-12 21:47:22 +02:00
persist.logd. u:object_r:logd_prop:s0
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.logd. u:object_r:logd_prop:s0
SELinux rule for ro.device_owner and persist.logd.security They are introduced for the device owner process logging feature. That is, for enterprise-owned devices with device owner app provisioned, the device owner may choose to turn on additional device-wide logging for auditing and intrusion detection purposes. Logging includes histories of app process startup, commands issued over ADB and lockscreen unlocking attempts. These logs will available to the device owner for analysis, potentially shipped to a remote server if it chooses to. ro.device_owner will be a master switch to turn off logging, if the device has no device owner provisioned. persist.logd.security is a switch that device owner can toggle (via DevicePoliyManager) to enable/disable logging. Writing to both properties should be only allowed by the system server. Bug: 22860162 Change-Id: Iabfe2347b094914813b9d6e0c808877c25ccd038
2016-01-04 16:20:45 +01:00
persist.logd.security u:object_r:device_logging_prop:s0
logpersist: reserve persist.logd.logpersistd shell, system_app and logd access granted on debug builds only Bug: 28936216 Change-Id: Ib9648e8565cc0ea0077cf0950b0e4ac6fe0a3135
2016-06-06 21:18:46 +02:00
persist.logd.logpersistd u:object_r:logpersistd_logging_prop:s0
logcatd: trampoline persist.logd.logpersistd to logd.logpersistd Bug: 28936216 Change-Id: I90dc7ca296dc5c9b6d13e7920ebb864981a112b5
2016-07-08 17:41:08 +02:00
logd.logpersistd u:object_r:logpersistd_logging_prop:s0
Regression for log.tag properties Allow log.tag and persist.log.tag as log_tag_prop Bug: 28942894 Change-Id: I05766b99b9535a79a39adc55cad004decd52956e
2016-06-06 21:10:00 +02:00
persist.log.tag u:object_r:log_tag_prop:s0
persist.mmc.* only set in init Bug: 26976972 Change-Id: I0e44bfc6774807a3bd2ba05637a432675d855118
2016-02-04 19:55:43 +01:00
persist.mmc. u:object_r:mmc_prop:s0
Revert "Temporarily revert the SELinux policy for persist.netd.stable_secret." This change must only be submitted when device-specific policies have been reverted. This reverts commit 07e631d2e0a01226ea83e517305d1eceb1b1a158. Bug: 17613910 Test: builds Change-Id: Ie33e293107bf1eba2498f2422d941544c76b8cad Merged-In: I356c39a5dc955b3d7c28d8c7baf2887a17beb272
2017-07-11 02:43:19 +02:00
persist.netd.stable_secret u:object_r:netd_stable_secret_prop:s0
Add label for persist.pm.mock-upgrade This property is used for testing purposes when verifying the behavior when an OTA occurs. It should be readable by the system server, and be settable by the shell. Test: Set property from shell, read with PackageManager Bug: 140992644 Change-Id: I39ad9b7961208f02fa45011215c2ff5ac03b7380
2019-10-09 18:09:48 +02:00
persist.pm.mock-upgrade u:object_r:mock_ota_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
persist.sys. u:object_r:system_prop:s0
Allow logd.auditd to reboot to safe mode Bug: 26902605 Change-Id: Ica825cf2af74f5624cf4091544bd24bb5482dbe7
2016-02-06 00:42:32 +01:00
persist.sys.safemode u:object_r:safemode_prop:s0
Add persist.sys.theme. This property will be set by system_server (to indicate the currently selected theme for device), and can be accessed by vendor init.rc. avc: denied { read } for property=persist.sys.theme pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:theme_prop:s0 tclass=file Bug: 113028175 Test: Set a vendor init trigger that waits on `persist.sys.theme`. Check that the trigger fires without denial. Change-Id: Ia85b1a8dfc118efdbb9337ca017c8fb7958dc386 Merged-In: Ibb4e392d5059b76059f36f7d11ba82cd65cbe970 (cherry picked from commit 75182a1ea645d3fa1e4c3e9f77851d90ff7cc803)
2019-06-15 02:00:16 +02:00
persist.sys.theme u:object_r:theme_prop:s0
Sepolicy: add dynamic_system_prop and allow shell and system_app (Settings) to set it to enable Dynamic System Update. Also allow priv_app (user of the API) to read it. Bug: 119647479 Bug: 129060539 Test: run the following command on crosshatch-user: adb shell setprop persist.sys.fflag.override.settings_dynamic_system 1 Change-Id: I24a5382649c64d36fd05a59bc87faca87e6f0eb8 Merged-In: I24a5382649c64d36fd05a59bc87faca87e6f0eb8
2019-04-26 10:14:52 +02:00
persist.sys.fflag.override.settings_dynamic_system u:object_r:dynamic_system_prop:s0
Add ro.sys.safemode property. Bug: 28008032 Change-Id: I29e076ee9c62a0fb3b386f79509935a1961f95e1
2016-03-03 01:14:17 +01:00
ro.sys.safemode u:object_r:safemode_prop:s0
Allow logd.auditd to reboot to safe mode Bug: 26902605 Change-Id: Ica825cf2af74f5624cf4091544bd24bb5482dbe7
2016-02-06 00:42:32 +01:00
persist.sys.audit_safemode u:object_r:safemode_prop:s0
Revert^2 "SELinux policy for system server JVMTI" This reverts commit baa06ee2cd8b2f6c8bd0c2d873dc2888d6296353. Reason for revert: Added missing property name in vendor_init.te. Bug: none Test: none (other than neverallow checking) Change-Id: I9e93bf4ea6ca3a4634f8f4cbce2f13c5f410883b
2019-11-25 23:03:59 +01:00
persist.sys.dalvik.jvmtiagent u:object_r:system_jvmti_agent_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
persist.service. u:object_r:system_prop:s0
SELinux policy for Bluetooth properties. Properties under bluetooth. and persist.service.bdroid. are considered Bluetooth-related properties. Change-Id: Iee937d9a1184c2494deec46f9ed7090c643acda7
2013-05-06 19:18:27 +02:00
persist.service.bdroid. u:object_r:bluetooth_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
persist.security. u:object_r:system_prop:s0
sepolicy: allow shell to read/write traced prop This is to fix the CTS failures given by the bugs below where devices where traced is not enabled by default causes test failures. Bug: 78215159 Bug: 78347829 Change-Id: Ib0f6a1cdb770528dbbeb857368534ff5040e464e
2018-04-20 20:09:45 +02:00
persist.traced.enable u:object_r:traced_enabled_prop:s0
Allow traced to lazily start heapprofd. Bug: 126724929 Change-Id: I15f0ae10d5e45fc65850635230e377b6f77ad4d7
2019-03-13 19:22:23 +01:00
traced.lazy. u:object_r:traced_lazy_prop:s0
Add persist.heapprofd.enable property. This is analoguous to what Perfetto does with persist.traced.enable. Test: m Test: flash walleye Test: setprop persist.heapprofd.enable 1 setprop persist.heapprofd.enable 0 Change-Id: I997272ef8c6fe078aca2388ed0cf2ecc3de612a5
2018-12-10 17:20:20 +01:00
persist.heapprofd.enable u:object_r:heapprofd_enabled_prop:s0
Add persist.vendor.overlay. to properties Allow the system_server to change. Allow the zygote to read it as well. Test: Have system_server set a property Change-Id: Ie90eec8b733fa7193861026a3a6e0fb0ba5d5318
2016-11-09 21:19:05 +01:00
persist.vendor.overlay. u:object_r:overlay_prop:s0
ro.boot.vendor.overlay. u:object_r:overlay_prop:s0
Assign a label to the ro.boottime.* properties system/core commit 331cf2fb7c16b5b25064f8d2f00284105a9b413f created a number of new properties of the form: [ro.boottime.init]: [5294587604] [ro.boottime.InputEventFind]: [10278767840] [ro.boottime.adbd]: [8359267180] ... These properties were assigned the default_prop SELinux label because a better label did not exist. Properties labeled with the default_prop label are readable to any SELinux domain, which is overly broad. bullhead:/ $ getprop -Z ro.boottime.adbd u:object_r:default_prop:s0 Instead, create a new label for the ro.boottime.* properties so we can apply more fine grain read access control to these properties. bullhead:/ $ getprop -Z ro.boottime.adbd u:object_r:boottime_prop:s0 New SELinux property labels have minimal permissions by default. As a result, after this change, ro.boottime.* properties will only be readable to system_server, bootstat, init (because it manages the property space), and "adb root" (because no SELinux permissions are enforced there). Additional read access can be granted as-needed. This is part of a larger effort to implement fine-grain access control on the properties managed by init. Test: Device boots and no SELinux denials on boot. Change-Id: Ibf981cb81898f4356fdc5c1b6f15dd93c0d6d84d
2016-12-14 04:50:36 +01:00
ro.boottime. u:object_r:boottime_prop:s0
Restrict access to ro.serialno and ro.boot.serialno This restricts access to ro.serialno and ro.boot.serialno, the two system properties which contain the device's serial number, to a select few SELinux domains which need the access. In particular, this removes access to these properties from Android apps. Apps can access the serial number via the public android.os.Build API. System properties are not public API for apps. The reason for the restriction is that serial number is a globally unique identifier which cannot be reset by the user. Thus, it can be used as a super-cookie by apps. Apps need to wean themselves off of identifiers not resettable by the user. Test: Set up fresh GMS device, install some apps via Play, update some apps, use Chrome Test: Access the device via ADB (ADBD exposes serial number) Test: Enable MTP over USB, use mtp-detect to confirm that serial number is reported in MTP DeviceInfo Bug: 31402365 Bug: 33700679 Change-Id: I4713133b8d78dbc63d8272503e80cd2ffd63a2a7
2016-12-21 00:31:37 +01:00
ro.serialno u:object_r:serialno_prop:s0
Restrict access to Bluetooth system properties This removes access to Bluetooth system properties from arbitrary SELinux domains. Access remains granted to init, bluetooth, and system_app domains. neverallow rules / CTS enforce that access is not granted to Zygote and processes spawned from Zygote expcept for system_app and bluetooth. The reason is that some of these properties may leak persistent identifiers not resettable by the user. Test: Bluetooth pairing and data transfer works Bug: 33700679 Change-Id: Icdcb3927a423c4011a62942340a498cc1b302472
2016-12-28 03:05:46 +01:00
ro.boot.btmacaddr u:object_r:bluetooth_prop:s0
Restrict access to ro.serialno and ro.boot.serialno This restricts access to ro.serialno and ro.boot.serialno, the two system properties which contain the device's serial number, to a select few SELinux domains which need the access. In particular, this removes access to these properties from Android apps. Apps can access the serial number via the public android.os.Build API. System properties are not public API for apps. The reason for the restriction is that serial number is a globally unique identifier which cannot be reset by the user. Thus, it can be used as a super-cookie by apps. Apps need to wean themselves off of identifiers not resettable by the user. Test: Set up fresh GMS device, install some apps via Play, update some apps, use Chrome Test: Access the device via ADB (ADBD exposes serial number) Test: Enable MTP over USB, use mtp-detect to confirm that serial number is reported in MTP DeviceInfo Bug: 31402365 Bug: 33700679 Change-Id: I4713133b8d78dbc63d8272503e80cd2ffd63a2a7
2016-12-21 00:31:37 +01:00
ro.boot.serialno u:object_r:serialno_prop:s0
Restrict access to Bluetooth system properties This removes access to Bluetooth system properties from arbitrary SELinux domains. Access remains granted to init, bluetooth, and system_app domains. neverallow rules / CTS enforce that access is not granted to Zygote and processes spawned from Zygote expcept for system_app and bluetooth. The reason is that some of these properties may leak persistent identifiers not resettable by the user. Test: Bluetooth pairing and data transfer works Bug: 33700679 Change-Id: Icdcb3927a423c4011a62942340a498cc1b302472
2016-12-28 03:05:46 +01:00
ro.bt. u:object_r:bluetooth_prop:s0
Switch /data/misc/reboot/last_reboot_reason to persistent property Switch from /data/misc/reboot/last_reboot_reason to persistent Android property persist.sys.boot.reason for indicating why the device is rebooted or shutdown. Introduce protection for all boot reason properties Protect the following properties with these labels ro.boot.bootreason u:object_r:bootloader_boot_reason_prop:s0 sys.boot.reason u:object_r:sys_boot_reason_prop:s0 persist.sys.boot.reason u:object_r:last_boot_reason_prop:s0 Setup the current as-need access rules for each. ToDo: Remove u:object_r:reboot_data_file after internal fixes. Test: system/core/bootstat/boot_reason_test.sh Bug: 64687998 Change-Id: I3771c73933e8ae2d94aee936c7a38b6282611b80
2017-08-14 23:25:10 +02:00
ro.boot.bootreason u:object_r:bootloader_boot_reason_prop:s0
persist.sys.boot.reason u:object_r:last_boot_reason_prop:s0
sys.boot.reason u:object_r:system_boot_reason_prop:s0
persist.sys.boot.reason is cleared once read by bootstat To ensure a surprise reboot does not take the last boot reason on face value especially if coming from more than one boot sessions ago. We shift and clear the value from persist.sys.boot.reason to sys.boot.reason.last and establish a correct last reboot reason in the canonical sys.boot.reason property. As a result, the power manager should read the canonical sys.boot.reason for a definitive result rather than relying on the possibly incorrect values in the persistent storage. sys.boot.reason should be a core property as it represents the canonical boot reason API. Test: compile Bug: 86671991 Bug: 63736262 Change-Id: If3742c487d6c0ab69c464f056bf48c786b66a945
2018-06-05 18:41:59 +02:00
sys.boot.reason.last u:object_r:last_boot_reason_prop:s0
Revert "Revert "Put pm.* property in new pm_prop context"" This reverts commit 248b6dc64444ea3260fba8e9cb390e59e2b941ab. Reason for revert: The dashboard complains that devices don't boot after this revert. Change-Id: I6a4648b64b096cbaa97c67aae6bc38b76d54cb48
2017-11-16 06:28:14 +01:00
pm. u:object_r:pm_prop:s0
FrameworksServicesTests: allow access to test.sys.boot.reason property com.android.server.power.PowerManagerServiceTest#testGetLastShutdownReasonInternal due to "RuntimeException: failed to set system property" W/roidJUnitRunner: type=1400 audit(0.0:6): avc: denied { write } for name="property_service" dev="tmpfs" ino=13178 scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=0 W/libc : Unable to set property "test.sys.boot.reason" to "shutdown,thermal": connection failed; errno=13 (Permission denied) Had to use precise property definition as com.android.phone accesses test properties as well. Test: compile Bug: 78245377 Change-Id: I2cc810846f8615f2a2fae8e0d4f41de585b7abd7
2015-10-25 01:20:18 +02:00
test.sys.boot.reason u:object_r:test_boot_reason_prop:s0
Selinux: Allow lmkd write access to sys.lmk. properties Allow lmkd write access to sys.lmk. properties to be able to set sys.lmk.minfree_levels. Bug: 111521182 Test: getprop sys.lmk.minfree_levels returns value set by lmkd Change-Id: I86ff11d75917966857d3a76876a56799bb92a5ad Signed-off-by: Suren Baghdasaryan <surenb@google.com>
2018-07-25 02:04:18 +02:00
sys.lmk. u:object_r:system_lmk_prop:s0
Allow traced to notify traceur via property This CL introduces allows traced to set the sys.traceur.trace_end_signal property at the end of the tracer. In turn that property notifies the the Traceur app. This is to allowing Traceur to be killed during a long-trace and avoid wasting resources making it a persistent service. See aosp/886616 for the matching traceur change. Test: manual Bug: 116754732 Change-Id: I89e2f02b3f973813ce8ff3507d397a06502f84c1
2019-02-01 23:52:02 +01:00
sys.trace. u:object_r:system_trace_prop:s0
Move policy files Update the file_contexts for the new location of the policy files, as well as update the policy for the management of these types. Change-Id: Idc475901ed437efb325807897e620904f4ff03e9
2013-01-23 23:02:43 +01:00
SELinux rule for ro.device_owner and persist.logd.security They are introduced for the device owner process logging feature. That is, for enterprise-owned devices with device owner app provisioned, the device owner may choose to turn on additional device-wide logging for auditing and intrusion detection purposes. Logging includes histories of app process startup, commands issued over ADB and lockscreen unlocking attempts. These logs will available to the device owner for analysis, potentially shipped to a remote server if it chooses to. ro.device_owner will be a master switch to turn off logging, if the device has no device owner provisioned. persist.logd.security is a switch that device owner can toggle (via DevicePoliyManager) to enable/disable logging. Writing to both properties should be only allowed by the system server. Bug: 22860162 Change-Id: Iabfe2347b094914813b9d6e0c808877c25ccd038
2016-01-04 16:20:45 +01:00
# Boolean property set by system server upon boot indicating
# if device owner is provisioned.
ro.device_owner u:object_r:device_logging_prop:s0
Move policy files Update the file_contexts for the new location of the policy files, as well as update the policy for the management of these types. Change-Id: Idc475901ed437efb325807897e620904f4ff03e9
2013-01-23 23:02:43 +01:00
# selinux non-persistent properties
New "selinux.restorecon" control property. This new property is used as a control verb for running a recursive restorecon at the path contained in the property value. Defines a new label and grants access to vold, which invokes it when mounting private adopted volumes. Bug: 21121357 Change-Id: I8ff12a146e54a505aa5b43a542578891563d647a
2015-06-09 20:01:04 +02:00
selinux.restorecon_recursive u:object_r:restorecon_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
# default property context
* u:object_r:default_prop:s0
# data partition encryption properties
vold. u:object_r:vold_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.crypto. u:object_r:vold_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
allow system_server to set ro.build.fingerprint Some devices leave "ro.build.fingerprint" undefined at build time, since they need to build it from the components at runtime. See https://android.googlesource.com/platform/frameworks/base/+/5568772e8161205b86905d815783505fd3d461d8 for details. Allow system_server to set ro.build.fingerprint Addresses the following denial/error: avc: denied { set } for property=build.fingerprint scontext=u:r:system_server:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service init: sys_prop: permission denied uid:1000 name:ro.build.fingerprint Bug: 18188956 Change-Id: I98b25773904a7be3e3d2926daa82c1d08f9bcc29
2014-11-18 23:36:23 +01:00
# ro.build.fingerprint is either set in /system/build.prop, or is
# set at runtime by system_server.
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.build.fingerprint u:object_r:fingerprint_prop:s0
allow system_server to set ro.build.fingerprint Some devices leave "ro.build.fingerprint" undefined at build time, since they need to build it from the components at runtime. See https://android.googlesource.com/platform/frameworks/base/+/5568772e8161205b86905d815783505fd3d461d8 for details. Allow system_server to set ro.build.fingerprint Addresses the following denial/error: avc: denied { set } for property=build.fingerprint scontext=u:r:system_server:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service init: sys_prop: permission denied uid:1000 name:ro.build.fingerprint Bug: 18188956 Change-Id: I98b25773904a7be3e3d2926daa82c1d08f9bcc29
2014-11-18 23:36:23 +01:00
make ro.persistent_properties.ready accessible for hidl client - compared to ro.boottime, this one does not pass time info bug: 35178781 bug: 34274385 Test: reboot Change-Id: I6a7bf636a3f201653e2890751d5fa210274c9ede
2017-03-01 04:21:31 +01:00
ro.persistent_properties.ready u:object_r:persistent_properties_ready_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
# ctl properties
Replace ctl_default_prop access with explicit service property keys. The ctl_default_prop label is a bit too generic for some of the priveleged domains when describing access rights. Instead, be explicit about which services are being started and stopped by introducing new ctl property keys. Change-Id: I1d0c6f6b3e8bd63da30bd6c7b084da44f063246a Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-02-18 19:24:26 +01:00
ctl.bootanim u:object_r:ctl_bootanim_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
ctl.dumpstate u:object_r:ctl_dumpstate_prop:s0
Replace ctl_default_prop access with explicit service property keys. The ctl_default_prop label is a bit too generic for some of the priveleged domains when describing access rights. Instead, be explicit about which services are being started and stopped by introducing new ctl property keys. Change-Id: I1d0c6f6b3e8bd63da30bd6c7b084da44f063246a Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-02-18 19:24:26 +01:00
ctl.fuse_ u:object_r:ctl_fuse_prop:s0
ctl.mdnsd u:object_r:ctl_mdnsd_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
ctl.ril-daemon u:object_r:ctl_rildaemon_prop:s0
Allow system_app to start bugreport and to create /data/anr/traces.txt. Resolves denials such as: avc: denied { set } for property =ctl.bugreport scontext=u:r:system_app:s0 tcontext=u:object_r:ctl_default_prop:s0 tclass=property_service avc: denied { write } for pid=4415 comm=5369676E616C2043617463686572 name="anr" dev="dm-0" ino=358337 scontext=u:r:system_app:s0 tcontext=u:object_r:anr_data_file:s0 tclass=dir avc: denied { add_name } for pid=4415 comm=5369676E616C2043617463686572 name="traces.txt" scontext=u:r:system_app:s0 tcontext=u:object_r:anr_data_file:s0 tclass=dir avc: denied { create } for pid=4415 comm=5369676E616C2043617463686572 name="traces.txt" scontext=u:r:system_app:s0 tcontext=u:object_r:anr_data_file:s0 tclass=file Change-Id: I71d0ede049136d72f28bdc85d52fcefa2f7d128f Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-03-06 20:47:22 +01:00
ctl.bugreport u:object_r:ctl_bugreport_prop:s0
Create context for ctl.console (cherry picked from commit c2e31a77825b4b404549396f5bcf1834d6ab0d3a) Change-Id: I92218709fa8cdb71c0369aca8fdd7922df45f7d0
2015-04-24 23:39:16 +02:00
ctl.console u:object_r:ctl_console_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
ctl. u:object_r:ctl_default_prop:s0
Allow NFC to read/write nfc. system properties. (cherry pick of commit 05383ebfb439bed8436912ed28db550e8842b343) Bug: 17298769 Change-Id: I1994ff9f9da9b13249099f6c9bcec88dcdc2bb97
2014-09-26 00:13:41 +02:00
Finer grained permissions for ctl. properties Currently, permissions for ctl. property apply to each action verb, so if a domain has permissions for controlling service 'foo', then it can start, stop, and restart foo. This change implements finer grainer permissions such that permission can be given to strictly start a given service, but not stop or restart it. This new permission scheme is mandatory for the new control functions, sigstop_on, sigstop_off, interface_start, interface_stop, interface_restart. Bug: 78511553 Test: see appropriate successes and failures based on permissions Merged-In: Ibe0cc0d6028fb0ed7d6bcba626721e0d84cc20fa Change-Id: Ibe0cc0d6028fb0ed7d6bcba626721e0d84cc20fa (cherry picked from commit 2208f96e9e6264553fcc8a58b86f4f21a092468c)
2018-05-04 02:00:16 +02:00
# Don't allow blind access to all services
ctl.sigstop_on$ u:object_r:ctl_sigstop_prop:s0
ctl.sigstop_off$ u:object_r:ctl_sigstop_prop:s0
ctl.start$ u:object_r:ctl_start_prop:s0
ctl.stop$ u:object_r:ctl_stop_prop:s0
ctl.restart$ u:object_r:ctl_restart_prop:s0
ctl.interface_start$ u:object_r:ctl_interface_start_prop:s0
ctl.interface_stop$ u:object_r:ctl_interface_stop_prop:s0
ctl.interface_restart$ u:object_r:ctl_interface_restart_prop:s0
Revert "Revert "Reduce the number of processes that can start adbd"" This reverts commit b5dc6137adf0c5ced252c6bedc48b00317e0a4e0. Reason for revert: Reverted incorrect change Change-Id: Ieafa3338e28ffeed40bcceb73486cffbfbd08b9d
2018-06-26 21:52:21 +02:00
# Restrict access to starting/stopping adbd
ctl.start$adbd u:object_r:ctl_adbd_prop:s0
ctl.stop$adbd u:object_r:ctl_adbd_prop:s0
ctl.restart$adbd u:object_r:ctl_adbd_prop:s0
Allow system_server and shell to start gsid on-demand. gsid is started lazily to reduce memory pressure. It can be started either via gsi_tool (invoked by adb shell), or by DynamicAndroidService via system_server. Bug: 126622385 Test: no denials running "gsi_tool status" Change-Id: I90a5f3f28fe4f294fb60e7c87a62e76716fbd5c0
2019-02-28 03:31:11 +01:00
# Restrict access to starting/stopping gsid.
ctl.start$gsid u:object_r:ctl_gsid_prop:s0
ctl.stop$gsid u:object_r:ctl_gsid_prop:s0
ctl.restart$gsid u:object_r:ctl_gsid_prop:s0
Allow apexd to stop itself apexd stops itself when it finds that it is running on a device with flattened APEXes (i.e. ro.apex.updatable = false). Bug: 133907211 Test: launch sdk_phone_x86_64 adb logcat -d | grep apexd | wc -l returns 3 Change-Id: I7fa161b069aa34adb028194b55f367fe740a0cfc
2019-06-13 02:45:05 +02:00
# Restrict access to stopping apexd.
ctl.stop$apexd u:object_r:ctl_apexd_prop:s0
Fix: dumpstate HAL service property context http://aosp/678384 changed property format Fixes: 137695210 Test: inject timeout and take BR see dumpstate restarted Change-Id: Ie24e2d42e92410a935ca4c9364b476d72aa459f3
2019-07-17 18:39:33 +02:00
# Restrict access to restart dumpstate
ctl.interface_restart$android.hardware.dumpstate u:object_r:ctl_dumpstate_prop:s0
Allow NFC to read/write nfc. system properties. (cherry pick of commit 05383ebfb439bed8436912ed28db550e8842b343) Bug: 17298769 Change-Id: I1994ff9f9da9b13249099f6c9bcec88dcdc2bb97
2014-09-26 00:13:41 +02:00
# NFC properties
nfc. u:object_r:nfc_prop:s0
Dependencies for new goldfish service domains. In order to support the new goldfish service domains in a change with the same Change-Id for the build project, we need the following changes in external/sepolicy: - /system/bin/logcat needs its own type so that it can be used as an entrypoint for the goldfish-logcat service. A neverallow rule prevents us from allowing entrypoint to any type not in exec_type. - The config. and dalvik. property namespaces need to be labeled with something other than default_prop so that the qemu-props service can set them. A neverallow rule prevents us from allowing qemu-props to set default_prop. We allow rx_file_perms to logcat_exec for any domain that was previously allowed read_logd() as many programs will read the logs by running logcat. We do not do this for all domains as it would violate a neverallow rule on the kernel domain executing any file without transitioning to another domain, and as we ultimately want to apply the same restriction to the init domain (and possibly others). Change-Id: Idce1fb5ed9680af84788ae69a5ace684c6663974 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-04 14:44:49 +02:00
# These properties are not normally set by processes other than init.
# They are only distinguished here for setting by qemu-props on the
# emulator/goldfish.
config. u:object_r:config_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.config. u:object_r:config_prop:s0
Dependencies for new goldfish service domains. In order to support the new goldfish service domains in a change with the same Change-Id for the build project, we need the following changes in external/sepolicy: - /system/bin/logcat needs its own type so that it can be used as an entrypoint for the goldfish-logcat service. A neverallow rule prevents us from allowing entrypoint to any type not in exec_type. - The config. and dalvik. property namespaces need to be labeled with something other than default_prop so that the qemu-props service can set them. A neverallow rule prevents us from allowing qemu-props to set default_prop. We allow rx_file_perms to logcat_exec for any domain that was previously allowed read_logd() as many programs will read the logs by running logcat. We do not do this for all domains as it would violate a neverallow rule on the kernel domain executing any file without transitioning to another domain, and as we ultimately want to apply the same restriction to the init domain (and possibly others). Change-Id: Idce1fb5ed9680af84788ae69a5ace684c6663974 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-04 14:44:49 +02:00
dalvik. u:object_r:dalvik_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.dalvik. u:object_r:dalvik_prop:s0
Separate permissions to set WiFi related properties wificond would like to be able to set WiFi related properties without access to the rest of the system properties. Today, this only involves marking the driver as loaded or unloaded. avc: denied { write } for name="property_service" dev="tmpfs" ino=10100 scontext=u:r:wificond:s0 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=0 Bug: 29579539 Test: No avc denials related to system properties across various WiFi events. Change-Id: I6d9f1de3fbef04cb7750cc3753634f9e02fdb71f (cherry picked from commit 1ebfdd6a14fb21705664c8e144f151b39c3d73f8)
2016-06-29 20:28:20 +02:00
# Shared between system server and wificond
wlan. u:object_r:wifi_prop:s0
sepolicy: allow hwservicemanager to set properties Allow hwservicemanager to set properties starting with the prefix "hwservicemanager." b/31458381 b/31240290 Test: passing build and runtime tests Change-Id: Id92e2170f52893bbf236987ee59383df2264952f Signed-off-by: Iliyan Malchev <malchev@google.com>
2016-09-20 00:23:41 +02:00
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
# Lowpan properties
lowpan. u:object_r:lowpan_prop:s0
ro.lowpan. u:object_r:lowpan_prop:s0
Property to enable heap profile from process startup. This is world-readable so it can be checked in libc's process init. Test: m Test: flash sailfish Bug: 117821125 Change-Id: Iac7317ceb75b5ad9cfb9adabdf16929263fa8a9d
2018-11-08 14:58:13 +01:00
# heapprofd properties
heapprofd. u:object_r:heapprofd_prop:s0
sepolicy: allow hwservicemanager to set properties Allow hwservicemanager to set properties starting with the prefix "hwservicemanager." b/31458381 b/31240290 Test: passing build and runtime tests Change-Id: Id92e2170f52893bbf236987ee59383df2264952f Signed-off-by: Iliyan Malchev <malchev@google.com>
2016-09-20 00:23:41 +02:00
# hwservicemanager properties
hwservicemanager. u:object_r:hwservicemanager_prop:s0
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
Add default namespaces of odm properties Since /odm is an extension of /vendor, its default property contexts should be consistent with ones of /vendor. Bug: 36796459 Test: tested on wahoo devices Change-Id: Ia67ebe81e9c7102aab35a34f14738ed9a24811d3
2018-01-18 05:25:28 +01:00
# Common default properties for vendor and odm.
init.svc.odm. u:object_r:vendor_default_prop:s0
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
init.svc.vendor. u:object_r:vendor_default_prop:s0
ro.hardware. u:object_r:vendor_default_prop:s0
Add default namespaces of odm properties Since /odm is an extension of /vendor, its default property contexts should be consistent with ones of /vendor. Bug: 36796459 Test: tested on wahoo devices Change-Id: Ia67ebe81e9c7102aab35a34f14738ed9a24811d3
2018-01-18 05:25:28 +01:00
ro.odm. u:object_r:vendor_default_prop:s0
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
ro.vendor. u:object_r:vendor_default_prop:s0
Add default namespaces of odm properties Since /odm is an extension of /vendor, its default property contexts should be consistent with ones of /vendor. Bug: 36796459 Test: tested on wahoo devices Change-Id: Ia67ebe81e9c7102aab35a34f14738ed9a24811d3
2018-01-18 05:25:28 +01:00
odm. u:object_r:vendor_default_prop:s0
persist.odm. u:object_r:vendor_default_prop:s0
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
persist.vendor. u:object_r:vendor_default_prop:s0
vendor. u:object_r:vendor_default_prop:s0
Combine vendor-init-actionable with vendor-init-readable Historically, vendor-init-actionable was created since the various property_contexts files were not yet available when init parses its scripts. Since then, the property_contexts files are now always available when init parses its scripts, so we can collapse these two categories. Specifically, this change ensures that all of the properties in the previous 'stable_properties.h' file in init, which contained the vendor-init-actionable properties, are able to be read by init according to SEPolicy. Bug: 71814576 Test: vendor_init fails to use non-readable properties as a trigger Test: vendor_init successfully uses readable properties as a trigger Change-Id: Ic6d9919b6047f3076a1a19fc26295c6a77aca627
2018-10-23 22:25:05 +02:00
# ro.boot. properties are set based on kernel commandline arguments, which are vendor owned.
ro.boot. u:object_r:exported2_default_prop:s0
Add label for time (zone) system properties This adds a label for system properties that will affect system-wide time / time detection logic. The first example will be something like: persist.time.detection_impl_version Bug: 78217059 Test: build Change-Id: I46044f1e28170760001da9acf2496a1e3037e48a
2018-06-25 16:36:51 +02:00
# Properties that relate to time / time zone detection behavior.
persist.time. u:object_r:time_prop:s0
sepolicy for server configurable flags Test: manual on device Change-Id: Ibafe1b345489c88a49a7ed3e2e61e5cc5e1880a1
2018-10-26 05:09:55 +02:00
# Properties that relate to server configurable flags
Sepolicies for server configural flags reset Test: m -j succeeded and manual tested on device Change-Id: I3415c58335361a9da4ef2368e61bc4e0250a91bb
2018-11-09 01:46:19 +01:00
device_config.reset_performed u:object_r:device_config_reset_performed_prop:s0
Update sepolicy with new native boot flag for activity_manager Whitelist the persistent system properties that will be used as flags in activity manager experiments. Bug: 120794810 Test: m, flash, test getting flag value in ActivityManagerService.java Change-Id: I90a10bc87d6db3a64347b62fd02e6f0b12ac9fa8
2019-01-17 22:30:05 +01:00
persist.device_config.activity_manager_native_boot. u:object_r:device_config_activity_manager_native_boot_prop:s0
sepolicy for server configurable flags Test: manual on device Change-Id: Ibafe1b345489c88a49a7ed3e2e61e5cc5e1880a1
2018-10-26 05:09:55 +02:00
persist.device_config.attempted_boot_count u:object_r:device_config_boot_count_prop:s0
Permissions for input_native_boot flags For input experiments that are enabled at boot time, allow system_server to read and write the device config flags. Bug: 120794829 Test: presubmit Change-Id: I0f075a7579c593d4e07c3e31be529e34554068a6
2019-01-14 23:18:38 +01:00
persist.device_config.input_native_boot. u:object_r:device_config_input_native_boot_prop:s0
SEPolicy updates for adding native flag namespace(netd). For experiment flag testing, we add a flag netd and have SEPolicy updates. Test: add sepolicy, m -j, check GetServerConfigurableFlag function in netd Bug:122050512 Change-Id: I21c844c277afc358085d80447f16e4c0d4eba5b3
2018-12-27 11:01:25 +01:00
persist.device_config.netd_native. u:object_r:device_config_netd_native_prop:s0
Rename runtime -> runtime_native property namespace The convention for native properties is to use _native suffix. Bug: 123524494 Bug: 120794191 Test: set a property and ensure it can be read in AndroidRuntime.cpp Change-Id: I69feab9be78f24d812b8f953d3ec06a5d8d18f15
2019-01-29 18:57:11 +01:00
persist.device_config.runtime_native. u:object_r:device_config_runtime_native_prop:s0
Add device_config_runtime_native_boot_prop Some runtime properties require reboots and should be in the native_boot namespace instead of native. Bug: 120794191 Bug: 123524494 Test: set a property and ensure it can be read in AndroidRuntime.cpp Change-Id: I1d1e984dcba26dd04d34a7d30fc63e1b75a8a311
2019-02-01 22:43:11 +01:00
persist.device_config.runtime_native_boot. u:object_r:device_config_runtime_native_boot_prop:s0
SEPolicy updates for adding native flag namespace(media). Test: add sepolicy, build, check GetServerConfigurableFlag function Bug: 123658514 Change-Id: I798b0ef901068c53070e768305acd38118a7e886
2019-01-31 00:28:31 +01:00
persist.device_config.media_native. u:object_r:device_config_media_native_prop:s0
Add native flags namespace storage_native_boot Grant SEPolicy write permissions for device_config_storage_native_boot. Test: build and flash - device successfully boots Bug: 140803239 Change-Id: I6e4f5889aee9384b47faacb31e2b1938250428ef
2019-09-23 16:14:47 +02:00
persist.device_config.storage_native_boot. u:object_r:device_config_storage_native_boot_prop:s0
apexd_prop is defined for PRODUCT_COMPATIBLE_PROPERTY = false case apexd_prop is also defined in private/propery_contexts in order to make the type to exist even when PRODUCT_COMPATIBLE_PROPERTY is false (i.e., Pixel 1). Bug: 119220815 Test: m plat_property_contexts for sailfish the built plat_property_contexts has apexd_prop defined Change-Id: I9ef71410533c1f64fc6a3112cfcb199d23aaf3db
2018-11-08 03:24:34 +01:00
Re-add sys_traced prop Add permissions for: persist.device_config.global_settings.sys_traced Bug: b/71737179 Test: As follows: patch aosp/891475 patch aosp/891853 patch ag/6224352 $ adb shell walleye:/ $ ps -A | grep traced nobody 1135 1 52288 2200 0 0 S traced nobody 1136 1 52288 2256 0 0 S traced_probes walleye:/ $ settings put global sys_traced 0 walleye:/ $ ps -A | grep traced 1|walleye:/ $ walleye:/ $ settings put global sys_traced 1 1|walleye:/ $ ps -A | grep traced nobody 12386 1 52288 2208 0 0 S traced nobody 12387 1 52288 2248 0 0 S traced_probes Change-Id: I8898672c8fdc9c5d87a31b90f6c7d5c03bef78ed
2019-04-05 17:41:30 +02:00
# Properties that relate to legacy server configurable flags
persist.device_config.global_settings.sys_traced u:object_r:device_config_sys_traced_prop:s0
apexd_prop is defined for PRODUCT_COMPATIBLE_PROPERTY = false case apexd_prop is also defined in private/propery_contexts in order to make the type to exist even when PRODUCT_COMPATIBLE_PROPERTY is false (i.e., Pixel 1). Bug: 119220815 Test: m plat_property_contexts for sailfish the built plat_property_contexts has apexd_prop defined Change-Id: I9ef71410533c1f64fc6a3112cfcb199d23aaf3db
2018-11-08 03:24:34 +01:00
apexd. u:object_r:apexd_prop:s0
Add persist.apexd. property context. For persistent properties related to apexd. Bug: 121302351 Test: apexd can get the prop Change-Id: Id9fd25923385188f46a9804155168c52f6b1187e
2019-01-09 12:04:03 +01:00
persist.apexd. u:object_r:apexd_prop:s0
Add permissions for bpf.progs_loaded property Change-Id: If4e550e4186415c5a1088bb53b0755b69f92560a Signed-off-by: Joel Fernandes <joelaf@google.com>
2019-01-11 14:32:45 +01:00
bpf.progs_loaded u:object_r:bpf_progs_loaded_prop:s0
Add sepolicy for gsid properties, and allow system_server to read them. Bug: 123777418 Test: manual test Change-Id: I9f8c721dfd074e638573d85cf1d8045a69c3854e
2019-02-07 22:14:20 +01:00
gsid. u:object_r:gsid_prop:s0
ro.gsid. u:object_r:gsid_prop:s0
NNAPI property to disable extensions use on GSI/AOSP product partition. Property is NNAPI client-readable and writeable only by init/build.prop. Bug: 129666983 Bug: 120483623 Test: flashed crosshatch/Cts tests for NNAPI Change-Id: Ic4c0f176440610a2c54c078863f3d5382323cc65
2019-04-02 16:34:16 +02:00
# Property for disabling NNAPI vendor extensions on product image (used on GSI /product image,
# which can't use NNAPI vendor extensions).
ro.nnapi.extensions.deny_on_product u:object_r:nnapi_ext_deny_product_prop:s0
Use a property instead of file to communicate cold boot done Ueventd can't set properties currently, but this is an artificial limitation, since ueventd communicates to init that it has finished cold boot via a file, and init polls this file instead of returning to the epoll loop, where properties are handled. A related change replaces that file with a property and thus frees ueventd to be able to set properties. This change creates the cold_boot_done property type for this property and gives only ueventd permissions to set it. Bug: 62301678 Test: boot, check that properties are set Change-Id: I40843b423b192ea841db6a82f648e5bab9738e0e
2019-06-18 18:53:51 +02:00
# Property that is set once ueventd finishes cold boot.
ro.cold_boot_done u:object_r:cold_boot_done_prop:s0
Allow charger to read ro.charger.* Allow charger to read system properties with this prefix so that charger's behavior is controlled by runtime. Test: run offline charging on walleye Bug: 124118169 Change-Id: I4266b2d043a5323b4adbd1636ada46b7e08ca667
2019-07-08 19:57:46 +02:00
# Charger properties
ro.charger. u:object_r:charger_prop:s0
Allow update_engine to read virtual ab feature flag. Test: adb shell getprop -Z [the two flags] Bug: 135752105 Change-Id: I3e0372e969ea0161787c32560a8c40fed2953619
2019-07-25 22:28:19 +02:00
# Virtual A/B properties
ro.virtual_ab.enabled u:object_r:virtual_ab_prop:s0
ro.virtual_ab.retrofit u:object_r:virtual_ab_prop:s0
Add a new context for property ota.warm_reset The property is set to inform kernel to do a warm_reset on the next reboot. This is useful to persist the logs to debug device boot failures. More details in http://go/rvc-ota-persist-logs. The property is set to 1 by update_engine after an OTA. And it's set to 0 by update_verifier or vold after we mark the current slot boot successful. The property is read by vendor_init. And according to its value, vendor_init writes a particular sysfs file to schedule a warm reset on the following reboot. Without the new context, the denial message says: [ 13.423163] audit: type=1107 audit(1746393.166:8): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { read } for property=ota.warm_reset pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0' [ 23.096497] init: Unable to set property 'OTA.warm_reset' from uid:0 gid:2001 pid:841: SELinux permission check failed [ 23.096574] type=1107 audit(1573768000.668:42): uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for property=OTA.warm_reset pid=841 uid=0 gid=2001 scontext=u:r:update_verifier:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service permissive=0' [ 23.108430] update_verifier: Failed to reset the warm reset flag Bug: 143489994 Test: check the property can be set by update_engine, and read by vendor_init Change-Id: I87c12a53a138b72ecfed3ab6a4d846c20f5a8484
2019-11-14 23:18:40 +01:00
# Property to set/clear the warm reset flag after an OTA update.
ota.warm_reset u:object_r:ota_prop:s0
Reference in a new issue Copy permalink