tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/runas.te

28 lines
962 B
Text
Raw Normal View History

Support run-as and ndk-gdb functionality. Confine run-as (but leave permissive for now) and add other allow rules required for the use of run-as and ndk-gdb functionality. Change-Id: Ifae38233c091cd34013e98830d72aac4c4adcae0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:39 +01:00
type runas, domain, mlstrustedsubject;
Make sure exec_type is assigned to all entrypoint types. Some file types used as domain entrypoints were missing the exec_type attribute. Add it and add a neverallow rule to keep it that way. Change-Id: I7563f3e03940a27ae40ed4d6bb74181c26148849 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-09-27 16:38:14 +02:00
type runas_exec, exec_type, file_type;
Add policy for run-as program. Add policy for run-as program and label it in file_contexts. Drop MLS constraints on local socket checks other than create/relabel as this interferes with connections with services, in particular for adb forward. Change-Id: Ib0c4abeb7cbef559e150a620c45a7c31e0531114 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-11-13 19:00:05 +01:00
# ndk-gdb invokes adb shell run-as.
domain_auto_trans(shell, runas_exec, runas)
Support run-as and ndk-gdb functionality. Confine run-as (but leave permissive for now) and add other allow rules required for the use of run-as and ndk-gdb functionality. Change-Id: Ifae38233c091cd34013e98830d72aac4c4adcae0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:39 +01:00
allow runas adbd:process sigchld;
runas: allow pipe communication from the shell run-as won't communicate with shell via pipes. Allow it. nnk@nnk:~$ adb shell "cat /dev/zero | run-as com.google.foo sh -c 'cat'" /system/bin/sh: cat: <stdout>: Broken pipe <4>[ 1485.483517] type=1400 audit(1402623577.085:25): avc: denied { read } for pid=6026 comm="run-as" path="pipe:[29823]" dev="pipefs" ino=29823 scontext=u:r:runas:s0 tcontext=u:r:shell:s0 tclass=fifo_file read is definitely needed. Not sure about write, but adding it just in case. Change-Id: Ifdf838b0df79a5f1e9559af57c2d1fdb8c41a201
2014-06-13 03:54:10 +02:00
allow runas shell:fd use;
allow runas shell:fifo_file { read write };
Support run-as and ndk-gdb functionality. Confine run-as (but leave permissive for now) and add other allow rules required for the use of run-as and ndk-gdb functionality. Change-Id: Ifae38233c091cd34013e98830d72aac4c4adcae0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:39 +01:00
allow runas devpts:chr_file { read write ioctl };
allow run-as to access /data/local/tmp Otherwise denials like the following occur: avc: denied { write } for path="/data/local/tmp/foo" dev="dm-0" ino=325769 scontext=u:r:runas:s0 tcontext=u:object_r:shell_data_file:s0 tclass=file avc: denied { read } for path="/data/local/tmp/foo" dev="dm-0" ino=325769 scontext=u:r:runas:s0 tcontext=u:object_r:shell_data_file:s0 tclass=file Steps to reproduce: $ run-as com.google.android.talk id > /data/local/tmp/id.out $ run-as com.google.android.talk cat < /data/local/tmp/id.out Change-Id: I68a7b804336a3d5776dcc31622f1279380282030
2014-11-08 01:21:42 +01:00
allow runas shell_data_file:file { read write };
Support run-as and ndk-gdb functionality. Confine run-as (but leave permissive for now) and add other allow rules required for the use of run-as and ndk-gdb functionality. Change-Id: Ifae38233c091cd34013e98830d72aac4c4adcae0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:39 +01:00
# run-as reads package information.
allow runas system_data_file:file r_file_perms;
# run-as checks and changes to the app data dir.
dontaudit runas self:capability dac_override;
allow runas app_data_file:dir { getattr search };
# run-as switches to the app UID/GID.
allow runas self:capability { setuid setgid };
# run-as switches to the app security context.
# read /seapp_contexts and /data/security/seapp_contexts
security_access_policy(runas)
selinux_check_context(runas) # validate context
Restrict requesting contexts other than policy-defined defaults. Writing to the /proc/self/attr files (encapsulated by the libselinux set*con functions) enables a program to request a specific security context for various operations instead of the policy-defined defaults. The security context specified using these calls is checked by an operation-specific permission, e.g. dyntransition for setcon, transition for setexeccon, create for setfscreatecon or setsockcreatecon, but the ability to request a context at all is controlled by a process permission. Omit these permissions from domain.te and only add them back where required so that only specific domains can even request a context other than the default defined by the policy. Change-Id: I6a2fb1279318625a80f3ea8e3f0932bdbe6df676 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-23 17:26:19 +02:00
allow runas self:process setcurrent;
Support run-as and ndk-gdb functionality. Confine run-as (but leave permissive for now) and add other allow rules required for the use of run-as and ndk-gdb functionality. Change-Id: Ifae38233c091cd34013e98830d72aac4c4adcae0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:39 +01:00
allow runas non_system_app_set:process dyntransition; # setcon
Reference in a new issue Copy permalink