tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/property.te

600 lines
17 KiB
Text
Raw Normal View History

Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
# Properties used only in /system
system_internal_prop(apexd_prop)
system_internal_prop(bootloader_boot_reason_prop)
system_internal_prop(device_config_activity_manager_native_boot_prop)
system_internal_prop(device_config_boot_count_prop)
system_internal_prop(device_config_input_native_boot_prop)
system_internal_prop(device_config_media_native_prop)
system_internal_prop(device_config_netd_native_prop)
system_internal_prop(device_config_reset_performed_prop)
system_internal_prop(device_config_runtime_native_boot_prop)
system_internal_prop(device_config_runtime_native_prop)
Add native flags namespace storage_native_boot Grant SEPolicy write permissions for device_config_storage_native_boot. Test: build and flash - device successfully boots Bug: 140803239 Change-Id: I6e4f5889aee9384b47faacb31e2b1938250428ef
2019-09-23 16:14:47 +02:00
system_internal_prop(device_config_storage_native_boot_prop)
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
system_internal_prop(device_config_sys_traced_prop)
Whitelisting window_manager_native_boot system property Bug: 147096935 Test: build, boot Change-Id: Iadeefa3cfc9bb17eb19b60dbd18de047fa01b673
2020-01-16 19:52:34 +01:00
system_internal_prop(device_config_window_manager_native_boot_prop)
Whitelist prop persist.device_config.configuration. For system prop flags from DeviceConfig namespace "Configuration". Test: Build and run on local device Bug: 149420506 Change-Id: If4196b4bf231e7c52f98b92cc0031a08dad06120
2020-02-27 23:05:05 +01:00
system_internal_prop(device_config_configuration_prop)
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
system_internal_prop(firstboot_prop)
system_internal_prop(gsid_prop)
Add sysprop for init's perf_event_open LSM hook check Written exclusively by init. Made it readable by shell for CTS, and for easier platform debugging. Bug: 137092007 Change-Id: Ia5b056117502c272bc7169661069d0c8020695e2
2020-01-14 19:20:06 +01:00
system_internal_prop(init_perf_lsm_hooks_prop)
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
system_internal_prop(init_svc_debug_prop)
system_internal_prop(last_boot_reason_prop)
system_internal_prop(netd_stable_secret_prop)
system_internal_prop(pm_prop)
Add userspace_reboot_log_prop This properties are used to compute UserspaceRebootAtom and are going to be written by system_server. Also removed now unused userspace_reboot_prop. Test: builds Bug: 148767783 Change-Id: Iee44b4ca9f5d3913ac71b2ac6959c232f060f0ed
2020-02-07 01:10:29 +01:00
system_internal_prop(userspace_reboot_log_prop)
Add userspace_reboot_test_prop This property type represents properties used in CTS tests of userspace reboot. For example, test.userspace_reboot.requested property which is used to check that userspace reboot was successful and didn't result in full reboot, e.g.: * before test setprop test.userspace_reboot.requested 1 * adb reboot userspace * wait for boot to complete * verify that value of test.userspace_reboot.requested is still 1 Test: adb shell setprop test.userspace_reboot.requested 1 Bug: 150901232 Change-Id: I45d187f386149cec08318ea8545ab864b5810ca8
2020-03-12 15:45:00 +01:00
system_internal_prop(userspace_reboot_test_prop)
Add adbd_prop, system_adbd_prop property types. service.adb.tls.port contains the adbd tcp port running the TLS server. persist.sys.adb.wifi tells adbd when to enable the TLS server. Bug: 149348431 Bug: 111434128 Test: Enable wireless debugging, check if TLS port information is displayed in the Developer options > Wireless debuggging. Change-Id: I5b5c5a3d064bc003f41386ede9051609fefec53e
2020-02-12 19:18:10 +01:00
system_internal_prop(system_adbd_prop)
system_internal_prop(adbd_prop)
traced_perf sepolicy tweaks * allow shell to enable/disable the daemon via a sysprop * don't audit signals, as some denials are expected * exclude zygote from the profileable set of targets on debug builds. I've not caught any crashes in practice, but believe there's a possibility that the zygote forks while holding a non-whitelisted fd due to the signal handler. Change-Id: Ib237d4edfb40b200a3bd52e6341f13c4777de3f1
2020-02-19 15:59:17 +01:00
system_internal_prop(traced_perf_enabled_prop)
Make public for exported properties on old devices Properties which are already allowed to be written by vendor_init can't be internal or restricted prop. This sets the properties as public except for forbidden ones on vendor_init.te. Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: Icc1e813e78a48856adee26fb20f01300713e1d30
2019-10-17 06:42:42 +02:00
compatible_property_only(`
# DO NOT ADD ANY PROPERTIES HERE
system_internal_prop(boottime_prop)
system_internal_prop(bpf_progs_loaded_prop)
system_internal_prop(charger_prop)
system_internal_prop(cold_boot_done_prop)
system_internal_prop(ctl_adbd_prop)
system_internal_prop(ctl_apexd_prop)
system_internal_prop(ctl_bootanim_prop)
system_internal_prop(ctl_bugreport_prop)
system_internal_prop(ctl_console_prop)
system_internal_prop(ctl_dumpstate_prop)
system_internal_prop(ctl_fuse_prop)
system_internal_prop(ctl_gsid_prop)
system_internal_prop(ctl_interface_restart_prop)
system_internal_prop(ctl_interface_stop_prop)
system_internal_prop(ctl_mdnsd_prop)
system_internal_prop(ctl_restart_prop)
system_internal_prop(ctl_rildaemon_prop)
system_internal_prop(ctl_sigstop_prop)
system_internal_prop(dynamic_system_prop)
system_internal_prop(heapprofd_enabled_prop)
system_internal_prop(llkd_prop)
system_internal_prop(lpdumpd_prop)
system_internal_prop(mmc_prop)
system_internal_prop(mock_ota_prop)
system_internal_prop(net_dns_prop)
system_internal_prop(overlay_prop)
system_internal_prop(persistent_properties_ready_prop)
system_internal_prop(safemode_prop)
system_internal_prop(system_lmk_prop)
system_internal_prop(system_trace_prop)
system_internal_prop(test_boot_reason_prop)
system_internal_prop(time_prop)
system_internal_prop(traced_enabled_prop)
system_internal_prop(traced_lazy_prop)
')
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
# Properties which can't be written outside system
Fix treble boundary neverallow to use attributes These neverallow rules are to prevent properties from crossing treble boundary. As attributes like internal / restricted / public has been landed, the neverallow rules are changed to use attributes to avoid endless manual maintaining of the list. Bug: 148181222 Test: system/sepolicy/tools/build_policies.sh Change-Id: I0ba930f6c78852e785858fb069faf4f984643e34
2020-01-28 06:43:57 +01:00
# Properties used by binder caches
system_restricted_prop(binder_cache_bluetooth_server_prop)
system_restricted_prop(binder_cache_system_server_prop)
Use prefixes for binder cache SELinux properties. Adds a context for telephony related cache properties and changes the bluetooth and system_server properties to match off of prefix instead of exact string matches. Test: Flashed phone with PowerManager caches enabled and verified that the phone boots. Change-Id: I9110192a12bb6222e49a8fb6b266d6067ef2ea92
2020-01-28 22:08:28 +01:00
system_restricted_prop(binder_cache_telephony_server_prop)
sepolicy: introduce boottime props in public Bug: 146053177 Bug: 146053658 Bug: 149844577 Change-Id: Iddfefedc4538044c6abcc2eea29b86e3f038aee0 Merged-In: Iddfefedc4538044c6abcc2eea29b86e3f038aee0 Signed-off-by: Jaegeuk Kim <jaegeuk@google.com> (cherry picked from commit 19df15400ee76df1938ae95d2f92217ce776a956)
2020-03-04 04:40:41 +01:00
system_restricted_prop(boottime_public_prop)
selinux policy for buffer queue config Test: boot and check for no policy violations Change-Id: I1ea2a79b9a45b503dcb061c196c5af1d0ddab653
2020-01-20 06:11:07 +01:00
system_restricted_prop(bq_config_prop)
Rename sdkext sepolicy to sdkextensions The module is getting renamed, so rename all the policy relating to it at the same time. Bug: 137191822 Test: presubmit Change-Id: Ia9d966ca9884ce068bd96cf5734e4a459158c85b Merged-In: Ia9d966ca9884ce068bd96cf5734e4a459158c85b (cherry picked from commit 6505573c36dcc6153af37895e968400f722119ea)
2020-01-06 18:29:13 +01:00
system_restricted_prop(module_sdkextensions_prop)
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
system_restricted_prop(nnapi_ext_deny_product_prop)
system_restricted_prop(restorecon_prop)
Define sepolicy for redirect-socket-calls feature Define two property_context. 1. vendor_socket_hook_prop - for ro.vendor.redirect_socket_calls. The property set once in vendor_init context. It's evaluated at process start time and is cannot change at runtime on a given device. The set permission is restricted to vendor_init. The read permission is unrestricted. 2. socket_hook_prop - for net.redirect_socket_calls.hooked. The property can be changed by System Server at runtime. It's evaluated when shimmed socket functions is called. The set permission is restricted to System Server. The read permission is unrestricted. Bug: Bug: 141611769 Test: System Server can set net.redirect_socket_calls.hooked libnetd_client can read both properties libnetd_client can't set both properties Change-Id: Ic42269539923e6930cc0ee3df8ba032797212395
2020-02-10 10:43:15 +01:00
system_restricted_prop(socket_hook_prop)
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
system_restricted_prop(system_boot_reason_prop)
Revert^2 "SELinux policy for system server JVMTI" This reverts commit baa06ee2cd8b2f6c8bd0c2d873dc2888d6296353. Reason for revert: Added missing property name in vendor_init.te. Bug: none Test: none (other than neverallow checking) Change-Id: I9e93bf4ea6ca3a4634f8f4cbce2f13c5f410883b
2019-11-25 23:03:59 +01:00
system_restricted_prop(system_jvmti_agent_prop)
Add selinux rules for userspace reboot related properties By default sys.init.userspace_reboot.* properties are internal to /system partition. Only exception is sys.init.userspace_reboot.in_progress which signals to all native services (including vendor ones) that userspace reboot is happening, hence it should be a system_public_prop. Only init should be allowed to set userspace reboot related properties. Bug: 135984674 Test: builds Test: adb reboot userspace Change-Id: Ibb04965be2d5bf6e81b34569aaaa1014ff61e0d3
2019-11-14 13:59:15 +01:00
system_restricted_prop(userspace_reboot_exported_prop)
Make public for exported properties on old devices Properties which are already allowed to be written by vendor_init can't be internal or restricted prop. This sets the properties as public except for forbidden ones on vendor_init.te. Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: Icc1e813e78a48856adee26fb20f01300713e1d30
2019-10-17 06:42:42 +02:00
compatible_property_only(`
# DO NOT ADD ANY PROPERTIES HERE
system_restricted_prop(config_prop)
system_restricted_prop(cppreopt_prop)
system_restricted_prop(dalvik_prop)
system_restricted_prop(debuggerd_prop)
system_restricted_prop(default_prop)
system_restricted_prop(device_logging_prop)
system_restricted_prop(dhcp_prop)
system_restricted_prop(dumpstate_prop)
system_restricted_prop(exported2_default_prop)
system_restricted_prop(exported3_system_prop)
system_restricted_prop(exported_dumpstate_prop)
system_restricted_prop(exported_fingerprint_prop)
system_restricted_prop(exported_secure_prop)
system_restricted_prop(exported_vold_prop)
system_restricted_prop(ffs_prop)
system_restricted_prop(fingerprint_prop)
system_restricted_prop(heapprofd_prop)
system_restricted_prop(net_radio_prop)
system_restricted_prop(pan_result_prop)
system_restricted_prop(persist_debug_prop)
system_restricted_prop(shell_prop)
system_restricted_prop(system_radio_prop)
system_restricted_prop(test_harness_prop)
system_restricted_prop(theme_prop)
system_restricted_prop(use_memfd_prop)
system_restricted_prop(vold_prop)
')
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
Move some properties to system_vendor_config_prop system_vendor_config_prop defines a property contexts which can only be set from vendor_init. It is one of the mostly used patterns of system properties. This migrates some properties to help readability and security. Bug: 148125056 Test: system/sepolicy/build_policies.sh Change-Id: I6b53ef520331b32417ad59f4daa04bdfc077f682
2020-02-08 00:34:17 +01:00
# Properties which can be written only by vendor_init
system_vendor_config_prop(apk_verity_prop)
system_vendor_config_prop(cpu_variant_prop)
system_vendor_config_prop(exported_audio_prop)
system_vendor_config_prop(exported_camera_prop)
system_vendor_config_prop(exported_config_prop)
system_vendor_config_prop(exported_default_prop)
system_vendor_config_prop(exported3_default_prop)
system_vendor_config_prop(userspace_reboot_config_prop)
system_vendor_config_prop(vehicle_hal_prop)
system_vendor_config_prop(vendor_security_patch_level_prop)
Define sepolicy for redirect-socket-calls feature Define two property_context. 1. vendor_socket_hook_prop - for ro.vendor.redirect_socket_calls. The property set once in vendor_init context. It's evaluated at process start time and is cannot change at runtime on a given device. The set permission is restricted to vendor_init. The read permission is unrestricted. 2. socket_hook_prop - for net.redirect_socket_calls.hooked. The property can be changed by System Server at runtime. It's evaluated when shimmed socket functions is called. The set permission is restricted to System Server. The read permission is unrestricted. Bug: Bug: 141611769 Test: System Server can set net.redirect_socket_calls.hooked libnetd_client can read both properties libnetd_client can't set both properties Change-Id: Ic42269539923e6930cc0ee3df8ba032797212395
2020-02-10 10:43:15 +01:00
system_vendor_config_prop(vendor_socket_hook_prop)
Move some properties to system_vendor_config_prop system_vendor_config_prop defines a property contexts which can only be set from vendor_init. It is one of the mostly used patterns of system properties. This migrates some properties to help readability and security. Bug: 148125056 Test: system/sepolicy/build_policies.sh Change-Id: I6b53ef520331b32417ad59f4daa04bdfc077f682
2020-02-08 00:34:17 +01:00
system_vendor_config_prop(vndk_prop)
system_vendor_config_prop(virtual_ab_prop)
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
# Properties with no restrictions
system_public_prop(audio_prop)
system_public_prop(bluetooth_a2dp_offload_prop)
system_public_prop(bluetooth_audio_hal_prop)
system_public_prop(bluetooth_prop)
system_public_prop(ctl_default_prop)
system_public_prop(ctl_interface_start_prop)
system_public_prop(ctl_start_prop)
system_public_prop(ctl_stop_prop)
system_public_prop(debug_prop)
system_public_prop(dumpstate_options_prop)
system_public_prop(exported_system_prop)
system_public_prop(exported2_config_prop)
system_public_prop(exported2_radio_prop)
system_public_prop(exported2_system_prop)
system_public_prop(exported2_vold_prop)
system_public_prop(exported3_radio_prop)
system_public_prop(exported_bluetooth_prop)
system_public_prop(exported_dalvik_prop)
system_public_prop(exported_ffs_prop)
system_public_prop(exported_overlay_prop)
system_public_prop(exported_pm_prop)
system_public_prop(exported_radio_prop)
system_public_prop(exported_system_radio_prop)
system_public_prop(exported_wifi_prop)
Create new system property type for Factory OTA could write system property Due to Factory OTA client install in product partition but it also declare coredomian in its sepolicy setting. That will let Factory OTA unable to find a property type could write system property. But now Factory OTA have a restore NFC wake function need to write system property for communicate with bootloader. So we need to create a new property type in system framework which could allow Factory OTA client to write system property. Bug: 145178094 Test: Manual Change-Id: Ic549cc939893ec67a46bf28a23ebeb9f9b81bd0b
2019-12-06 08:59:58 +01:00
system_public_prop(sota_prop)
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
system_public_prop(hwservicemanager_prop)
system_public_prop(logd_prop)
system_public_prop(logpersistd_logging_prop)
system_public_prop(log_prop)
system_public_prop(log_tag_prop)
system_public_prop(lowpan_prop)
system_public_prop(nfc_prop)
Add a new context for property ota.warm_reset The property is set to inform kernel to do a warm_reset on the next reboot. This is useful to persist the logs to debug device boot failures. More details in http://go/rvc-ota-persist-logs. The property is set to 1 by update_engine after an OTA. And it's set to 0 by update_verifier or vold after we mark the current slot boot successful. The property is read by vendor_init. And according to its value, vendor_init writes a particular sysfs file to schedule a warm reset on the following reboot. Without the new context, the denial message says: [ 13.423163] audit: type=1107 audit(1746393.166:8): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { read } for property=ota.warm_reset pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0' [ 23.096497] init: Unable to set property 'OTA.warm_reset' from uid:0 gid:2001 pid:841: SELinux permission check failed [ 23.096574] type=1107 audit(1573768000.668:42): uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for property=OTA.warm_reset pid=841 uid=0 gid=2001 scontext=u:r:update_verifier:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service permissive=0' [ 23.108430] update_verifier: Failed to reset the warm reset flag Bug: 143489994 Test: check the property can be set by update_engine, and read by vendor_init Change-Id: I87c12a53a138b72ecfed3ab6a4d846c20f5a8484
2019-11-14 23:18:40 +01:00
system_public_prop(ota_prop)
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
system_public_prop(powerctl_prop)
system_public_prop(radio_prop)
system_public_prop(serialno_prop)
system_public_prop(system_prop)
system_public_prop(wifi_log_prop)
system_public_prop(wifi_prop)
rebootescrow: allow use of block file pmem uses a block file while access_ramoops uses a char file. Allow both for now until we can unify on pmem. Additionally allow the reading of vendor properties so it can read the path to the character or block device to open. Test: atest VtsHalRebootEscrowTargetTest Bug: 146400078 Change-Id: Ief61534e0946480a01c635ce1672579959ec8db5
2020-01-25 01:31:58 +01:00
# Properties used in default HAL implementations
vendor_internal_prop(rebootescrow_hal_prop)
Make public for exported properties on old devices Properties which are already allowed to be written by vendor_init can't be internal or restricted prop. This sets the properties as public except for forbidden ones on vendor_init.te. Bug: 131162102 Test: system/sepolicy/tools/build_policies.sh Change-Id: Icc1e813e78a48856adee26fb20f01300713e1d30
2019-10-17 06:42:42 +02:00
# Properties which are public for devices launching with Android O or earlier
# This should not be used for any new properties.
not_compatible_property(`
# DO NOT ADD ANY PROPERTIES HERE
system_public_prop(boottime_prop)
system_public_prop(bpf_progs_loaded_prop)
system_public_prop(charger_prop)
system_public_prop(cold_boot_done_prop)
system_public_prop(ctl_adbd_prop)
system_public_prop(ctl_apexd_prop)
system_public_prop(ctl_bootanim_prop)
system_public_prop(ctl_bugreport_prop)
system_public_prop(ctl_console_prop)
system_public_prop(ctl_dumpstate_prop)
system_public_prop(ctl_fuse_prop)
system_public_prop(ctl_gsid_prop)
system_public_prop(ctl_interface_restart_prop)
system_public_prop(ctl_interface_stop_prop)
system_public_prop(ctl_mdnsd_prop)
system_public_prop(ctl_restart_prop)
system_public_prop(ctl_rildaemon_prop)
system_public_prop(ctl_sigstop_prop)
system_public_prop(dynamic_system_prop)
system_public_prop(heapprofd_enabled_prop)
system_public_prop(llkd_prop)
system_public_prop(lpdumpd_prop)
system_public_prop(mmc_prop)
system_public_prop(mock_ota_prop)
system_public_prop(net_dns_prop)
system_public_prop(overlay_prop)
system_public_prop(persistent_properties_ready_prop)
system_public_prop(safemode_prop)
system_public_prop(system_lmk_prop)
system_public_prop(system_trace_prop)
system_public_prop(test_boot_reason_prop)
system_public_prop(time_prop)
system_public_prop(traced_enabled_prop)
system_public_prop(traced_lazy_prop)
system_public_prop(config_prop)
system_public_prop(cppreopt_prop)
system_public_prop(dalvik_prop)
system_public_prop(debuggerd_prop)
system_public_prop(default_prop)
system_public_prop(device_logging_prop)
system_public_prop(dhcp_prop)
system_public_prop(dumpstate_prop)
system_public_prop(exported2_default_prop)
system_public_prop(exported3_system_prop)
system_public_prop(exported_dumpstate_prop)
system_public_prop(exported_fingerprint_prop)
system_public_prop(exported_secure_prop)
system_public_prop(exported_vold_prop)
system_public_prop(ffs_prop)
system_public_prop(fingerprint_prop)
system_public_prop(heapprofd_prop)
system_public_prop(net_radio_prop)
system_public_prop(pan_result_prop)
system_public_prop(persist_debug_prop)
system_public_prop(shell_prop)
system_public_prop(system_radio_prop)
system_public_prop(test_harness_prop)
system_public_prop(theme_prop)
system_public_prop(use_memfd_prop)
system_public_prop(vold_prop)
')
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
type vendor_default_prop, property_type;
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
typeattribute log_prop log_property_type;
typeattribute log_tag_prop log_property_type;
typeattribute wifi_log_prop log_property_type;
Support fine grain read access control for properties Properties are now broken up from a single /dev/__properties__ file into multiple files, one per property label. This commit provides the mechanism to control read access to each of these files and therefore sets of properties. This allows full access for all domains to each of these new property files to match the current permissions of /dev/__properties__. Future commits will restrict the access. Bug: 21852512 Change-Id: Ie9e43968acc7ac3b88e354a0bdfac75b8a710094
2015-12-02 01:58:27 +01:00
allow property_type tmpfs:filesystem associate;
Do not allow new additions to core_property_type core_property_type is an attribute which was given to all existing properties known to core SELinux policy. Any property with this label is readable to all SELinux domains, which is overly broad. The long term goal is to remove the core_property_type attribute entirely. Add a neverallow rule prohibiting the introduction of new properties with the core_property_type attribute. Device specific properties, or new properties in core SELinux policy, should not have this attribute. Test: policy compiles Change-Id: Ie89a9f0d81c8561616001ff8451496ce2278dbb2
2016-12-14 00:59:33 +01:00
###
### Neverallow rules
###
Add BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW A new sysprop neverallow rules are mandatory only for devices launching with R or later. For devices already launched, neverallow rules can be relaxed with adding following line to BoardConfig.mk: BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true Bug: 131162102 Test: Set PRODUCT_SHIPPING_API_LEVEL := 30 and try building with changing some system_public_prop to system_internal_prop Test: m cts sepolicy_tests Change-Id: Id978b4d81a8683a57304bb639961105e2d91fa9a Merged-In: Id978b4d81a8683a57304bb639961105e2d91fa9a (cherry picked from commit 3be11e7abb8f4fd651295f9ccb0ce087855c1cc0)
2019-09-26 08:14:55 +02:00
treble_sysprop_neverallow(`
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
# TODO(b/131162102): uncomment these after assigning ownership attributes to all properties
Add BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW A new sysprop neverallow rules are mandatory only for devices launching with R or later. For devices already launched, neverallow rules can be relaxed with adding following line to BoardConfig.mk: BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true Bug: 131162102 Test: Set PRODUCT_SHIPPING_API_LEVEL := 30 and try building with changing some system_public_prop to system_internal_prop Test: m cts sepolicy_tests Change-Id: Id978b4d81a8683a57304bb639961105e2d91fa9a Merged-In: Id978b4d81a8683a57304bb639961105e2d91fa9a (cherry picked from commit 3be11e7abb8f4fd651295f9ccb0ce087855c1cc0)
2019-09-26 08:14:55 +02:00
# neverallow domain {
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
# property_type
# -system_property_type
# -product_property_type
# -vendor_property_type
# }:file no_rw_file_perms;
neverallow { domain -coredomain } {
system_property_type
Fix vendor defining macros and neverallows init and dumpstate should be able to access all properties, but they are in coredomain, so neverallow rules for vendor properties should be changed in order to avoid conflicts. Bug: 145339613 Test: add vendor_internal_prop manually and build. Change-Id: If582870f855e4444f8ac0d091696c0c7fd833791
2019-12-03 02:49:42 +01:00
system_internal_property_type
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
-system_restricted_property_type
-system_public_property_type
}:file no_rw_file_perms;
neverallow { domain -coredomain } {
system_property_type
-system_public_property_type
}:property_service set;
Fix vendor defining macros and neverallows init and dumpstate should be able to access all properties, but they are in coredomain, so neverallow rules for vendor properties should be changed in order to avoid conflicts. Bug: 145339613 Test: add vendor_internal_prop manually and build. Change-Id: If582870f855e4444f8ac0d091696c0c7fd833791
2019-12-03 02:49:42 +01:00
# init is in coredomain, but should be able to read/write all props.
# dumpstate is also in coredomain, but should be able to read all props.
neverallow { coredomain -init -dumpstate } {
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
vendor_property_type
Fix vendor defining macros and neverallows init and dumpstate should be able to access all properties, but they are in coredomain, so neverallow rules for vendor properties should be changed in order to avoid conflicts. Bug: 145339613 Test: add vendor_internal_prop manually and build. Change-Id: If582870f855e4444f8ac0d091696c0c7fd833791
2019-12-03 02:49:42 +01:00
vendor_internal_property_type
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
-vendor_restricted_property_type
-vendor_public_property_type
}:file no_rw_file_perms;
Fix vendor defining macros and neverallows init and dumpstate should be able to access all properties, but they are in coredomain, so neverallow rules for vendor properties should be changed in order to avoid conflicts. Bug: 145339613 Test: add vendor_internal_prop manually and build. Change-Id: If582870f855e4444f8ac0d091696c0c7fd833791
2019-12-03 02:49:42 +01:00
neverallow { coredomain -init } {
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
vendor_property_type
-vendor_public_property_type
}:property_service set;
')
property files: remove ioctl and lock They are unneeded. Test: device boots and no obvious problems. Change-Id: Ib788a89645c893c8c36acbe7fb34ce93bf6a57d7
2018-10-10 18:02:12 +02:00
# There is no need to perform ioctl or advisory locking operations on
# property files. If this neverallow is being triggered, it is
# likely that the policy is using r_file_perms directly instead of
# the get_prop() macro.
neverallow domain property_type:file { ioctl lock };
Do not allow new additions to core_property_type core_property_type is an attribute which was given to all existing properties known to core SELinux policy. Any property with this label is readable to all SELinux domains, which is overly broad. The long term goal is to remove the core_property_type attribute entirely. Add a neverallow rule prohibiting the introduction of new properties with the core_property_type attribute. Device specific properties, or new properties in core SELinux policy, should not have this attribute. Test: policy compiles Change-Id: Ie89a9f0d81c8561616001ff8451496ce2278dbb2
2016-12-14 00:59:33 +01:00
# core_property_type should not be used for new properties or
# device specific properties. Properties with this attribute
# are readable to everyone, which is overly broad and should
# be avoided.
# New properties should have appropriate read / write access
# control rules written.
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
typeattribute audio_prop core_property_type;
typeattribute config_prop core_property_type;
typeattribute cppreopt_prop core_property_type;
typeattribute dalvik_prop core_property_type;
typeattribute debuggerd_prop core_property_type;
typeattribute debug_prop core_property_type;
typeattribute default_prop core_property_type;
typeattribute dhcp_prop core_property_type;
typeattribute dumpstate_prop core_property_type;
typeattribute ffs_prop core_property_type;
typeattribute fingerprint_prop core_property_type;
typeattribute logd_prop core_property_type;
typeattribute net_radio_prop core_property_type;
typeattribute nfc_prop core_property_type;
Add a new context for property ota.warm_reset The property is set to inform kernel to do a warm_reset on the next reboot. This is useful to persist the logs to debug device boot failures. More details in http://go/rvc-ota-persist-logs. The property is set to 1 by update_engine after an OTA. And it's set to 0 by update_verifier or vold after we mark the current slot boot successful. The property is read by vendor_init. And according to its value, vendor_init writes a particular sysfs file to schedule a warm reset on the following reboot. Without the new context, the denial message says: [ 13.423163] audit: type=1107 audit(1746393.166:8): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { read } for property=ota.warm_reset pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0' [ 23.096497] init: Unable to set property 'OTA.warm_reset' from uid:0 gid:2001 pid:841: SELinux permission check failed [ 23.096574] type=1107 audit(1573768000.668:42): uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for property=OTA.warm_reset pid=841 uid=0 gid=2001 scontext=u:r:update_verifier:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service permissive=0' [ 23.108430] update_verifier: Failed to reset the warm reset flag Bug: 143489994 Test: check the property can be set by update_engine, and read by vendor_init Change-Id: I87c12a53a138b72ecfed3ab6a4d846c20f5a8484
2019-11-14 23:18:40 +01:00
typeattribute ota_prop core_property_type;
Add attributes for exported properties This introduces some attributes that can be used to restrict access to exported properties so that one can easily check from which the properties can be accessed, and that OEMs can extend their own exported properties. Bug: 71814576 Bug: 131162102 Test: boot aosp_cf_x86_phone-userdebug Test: logcat | grep "avc: " Change-Id: I6f988ec1cb94fa64563ca6cb91b7702da5d604e3
2019-09-09 12:46:15 +02:00
typeattribute pan_result_prop core_property_type;
typeattribute persist_debug_prop core_property_type;
typeattribute powerctl_prop core_property_type;
typeattribute radio_prop core_property_type;
typeattribute restorecon_prop core_property_type;
typeattribute shell_prop core_property_type;
typeattribute system_prop core_property_type;
typeattribute system_radio_prop core_property_type;
typeattribute vold_prop core_property_type;
Do not allow new additions to core_property_type core_property_type is an attribute which was given to all existing properties known to core SELinux policy. Any property with this label is readable to all SELinux domains, which is overly broad. The long term goal is to remove the core_property_type attribute entirely. Add a neverallow rule prohibiting the introduction of new properties with the core_property_type attribute. Device specific properties, or new properties in core SELinux policy, should not have this attribute. Test: policy compiles Change-Id: Ie89a9f0d81c8561616001ff8451496ce2278dbb2
2016-12-14 00:59:33 +01:00
neverallow * {
core_property_type
-audio_prop
-config_prop
-cppreopt_prop
-dalvik_prop
-debuggerd_prop
-debug_prop
-default_prop
-dhcp_prop
-dumpstate_prop
-ffs_prop
-fingerprint_prop
-logd_prop
-net_radio_prop
-nfc_prop
Add a new context for property ota.warm_reset The property is set to inform kernel to do a warm_reset on the next reboot. This is useful to persist the logs to debug device boot failures. More details in http://go/rvc-ota-persist-logs. The property is set to 1 by update_engine after an OTA. And it's set to 0 by update_verifier or vold after we mark the current slot boot successful. The property is read by vendor_init. And according to its value, vendor_init writes a particular sysfs file to schedule a warm reset on the following reboot. Without the new context, the denial message says: [ 13.423163] audit: type=1107 audit(1746393.166:8): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { read } for property=ota.warm_reset pid=0 uid=0 gid=0 scontext=u:r:vendor_init:s0 tcontext=u:object_r:default_prop:s0 tclass=file permissive=0' [ 23.096497] init: Unable to set property 'OTA.warm_reset' from uid:0 gid:2001 pid:841: SELinux permission check failed [ 23.096574] type=1107 audit(1573768000.668:42): uid=0 auid=4294967295 ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for property=OTA.warm_reset pid=841 uid=0 gid=2001 scontext=u:r:update_verifier:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service permissive=0' [ 23.108430] update_verifier: Failed to reset the warm reset flag Bug: 143489994 Test: check the property can be set by update_engine, and read by vendor_init Change-Id: I87c12a53a138b72ecfed3ab6a4d846c20f5a8484
2019-11-14 23:18:40 +01:00
-ota_prop
Do not allow new additions to core_property_type core_property_type is an attribute which was given to all existing properties known to core SELinux policy. Any property with this label is readable to all SELinux domains, which is overly broad. The long term goal is to remove the core_property_type attribute entirely. Add a neverallow rule prohibiting the introduction of new properties with the core_property_type attribute. Device specific properties, or new properties in core SELinux policy, should not have this attribute. Test: policy compiles Change-Id: Ie89a9f0d81c8561616001ff8451496ce2278dbb2
2016-12-14 00:59:33 +01:00
-pan_result_prop
-persist_debug_prop
-powerctl_prop
-radio_prop
-restorecon_prop
-shell_prop
-system_prop
-system_radio_prop
-vold_prop
}:file no_rw_file_perms;
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
Finer grained permissions for ctl. properties Currently, permissions for ctl. property apply to each action verb, so if a domain has permissions for controlling service 'foo', then it can start, stop, and restart foo. This change implements finer grainer permissions such that permission can be given to strictly start a given service, but not stop or restart it. This new permission scheme is mandatory for the new control functions, sigstop_on, sigstop_off, interface_start, interface_stop, interface_restart. Bug: 78511553 Test: see appropriate successes and failures based on permissions Change-Id: Ibe0cc0d6028fb0ed7d6bcba626721e0d84cc20fa
2018-05-04 02:00:16 +02:00
# sigstop property is only used for debugging; should only be set by su which is permissive
# for userdebug/eng
neverallow {
domain
-init
-vendor_init
} ctl_sigstop_prop:property_service set;
# Don't audit legacy ctl. property handling. We only want the newer permission check to appear
# in the audit log
dontaudit domain {
ctl_bootanim_prop
ctl_bugreport_prop
ctl_console_prop
ctl_default_prop
ctl_dumpstate_prop
ctl_fuse_prop
ctl_mdnsd_prop
ctl_rildaemon_prop
}:property_service set;
Adds new policy for init_svc_debug_prop. Used to restrict properties init.svc_debug_pid.* Bug: 138114550 Test: getprop | grep init.svc_debug_pid only shows results on root Change-Id: I0c10699deec4c548a2463a934e96b897ddee1678
2019-07-25 20:29:17 +02:00
neverallow {
domain
-init
} init_svc_debug_prop:property_service set;
neverallow {
domain
-init
-dumpstate
userdebug_or_eng(`-su')
} init_svc_debug_prop:file no_rw_file_perms;
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
compatible_property_only(`
Fix compatible property neverallows The current neverallow rules for compatible properties restrict domains from write file permissions to the various property files. This however is the wrong restriction, since only init actually writes to these property files. The correct restriction is to restrict 'set' for 'property_service' as this change does. Note there is already a restriction preventing {domain -init} from writing to these files in domain.te. Test: build Change-Id: I19e13b0d084a240185d0f3f5195e54065dc20e09
2018-01-24 20:20:35 +01:00
# Prevent properties from being set
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
neverallow {
domain
-coredomain
-appdomain
-vendor_init
} {
core_property_type
add extended_core_property_type The attribute is used to capture system properties added from outside of AOSP (e.g. by OEM), but are not device-specific and thus are used only inside the system partition. Access to the the system properties from outside of the system partition is prevented by the neverallow rule. Bug: 80382020 Bug: 78598545 Test: m -j selinux_policy Change-Id: I22c083dc195dab84c9c21a79fbe3ad823a3bbb46
2018-05-30 10:38:09 +02:00
extended_core_property_type
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
exported_config_prop
exported_dalvik_prop
exported_default_prop
exported_dumpstate_prop
exported_ffs_prop
Fix TODOs of duplicate property names for prefix and exact matching Duplicate property names are supported now for prefix and exact matching. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: Ifd9d32eaece7370d69f121e88d5541f7a2e34458
2018-01-12 02:19:48 +01:00
exported_fingerprint_prop
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
exported_system_prop
exported_system_radio_prop
exported_vold_prop
exported2_config_prop
exported2_default_prop
exported2_system_prop
exported2_vold_prop
exported3_default_prop
exported3_system_prop
Fix compatible property neverallows The current neverallow rules for compatible properties restrict domains from write file permissions to the various property files. This however is the wrong restriction, since only init actually writes to these property files. The correct restriction is to restrict 'set' for 'property_service' as this change does. Note there is already a restriction preventing {domain -init} from writing to these files in domain.te. Test: build Change-Id: I19e13b0d084a240185d0f3f5195e54065dc20e09
2018-01-24 20:20:35 +01:00
-nfc_prop
-powerctl_prop
-radio_prop
}:property_service set;
neverallow {
domain
-coredomain
-appdomain
Add tests for compatible property (1/2) The feature of compatible property has its own neverallow rules and it is enforced on devices launchig with Android P. This CL changes hal_nfc to hal_nfc_server in neverallow rules because sepolicy-analyze doesn't recognize it. Additionally one more neverallow rule is added to restrict reading nfc_prop. Bug: 72013705 Bug: 72678352 Test: 'run cts -m CtsSecurityHostTestCases' on walleye with ro.product.first_api_level=28 Change-Id: I753cc81f7ca0e4ad6a2434b2a047052678f57671
2018-01-30 09:23:58 +01:00
-hal_nfc_server
Fix compatible property neverallows The current neverallow rules for compatible properties restrict domains from write file permissions to the various property files. This however is the wrong restriction, since only init actually writes to these property files. The correct restriction is to restrict 'set' for 'property_service' as this change does. Note there is already a restriction preventing {domain -init} from writing to these files in domain.te. Test: build Change-Id: I19e13b0d084a240185d0f3f5195e54065dc20e09
2018-01-24 20:20:35 +01:00
} {
nfc_prop
}:property_service set;
neverallow {
domain
-coredomain
-appdomain
Revert "Revert "Move rild from public to vendor."" This reverts commit 016f0a58a9cd429f1986033f922d4bb7f58f5f3a. Reason for revert: Was temporarily reverted, merging back in with fix. Bug: 74486619 Bug: 36427227 Change-Id: Ide68726a90d5485c2758673079427407aee1e4f2
2018-03-12 18:12:09 +01:00
-hal_telephony_server
Fix compatible property neverallows The current neverallow rules for compatible properties restrict domains from write file permissions to the various property files. This however is the wrong restriction, since only init actually writes to these property files. The correct restriction is to restrict 'set' for 'property_service' as this change does. Note there is already a restriction preventing {domain -init} from writing to these files in domain.te. Test: build Change-Id: I19e13b0d084a240185d0f3f5195e54065dc20e09
2018-01-24 20:20:35 +01:00
-vendor_init
} {
exported_radio_prop
Allow vendor-init-settable to persist.radio.multisim.config A default value of persist.radio.multisim.config can be set by SoC vendors, and so vendor-init-settable should be allowed to it. Bug: 73871799 Test: succeeded building and tested with taimen Change-Id: Ie62b91e7e3d7e05425b742838417f1cab7b3fed4 Merged-In: Ie62b91e7e3d7e05425b742838417f1cab7b3fed4 (cherry picked from commit ac8c6e3d44ec55474759d99e58c9dbf034f4f815)
2018-03-27 06:41:47 +02:00
exported3_radio_prop
Neverallow unexpected domains to access bluetooth_prop and wifi_prop And this CL will remove unnecessary vendor-init exceptions for nfc_prop and radio_prop as well. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: I468b8fd907c6408f51419cfb58eb2b8da29118ae Merged-In: I468b8fd907c6408f51419cfb58eb2b8da29118ae (cherry picked from commit 41e42d63fecf9c237337acea7e21a5da0683debe)
2018-04-18 04:24:15 +02:00
}:property_service set;
neverallow {
domain
-coredomain
-appdomain
-hal_telephony_server
} {
exported2_radio_prop
Fix compatible property neverallows The current neverallow rules for compatible properties restrict domains from write file permissions to the various property files. This however is the wrong restriction, since only init actually writes to these property files. The correct restriction is to restrict 'set' for 'property_service' as this change does. Note there is already a restriction preventing {domain -init} from writing to these files in domain.te. Test: build Change-Id: I19e13b0d084a240185d0f3f5195e54065dc20e09
2018-01-24 20:20:35 +01:00
radio_prop
}:property_service set;
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
Neverallow unexpected domains to access bluetooth_prop and wifi_prop And this CL will remove unnecessary vendor-init exceptions for nfc_prop and radio_prop as well. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: I468b8fd907c6408f51419cfb58eb2b8da29118ae Merged-In: I468b8fd907c6408f51419cfb58eb2b8da29118ae (cherry picked from commit 41e42d63fecf9c237337acea7e21a5da0683debe)
2018-04-18 04:24:15 +02:00
neverallow {
domain
-coredomain
-bluetooth
Use non-expanded types in prop neverallows Using hal_foo attributes in neverallow rules does not work because they are auto-expanded to types. Use hal_foo_server types instead. Fixes the following error: unit.framework.AssertionFailedError: The following errors were encountered when validating the SELinuxneverallow rule: neverallow { domain -coredomain -bluetooth -hal_bluetooth } { bluetooth_prop }: property_service set; Warning! Type or attribute hal_bluetooth used in neverallow undefined in policy being checked. Test: CtsSecurityHostTestCases Bug: 80153368 Change-Id: I2baf9f66d2ff110a4f181423790a1160a6e138da
2018-05-23 16:21:32 +02:00
-hal_bluetooth_server
Neverallow unexpected domains to access bluetooth_prop and wifi_prop And this CL will remove unnecessary vendor-init exceptions for nfc_prop and radio_prop as well. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: I468b8fd907c6408f51419cfb58eb2b8da29118ae Merged-In: I468b8fd907c6408f51419cfb58eb2b8da29118ae (cherry picked from commit 41e42d63fecf9c237337acea7e21a5da0683debe)
2018-04-18 04:24:15 +02:00
} {
bluetooth_prop
}:property_service set;
neverallow {
domain
-coredomain
-bluetooth
Use non-expanded types in prop neverallows Using hal_foo attributes in neverallow rules does not work because they are auto-expanded to types. Use hal_foo_server types instead. Fixes the following error: unit.framework.AssertionFailedError: The following errors were encountered when validating the SELinuxneverallow rule: neverallow { domain -coredomain -bluetooth -hal_bluetooth } { bluetooth_prop }: property_service set; Warning! Type or attribute hal_bluetooth used in neverallow undefined in policy being checked. Test: CtsSecurityHostTestCases Bug: 80153368 Change-Id: I2baf9f66d2ff110a4f181423790a1160a6e138da
2018-05-23 16:21:32 +02:00
-hal_bluetooth_server
Neverallow unexpected domains to access bluetooth_prop and wifi_prop And this CL will remove unnecessary vendor-init exceptions for nfc_prop and radio_prop as well. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: I468b8fd907c6408f51419cfb58eb2b8da29118ae Merged-In: I468b8fd907c6408f51419cfb58eb2b8da29118ae (cherry picked from commit 41e42d63fecf9c237337acea7e21a5da0683debe)
2018-04-18 04:24:15 +02:00
-vendor_init
} {
exported_bluetooth_prop
}:property_service set;
vendor_init can set config.disable_cameraservice This had been settable by vendors up to and including Q release by making config_prop avendor_init writeable. We don't allow this any more. This should be a real vendor settable property now. Bug: 143755062 Test: adb logcat -b all | grep cameraservice Test: atest CtsCameraTestCases Change-Id: Id583e899a906da8a8e8d71391ff2159a9510a630
2020-01-06 13:25:00 +01:00
neverallow {
domain
-coredomain
-hal_camera_server
-cameraserver
-vendor_init
} {
exported_camera_prop
}:property_service set;
Neverallow unexpected domains to access bluetooth_prop and wifi_prop And this CL will remove unnecessary vendor-init exceptions for nfc_prop and radio_prop as well. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: I468b8fd907c6408f51419cfb58eb2b8da29118ae Merged-In: I468b8fd907c6408f51419cfb58eb2b8da29118ae (cherry picked from commit 41e42d63fecf9c237337acea7e21a5da0683debe)
2018-04-18 04:24:15 +02:00
neverallow {
domain
-coredomain
Use non-expanded types in prop neverallows Using hal_foo attributes in neverallow rules does not work because they are auto-expanded to types. Use hal_foo_server types instead. Fixes the following error: unit.framework.AssertionFailedError: The following errors were encountered when validating the SELinuxneverallow rule: neverallow { domain -coredomain -bluetooth -hal_bluetooth } { bluetooth_prop }: property_service set; Warning! Type or attribute hal_bluetooth used in neverallow undefined in policy being checked. Test: CtsSecurityHostTestCases Bug: 80153368 Change-Id: I2baf9f66d2ff110a4f181423790a1160a6e138da
2018-05-23 16:21:32 +02:00
-hal_wifi_server
Neverallow unexpected domains to access bluetooth_prop and wifi_prop And this CL will remove unnecessary vendor-init exceptions for nfc_prop and radio_prop as well. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: I468b8fd907c6408f51419cfb58eb2b8da29118ae Merged-In: I468b8fd907c6408f51419cfb58eb2b8da29118ae (cherry picked from commit 41e42d63fecf9c237337acea7e21a5da0683debe)
2018-04-18 04:24:15 +02:00
-wificond
} {
wifi_prop
}:property_service set;
neverallow {
domain
-coredomain
Use non-expanded types in prop neverallows Using hal_foo attributes in neverallow rules does not work because they are auto-expanded to types. Use hal_foo_server types instead. Fixes the following error: unit.framework.AssertionFailedError: The following errors were encountered when validating the SELinuxneverallow rule: neverallow { domain -coredomain -bluetooth -hal_bluetooth } { bluetooth_prop }: property_service set; Warning! Type or attribute hal_bluetooth used in neverallow undefined in policy being checked. Test: CtsSecurityHostTestCases Bug: 80153368 Change-Id: I2baf9f66d2ff110a4f181423790a1160a6e138da
2018-05-23 16:21:32 +02:00
-hal_wifi_server
Neverallow unexpected domains to access bluetooth_prop and wifi_prop And this CL will remove unnecessary vendor-init exceptions for nfc_prop and radio_prop as well. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: I468b8fd907c6408f51419cfb58eb2b8da29118ae Merged-In: I468b8fd907c6408f51419cfb58eb2b8da29118ae (cherry picked from commit 41e42d63fecf9c237337acea7e21a5da0683debe)
2018-04-18 04:24:15 +02:00
-wificond
-vendor_init
} {
exported_wifi_prop
}:property_service set;
Fix compatible property neverallows The current neverallow rules for compatible properties restrict domains from write file permissions to the various property files. This however is the wrong restriction, since only init actually writes to these property files. The correct restriction is to restrict 'set' for 'property_service' as this change does. Note there is already a restriction preventing {domain -init} from writing to these files in domain.te. Test: build Change-Id: I19e13b0d084a240185d0f3f5195e54065dc20e09
2018-01-24 20:20:35 +01:00
# Prevent properties from being read
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
neverallow {
domain
-coredomain
-appdomain
-vendor_init
} {
core_property_type
add extended_core_property_type The attribute is used to capture system properties added from outside of AOSP (e.g. by OEM), but are not device-specific and thus are used only inside the system partition. Access to the the system properties from outside of the system partition is prevented by the neverallow rule. Bug: 80382020 Bug: 78598545 Test: m -j selinux_policy Change-Id: I22c083dc195dab84c9c21a79fbe3ad823a3bbb46
2018-05-30 10:38:09 +02:00
extended_core_property_type
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
exported_dalvik_prop
exported_ffs_prop
exported_system_radio_prop
exported2_config_prop
exported2_system_prop
exported2_vold_prop
exported3_default_prop
exported3_system_prop
-debug_prop
-logd_prop
-nfc_prop
-powerctl_prop
-radio_prop
}:file no_rw_file_perms;
Add neverallow rules to restrict reading radio_prop This CL will allow only specific components to read radio_prop. Bug: 72459527 Test: tested with walleye Change-Id: I6b6c90870987de976187ff675005c5d964b48cda
2018-01-30 03:18:47 +01:00
Add tests for compatible property (1/2) The feature of compatible property has its own neverallow rules and it is enforced on devices launchig with Android P. This CL changes hal_nfc to hal_nfc_server in neverallow rules because sepolicy-analyze doesn't recognize it. Additionally one more neverallow rule is added to restrict reading nfc_prop. Bug: 72013705 Bug: 72678352 Test: 'run cts -m CtsSecurityHostTestCases' on walleye with ro.product.first_api_level=28 Change-Id: I753cc81f7ca0e4ad6a2434b2a047052678f57671
2018-01-30 09:23:58 +01:00
neverallow {
domain
-coredomain
-appdomain
-hal_nfc_server
} {
nfc_prop
}:file no_rw_file_perms;
Add neverallow rules to restrict reading radio_prop This CL will allow only specific components to read radio_prop. Bug: 72459527 Test: tested with walleye Change-Id: I6b6c90870987de976187ff675005c5d964b48cda
2018-01-30 03:18:47 +01:00
neverallow {
domain
-coredomain
-appdomain
Revert "Revert "Move rild from public to vendor."" This reverts commit 016f0a58a9cd429f1986033f922d4bb7f58f5f3a. Reason for revert: Was temporarily reverted, merging back in with fix. Bug: 74486619 Bug: 36427227 Change-Id: Ide68726a90d5485c2758673079427407aee1e4f2
2018-03-12 18:12:09 +01:00
-hal_telephony_server
Add neverallow rules to restrict reading radio_prop This CL will allow only specific components to read radio_prop. Bug: 72459527 Test: tested with walleye Change-Id: I6b6c90870987de976187ff675005c5d964b48cda
2018-01-30 03:18:47 +01:00
} {
radio_prop
}:file no_rw_file_perms;
Neverallow unexpected domains to access bluetooth_prop and wifi_prop And this CL will remove unnecessary vendor-init exceptions for nfc_prop and radio_prop as well. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: I468b8fd907c6408f51419cfb58eb2b8da29118ae Merged-In: I468b8fd907c6408f51419cfb58eb2b8da29118ae (cherry picked from commit 41e42d63fecf9c237337acea7e21a5da0683debe)
2018-04-18 04:24:15 +02:00
neverallow {
domain
-coredomain
-bluetooth
Use non-expanded types in prop neverallows Using hal_foo attributes in neverallow rules does not work because they are auto-expanded to types. Use hal_foo_server types instead. Fixes the following error: unit.framework.AssertionFailedError: The following errors were encountered when validating the SELinuxneverallow rule: neverallow { domain -coredomain -bluetooth -hal_bluetooth } { bluetooth_prop }: property_service set; Warning! Type or attribute hal_bluetooth used in neverallow undefined in policy being checked. Test: CtsSecurityHostTestCases Bug: 80153368 Change-Id: I2baf9f66d2ff110a4f181423790a1160a6e138da
2018-05-23 16:21:32 +02:00
-hal_bluetooth_server
Neverallow unexpected domains to access bluetooth_prop and wifi_prop And this CL will remove unnecessary vendor-init exceptions for nfc_prop and radio_prop as well. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: I468b8fd907c6408f51419cfb58eb2b8da29118ae Merged-In: I468b8fd907c6408f51419cfb58eb2b8da29118ae (cherry picked from commit 41e42d63fecf9c237337acea7e21a5da0683debe)
2018-04-18 04:24:15 +02:00
} {
bluetooth_prop
}:file no_rw_file_perms;
neverallow {
domain
-coredomain
Use non-expanded types in prop neverallows Using hal_foo attributes in neverallow rules does not work because they are auto-expanded to types. Use hal_foo_server types instead. Fixes the following error: unit.framework.AssertionFailedError: The following errors were encountered when validating the SELinuxneverallow rule: neverallow { domain -coredomain -bluetooth -hal_bluetooth } { bluetooth_prop }: property_service set; Warning! Type or attribute hal_bluetooth used in neverallow undefined in policy being checked. Test: CtsSecurityHostTestCases Bug: 80153368 Change-Id: I2baf9f66d2ff110a4f181423790a1160a6e138da
2018-05-23 16:21:32 +02:00
-hal_wifi_server
Neverallow unexpected domains to access bluetooth_prop and wifi_prop And this CL will remove unnecessary vendor-init exceptions for nfc_prop and radio_prop as well. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: I468b8fd907c6408f51419cfb58eb2b8da29118ae Merged-In: I468b8fd907c6408f51419cfb58eb2b8da29118ae (cherry picked from commit 41e42d63fecf9c237337acea7e21a5da0683debe)
2018-04-18 04:24:15 +02:00
-wificond
} {
wifi_prop
}:file no_rw_file_perms;
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 09:54:49 +02:00
')
Revert "Remove neverallow coredomain to set vendor prop." Bug: 80466516 Bug: 78598545 This reverts commit 6f6fbebcefc8f38dbb13b648dbab7589f1880981. Change-Id: I3c0f374b846241571b5db6f061503f0ea2d6396a
2018-06-01 18:36:51 +02:00
compatible_property_only(`
# Neverallow coredomain to set vendor properties
neverallow {
coredomain
-init
-system_writes_vendor_properties_violators
} {
property_type
Fix treble boundary neverallow to use attributes These neverallow rules are to prevent properties from crossing treble boundary. As attributes like internal / restricted / public has been landed, the neverallow rules are changed to use attributes to avoid endless manual maintaining of the list. Bug: 148181222 Test: system/sepolicy/tools/build_policies.sh Change-Id: I0ba930f6c78852e785858fb069faf4f984643e34
2020-01-28 06:43:57 +01:00
-system_property_type
Revert "Remove neverallow coredomain to set vendor prop." Bug: 80466516 Bug: 78598545 This reverts commit 6f6fbebcefc8f38dbb13b648dbab7589f1880981. Change-Id: I3c0f374b846241571b5db6f061503f0ea2d6396a
2018-06-01 18:36:51 +02:00
-extended_core_property_type
}:property_service set;
')
Add userspace_reboot_log_prop This properties are used to compute UserspaceRebootAtom and are going to be written by system_server. Also removed now unused userspace_reboot_prop. Test: builds Bug: 148767783 Change-Id: Iee44b4ca9f5d3913ac71b2ac6959c232f060f0ed
2020-02-07 01:10:29 +01:00
neverallow {
-init
-system_server
} {
userspace_reboot_log_prop
}:property_service set;
Add adbd_prop, system_adbd_prop property types. service.adb.tls.port contains the adbd tcp port running the TLS server. persist.sys.adb.wifi tells adbd when to enable the TLS server. Bug: 149348431 Bug: 111434128 Test: Enable wireless debugging, check if TLS port information is displayed in the Developer options > Wireless debuggging. Change-Id: I5b5c5a3d064bc003f41386ede9051609fefec53e
2020-02-12 19:18:10 +01:00
neverallow {
# Only allow init and system_server to set system_adbd_prop
-init
-system_server
} {
system_adbd_prop
}:property_service set;
neverallow {
# Only allow init and adbd to set adbd_prop
-init
-adbd
} {
adbd_prop
}:property_service set;
Add userspace_reboot_test_prop This property type represents properties used in CTS tests of userspace reboot. For example, test.userspace_reboot.requested property which is used to check that userspace reboot was successful and didn't result in full reboot, e.g.: * before test setprop test.userspace_reboot.requested 1 * adb reboot userspace * wait for boot to complete * verify that value of test.userspace_reboot.requested is still 1 Test: adb shell setprop test.userspace_reboot.requested 1 Bug: 150901232 Change-Id: I45d187f386149cec08318ea8545ab864b5810ca8
2020-03-12 15:45:00 +01:00
neverallow {
# Only allow init and shell to set userspace_reboot_test_prop
-init
-shell
} {
userspace_reboot_test_prop
}:property_service set;
Reference in a new issue Copy permalink