tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/debuggerd.te

62 lines
1.7 KiB
Text
Raw Normal View History

SE Android policy.
2012-01-04 18:33:27 +01:00
# debugger interface
Create attribute for moving perms out of domain Motivation: Domain is overly permissive. Start removing permissions from domain and assign them to the domain_deprecated attribute. Domain_deprecated and domain can initially be assigned to all domains. The goal is to not assign domain_deprecated to new domains and to start removing domain_deprecated where it is not required or reassigning the appropriate permissions to the inheriting domain when necessary. Bug: 25433265 Change-Id: I8b11cb137df7bdd382629c98d916a73fe276413c
2015-11-03 18:54:39 +01:00
type debuggerd, domain, domain_deprecated;
SE Android policy.
2012-01-04 18:33:27 +01:00
type debuggerd_exec, exec_type, file_type;
init_daemon_domain(debuggerd)
Confine debuggerd, but leave it permissive for now. Change-Id: I09932cdd59f9d3a38e69df9fcfc34cc9cec1d8cd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:35 +01:00
typeattribute debuggerd mlstrustedsubject;
debuggerd.te: allow debuggerd to drop root. Bug: http://b/25195825 Change-Id: I70257d5e40332f315020547baaa77a92fdfc58b0
2015-11-18 01:21:38 +01:00
allow debuggerd self:capability { dac_override sys_ptrace chown kill fowner setuid setgid };
Confine debuggerd, but leave it permissive for now. Change-Id: I09932cdd59f9d3a38e69df9fcfc34cc9cec1d8cd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:35 +01:00
allow debuggerd self:capability2 { syslog };
allow debuggerd domain:dir r_dir_perms;
allow debuggerd domain:file r_file_perms;
Allow readlink(2) of /proc from debuggerd. Bug: 15021938 Change-Id: Id815640302efde3ae089da33ff8e2cb7daee8bfd
2014-05-17 04:14:13 +02:00
allow debuggerd domain:lnk_file read;
don't allow debuggerd to ptrace itself. It doesn't make any sense for debuggerd to ever attempt to ptrace itself. A debuggerd crash can't be debugged via debuggerd. Bug: 28399663 Change-Id: I710d474e89d121385ef423b7bed9673a90e0759b
2016-04-27 21:32:36 +02:00
allow debuggerd {
domain
-adbd
-debuggerd
-healthd
-init
-keystore
-ueventd
-watchdogd
}:process { ptrace getattr };
Confine debuggerd, but leave it permissive for now. Change-Id: I09932cdd59f9d3a38e69df9fcfc34cc9cec1d8cd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:35 +01:00
security_access_policy(debuggerd)
debuggerd.te: allow debuggerd to drop root. Bug: http://b/25195825 Change-Id: I70257d5e40332f315020547baaa77a92fdfc58b0
2015-11-18 01:21:38 +01:00
allow debuggerd tombstone_data_file:dir rw_dir_perms;
Confine debuggerd, but leave it permissive for now. Change-Id: I09932cdd59f9d3a38e69df9fcfc34cc9cec1d8cd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:35 +01:00
allow debuggerd tombstone_data_file:file create_file_perms;
Allow debuggerd read access to shared_relro files. Addresses the following denial when debuggerd attempts to stat Webview mmap'd shared relro files on process crash. Full read permissions may not be necessary: W/debuggerd( 185): type=1400 audit(0.0:97): avc: denied { search } for name="shared_relro" dev="mmcblk0p28" ino=618955 scontext=u:r:debuggerd:s0 tcontext=u:object_r:shared_relro_file:s0 tclass=dir Bug: 17101854 Change-Id: I11eea85668ba033c554e5aab99b70a454fb75164
2014-08-19 02:09:38 +02:00
allow debuggerd shared_relro_file:dir r_dir_perms;
allow debuggerd shared_relro_file:file r_file_perms;
Allow debuggerd to send SIGKILL. Bug: http://b/27367422 Change-Id: I936c16281e06214b35f8d245da8f619dc92ff15f (cherry picked from commit 48141c36754a16795d8666a76d92dbf182119563)
2016-03-09 03:02:15 +01:00
allow debuggerd domain:process { sigstop sigkill signal };
Confine debuggerd, but leave it permissive for now. Change-Id: I09932cdd59f9d3a38e69df9fcfc34cc9cec1d8cd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:35 +01:00
allow debuggerd exec_type:file r_file_perms;
# Access app library
allow debuggerd system_data_file:file open;
Allow debuggerd to redirect requests. On 64 bit systems, all requests will first go to the 64 bit debuggerd which will redirect to the 32 bit debuggerd if necessary. This avoids any permissions problems where a java process needs to be able to read the elf data for executables. Instead the permissions are granted to debuggerd instead. Also remove the permissions to read the /system/bin executables from dumpstate since they aren't necessary any more. Bug: https://code.google.com/p/android/issues/detail?id=97024 Change-Id: I80ab1a177a110aa7381c2a4b516cfe71ef2a4808
2015-01-19 02:39:53 +01:00
# Allow debuggerd to redirect a dump_backtrace request to itself.
# This only happens on 64 bit systems, where all requests go to the 64 bit
# debuggerd and get redirected to the 32 bit debuggerd if the process is 32 bit.
selinux: Update policies for cameraserver Update policies for cameraserver so it has the same permissions as mediaserver. Bug: 24511454 Change-Id: I1191e2ac36c00b942282f8dc3db9903551945adb
2015-12-04 01:10:05 +01:00
Sepolicy: Refactor long lines for debuggerd backtraces Split single lines in preparation for new additions. Bug: 28658141 Change-Id: I89f6a52bd2d145c53dd6bb39177578f51a352acf
2016-05-12 03:40:27 +02:00
allow debuggerd {
audioserver
Sepolicy: Allow debuggerd to dump backtraces of Bluetooth Allow to dump traces of the Bluetooth process during ANR and system-server watchdog dumps. Bug: 28658141 Change-Id: Ie78bcb25e94e1ed96ccd75f7a35ecb04e7cb2b82
2016-05-13 02:28:34 +02:00
bluetooth
Sepolicy: Refactor long lines for debuggerd backtraces Split single lines in preparation for new additions. Bug: 28658141 Change-Id: I89f6a52bd2d145c53dd6bb39177578f51a352acf
2016-05-12 03:40:27 +02:00
cameraserver
drmserver
inputflinger
mediacodec
mediadrmserver
mediaextractor
mediaserver
sdcardd
surfaceflinger
}:debuggerd dump_backtrace;
Label and allow access to /data/system/ndebugsocket. Otherwise it defaults to the label of /data/system and cannot be distinguished from any other socket in that directory. Also adds allow rule required for pre-existing wpa_socket transition to function without unconfined_domain. Change-Id: I57179aa18786bd56d247f397347e546cca978e41 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-09-27 16:24:49 +02:00
# Connect to system_server via /data/system/ndebugsocket.
unix_socket_connect(debuggerd, system_ndebug, system_server)
sepolicy: Add write_logd, read_logd & control_logd - Add write_logd, read_logd and control_logd macros added along with contexts for user space logd. - Specify above on domain wide, or service-by-service basis - Add logd rules. - deprecate access_logcat as unused. - 'allow <domain> zygote:unix_dgram_socket write;' rule added to deal with fd inheritance. ToDo: investigate means to allow references to close, and reopen in context of application or call setsockcreatecon() to label them in child context. Change-Id: I35dbb9d5122c5ed9b8c8f128abf24a871d6b26d8
2013-11-13 00:34:52 +01:00
debuggerd: Allow "debug.db.uid" usage Allow the use of debug.db.uid on userdebug / eng builds. Setting this property allows debuggerd to suspend a process if it detects a crash. Make debug.db.uid only accessible to the su domain. This should not be used on a user build. Only support reading user input on userdebug / eng builds. Steps to reproduce with the "crasher" program: adb root adb shell setprop debug.db.uid 20000 mmm system/core/debuggerd adb sync adb shell crasher Addresses the following denials: <5>[ 580.637442] type=1400 audit(1392412124.612:149): avc: denied { read } for pid=182 comm="debuggerd" name="input" dev="tmpfs" ino=5665 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=dir <5>[ 580.637589] type=1400 audit(1392412124.612:150): avc: denied { open } for pid=182 comm="debuggerd" name="input" dev="tmpfs" ino=5665 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=dir <5>[ 580.637706] type=1400 audit(1392412124.612:151): avc: denied { read write } for pid=182 comm="debuggerd" name="event5" dev="tmpfs" ino=6723 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=chr_file <5>[ 580.637823] type=1400 audit(1392412124.612:152): avc: denied { open } for pid=182 comm="debuggerd" name="event5" dev="tmpfs" ino=6723 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=chr_file <5>[ 580.637958] type=1400 audit(1392412124.612:153): avc: denied { ioctl } for pid=182 comm="debuggerd" path="/dev/input/event5" dev="tmpfs" ino=6723 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=chr_file Bug: 12532622 Change-Id: I63486edb73efb1ca12e9eb1994ac9e389251a3f1
2014-02-06 01:36:25 +01:00
userdebug_or_eng(`
allow debuggerd input_device:dir r_dir_perms;
allow debuggerd input_device:chr_file rw_file_perms;
')
sepolicy: Add write_logd, read_logd & control_logd - Add write_logd, read_logd and control_logd macros added along with contexts for user space logd. - Specify above on domain wide, or service-by-service basis - Add logd rules. - deprecate access_logcat as unused. - 'allow <domain> zygote:unix_dgram_socket write;' rule added to deal with fd inheritance. ToDo: investigate means to allow references to close, and reopen in context of application or call setsockcreatecon() to label them in child context. Change-Id: I35dbb9d5122c5ed9b8c8f128abf24a871d6b26d8
2013-11-13 00:34:52 +01:00
# logd access
read_logd(debuggerd)
Define debuggerd class, permissions, and rules. Define a new class, permissions, and rules for the debuggerd SELinux MAC checks. Used by Ib317564e54e07cc21f259e75124b762ad17c6e16 for debuggerd. Change-Id: I8e120d319512ff207ed22ed87cde4e0432a13dda Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-07-24 21:25:43 +02:00
# Check SELinux permissions.
selinux_check_access(debuggerd)
Reference in a new issue Copy permalink