tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/file.te

77 lines
2.8 KiB
Text
Raw Normal View History

Label /proc/config.gz Add a label to /proc/config.gz, so we can distinguish this file from other /proc files in security policy. For now, only init is allowed read access. All others are denied. TODO: clarify exactly who needs access. Further access will be granted in a future commit. Bug: 35126415 Test: policy compiles and no device boot problems. Change-Id: I8b480890495ce5b8aa3f8c7eb00e14159f177860
2017-02-16 21:04:40 +01:00
# /proc/config.gz
proc_type attribute for files under /proc. With this attribute it will be easier to reference /proc files. Bug: 74182216 Test: policy builds Change-Id: I5b7da508d821e45f122832261a742a201e8fdf2c
2018-02-16 03:07:18 +01:00
type config_gz, fs_type, proc_type;
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
# /data/misc/storaged
type storaged_data_file, file_type, data_file_type, core_data_file_type;
Add window trace files SELinux policy rules - Allow system_server to create and write to /data/misc/wmtrace/* - Allow surfaceflinger to create and write files from /data/misc/wmtrace/* - Allow dumpstate to read files from /data/misc/wmtrace/* permissions are restricted to userdebug or eng builds Bug: 64831661 Test: adb shell cmd window tracing start && adb shell cmd window tracing stop Test: adb shell su root service call SurfaceFlinger 1025 i32 1 >/dev/null && adb shell su root service call SurfaceFlinger 1025 i32 0 >/dev/null Test: adb bugreport ~/tmp.zip && adb shell su root dmesg | grep 'avc: ' Change-Id: I0b15166560739d73d7749201f3ad197dbcf5791c
2017-11-17 17:23:32 +01:00
# /data/misc/wmtrace for wm traces
type wm_trace_data_file, file_type, data_file_type, core_data_file_type;
SELinux policies for Perfetto cmdline client (/system/bin/perfetto) Instead of having statsd linking the perfetto client library and talk directly to its socket, we let just statsd exec() the /system/bin/perfetto cmdline client. There are two reasons for this: 1) Simplify the interaction between statsd and perfetto, reduce dependencies, binary size bloat and isolate faults. 2) The cmdline client also takes care of handing the trace to Dropbox. This allows to expose the binder interaction surface to the short-lived cmdline client and avoid to grant binder access to the perfetto traced daemon. This cmdline client will be used by: - statsd - the shell user (for our UI and Studio) Bug: 70942310 Change-Id: I8cdde181481ad0a1a5cae5937ac446cedac54a1f
2018-01-24 17:07:09 +01:00
Add /data/misc/a11ytrace folder to store accessibility trace files. Bug: 157601519 Test: adb shell cmd accessibility start-trace adb shell cmd accessibility stop-trace Change-Id: Id4224cee800fe3e10f33794c96048366a0bf09bb
2021-02-09 21:03:40 +01:00
# /data/misc/a11ytrace for accessibility traces
type accessibility_trace_data_file, file_type, data_file_type, core_data_file_type;
SELinux policies for Perfetto cmdline client (/system/bin/perfetto) Instead of having statsd linking the perfetto client library and talk directly to its socket, we let just statsd exec() the /system/bin/perfetto cmdline client. There are two reasons for this: 1) Simplify the interaction between statsd and perfetto, reduce dependencies, binary size bloat and isolate faults. 2) The cmdline client also takes care of handing the trace to Dropbox. This allows to expose the binder interaction surface to the short-lived cmdline client and avoid to grant binder access to the perfetto traced daemon. This cmdline client will be used by: - statsd - the shell user (for our UI and Studio) Bug: 70942310 Change-Id: I8cdde181481ad0a1a5cae5937ac446cedac54a1f
2018-01-24 17:07:09 +01:00
# /data/misc/perfetto-traces for perfetto traces
type perfetto_traces_data_file, file_type, data_file_type, core_data_file_type;
SEPolicy changes to allow kcov access in userdebug. This includes the SELinux policy changes to allow for kcov access in userdebug builds for coverage-guided kernel fuzzing. Bug: 117990869 Test: Ran syzkaller with Android untrusted_app sandbox with coverage. Change-Id: I1fcaad447c7cdc2a3360383b5dcd76e8a0f93f09
2018-11-29 19:37:18 +01:00
Allow dumpstate to snapshot traces and attach them to bug reports Feature description: if a background trace is happening at the time dumpstate is invoked, the tracing daemon will snapshot the trace into a fixed path (/data/misc/perfetto-traces/bugreport/). Dumpstate will attach the trace, if present, to the bugreport. From a SELinux viewpoint this involves the following permissions: - Allow dumpstate to exec+trans perfetto --save-for-bugreport (this will just send an IPC to traced, which will save the trace). - Allow dumpstate to list, read and unlink the trace file. - Create a dedicated label for bugreport traces, to prevent that dumpstate gets access to other traces not meant for bug reporting. Note that this does NOT allow dumpstate to serialze arbitary traces. Traces must be marked as "eligible for bugreport" upfront in the trace config (which is not under dumpstate control), by setting bugreport_score > 0. Design doc: go/perfetto-betterbug Bug: 170334305 Test: manual: 1. start a perfetto trace with bugreport_score > 0 2. adb shell dumpstate 3. check that the bugreport zip contains the trace Change-Id: I259c3ee9d5be08d6b22c796b32875d7de703a230
2021-01-07 18:12:21 +01:00
# /data/misc/perfetto-traces/bugreport for perfetto traces for bugreports.
type perfetto_traces_bugreport_data_file, file_type, data_file_type, core_data_file_type;
Create directory for shell<>perfetto interaction Users are unable to pass config files directly to perfetto via `perfetto -c /path/to/config` and have to resort to awkward quirks like `cat config | perfetto -c -'. This is because /system/bin/perfetto runs in its own SELinux domain for reasons explained in the bug. This causes problem to test infrastructures authors. Instead of allowing the use of /data/local/tmp which is too ill-scoped we create a dedicated folder and allow only shell and perfetto to operate on it. Bug: 170404111 Test: manual, see aosp/1459023 Change-Id: I6fefe066f93f1f389c6f45bd18214f8e8b07079e
2020-10-13 22:13:09 +02:00
# /data/misc/perfetto-configs for perfetto configs
type perfetto_configs_data_file, file_type, data_file_type, core_data_file_type;
SEPolicy changes to allow kcov access in userdebug. This includes the SELinux policy changes to allow for kcov access in userdebug builds for coverage-guided kernel fuzzing. Bug: 117990869 Test: Ran syzkaller with Android untrusted_app sandbox with coverage. Change-Id: I1fcaad447c7cdc2a3360383b5dcd76e8a0f93f09
2018-11-29 19:37:18 +01:00
# /sys/kernel/debug/kcov for coverage guided kernel fuzzing in userdebug builds.
type debugfs_kcov, fs_type, debugfs_type;
rename rs_data_file to app_exec_data_file There are multiple trusted system components which may be responsible for creating executable code within an application's home directory. Renderscript is just one of those trusted components. Generalize rs_data_file to app_exec_data_file. This label is intended to be used for any executable code created by trusted components placed into an application's home directory. Introduce a typealias statement to ensure files with the previous label continue to be understood by policy. This change is effectively a no-op, as it just renames a type, but neither adds or removes any rules. Bug: 121375718 Bug: 112357170 Test: cts-tradefed run cts-dev -m CtsRenderscriptTestCases Change-Id: I17dca5e3e8a1237eb236761862174744fb2196c0
2019-01-11 18:37:46 +01:00
# App executable files in /data/data directories
type app_exec_data_file, file_type, data_file_type, core_data_file_type;
typealias app_exec_data_file alias rs_data_file;
Add initial sepolicy for app data snapshots. Define a rollback_data_file label and apply it to the snapshots directory. This change contains just enough detail to allow vold_prepare_subdirs to prepare these directories correctly. A follow up change will flesh out the access policy on these directories in more detail. Test: make, manual Bug: 112431924 Change-Id: I4fa7187d9558697016af4918df6e34aac1957176
2019-01-14 16:02:12 +01:00
# /data/misc_[ce|de]/rollback : Used by installd to store snapshots
# of application data.
type rollback_data_file, file_type, data_file_type, core_data_file_type;
Add linker config generator and output file to sepolicy Sepolicy for linkerconfig generator and ld.config.txt file from generator Bug: 135004088 Test: m -j & tested from device Change-Id: I2ea7653a33996dde67a84a2e7a0efa660886434a
2019-07-08 12:02:05 +02:00
Add context for checkin directory Checkin apps use /data/misc_ce/<id>/checkin to backup the checkin metadata. So users won't lose the checkin tokens when they clear the app's storage. One example is when GMScore is used for checkin, users may clear GMScore data via "settings". If the device accidentally loses the token without backup, it won't be able to checkin again until factory reset. The contents in checkin dir will be cleaned up when a user is removed from the device. We also plan to add Gmscore test to ensure the dir is cleaned up at checkin time, thus prevent other Gmscore modules from using this storage by mistake. Bug: 197636740 Test: boot device, check selinux label, check gmscore writes to the new dir Change-Id: If3ff5e0fb75b4d49ce80d91b0086b58db002e4fb
2021-10-06 07:13:20 +02:00
# /data/misc_ce/checkin for checkin apps.
type checkin_data_file, file_type, data_file_type, core_data_file_type;
update_engine: rules to apply virtual A/B OTA - /data/gsi/ota/* now has the type ota_image_data_file. At runtime during an OTA, update_engine uses libsnapshot to talk to gsid to create these images as a backing storage of snapshots. These "COW images" stores the changes update_engine has applied to the partitions. If the update is successful, these changes will be merged to the partitions, and these images will be teared down. If the update fails, these images will be deleted after rolling back to the previous slot. - /metadata/gsi/ota/* now has the type ota_metadata_file. At runtime during an OTA, update_engine and gsid stores update states and information of the created snapshots there. At next boot, init reads these files to re-create the snapshots. Beside these assignments, this CL also allows gsid and update_engine to have the these permissions to do these operations. Bug: 135752105 Test: apply OTA, no failure Change-Id: Ibd53cacb6b4ee569c33cffbc18b1b801b62265de
2019-08-07 22:01:15 +02:00
# /data/gsi/ota
type ota_image_data_file, file_type, data_file_type, core_data_file_type;
Setting up SELinux policy for Emergency number database Test: Manual; https://paste.googleplex.com/6222197494382592 Bug: 136027884 Change-Id: I29214de6b5b5a62bff246c1256567844f4ce55c7
2019-10-15 22:13:56 +02:00
Support copy-on-write persistent data block when running a DSU The persistent data block is protected by a copy-on-write scratchpad when running a Dynamic System Update (DSU). The copy-on-write scratchpad uses a backing file for write operations. This CL adds permissions to write the backing file for the PersistentDataBlockService. Bug: 175852148 Test: gsi_tool install & vts_kernel_net_tests Change-Id: Id0efe407e707fc382679c0eee249af52f877f5d2
2020-12-25 10:32:13 +01:00
# /data/gsi_persistent_data
type gsi_persistent_data_file, file_type, data_file_type, core_data_file_type;
Setting up SELinux policy for Emergency number database Test: Manual; https://paste.googleplex.com/6222197494382592 Bug: 136027884 Change-Id: I29214de6b5b5a62bff246c1256567844f4ce55c7
2019-10-15 22:13:56 +02:00
# /data/misc/emergencynumberdb
type emergency_data_file, file_type, data_file_type, core_data_file_type;
Add sepolicy for profcollectd This does not yet list all the required capabilities for profcollectd, but it at least allows the service to start under permissive mode. Bug: 79161490 Test: start profcollectd Change-Id: I92c6192fa9b31840b2aba26f83a6dc9f9e835030
2020-06-18 06:43:23 +02:00
# /data/misc/profcollectd
type profcollectd_data_file, file_type, data_file_type, core_data_file_type;
Permissions for odrefresh and /data/misc/apexdata/com.android.art odrefresh is the process responsible for checking and creating ART compilation artifacts that live in the ART APEX data directory (/data/misc/apexdata/com.android.art). There are two types of change here: 1) enabling odrefresh to run dex2oat and write updated boot class path and system server AOT artifacts into the ART APEX data directory. 2) enabling the zygote and assorted diagnostic tools to use the updated AOT artifacts. odrefresh uses two file contexts: apex_art_data_file and apex_art_staging_data_file. When odrefresh invokes dex2oat, the generated files have the apex_art_staging_data_file label (which allows writing). odrefresh then moves these files from the staging area to their installation area and gives them the apex_art_data_file label. Bug: 160683548 Test: adb root && adb shell /apex/com.android.art/bin/odrefresh Change-Id: I9fa290e0c9c1b7b82be4dacb9f2f8cb8c11e4895
2020-10-16 16:29:55 +02:00
# /data/misc/apexdata/com.android.art
Refactor apex data file types. We ended up with 4 labels for specific APEX files that were all identical; I've replaced them with a single one (apex_system_server_data_file). Additionally I created an attribute to be applied to a "standard" APEX module data file type that establishes the basics (it can be managed by vold_prepare_subdirs and apexd), to make it easier to add new such types - which I'm about to do. Fix: 189415223 Test: Presubmits Change-Id: I4406f6680aa8aa0e38afddb2f3ba75f8bfbb8c3c
2021-07-12 15:21:48 +02:00
type apex_art_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
Permissions for odrefresh and /data/misc/apexdata/com.android.art odrefresh is the process responsible for checking and creating ART compilation artifacts that live in the ART APEX data directory (/data/misc/apexdata/com.android.art). There are two types of change here: 1) enabling odrefresh to run dex2oat and write updated boot class path and system server AOT artifacts into the ART APEX data directory. 2) enabling the zygote and assorted diagnostic tools to use the updated AOT artifacts. odrefresh uses two file contexts: apex_art_data_file and apex_art_staging_data_file. When odrefresh invokes dex2oat, the generated files have the apex_art_staging_data_file label (which allows writing). odrefresh then moves these files from the staging area to their installation area and gives them the apex_art_data_file label. Bug: 160683548 Test: adb root && adb shell /apex/com.android.art/bin/odrefresh Change-Id: I9fa290e0c9c1b7b82be4dacb9f2f8cb8c11e4895
2020-10-16 16:29:55 +02:00
# /data/misc/apexdata/com.android.art/staging
type apex_art_staging_data_file, file_type, data_file_type, core_data_file_type;
Add /data/fonts/files directory The updated font files will be stored to /data/fonts/files and all application will read it for drawing text. Thus, /data/fonts/files needs to be readable by apps and only writable by system_server (and init). Bug: 173517579 Test: atest CtsGraphicsTestCases Test: Manually done Change-Id: Ia76b109704f6214eb3f1798e8d21260343eda231
2021-01-21 22:08:31 +01:00
Add policy for CompOS APEX data files. Grant access to odsign to read & delete pending key files. Eventually we will grant the CompOS daemon write access. Bug: 190166662 Test: Via odsign; no denials seen. Change-Id: I6d3c3e5b2aec8ef65bd28cbb274d18263534ce66
2021-07-12 16:12:37 +02:00
# /data/misc/apexdata/com.android.compos
type apex_compos_data_file, file_type, data_file_type, core_data_file_type, apex_data_file_type;
Add /data/fonts/files directory The updated font files will be stored to /data/fonts/files and all application will read it for drawing text. Thus, /data/fonts/files needs to be readable by apps and only writable by system_server (and init). Bug: 173517579 Test: atest CtsGraphicsTestCases Test: Manually done Change-Id: Ia76b109704f6214eb3f1798e8d21260343eda231
2021-01-21 22:08:31 +01:00
# /data/font/files
type font_data_file, file_type, data_file_type, core_data_file_type;
SELinux policy for on-device signing binary. Bug: 165630556 Test: no denials on boot Change-Id: I9d75659fb1eaea562c626ff54521f6dfb02da6b3
2020-11-27 12:23:54 +01:00
Add odrefresh_data_file for odrefresh metrics Metrics are written to /data/misc/odrefresh by odrefresh during early boot, then native code in ART system_server initialization passes them to statsd and deletes the metrics files. This hand-off is necessary because statsd does not start until after odsign and odrefresh have run. Bug: 169925964 Test: manual Change-Id: I8054519a714907819886dd6e5e78f3b5796d0898
2021-04-09 16:17:38 +02:00
# /data/misc/odrefresh
type odrefresh_data_file, file_type, data_file_type, core_data_file_type;
SELinux policy for on-device signing binary. Bug: 165630556 Test: no denials on boot Change-Id: I9d75659fb1eaea562c626ff54521f6dfb02da6b3
2020-11-27 12:23:54 +01:00
# /data/misc/odsign
type odsign_data_file, file_type, data_file_type, core_data_file_type;
Revert^2 "Introduce derive_classpath." 5fd85de907f9c22ab7a540b5b3dda156962c18bc Bug: 180105615 Test: manual boot of cuttlefish and gphone emulator Change-Id: I9e43268d3b745e65b5ccc0a4896a7e55a253659d
2021-03-19 12:08:49 +01:00
Set sepolicy for VirtualizationService data directory and mk_cdisk. Bug: 184131523 Test: atest VirtualizationTestCases Test: flashed on VIM3L and ran microdroid manually Change-Id: I6d1b69b63debf44431cd542a0ee85748fcc4191b
2021-05-19 19:10:43 +02:00
# /data/misc/virtualizationservice
type virtualizationservice_data_file, file_type, data_file_type, core_data_file_type;
Revert^2 "Introduce derive_classpath." 5fd85de907f9c22ab7a540b5b3dda156962c18bc Bug: 180105615 Test: manual boot of cuttlefish and gphone emulator Change-Id: I9e43268d3b745e65b5ccc0a4896a7e55a253659d
2021-03-19 12:08:49 +01:00
# /data/system/environ
type environ_system_data_file, file_type, data_file_type, core_data_file_type;
Add crosvm domain and give virtmanager and crosvm necessary permissions. Bug: 183583115 Test: make TARGET_KERNEL_USE=5.4 TARGET_VIM3L=true Change-Id: I566436fa2d27597566014f2a63198a88d6d2dbd6
2021-03-29 19:19:12 +02:00
# /dev/kvm
type kvm_device, dev_type;
Enable odrefresh to work with composd. composd spawns odrefresh in its usual domain. odrefresh then spawns fd_server in a different domain, and makes binder calls back to composd to perform individual compilation steps. fd_server is fairly generic, and part of the virt APEX, but this instance is specific to composd (e.g. it has access to ART files), so I named the domain composd_fd_server. Bug: 186126194 Test: Run composd_cmd, artifacts generated Change-Id: I5a431dd00b5b396a67021c618fc6edcfb25aa21b
2021-09-21 14:32:24 +02:00
# /apex/com.android.virt/bin/fd_server
type fd_server_exec, system_file_type, exec_type, file_type;
Reference in a new issue Copy permalink