tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/microdroid/system/private/file.te

31 lines
1.3 KiB
Text
Raw Normal View History

Move microdroid sepolicy to system/sepolicy Bug: 190511750 Test: boot microdroid Change-Id: I4aa4a56e9be5103d70469c3508110a973f3e4f12
2021-07-19 09:48:34 +02:00
allow fs_type self:filesystem associate;
allow cgroup tmpfs:filesystem associate;
allow cgroup_v2 tmpfs:filesystem associate;
allow debugfs_type { debugfs debugfs_tracing debugfs_tracing_debug }:filesystem associate;
allow dev_type tmpfs:filesystem associate;
Selinux label for /mnt/encryptedstore Create a label for the encrypted storage. encryptedstore_file & _fs corresponding to the file & fs type. encryptedstore process mounts the device on /mnt/encryptedstore with fscontext & context. microdroid_payload will have rw & related permissions on it. Also, add a neverallow rule to deny execute permission on all domains. encryptedstore needs relabel permission from tmpfs to encryptedstore_file, along with mount like permissions on the later. Bug: 261477008 Test: atest MicrodroidTests#encryptedStorageAvailable Change-Id: Iffa1eb400f90874169d26fc2becb1dda9a1269a9
2022-12-08 14:18:56 +01:00
allow encryptedstore_file encryptedstore_fs:filesystem associate;
microdroid: Add support for extra apk files extra_apk_file is a new label only for APK files passed to microdroid. microdroid_manager will create directories under /mnt/extra-apk/, and zipfuse will mount APK block devices to the directories. Currently only payload can read the files. Bug: 205224817 Test: manually edit vm config and see APK files mounted Change-Id: Ie5afb3156f22bb18979ec70904be675e8ff285a7
2021-11-29 06:56:46 +01:00
allow extra_apk_file zipfusefs:filesystem associate;
Move microdroid sepolicy to system/sepolicy Bug: 190511750 Test: boot microdroid Change-Id: I4aa4a56e9be5103d70469c3508110a973f3e4f12
2021-07-19 09:48:34 +02:00
allow file_type labeledfs:filesystem associate;
allow file_type tmpfs:filesystem associate;
allow file_type rootfs:filesystem associate;
allow proc_net proc:filesystem associate;
allow sysfs_type sysfs:filesystem associate;
allow system_data_file tmpfs:filesystem associate;
SELinux policy for authfs_service and authfs authfs_service is a binder service on microdroid. Upon a request by the client, the service will create the mount directory, execute authfs to mount the FUSE, and finally unmount and delete the mount directory. authfs currently requires more privileges than it should, but it's ok because the client owns the VM, and all input will be verified by signatures. But there is plan to keep the privileges isoated in the service (b/195554831). Bug: 194717985 Bug: 195554831 Test: Start the service from init, use a test executable to call the service API. Only observed denial from the test executable. Change-Id: Ie53aa9e2796433fc3182357039d0b7ba1c0848ef
2021-08-04 02:26:38 +02:00
type authfs_fuse, fs_type, contextmount_type;
Policy for using Apex sepolicy Bug: 199914227 Test: aosp/1910032 Change-Id: I0726facbf0c28c486ef6501718a6013a040e4b0e
2021-12-03 15:21:54 +01:00
Encryptedstore/Selinux: Format the crypt device Add selinux policies required for formatting the crypt device. 1. Allow encryptedstore to execute mk2fs. 2. The execution will happen without domain transition - so add permissions related to formatting the device. 3. Allow encryptedstore to write on /dev/vd device - required to zero starting bits initially Test: Run vm with --storage & --storage-size option Bug: 241541860 Change-Id: I9766e3c67e47a58707beee8b3a156944e3b0a9ce
2022-11-21 17:06:09 +01:00
# /system/bin/mke2fs - used to format encryptedstore block device
type e2fs_exec, system_file_type, exec_type, file_type;
Selinux label for /mnt/encryptedstore Create a label for the encrypted storage. encryptedstore_file & _fs corresponding to the file & fs type. encryptedstore process mounts the device on /mnt/encryptedstore with fscontext & context. microdroid_payload will have rw & related permissions on it. Also, add a neverallow rule to deny execute permission on all domains. encryptedstore needs relabel permission from tmpfs to encryptedstore_file, along with mount like permissions on the later. Bug: 261477008 Test: atest MicrodroidTests#encryptedStorageAvailable Change-Id: Iffa1eb400f90874169d26fc2becb1dda9a1269a9
2022-12-08 14:18:56 +01:00
type encryptedstore_file, file_type;
type encryptedstore_fs, fs_type, contextmount_type;
Add rules for prng_seeder The process has the exclusive access to /dev/hw_random. It instead opens provides a socket (/dev/prng_seeder/socket) which any process can connect to to get random numbers. This CL is basically a Microdroid version of aosp/2215051 Bug: 247781653 Test: same as aosp/I0a7e339115a2cf6b819730dcf5f8b189a339c57d * Verify prng_seeder daemon is running and has the correct label (via ps -Z) * Verify prng_seeder socket present and has correct label (via ls -Z) * Verify no SELinux denials * strace a libcrypto process and verify it reads seeding data from prng_seeder (e.g. strace bssl rand -hex 1024) * strace seeder daemon to observe incoming connections (e.g. strace -f -p `pgrep prng_seeder`) Change-Id: I3483132ead0f5d101b5b3365f78cc36d89528f0e
2022-12-20 11:27:49 +01:00
# Filesystem entry for for PRNG seeder socket.
type prng_seeder_socket, file_type, coredomain_socket;
Add selinux rules for perfetto daemones Note: this is a somewhat minimal set of rules required to be able to capture traces on Microdroid. After the trace is captured I still see a bunch of SELinux denials. We might need to add more allow rules in the follow up changes. Bug: 249050813 Test: boot Microdroid VM, capture traces with record_android_traces Change-Id: I62098fb79a8db65706a5bb28c8acce7ff3821f15
2023-03-03 01:43:22 +01:00
# /data/misc/perfetto-traces for perfetto traces
type perfetto_traces_data_file, file_type, data_file_type, core_data_file_type;
# /data/misc/perfetto-configs for perfetto configs
type perfetto_configs_data_file, file_type, data_file_type, core_data_file_type;
Reference in a new issue Copy permalink