tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/slideshow.te

15 lines
566 B
Text
Raw Normal View History

Allow init to execute /sbin/slideshow Add rules to allow /sbin/slideshow to access framebuffer and input devices at early stages of boot, and rules to allow init to execute the program (from init.rc using exec). Needed by changes from I58c79a7f3ac747eec0d73a10f018d3d8ade9df7d Change-Id: I1d5018feb7025853f0bf81651f497fef8c3a6ab0
2015-02-18 14:59:38 +01:00
# slideshow seclabel is specified in init.rc since
# it lives in the rootfs and has no unique file type.
slideshow: remove domain_deprecated attribute No "granted" messages for the removed permissions observed in three months of log audits. Bug: 28760354 Change-Id: I7713a9ad9a1604b17119ecad4970e2aa46c15bd0
2016-09-12 06:30:10 +02:00
type slideshow, domain;
Allow init to execute /sbin/slideshow Add rules to allow /sbin/slideshow to access framebuffer and input devices at early stages of boot, and rules to allow init to execute the program (from init.rc using exec). Needed by changes from I58c79a7f3ac747eec0d73a10f018d3d8ade9df7d Change-Id: I1d5018feb7025853f0bf81651f497fef8c3a6ab0
2015-02-18 14:59:38 +01:00
Allow /dev/klog access, drop mknod and __null__ access Allow vold, healthd, slideshow, and watchdogd access to /dev/kmsg. These processes log to the kernel dmesg ring buffer, so they need write access to that file. Addresses the following denials: avc: denied { write } for pid=134 comm="watchdogd" name="kmsg" dev="tmpfs" ino=9248 scontext=u:r:watchdogd:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0 avc: denied { write } for pid=166 comm="healthd" name="kmsg" dev="tmpfs" ino=9248 scontext=u:r:healthd:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0 avc: denied { write } for pid=180 comm="vold" name="kmsg" dev="tmpfs" ino=9248 scontext=u:r:vold:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0 These denials were triggered by the change in https://android-review.googlesource.com/151209 . Prior to that change, any code which called klog_init would (unnecessarily) create the device node themselves, rather than using the already existing device node. Drop special /dev/__null__ handling from watchdogd. As of https://android-review.googlesource.com/148288 , watchdogd no longer creates it's own /dev/null device, so it's unnecessary for us to allow for it. Drop mknod from healthd, slideshow, and watchdogd. healthd and slideshow only needed mknod to create /dev/__kmsg__, which is now obsolete. watchdogd only needed mknod to create /dev/__kmsg__ and /dev/__null__, which again is now obsolete. Bug: 21242418 Change-Id: If01c8001084575e7441253f0fa8b4179ae33f534
2015-06-06 16:42:37 +02:00
allow slideshow kmsg_device:chr_file rw_file_perms;
Fix block_suspend denial for slideshow Add wakelock_use to slideshow.te to fix the following denial: avc: denied { block_suspend } for pid=137 comm="slideshow" capability=36 scontext=u:r:slideshow:s0 tcontext=u:r:slideshow:s0 tclass=capability2 permissive=0 Change-Id: If84f167cd235e8196eadf3fb85cc725a5ea464e6
2015-03-31 10:17:43 +02:00
wakelock_use(slideshow)
Allow init to execute /sbin/slideshow Add rules to allow /sbin/slideshow to access framebuffer and input devices at early stages of boot, and rules to allow init to execute the program (from init.rc using exec). Needed by changes from I58c79a7f3ac747eec0d73a10f018d3d8ade9df7d Change-Id: I1d5018feb7025853f0bf81651f497fef8c3a6ab0
2015-02-18 14:59:38 +01:00
allow slideshow device:dir r_dir_perms;
sepolicy: Add rules for non-init namespaces In kernel 4.7, the capability and capability2 classes were split apart from cap_userns and cap2_userns (see kernel commit 8e4ff6f228e4722cac74db716e308d1da33d744f). Since then, Android cannot be run in a container with SELinux in enforcing mode. This change applies the existing capability rules to user namespaces as well as the root namespace so that Android running in a container behaves the same on pre- and post-4.7 kernels. This is essentially: 1. New global_capability_class_set and global_capability2_class_set that match capability+cap_userns and capability2+cap2_userns, respectively. 2. s/self:capability/self:global_capability_class_set/g 3. s/self:capability2/self:global_capability2_class_set/g 4. Add cap_userns and cap2_userns to the existing capability_class_set so that it covers all capabilities. This set was used by several neverallow and dontaudit rules, and I confirmed that the new classes are still appropriate. Test: diff new policy against old and confirm that all new rules add only cap_userns or cap2_userns; Boot ARC++ on a device with the 4.12 kernel. Bug: crbug.com/754831 Change-Id: I4007eb3a2ecd01b062c4c78d9afee71c530df95f
2017-11-09 23:51:26 +01:00
allow slideshow self:global_capability_class_set sys_tty_config;
Allow init to execute /sbin/slideshow Add rules to allow /sbin/slideshow to access framebuffer and input devices at early stages of boot, and rules to allow init to execute the program (from init.rc using exec). Needed by changes from I58c79a7f3ac747eec0d73a10f018d3d8ade9df7d Change-Id: I1d5018feb7025853f0bf81651f497fef8c3a6ab0
2015-02-18 14:59:38 +01:00
allow slideshow graphics_device:dir r_dir_perms;
allow slideshow graphics_device:chr_file rw_file_perms;
allow slideshow input_device:dir r_dir_perms;
allow slideshow input_device:chr_file r_file_perms;
allow slideshow tty_device:chr_file rw_file_perms;
Reference in a new issue Copy permalink