tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/install_recovery.te

28 lines
1.1 KiB
Text
Raw Normal View History

New domain "install_recovery" Create a new domain for the one-shot init service flash_recovery. This domain is initially in permissive_or_unconfined() for testing. Any SELinux denials won't be enforced for now. Change-Id: I7146dc154a5c78b6f3b4b6fb5d5855a05a30bfd8
2014-07-03 01:18:16 +02:00
# service flash_recovery in init.rc
install_recovery.te: remove domain_deprecated No relevant collected denials. Test: device boots and no obvious problems. Test: no collected denials. Bug: 28760354 Change-Id: Idcf939b3cbdb1dec835d59150181047d062e6c48
2017-01-07 01:54:25 +01:00
type install_recovery, domain;
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type install_recovery_exec, system_file_type, exec_type, file_type;
New domain "install_recovery" Create a new domain for the one-shot init service flash_recovery. This domain is initially in permissive_or_unconfined() for testing. Any SELinux denials won't be enforced for now. Change-Id: I7146dc154a5c78b6f3b4b6fb5d5855a05a30bfd8
2014-07-03 01:18:16 +02:00
sepolicy: grant dac_read_search to domains with dac_override kernel commit 2a4c22426955d4fc04069811997b7390c0fb858e (fs: switch order of CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH checks) swapped the order of dac_override and dac_read_search checks. Domains that have dac_override will now generate spurious denials for dac_read_search unless they also have that permission. Since dac_override is a strict superset of dac_read_search, grant dac_read_search to all domains that already have dac_override to get rid of the denials. Bug: 114280985 Bug: crbug.com/877588 Test: Booted on a device running 4.14. Change-Id: I5c1c136b775cceeb7f170e139e8d4279e73267a4
2018-09-07 00:19:40 +02:00
allow install_recovery self:global_capability_class_set { dac_override dac_read_search };
New domain "install_recovery" Create a new domain for the one-shot init service flash_recovery. This domain is initially in permissive_or_unconfined() for testing. Any SELinux denials won't be enforced for now. Change-Id: I7146dc154a5c78b6f3b4b6fb5d5855a05a30bfd8
2014-07-03 01:18:16 +02:00
# /system/bin/install-recovery.sh is a shell script.
# Needs to execute /system/bin/sh
allow install_recovery shell_exec:file rx_file_perms;
# Execute /system/bin/applypatch
allow install_recovery system_file:file rx_file_perms;
Fix build time warning Fixes warning: system/sepolicy/public/install_recovery.te:14:WARNING 'unrecognized character' at token ''' on line 13335: allow install_recovery vendor_file:file { { getattr open read ioctl lock } { getattr execute execute_no_trans } };' Bug: 37105075 Test: Fugu policy builds without this warning. Change-Id: I8f417c51a816f3983a918c7e36dd804c5b85543f
2017-04-21 18:33:39 +02:00
not_full_treble(`allow install_recovery vendor_file:file rx_file_perms;')
New domain "install_recovery" Create a new domain for the one-shot init service flash_recovery. This domain is initially in permissive_or_unconfined() for testing. Any SELinux denials won't be enforced for now. Change-Id: I7146dc154a5c78b6f3b4b6fb5d5855a05a30bfd8
2014-07-03 01:18:16 +02:00
Only allow toolbox exec where /system exec was already allowed. When the toolbox domain was introduced, we allowed all domains to exec it to avoid breakage. However, only domains that were previously allowed the ability to exec /system files would have been able to do this prior to the introduction of the toolbox domain. Remove the rule from domain.te and add rules to all domains that are already allowed execute_no_trans to system_file. Requires coordination with device-specific policy changes with the same Change-Id. Change-Id: Ie46209f0412f9914857dc3d7c6b0917b7031aae5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-08-25 17:38:29 +02:00
allow install_recovery toolbox_exec:file rx_file_perms;
Create boot_block_device and allow install_recovery read access The install_recovery script creates a new recovery image based off of the boot image plus a patch on /system. We need to allow read access to the boot image to allow the patching to succeed, otherwise OTAs are broken. Addresses the following denial: type=1400 audit(9109404.519:6): avc: denied { read } for pid=341 comm="applypatch" name="mmcblk0p37" dev="tmpfs" ino=9186 scontext=u:r:install_recovery:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=0 TODO: Add device specific labels for the boot image. Bug: 19534538 Change-Id: Ic811ec03e235df3b1bfca9b0a65e23307cd968aa
2015-02-28 02:39:09 +01:00
# Update the recovery block device based off a diff of the boot block device
New domain "install_recovery" Create a new domain for the one-shot init service flash_recovery. This domain is initially in permissive_or_unconfined() for testing. Any SELinux denials won't be enforced for now. Change-Id: I7146dc154a5c78b6f3b4b6fb5d5855a05a30bfd8
2014-07-03 01:18:16 +02:00
allow install_recovery block_device:dir search;
Create boot_block_device and allow install_recovery read access The install_recovery script creates a new recovery image based off of the boot image plus a patch on /system. We need to allow read access to the boot image to allow the patching to succeed, otherwise OTAs are broken. Addresses the following denial: type=1400 audit(9109404.519:6): avc: denied { read } for pid=341 comm="applypatch" name="mmcblk0p37" dev="tmpfs" ino=9186 scontext=u:r:install_recovery:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=0 TODO: Add device specific labels for the boot image. Bug: 19534538 Change-Id: Ic811ec03e235df3b1bfca9b0a65e23307cd968aa
2015-02-28 02:39:09 +01:00
allow install_recovery boot_block_device:blk_file r_file_perms;
Define specific block device types for system and recovery partitions. Define a specific block device type for system so that we can prevent raw writes to the system partition by anything other than recovery. Define a specific block device type for recovery so that we can prevent raw writes to the recovery partition by anything other than install_recovery or recovery. These types must be assigned to specific block device nodes via device-specific policy. This change merely defines the types, adds allow rules so that nothing will break when the types are assigned, and adds neverallow rules to prevent adding further allow rules on these types. This change does not remove access to the generic block_device type from any domain so nothing should break even on devices without these type assignments. Change-Id: Ie9c1f6d632f6e9e8cbba106f07f6b1979d2a3c4a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-30 18:53:12 +02:00
allow install_recovery recovery_block_device:blk_file rw_file_perms;
New domain "install_recovery" Create a new domain for the one-shot init service flash_recovery. This domain is initially in permissive_or_unconfined() for testing. Any SELinux denials won't be enforced for now. Change-Id: I7146dc154a5c78b6f3b4b6fb5d5855a05a30bfd8
2014-07-03 01:18:16 +02:00
# Create and delete /cache/saved.file
drop install_recovery cache_recovery_file rules The auditallow for install_recovery accessing cache_recovery_files hasn't triggered, so drop the rules as they don't appear to be used. Change-Id: I74bb152b6c829612594c647674907e16783fa477
2016-03-29 18:20:41 +02:00
allow install_recovery cache_file:dir rw_dir_perms;
allow install_recovery cache_file:file create_file_perms;
New domain "install_recovery" Create a new domain for the one-shot init service flash_recovery. This domain is initially in permissive_or_unconfined() for testing. Any SELinux denials won't be enforced for now. Change-Id: I7146dc154a5c78b6f3b4b6fb5d5855a05a30bfd8
2014-07-03 01:18:16 +02:00
# Write to /proc/sys/vm/drop_caches
drop_caches label, vold scratch space on expanded. Define an explicit label for /proc/sys/vm/drop_caches and grant to the various people who need it, including vold which uses it when performing storage benchmarks. Also let vold create new directories under it's private storage area where the benchmarks will be carried out. Mirror the definition of the private storage area on expanded media. avc: denied { write } for name="drop_caches" dev="proc" ino=20524 scontext=u:r:vold:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=0 Bug: 21172095 Change-Id: I300b1cdbd235ff60e64064d3ba6e5ea783baf23f
2015-05-15 05:55:31 +02:00
allow install_recovery proc_drop_caches:file w_file_perms;
Reference in a new issue Copy permalink