tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/keystore.te

39 lines
1.2 KiB
Text
Raw Normal View History

Add libselinux keystore_key backend. We add a new back end for SELinux based keystore2_key namespaces. This patch adds the rump policy and build system infrastructure for installing keystore2_key context files on the target devices. Bug: 158500146 Bug: 159466840 Test: None Change-Id: I423c9e68ad259926e4a315d052dfda97fa502106 Merged-In: I423c9e68ad259926e4a315d052dfda97fa502106
2020-07-25 22:02:29 +02:00
type keystore, domain, keystore2_key_type;
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type keystore_exec, system_file_type, exec_type, file_type;
SE Android policy.
2012-01-04 18:33:27 +01:00
# keystore daemon
Confine keystore, but leave it permissive for now. Change-Id: Ia92165478764b062e7e33e7741742f5ec8762ad9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:37 +01:00
typeattribute keystore mlstrustedsubject;
binder_use(keystore)
binder_service(keystore)
Allow keystore to access KeyAttestationApplicationIDProviderService (cherry picked from commit 58b079a25961d15e8ff24342a7ba51bf125e7469) Bug: 22914603 Change-Id: I8ae1a786702694ca2bb8707a4c142b8a233042ee
2016-06-03 20:36:41 +02:00
binder_call(keystore, system_server)
sepolicy(wifi): Allow keystore-wificond communication Denial log: 1. 10-30 11:02:50.279 wifi 1119 1119 W HwBinder:1119_1: type=1400 audit(0.0:113): avc: denied { transfer } for scontext=u:r:wificond:s0 tcontext=u:r:keystore:s0 tclass=binder permissive=0 2. 01-15 16:24:04.214 W/keystore( 1007): type=1400 audit(0.0:109): avc: denied { call } for scontext=u:r:keystore:s0 tcontext=u:r:wificond:s0 tclass=binder permissive=0 3. 01-16 12:11:19.704 W/keystore( 1021): type=1400 audit(0.0:163): avc: denied { transfer } for scontext=u:r:keystore:s0 tcontext=u:r:wificond:s0 tclass=binder permissive=0 Bug: 143638513 Bug: 145310496 Test: Installed CA and wifi certificates and connects to enterprise network. No selinux denial seen from wificond and keystore. Change-Id: I9727add13844b1ff1875e493b777e3a294e00ffa
2020-01-16 19:17:20 +01:00
binder_call(keystore, wificond)
Preliminary policy for hal_keymaster (TREBLE) This adds the premissions required for android.hardware.keymaster@2.0-service to access the keymaster TA as well as for keystore and vold to lookup and use android.hardware.keymaster@2.0-service. IT DOES NOT remove the privileges from keystore and vold to access the keymaster TA directly. Test: Run keystore CTS tests Bug: 32020919 (cherry picked from commit 5090d6f3241ffbd96f5a0b24df602bd2559f3cf4) Change-Id: Ib02682da26e2dbcabd81bc23169f9bd0e832eb19
2017-01-28 00:00:27 +01:00
Confine keystore, but leave it permissive for now. Change-Id: Ia92165478764b062e7e33e7741742f5ec8762ad9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-29 19:42:37 +01:00
allow keystore keystore_data_file:dir create_dir_perms;
allow keystore keystore_data_file:notdevfile_class_set create_file_perms;
allow keystore keystore_exec:file { getattr };
Protect keystore's files. Only keystore itself should be reading / writing it's files. Remove keystore file access from other SELinux domains, including unconfined. Add neverallow rules to protect against regressions. Allow init limited access to recurse into keystore's directory. Change-Id: I0bb5de7804f4314997c16fac18507933014bcadf
2014-05-09 08:28:52 +02:00
te_macros: introduce add_service() macro Introduce the add_service() macro which wraps up add/find permissions for the source domain with a neverallow preventing others from adding it. Only a particular domain should add a particular service. Use the add_service() macro to automatically add a neverallow that prevents other domains from adding the service. mediadrmserver was adding services labeled mediaserver_service. Drop the add permission as it should just need the find permission. Additionally, the macro adds the { add find } permission which causes some existing neverallow's to assert. Adjust those neverallow's so "self" can always find. Test: compile and run on hikey and emulator. No new denials were found, and all services, where applicable, seem to be running OK. Change-Id: Ibbd2a5304edd5f8b877bc86852b0694732be993c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2017-01-19 22:23:52 +01:00
add_service(keystore, keystore_service)
Allow keystore to access KeyAttestationApplicationIDProviderService (cherry picked from commit 58b079a25961d15e8ff24342a7ba51bf125e7469) Bug: 22914603 Change-Id: I8ae1a786702694ca2bb8707a4c142b8a233042ee
2016-06-03 20:36:41 +02:00
allow keystore sec_key_att_app_id_provider_service:service_manager find;
Adding ability for keystore to find dropbox This will allow the logging in keystore to actually work. Bug: 36549319 Test: keystore dropbox logging is successful Change-Id: Ic135fa9624c289c54187e946affbd0caacef13c1 (cherry picked from commit 2e69afc079a175070279674be78aacbe4434c367)
2018-04-05 04:00:40 +02:00
allow keystore dropbox_service:service_manager find;
Add policy for the android protected confirmation service. This is the service offered by Keystore 2.0 to provide APC service to application. It was formerly part of the IKeystoreService interface. Not it is an interface in ints own right. Test: Keystore 2.0 can register the apc service interface. Apps can lookup and call this interface. Bug: 159341464 Change-Id: I058adf0021d9b89f4eac7534e366c29071f0f98b
2020-12-02 03:55:11 +01:00
add_service(keystore, apc_service)
Add policy for the security compatibility hal service. This service manager is registered by Keystore 2.0 to lookup legacy wrapper services. Keystore 2.0 is now written in rust. We have AIDL binding for rust but no HIDL binding. Keystore 2.0 has to support legacy HIDL based interfaces. So we implement the AIDL KeyMint interface in terms of the legacy HIDL Keymaster <= V4.1 devices in C++. This wrapper is linked into the Keystore 2.0 process but it cannot be called directly but must be treated like a remote binder instead. However, we cannot register these wrappers directly, because a) we are not a vendor component, and b) it would conflict with genuine KeyMint devices on newer devices. So Instead we register Keystore 2.0 itself as a legacy service provider. Which it can query itself for the legacy wrappers if it does not find a genuine KeyMint implementation to connect to. Bug: 171351607 Test: Keystore 2.0 can register this Service and lookup legacy wrapper services. Change-Id: I935f23837721ce126531236f4920dba469a47be4
2020-12-02 18:52:42 +01:00
add_service(keystore, keystore_compat_hal_service)
Move allow rules before neverallow rules. There were a few instances where allow rules were appended after the neverallow rules stanza in the .te file. Also there were some regular allow rules inserted into the CTS-specific rules section of app.te. Just move the rules as appropriate. Should be no change in policy. Change-Id: Iec76f32d4b531d245bbf5dd9f621a71ff5c71f3e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2015-03-13 21:42:42 +01:00
# Check SELinux permissions.
selinux_check_access(keystore)
audit domain_deprecated perms for removal Grant permissions observed. Bug: 28760354 Change-Id: Ie63cda709319bbf635ef7bffbba3477c2cccc11b
2016-09-10 01:27:17 +02:00
r_dir_file(keystore, cgroup)
Protect keystore's files. Only keystore itself should be reading / writing it's files. Remove keystore file access from other SELinux domains, including unconfined. Add neverallow rules to protect against regressions. Allow init limited access to recurse into keystore's directory. Change-Id: I0bb5de7804f4314997c16fac18507933014bcadf
2014-05-09 08:28:52 +02:00
###
### Neverallow rules
###
Don't allow ptrace on keystore keystore may hold sensitive information in it's memory. Don't allow anyone to ptrace keystore. Change-Id: I4e3717e482b9fd128d38ce687c03122d41678b6f
2014-05-20 06:49:50 +02:00
### Protect ourself from others
Protect keystore's files. Only keystore itself should be reading / writing it's files. Remove keystore file access from other SELinux domains, including unconfined. Add neverallow rules to protect against regressions. Allow init limited access to recurse into keystore's directory. Change-Id: I0bb5de7804f4314997c16fac18507933014bcadf
2014-05-09 08:28:52 +02:00
###
New ext4enc kernel switching from xattrs to ioctl This is one of three changes to enable this functionality: https://android-review.googlesource.com/#/c/146259/ https://android-review.googlesource.com/#/c/146264/ https://android-review.googlesource.com/#/c/146265/ Bug: 18151196 Change-Id: I6ce4bc977a548df93ea5c09430f93eef5ee1f9fa
2015-04-10 16:42:32 +02:00
neverallow { domain -keystore } keystore_data_file:dir ~{ open create read getattr setattr search relabelto ioctl };
Protect keystore's files. Only keystore itself should be reading / writing it's files. Remove keystore file access from other SELinux domains, including unconfined. Add neverallow rules to protect against regressions. Allow init limited access to recurse into keystore's directory. Change-Id: I0bb5de7804f4314997c16fac18507933014bcadf
2014-05-09 08:28:52 +02:00
neverallow { domain -keystore } keystore_data_file:notdevfile_class_set ~{ relabelto getattr };
Remove -kernel -recovery from keystore_data_file neverallow. Aside from the keystore daemon itself, only init needs any access to keystore_data_file (in order to create and potentially restorecon /data/misc/keystore). The exceptions for the kernel and recovery domains are unnecessary; no allow rule permits this access in current policy. Change-Id: I5cf6f29ec08174017ac8f5fb36fef166ce360ca0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-10-22 17:13:17 +02:00
neverallow { domain -keystore -init } keystore_data_file:dir *;
neverallow { domain -keystore -init } keystore_data_file:notdevfile_class_set *;
Don't allow ptrace on keystore keystore may hold sensitive information in it's memory. Don't allow anyone to ptrace keystore. Change-Id: I4e3717e482b9fd128d38ce687c03122d41678b6f
2014-05-20 06:49:50 +02:00
Replace "neverallow domain" by "neverallow *" Modify many "neverallow domain" rules to be "neverallow *" rules instead. This will catch more SELinux policy bugs where a label is assigned an irrelevant rule, as well as catch situations where a domain attribute is not assigned to a process. Change-Id: I5b83a2504c13b384f9dff616a70ca733b648ccdf
2016-02-05 23:48:03 +01:00
neverallow * keystore:process ptrace;
Reference in a new issue Copy permalink