tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/bluetooth.te

64 lines
2.1 KiB
Text
Raw Normal View History

Update policy for Android 4.2 / latest master. Update policy for Android 4.2 / latest master. Primarily this consists of changes around the bluetooth subsystem. The zygote also needs further permissions to set up /storage/emulated. adbd service now gets a socket under /dev/socket. keystore uses the binder. Change-Id: I8c5aeb8d100313c75169734a0fa614aa974b3bfc Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-11-16 15:06:47 +01:00
# bluetooth subsystem
Create attribute for moving perms out of domain Motivation: Domain is overly permissive. Start removing permissions from domain and assign them to the domain_deprecated attribute. Domain_deprecated and domain can initially be assigned to all domains. The goal is to not assign domain_deprecated to new domains and to start removing domain_deprecated where it is not required or reassigning the appropriate permissions to the inheriting domain when necessary. Bug: 25433265 Change-Id: I8b11cb137df7bdd382629c98d916a73fe276413c
2015-11-03 18:54:39 +01:00
type bluetooth, domain, domain_deprecated;
Update policy for Android 4.2 / latest master. Update policy for Android 4.2 / latest master. Primarily this consists of changes around the bluetooth subsystem. The zygote also needs further permissions to set up /storage/emulated. adbd service now gets a socket under /dev/socket. keystore uses the binder. Change-Id: I8c5aeb8d100313c75169734a0fa614aa974b3bfc Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2012-11-16 15:06:47 +01:00
app_domain(bluetooth)
Resolve overlapping rules between app.te and net.te. There is some overlap between socket rules in app.te and the net.te rules, but they aren't quite identical since not all app domains presently include the net_domain() macro and because the rules in app.te allow more permissions for netlink_route_socket and allow rawip_socket permissions for ping. The current app.te rules prevent one from ever creating a non-networked app domain. Resolve this overlap by: 1) Adding the missing permissions allowed by app.te to net.te for netlink_route_socket and rawip_socket. 2) Adding net_domain() calls to all existing app domains that do not already have it. 3) Deleting the redundant socket rules from app.te. Then we'll have no effective change in what is allowed for apps but allow one to define app domains in the future that are not allowed network access. Also cleanup net.te to use the create_socket_perms macro rather than * and add macros for stream socket permissions. Change-Id: I6e80d65b0ccbd48bd2b7272c083a4473e2b588a9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 16:48:03 +01:00
net_domain(bluetooth)
Confine bluetooth app. Remove unconfined_domain() from the bluetooth app domain, restore the rules from our policy, and move the neverallow rule for bluetooth capabilities to bluetooth.te. Make the bluetooth domain permissive again until it has received sufficient testing. Change-Id: I3b3072d76e053eefd3d0e883a4fdb7c333bbfc09 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-22 18:56:32 +02:00
DO NOT MERGE Grant Bluetooth the ability to acquire wake locks. Bug: 23375670 Change-Id: I0454c580b465a2f0edc928cf0effb71733866f03
2015-09-01 08:28:15 +02:00
wakelock_use(bluetooth);
Confine bluetooth app. Remove unconfined_domain() from the bluetooth app domain, restore the rules from our policy, and move the neverallow rule for bluetooth capabilities to bluetooth.te. Make the bluetooth domain permissive again until it has received sufficient testing. Change-Id: I3b3072d76e053eefd3d0e883a4fdb7c333bbfc09 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-22 18:56:32 +02:00
# Data file accesses.
allow bluetooth bluetooth_data_file:dir create_dir_perms;
allow bluetooth bluetooth_data_file:notdevfile_class_set create_file_perms;
Allow mediaserver to connect to bluetooth. Re-purpose the existing bluetooth_socket type, originally for /dev/socket/bluetooth used by bluetoothd in the old bluetooth stack, for sockets created by bluedroid under /data/misc/bluedroid, and allow mediaserver to connect to such sockets. This is required for playing audio on paired BT devices. Based on b/12417855. Change-Id: I24ecdf407d066e7c4939ed2a0edb97222a1879f6 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-01-13 15:14:15 +01:00
# Socket creation under /data/misc/bluedroid.
type_transition bluetooth bluetooth_data_file:sock_file bluetooth_socket;
allow bluetooth bluetooth_socket:sock_file create_file_perms;
Confine bluetooth app. Remove unconfined_domain() from the bluetooth app domain, restore the rules from our policy, and move the neverallow rule for bluetooth capabilities to bluetooth.te. Make the bluetooth domain permissive again until it has received sufficient testing. Change-Id: I3b3072d76e053eefd3d0e883a4fdb7c333bbfc09 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-22 18:56:32 +02:00
# bluetooth factory file accesses.
r_dir_file(bluetooth, bluetooth_efs_file)
Further restrict access to tun_device Remove bluetooth's access to tun_device. Auditallow rule demonstrates that it's not used. Strengthen the neverallow on opening tun_device to include all Apps. Bug: 24744295 Change-Id: Iba85ba016b1e24c6c12d5b33e46fe8232908aac1
2015-12-04 00:56:04 +01:00
allow bluetooth { uhid_device hci_attach_dev }:chr_file rw_file_perms;
Confine bluetooth app. Remove unconfined_domain() from the bluetooth app domain, restore the rules from our policy, and move the neverallow rule for bluetooth capabilities to bluetooth.te. Make the bluetooth domain permissive again until it has received sufficient testing. Change-Id: I3b3072d76e053eefd3d0e883a4fdb7c333bbfc09 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-22 18:56:32 +02:00
# sysfs access.
allow bluetooth sysfs_bluetooth_writable:file rw_file_perms;
allow bluetooth self:capability net_admin;
Grant Bluetooth CAP_WAKE_ALARM so it can use the POSIX timer API for wake alarms. Change-Id: Ic7b25e79116b90378e5e89a879d8e6b87e4f052e
2014-06-29 19:45:03 +02:00
allow bluetooth self:capability2 wake_alarm;
Confine bluetooth app. Remove unconfined_domain() from the bluetooth app domain, restore the rules from our policy, and move the neverallow rule for bluetooth capabilities to bluetooth.te. Make the bluetooth domain permissive again until it has received sufficient testing. Change-Id: I3b3072d76e053eefd3d0e883a4fdb7c333bbfc09 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-22 18:56:32 +02:00
# tethering
Clean up socket rules. Replace * or any permission set containing create with create_socket_perms or create_stream_socket_perms. Add net_domain() to all domains using network sockets and delete rules already covered by domain.te or net.te. For netlink_route_socket, only nlmsg_write needs to be separately granted to specific domains that are permitted to modify the routing table. Clarification: read/write permissions are just ability to perform read/recv() or write/send() on the socket, whereas nlmsg_read/ nlmsg_write permissions control ability to observe or modify the underlying kernel state accessed via the socket. See security/selinux/nlmsgtab.c in the kernel for the mapping of netlink message types to nlmsg_read or nlmsg_write. Delete legacy rule for b/12061011. This change does not touch any rules where only read/write were allowed to a socket created by another domain (inherited across exec or received across socket or binder IPC). We may wish to rewrite some or all of those rules with the rw_socket_perms macro but that is a separate change. Change-Id: Ib0637ab86f6d388043eff928e5d96beb02e5450e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-24 21:06:11 +01:00
allow bluetooth self:tun_socket create_socket_perms;
Confine bluetooth app. Remove unconfined_domain() from the bluetooth app domain, restore the rules from our policy, and move the neverallow rule for bluetooth capabilities to bluetooth.te. Make the bluetooth domain permissive again until it has received sufficient testing. Change-Id: I3b3072d76e053eefd3d0e883a4fdb7c333bbfc09 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-22 18:56:32 +02:00
allow bluetooth efs_file:dir search;
# proc access.
allow bluetooth proc_bluetooth_writable:file rw_file_perms;
Allow bluetooth to write to bluetooth properties Some bluetooth implementations write to bluetooth.* properties. It seems reasonable to allow this for all bluetooth implementations. This addresses the following denial (seen on mako): <4>[ 132.182755] avc: denied { set } for property=bluetooth.hciattach scontext=u:r:bluetooth:s0 tcontext=u:object_r:bluetooth_prop:s0 tclass=property_service Change-Id: I6d92c0ff108838dd1107c5fb3c436699ef824814
2013-10-29 20:45:10 +01:00
# Allow write access to bluetooth specific properties
Replace unix_socket_connect() and explicit property sets with macro A common source of mistakes when authoring sepolicy is properly setting up property sets. This is a 3 part step of: 1. Allowing the unix domain connection to the init/property service 2. Allowing write on the property_socket file 3. Allowing the set on class property_service The macro unix_socket_connect() handled 1 and 2, but could be confusing for first time policy authors. 3 had to be explicitly added. To correct this, we introduce a new macros: set_prop(sourcedomain, targetprop) This macro handles steps 1, 2 and 3. No difference in sediff is expected. (cherrypicked from commit 625a3526f1ebaaa014bb563239cc33829f616232) Change-Id: I630ba0178439c935d08062892990d43a3cc1239e Signed-off-by: William Roberts <william.c.roberts@linux.intel.com>
2015-05-05 03:22:45 +02:00
set_prop(bluetooth, bluetooth_prop)
set_prop(bluetooth, pan_result_prop)
set_prop(bluetooth, ctl_dhcp_pan_prop)
Allow bluetooth to write to bluetooth properties Some bluetooth implementations write to bluetooth.* properties. It seems reasonable to allow this for all bluetooth implementations. This addresses the following denial (seen on mako): <4>[ 132.182755] avc: denied { set } for property=bluetooth.hciattach scontext=u:r:bluetooth:s0 tcontext=u:object_r:bluetooth_prop:s0 tclass=property_service Change-Id: I6d92c0ff108838dd1107c5fb3c436699ef824814
2013-10-29 20:45:10 +01:00
Restrict service_manager find and list access. All domains are currently granted list and find service_manager permissions, but this is not necessary. Pare the permissions which did not trigger any of the auditallow reporting. Bug: 18106000 Change-Id: Ie0ce8de2af8af2cbe4ce388a2dcf4534694c994a
2014-12-12 01:01:27 +01:00
allow bluetooth bluetooth_service:service_manager find;
Allow bluetooth to find the drmservice Address the following denial: SELinux E avc: denied { find } for service=drm.drmManager scontext=u:r:bluetooth:s0 tcontext=u:object_r:drmserver_service:s0 This denial is triggered by Bluetooth when MmsFileProvider.java is using the PduPersister which in turn is using DRM. Change-Id: I4c077635f8afa39e6bc5e10178c3a7ae3cb6a9ea
2015-10-07 14:42:37 +02:00
allow bluetooth drmserver_service:service_manager find;
Allow bluetooth mediaserver_service access. This was observed when attempting to change volume for a bluetooth device supporting AVRCP volume control. Addresses the following denials: avc: denied { find } for service=media.audio_flinger scontext=u:r:bluetooth:s0 tcontext=u:object_r:mediaserver_service:s0 tclass=service_manager avc: denied { find } for service=media.audio_policy scontext=u:r:bluetooth:s0 tcontext=u:object_r:mediaserver_service:s0 tclass=service_manager Bug: 19341236 Change-Id: If7f2ff1ea9fc694bad700cf59f400f2d2df8c2dd
2015-02-11 22:25:57 +01:00
allow bluetooth mediaserver_service:service_manager find;
Restrict service_manager find and list access. All domains are currently granted list and find service_manager permissions, but this is not necessary. Pare the permissions which did not trigger any of the auditallow reporting. Bug: 18106000 Change-Id: Ie0ce8de2af8af2cbe4ce388a2dcf4534694c994a
2014-12-12 01:01:27 +01:00
allow bluetooth radio_service:service_manager find;
Allow bluetooth surfaceflinger access. Address the following denial: 02-12 07:51:42.702: E/SELinux(158): avc: denied { find } for service=SurfaceFlinger scontext=u:r:bluetooth:s0 tcontext=u:object_r:surfaceflinger_service:s0 tclass=service_manager which occurs when the remote service starts up. 02-12 07:51:42.702: E/ServiceManager(158): find_service('SurfaceFlinger') uid=1002 - PERMISSION DENIED 02-12 07:51:42.702: I/ServiceManager(2827): Waiting for service SurfaceFlinger... 02-12 07:51:42.959: E/ActivityManager(469): ANR in com.google.android.remote.tv.services 02-12 07:51:42.959: E/ActivityManager(469): PID: 2827 02-12 07:51:42.959: E/ActivityManager(469): Reason: executing service com.google.android.tv.remote/.RemoteService Bug: 19268019 Change-Id: I2d415c2ea2f70cf71851147253cf6e1906fd0940
2015-02-12 18:50:20 +01:00
allow bluetooth surfaceflinger_service:service_manager find;
Add system_api_service and app_api_service attributes. System services differ in designed access level. Add attributes reflecting this distinction and label services appropriately. Begin moving access to the newly labeled services by removing them from tmp_system_server_service into the newly made system_server_service attribute. Reflect the move of system_server_service from a type to an attribute by removing access to system_server_service where appropriate. Change-Id: I7fd06823328daaea6d6f96e4d6bd00332382230b
2015-04-03 01:50:08 +02:00
allow bluetooth app_api_service:service_manager find;
allow bluetooth system_api_service:service_manager find;
Add access control for each service_manager action. Add SELinux MAC for the service manager actions list and find. Add the list and find verbs to the service_manager class. Add policy requirements for service_manager to enforce policies to binder_use macro. Change-Id: I224b1c6a6e21e3cdeb23badfc35c82a37558f964
2014-07-07 22:56:27 +02:00
Add permission for Bluetooth Sim Access Profile Added permission to SAP socket used to access the the RIL daemon Change-Id: Ifbfb764f0b8731e81fb3157955aa4fda6120d846 Signed-off-by: Casper Bonde <c.bonde@samsung.com>
2015-03-19 10:56:26 +01:00
# Bluetooth Sim Access Profile Socket to the RIL
unix_socket_connect(bluetooth, sap_uim, rild)
bluetooth: allow sending bugreports via bluetooth Bluetooth can receive bugreport data for beaming to another device. This comes across as an open file descriptor. Allow bluetooth access to bugreports. Addresses the following denial: avc: denied { read } for path="/data/data/com.android.shell/files/bugreports/bugreport-2014-12-19-15-35-32.txt" dev="dm-0" ino=662738 scontext=u:r:bluetooth:s0 tcontext=u:object_r:shell_data_file:s0 tclass=file permissive=0 Change-Id: I7be2ce2e0e48323c1e8f932be17b434b89daf085
2014-12-20 01:43:41 +01:00
# already open bugreport file descriptors may be shared with
# the bluetooth process, from a file in
# /data/data/com.android.shell/files/bugreports/bugreport-*.
allow bluetooth shell_data_file:file read;
Confine bluetooth app. Remove unconfined_domain() from the bluetooth app domain, restore the rules from our policy, and move the neverallow rule for bluetooth capabilities to bluetooth.te. Make the bluetooth domain permissive again until it has received sufficient testing. Change-Id: I3b3072d76e053eefd3d0e883a4fdb7c333bbfc09 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-10-22 18:56:32 +02:00
###
### Neverallow rules
###
### These are things that the bluetooth app should NEVER be able to do
###
# Superuser capabilities.
Grant Bluetooth CAP_WAKE_ALARM so it can use the POSIX timer API for wake alarms. Change-Id: Ic7b25e79116b90378e5e89a879d8e6b87e4f052e
2014-06-29 19:45:03 +02:00
# bluetooth requires net_admin and wake_alarm.
Remove -unconfineddomain from neverallow rules Many of the neverallow rules have -unconfineddomain. This was intended to allow us to support permissive_or_unconfined(), and ensure that all domains were enforcing at least a minimal set of rules. Now that all the app domains are in enforcing / confined, there's no need to allow for these exceptions. Remove them. Change-Id: Ieb29872dad415269f7fc2fe5be5a3d536d292d4f
2014-07-04 19:12:13 +02:00
neverallow bluetooth self:capability ~net_admin;
DO NOT MERGE Grant Bluetooth the ability to acquire wake locks. Bug: 23375670 Change-Id: I0454c580b465a2f0edc928cf0effb71733866f03
2015-09-01 08:28:15 +02:00
neverallow bluetooth self:capability2 ~{ wake_alarm block_suspend };
Reference in a new issue Copy permalink