tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/bootstat.te

16 lines
445 B
Text
Raw Normal View History

bootstat: Implement the SELinux policy to allow reading/writing to /data/misc/bootstat. BUG: 21724738 Change-Id: I2789f57cc8182af1a7c33672ef82297f32f54e2e
2016-01-19 19:54:20 +01:00
# bootstat command
type bootstat, domain;
type bootstat_exec, exec_type, file_type;
logd: restrict access to /dev/event-log-tags Create an event_log_tags_file label and use it for /dev/event-log-tags. Only trusted system log readers are allowed direct read access to this file, no write access. Untrusted domain requests lack direct access, and are thus checked for credentials via the "plan b" long path socket to the event log tag service. Test: gTest logd-unit-tests, liblog-unit-tests and logcat-unit-tests Bug: 31456426 Bug: 30566487 Change-Id: Ib9b71ca225d4436d764c9bc340ff7b1c9c252a9e
2016-11-08 00:11:39 +01:00
read_runtime_log_tags(bootstat)
bootstat: Implement the SELinux policy to allow reading/writing to /data/misc/bootstat. BUG: 21724738 Change-Id: I2789f57cc8182af1a7c33672ef82297f32f54e2e
2016-01-19 19:54:20 +01:00
# Allow persistent storage in /data/misc/bootstat.
allow bootstat bootstat_data_file:dir rw_dir_perms;
allow bootstat bootstat_data_file:file create_file_perms;
bootstat: Fix the SELinux policy after removing domain_deprecated. * Allow reading /proc. type=1400 audit(1453834004.239:7): avc: denied { read } for pid=1305 comm="bootstat" name="uptime" dev="proc" ino=4026536600 scontext=u:r:bootstat:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=0 * Define domain for the /system/bin/bootstat file. init: Service exec 4 (/system/bin/bootstat) does not have a SELinux domain defined. Bug: 21724738 Change-Id: I4baa2fa7466ac35a1ced79776943c07635ec9804
2016-01-26 01:23:10 +01:00
# Read access to pseudo filesystems (for /proc/uptime).
Whitespace fix Because I'm nitpicky. Test: policy compiles Change-Id: I4d886d0d6182d29d7b260cf1f142c47cd32eda29
2016-12-10 05:14:31 +01:00
r_dir_file(bootstat, proc)
Assign a label to the ro.boottime.* properties system/core commit 331cf2fb7c16b5b25064f8d2f00284105a9b413f created a number of new properties of the form: [ro.boottime.init]: [5294587604] [ro.boottime.InputEventFind]: [10278767840] [ro.boottime.adbd]: [8359267180] ... These properties were assigned the default_prop SELinux label because a better label did not exist. Properties labeled with the default_prop label are readable to any SELinux domain, which is overly broad. bullhead:/ $ getprop -Z ro.boottime.adbd u:object_r:default_prop:s0 Instead, create a new label for the ro.boottime.* properties so we can apply more fine grain read access control to these properties. bullhead:/ $ getprop -Z ro.boottime.adbd u:object_r:boottime_prop:s0 New SELinux property labels have minimal permissions by default. As a result, after this change, ro.boottime.* properties will only be readable to system_server, bootstat, init (because it manages the property space), and "adb root" (because no SELinux permissions are enforced there). Additional read access can be granted as-needed. This is part of a larger effort to implement fine-grain access control on the properties managed by init. Test: Device boots and no SELinux denials on boot. Change-Id: Ibf981cb81898f4356fdc5c1b6f15dd93c0d6d84d
2016-12-14 04:50:36 +01:00
# Collect metrics on boot time created by init
get_prop(bootstat, boottime_prop)
Reference in a new issue Copy permalink