tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/vdc.te

21 lines
707 B
Text
Raw Normal View History

Remove some FDE rules and update comments Now that FDE (Full Disk Encryption) is no longer supported, the SELinux policy doesn't need to support it. Remove two rules that are no longer needed. Also update some comments that implied that other rules were needed only because of FDE support, when actually they are still needed for other reasons. Finally, fix some outdated documentation links. Bug: 208476087 Change-Id: I4e03dead91d34fcefdfcdc68d44dd97f433d6eaf
2022-04-15 04:18:37 +02:00
# vdc is a helper program for making Binder calls to vold. It is spawned from
# init for various reasons, such as initializing file-based encryption and
# metadata encryption, and managing userdata checkpointing.
dumpstate: transition into vdc domain dumpstate uses vdc to collect asec lists and do a vold dump. Force a transition into the vdc domain when this occurs. Addresses the following denial: <4>[ 1099.623572] type=1400 audit(1403716545.565:7): avc: denied { execute } for pid=6987 comm="dumpstate" name="vdc" dev="mmcblk0p8" ino=222 scontext=u:r:dumpstate:s0 tcontext=u:object_r:vdc_exec:s0 tclass=file permissive=0 Change-Id: I4bd9f3ad83480f8c9f9843ffe136295c582f96fe
2014-06-25 21:30:11 +02:00
#
# We also transition into this domain from dumpstate, when
# collecting bug reports.
Create vdc domain The init.rc one-shot services "defaultcrypto" and "encrypt" call out to the /system/bin/vdc command line to ask vold to perform encryption operations. Create a new domain for these one-shot services. Allow the vdc domain to talk to vold. Change-Id: I73dc2ee4cc265bc16056b27307c254254940fd9f
2014-06-21 03:11:11 +02:00
remove more domain_deprecated Test: no denials showing up in log collection Test: device boots Bug: 28760354 Change-Id: I089cfcf486464952fcbb52cce9f6152caf662c23
2016-12-10 04:30:39 +01:00
type vdc, domain;
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type vdc_exec, system_file_type, exec_type, file_type;
Create vdc domain The init.rc one-shot services "defaultcrypto" and "encrypt" call out to the /system/bin/vdc command line to ask vold to perform encryption operations. Create a new domain for these one-shot services. Allow the vdc domain to talk to vold. Change-Id: I73dc2ee4cc265bc16056b27307c254254940fd9f
2014-06-21 03:11:11 +02:00
Allow 'vdc' to be invoked with logwrapper. Currently vdc emits logs to stderr, which makes sense for command line invocations, but when exec'ed they're silently dropped unless the caller uses logwrapper. avc: denied { read write } for path="/dev/pts/2" dev="devpts" ino=5 scontext=u:r:vdc:s0 tcontext=u:object_r:devpts:s0 tclass=chr_file permissive=0 Bug: 25796509 Change-Id: Ib92e0a7f580b1934a9853a83684f95b24bdc355c
2016-02-04 23:18:52 +01:00
# vdc can be invoked with logwrapper, so let it write to pty
allow vdc devpts:chr_file rw_file_perms;
Grant vdc access to kmsg Init is no longer calling vdc with logwrapper, so it must take care of logging to kmsg directly. Change-Id: I529f5a95e19c08ef75e0da9a02bae1cb7187eec0 avc: denied { write } for pid=367 comm="vdc" name="kmsg" dev="tmpfs" ino=11056 scontext=u:r:vdc:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0 Test: observe vdc logging in kmsg on boot and stderr on normal usage Change-Id: Ie3678509d360f19b95cb03aeea75f29843728203
2017-03-30 01:52:19 +02:00
# vdc writes directly to kmsg during the boot process
Allow to getattr kmsg_device These denials occur on boot when android_get_control_file also changes from readlink() to realpath(), because realpath() will lstat() the given path. Some other domains (fastbootd, update_engine, etc.) also uses libcutils to write to kernel log, where android_get_control_file() is invoked, hence getattr is added to them as well. 04-28 06:15:22.290 618 618 I auditd : type=1400 audit(0.0:4): avc: denied { getattr } for comm="logd" path="/dev/kmsg" dev="tmpfs" ino=20917 scontext=u:r:logd:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0 03-20 19:52:23.431 900 900 I auditd : type=1400 audit(0.0:7): avc: denied { getattr } for comm="android.hardwar" path="/dev/kmsg" dev="tmpfs" ino=20917 scontext=u:r:hal_health_default:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0 ... 03-20 22:40:42.316 1 1 W init : type=1400 audit(0.0:33): avc: denied { getattr } for path="/dev/kmsg" dev="tmpfs" ino=21999 scontext=u:r:init:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0 Test: no denials related to these Change-Id: I5263dd6b64c06fb092f3461858f57a1a09107429
2019-03-20 23:36:26 +01:00
allow vdc kmsg_device:chr_file { getattr w_file_perms };
Move vdc commands over to Binder. Use nice clean AIDL instead of dirty sockets. avc: denied { call } for pid=603 comm="vdc" scontext=u:r:vdc:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=0 Test: vdc cryptfs init_user0 Bug: 13758960 Change-Id: I8b0e63adad8c4c7e2b5e6aca48386d1b371ea6a5
2017-09-14 21:19:20 +02:00
# vdc talks to vold over Binder
binder_use(vdc)
binder_call(vdc, vold)
allow vdc vold_service:service_manager find;
Reference in a new issue Copy permalink