tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/wificond.te

37 lines
1.3 KiB
Text
Raw Normal View History

Sepolicy files for wificond This sepolicy change allows wificond to run as a deamon. BUG=28865186 TEST=compile TEST=compile with ag/1059605 Add wificond to '/target/product/base.mk' Adb shell ps -A | grep 'wificond' Change-Id: If1e4a8542ac03e8ae42371d75aa46b90c3d8545d (cherry picked from commit 4ef44a616ee5888023e5c53bbc2c4df6549f748a)
2016-05-20 04:31:20 +02:00
# wificond
type wificond, domain;
type wificond_exec, exec_type, file_type;
sepolicy: add sepolicy binder support for wificond This allows wificond to publish binder interface using service manager. Denial warnings: wificond: type=1400 audit(0.0:8): avc: denied { call } for scontext=u:r:wificond:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=1 wificond: type=1400 audit(0.0:9): avc: denied { transfer } for scontext=u:r:wificond:s0 tcontext=u:r:servicemanager:s0 tclass=binder permissive=1 servicemanager: type=1400 audit(0.0:10): avc: denied { search } for name="6085" dev="proc" ino=40626 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=dir permissive=1 servicemanager: type=1400 audit(0.0:11): avc: denied { read } for name="current" dev="proc" ino=40641 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=file permissive=1 servicemanager: type=1400 audit(0.0:12): avc: denied { open } for path="/proc/6085/attr/current" dev="proc" ino=40641 scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=file permissive=1 servicemanager: type=1400 audit(0.0:13): avc: denied { getattr } for scontext=u:r:servicemanager:s0 tcontext=u:r:wificond:s0 tclass=process permissive=1 SELinux : avc: denied { add } for service=wificond pid=6085 uid=0 scontext=u:r:wificond:s0 tcontext=u:object_r:wifi_service:s0 tclass=service_manager permissive=1 BUG=28867093 TEST=compile TEST=use a client to call wificond service through binder Change-Id: I9312892caff171f17b04c30a415c07036b39ea7f (cherry picked from commit d56bcb1c5452c8dcdda7e4ef5d0f44b91b6bb08b)
2016-06-03 19:08:56 +02:00
binder_use(wificond)
binder_call(wificond, system_server)
te_macros: introduce add_service() macro Introduce the add_service() macro which wraps up add/find permissions for the source domain with a neverallow preventing others from adding it. Only a particular domain should add a particular service. Use the add_service() macro to automatically add a neverallow that prevents other domains from adding the service. mediadrmserver was adding services labeled mediaserver_service. Drop the add permission as it should just need the find permission. Additionally, the macro adds the { add find } permission which causes some existing neverallow's to assert. Adjust those neverallow's so "self" can always find. Test: compile and run on hikey and emulator. No new denials were found, and all services, where applicable, seem to be running OK. Change-Id: Ibbd2a5304edd5f8b877bc86852b0694732be993c Signed-off-by: William Roberts <william.c.roberts@intel.com>
2017-01-19 22:23:52 +01:00
add_service(wificond, wificond_service)
Define explicit label for wlan sysfs fwpath avc: denied { write } for name="fwpath" dev="sysfs" ino=6863 scontext=u:r:wificond:s0 tcontext=u:object_r:sysfs_wlan_fwpath:s0 tclass=file permissive=0 Test: wificond and netd can write to this path, wifi works Test: `runtest frameworks-wifi` passes Bug: 29579539 Change-Id: Ia21c654b00b09b9fe3e50d564b82966c9c8e6994 (cherry picked from commit 7d13dd806f37523ba8164325fef9b000d6eacd7c)
2016-06-30 23:23:12 +02:00
Whitelist vendor-init-settable bluetooth_prop and wifi_prop Values of the following properties are set by SoC vendors on some devices including Pixels. - persist.bluetooth.a2dp_offload.cap - persist.bluetooth.a2dp_offload.enable - persist.vendor.bluetooth.a2dp_offload.enable - ro.bt.bdaddr_path - wlan.driver.status So they should be whitelisted for compatibility. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: Ib2b81bcc1fd70ddd571dc7fb2b923b576d62b7d5
2018-04-09 05:07:32 +02:00
set_prop(wificond, exported_wifi_prop)
Separate permissions to set WiFi related properties wificond would like to be able to set WiFi related properties without access to the rest of the system properties. Today, this only involves marking the driver as loaded or unloaded. avc: denied { write } for name="property_service" dev="tmpfs" ino=10100 scontext=u:r:wificond:s0 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=0 Bug: 29579539 Test: No avc denials related to system properties across various WiFi events. Change-Id: I6d9f1de3fbef04cb7750cc3753634f9e02fdb71f (cherry picked from commit 1ebfdd6a14fb21705664c8e144f151b39c3d73f8)
2016-06-29 20:28:20 +02:00
set_prop(wificond, wifi_prop)
Give wificond permission to start/stop init services Bug: 30292103 Change-Id: I433f2b8cc912b42bf026f6e908fd458a07c41fc2 Test: Integration tests reveal wificond can start/stop hostapd. (cherry picked from commit 1faa9c55daed010398bd2586e418b66f3c182a24)
2016-07-22 23:34:26 +02:00
set_prop(wificond, ctl_default_prop)
Allow wificond to mark interfaces up and down avc: denied { create } for scontext=u:r:wificond:s0 tcontext=u:r:wificond:s0 tclass=udp_socket permissive=0 avc: denied { net_raw } for capability=13 scontext=u:r:wificond:s0 tcontext=u:r:wificond:s0 tclass=capability permissive=0 avc: denied { read } for name="psched" dev="proc" ino=4026535377 scontext=u:r:wificond:s0 tcontext=u:object_r:proc_net:s0 tclass=file permissive=0 Test: fixes above avc denials Bug: 29579539 Change-Id: Ie1dff80103e81cfba8064a22b5dd3e1e8f29471b (cherry picked from commit b6a6561d0ef37ad86802ef1ceeefc59a42612435)
2016-07-01 02:48:12 +02:00
# create sockets to set interfaces up and down
allow wificond self:udp_socket create_socket_perms;
Allow wificond to set interfaces up and down This is apparently a privileged ioctl. Being able to do this allows us to no longer kill hostapd with SIGTERM, since we can cleanup after hard stops. Bug: 31023120 Test: wificond unit and integration tests pass Change-Id: Icdf2469d403f420c742871f54b9fb17432805991 (cherry picked from commit ca7b04ba525a61cb8663e5e6faf52bfcdb80dde8)
2016-08-23 02:47:13 +02:00
# setting interface state up/down is a privileged ioctl
MAC Anonymization: wificond SIOCSIFHWADDR sepolicy Add sepolicy rules to grant wificond permission to use SIOCSIFHWADDR ioctl. This permission is needed to dynamically change MAC address of the device when connecting to wifi networks. Bug: 63905794 Test: Verified manually that wificond can dynamically change MAC address. Change-Id: If2c6b955b0b792f706d8438e8e2e018c0b4cfc31
2018-01-23 05:42:12 +01:00
allowxperm wificond self:udp_socket ioctl { SIOCSIFFLAGS SIOCSIFHWADDR };
sepolicy: Add rules for non-init namespaces In kernel 4.7, the capability and capability2 classes were split apart from cap_userns and cap2_userns (see kernel commit 8e4ff6f228e4722cac74db716e308d1da33d744f). Since then, Android cannot be run in a container with SELinux in enforcing mode. This change applies the existing capability rules to user namespaces as well as the root namespace so that Android running in a container behaves the same on pre- and post-4.7 kernels. This is essentially: 1. New global_capability_class_set and global_capability2_class_set that match capability+cap_userns and capability2+cap2_userns, respectively. 2. s/self:capability/self:global_capability_class_set/g 3. s/self:capability2/self:global_capability2_class_set/g 4. Add cap_userns and cap2_userns to the existing capability_class_set so that it covers all capabilities. This set was used by several neverallow and dontaudit rules, and I confirmed that the new classes are still appropriate. Test: diff new policy against old and confirm that all new rules add only cap_userns or cap2_userns; Boot ARC++ on a device with the 4.12 kernel. Bug: crbug.com/754831 Change-Id: I4007eb3a2ecd01b062c4c78d9afee71c530df95f
2017-11-09 23:51:26 +01:00
allow wificond self:global_capability_class_set { net_admin net_raw };
Allow wificond to set interfaces up and down This is apparently a privileged ioctl. Being able to do this allows us to no longer kill hostapd with SIGTERM, since we can cleanup after hard stops. Bug: 31023120 Test: wificond unit and integration tests pass Change-Id: Icdf2469d403f420c742871f54b9fb17432805991 (cherry picked from commit ca7b04ba525a61cb8663e5e6faf52bfcdb80dde8)
2016-08-23 02:47:13 +02:00
# allow wificond to speak to nl80211 in the kernel
Enforce ioctl command whitelisting on all sockets Remove the ioctl permission for most socket types. For others, such as tcp/udp/rawip/unix_dgram/unix_stream set a default unprivileged whitelist that individual domains may extend (except where neverallowed like untrusted_app). Enforce via a neverallowxperm rule. Change-Id: I15548d830f8eff1fd4d64005c5769ca2be8d4ffe
2016-05-17 06:12:17 +02:00
allow wificond self:netlink_socket create_socket_perms_no_ioctl;
Fix wificond permissions for hikey Newer kernels apparently introduce a new SELinux label "netlink_generic_socket". AOSP is missing some patches for ioctl whitelisting and it was suggested we add unpriv_socket_ioctls as a stopgap. Bug: 31226503 Change-Id: Ie4dd499925f74747c0247e5d7ad0de0f673b5ed2
2016-09-01 02:46:42 +02:00
# newer kernels (e.g. 4.4 but not 4.1) have a new class for sockets
Enforce ioctl command whitelisting on all sockets Remove the ioctl permission for most socket types. For others, such as tcp/udp/rawip/unix_dgram/unix_stream set a default unprivileged whitelist that individual domains may extend (except where neverallowed like untrusted_app). Enforce via a neverallowxperm rule. Change-Id: I15548d830f8eff1fd4d64005c5769ca2be8d4ffe
2016-05-17 06:12:17 +02:00
allow wificond self:netlink_generic_socket create_socket_perms_no_ioctl;
Allow wificond to mark interfaces up and down avc: denied { create } for scontext=u:r:wificond:s0 tcontext=u:r:wificond:s0 tclass=udp_socket permissive=0 avc: denied { net_raw } for capability=13 scontext=u:r:wificond:s0 tcontext=u:r:wificond:s0 tclass=capability permissive=0 avc: denied { read } for name="psched" dev="proc" ino=4026535377 scontext=u:r:wificond:s0 tcontext=u:object_r:proc_net:s0 tclass=file permissive=0 Test: fixes above avc denials Bug: 29579539 Change-Id: Ie1dff80103e81cfba8064a22b5dd3e1e8f29471b (cherry picked from commit b6a6561d0ef37ad86802ef1ceeefc59a42612435)
2016-07-01 02:48:12 +02:00
r_dir_file(wificond, proc_net)
Allow wificond to write wifi component config files We need the ability to set file permissions, create files, write files, chown files. Test: integration tests that start/stop hostapd and write its config file via wificond pass without SELinux denials. Bug: 30040724 Change-Id: Iee15fb36a6a4a89009d4b45281060379d70cd53c (cherry picked from commit f83da1421b38b021d9c0b829e791c84a1c6d9e1e)
2016-07-21 18:12:28 +02:00
# wificond writes out configuration files for wpa_supplicant/hostapd.
Allow wificond to drop signals on hostapd Stopping hostapd abruptly with SIGKILL can sometimes leave the driver in a poor state. Long term, we should pro-actively go in and clean up the driver. In the short term, it helps tremendously to send SIGTERM and give hostapd time to clean itself up. Bug: 30311493 Test: With patches in this series, wificond can cleanly start and stop hostapd in integration tests. Change-Id: Ic770c2fb1a1b636fced4620fe6e24d1c8dcdfeb8 (cherry picked from commit 762cb7c4aaa1d20309edbb07c932ae12669506a5)
2016-07-29 19:26:54 +02:00
# wificond also reads pid files out of this directory
Allow wificond to write wifi component config files We need the ability to set file permissions, create files, write files, chown files. Test: integration tests that start/stop hostapd and write its config file via wificond pass without SELinux denials. Bug: 30040724 Change-Id: Iee15fb36a6a4a89009d4b45281060379d70cd53c (cherry picked from commit f83da1421b38b021d9c0b829e791c84a1c6d9e1e)
2016-07-21 18:12:28 +02:00
allow wificond wifi_data_file:dir rw_dir_perms;
allow wificond wifi_data_file:file create_file_perms;
Allow wificond to drop privileges after startup wificond will now change user/group to wifi/wifi after taking control of a particular path in the sysfs. Bug: 29870863 Change-Id: I9ccb23f60a66d6850f3969c364288f8850044fed Test: wificond unit and integration tests pass (cherry picked from commit 8a04a3138af98e95a9037b8cecbf68d08ea4df8b)
2016-08-23 02:47:36 +02:00
Allow wificond to find permission This is used for wificond to check if it is allowed to dump logs. Bug: 31336376 Test: compile, manual test Change-Id: I8a1b681255398f9a1f2cf79fd0891e58283aa747
2017-04-05 01:52:25 +02:00
# allow wificond to check permission for dumping logs
allow wificond permission_service:service_manager find;
dumpstate: Fix wificond access Bug: 31246864 Change-Id: I8319e632b3be1e558dfc550453b8298914c89064 Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2016-09-07 22:58:04 +02:00
# dumpstate support
allow wificond dumpstate:fd use;
Enforce ioctl command whitelisting on all sockets Remove the ioctl permission for most socket types. For others, such as tcp/udp/rawip/unix_dgram/unix_stream set a default unprivileged whitelist that individual domains may extend (except where neverallowed like untrusted_app). Enforce via a neverallowxperm rule. Change-Id: I15548d830f8eff1fd4d64005c5769ca2be8d4ffe
2016-05-17 06:12:17 +02:00
allow wificond dumpstate:fifo_file write;
Reference in a new issue Copy permalink