tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/bluetooth.te

88 lines
3.3 KiB
Text
Raw Normal View History

bluetooth: Remove domain_deprecated Remove domain_deprecated from bluetooth. This removes some unnecessarily permissive rules. Bug: 25433265 Test: All of the permissions being removed were being audited. Verify that no audited (granted) avc messages for bluetooth exist in in the logs. Change-Id: Ifa12a0f1533edcb623bbb9631f88f1ff1d6d7085
2017-04-13 16:51:36 +02:00
# bluetooth app
Move bluetooth policy to private This leaves only the existence of bluetooth domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules to do with bluetooth_current except those created by other domains' allow rules referencing bluetooth domain from public and vendor policy. Bug: 31364497 Change-Id: I3521b74a1a9f6c5a5766b358e944dc5444e3c536
2017-02-07 00:27:19 +01:00
Make cross-user apps mlstrustedsubject. We have various apps which inherently work across all users, configured in seapp_contexts with levelFrom=None (usually implicitly). This change marks those apps, where they have private data files, as mlstrustedsubject, to allow us to increase restrictions on cross-user access without breaking them. Currently these apps are granted full access to [priv_]app__data_file via TE rules, but are blocked from calling open (etc) by mls rules (they don't have a matching level). This CL changes things round so they are granted access by mls, but blocked from calling open by TE rules; the overall effect is thus the same - they do not have access. A neverallow rule is added to ensure this remains true. Note that there are various vendor apps which are appdomain, levelFrom=None; they will also need modified policy. Test: builds, boots, no new denials. Bug: 141677108 Change-Id: Ic14f24ec6e8cbfda7a775adf0c350b406d3a197e
2020-02-11 15:43:05 +01:00
typeattribute bluetooth coredomain, mlstrustedsubject;
Move bluetooth policy to private This leaves only the existence of bluetooth domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules to do with bluetooth_current except those created by other domains' allow rules referencing bluetooth domain from public and vendor policy. Bug: 31364497 Change-Id: I3521b74a1a9f6c5a5766b358e944dc5444e3c536
2017-02-07 00:27:19 +01:00
app_domain(bluetooth)
net_domain(bluetooth)
Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c
2016-07-22 22:13:11 +02:00
# Socket creation under /data/misc/bluedroid.
type_transition bluetooth bluetooth_data_file:sock_file bluetooth_socket;
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
Move bluetooth policy to private This leaves only the existence of bluetooth domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules to do with bluetooth_current except those created by other domains' allow rules referencing bluetooth domain from public and vendor policy. Bug: 31364497 Change-Id: I3521b74a1a9f6c5a5766b358e944dc5444e3c536
2017-02-07 00:27:19 +01:00
# Allow access to net_admin ioctls
allowxperm bluetooth self:udp_socket ioctl priv_sock_ioctls;
wakelock_use(bluetooth);
# Data file accesses.
allow bluetooth bluetooth_data_file:dir create_dir_perms;
allow bluetooth bluetooth_data_file:notdevfile_class_set create_file_perms;
allow bluetooth bluetooth_logs_data_file:dir rw_dir_perms;
allow bluetooth bluetooth_logs_data_file:file create_file_perms;
# Socket creation under /data/misc/bluedroid.
allow bluetooth bluetooth_socket:sock_file create_file_perms;
sepolicy: Add rules for non-init namespaces In kernel 4.7, the capability and capability2 classes were split apart from cap_userns and cap2_userns (see kernel commit 8e4ff6f228e4722cac74db716e308d1da33d744f). Since then, Android cannot be run in a container with SELinux in enforcing mode. This change applies the existing capability rules to user namespaces as well as the root namespace so that Android running in a container behaves the same on pre- and post-4.7 kernels. This is essentially: 1. New global_capability_class_set and global_capability2_class_set that match capability+cap_userns and capability2+cap2_userns, respectively. 2. s/self:capability/self:global_capability_class_set/g 3. s/self:capability2/self:global_capability2_class_set/g 4. Add cap_userns and cap2_userns to the existing capability_class_set so that it covers all capabilities. This set was used by several neverallow and dontaudit rules, and I confirmed that the new classes are still appropriate. Test: diff new policy against old and confirm that all new rules add only cap_userns or cap2_userns; Boot ARC++ on a device with the 4.12 kernel. Bug: crbug.com/754831 Change-Id: I4007eb3a2ecd01b062c4c78d9afee71c530df95f
2017-11-09 23:51:26 +01:00
allow bluetooth self:global_capability_class_set net_admin;
allow bluetooth self:global_capability2_class_set wake_alarm;
Move bluetooth policy to private This leaves only the existence of bluetooth domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules to do with bluetooth_current except those created by other domains' allow rules referencing bluetooth domain from public and vendor policy. Bug: 31364497 Change-Id: I3521b74a1a9f6c5a5766b358e944dc5444e3c536
2017-02-07 00:27:19 +01:00
# tethering
allow bluetooth self:packet_socket create_socket_perms_no_ioctl;
sepolicy: Add rules for non-init namespaces In kernel 4.7, the capability and capability2 classes were split apart from cap_userns and cap2_userns (see kernel commit 8e4ff6f228e4722cac74db716e308d1da33d744f). Since then, Android cannot be run in a container with SELinux in enforcing mode. This change applies the existing capability rules to user namespaces as well as the root namespace so that Android running in a container behaves the same on pre- and post-4.7 kernels. This is essentially: 1. New global_capability_class_set and global_capability2_class_set that match capability+cap_userns and capability2+cap2_userns, respectively. 2. s/self:capability/self:global_capability_class_set/g 3. s/self:capability2/self:global_capability2_class_set/g 4. Add cap_userns and cap2_userns to the existing capability_class_set so that it covers all capabilities. This set was used by several neverallow and dontaudit rules, and I confirmed that the new classes are still appropriate. Test: diff new policy against old and confirm that all new rules add only cap_userns or cap2_userns; Boot ARC++ on a device with the 4.12 kernel. Bug: crbug.com/754831 Change-Id: I4007eb3a2ecd01b062c4c78d9afee71c530df95f
2017-11-09 23:51:26 +01:00
allow bluetooth self:global_capability_class_set { net_admin net_raw net_bind_service };
Move bluetooth policy to private This leaves only the existence of bluetooth domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules to do with bluetooth_current except those created by other domains' allow rules referencing bluetooth domain from public and vendor policy. Bug: 31364497 Change-Id: I3521b74a1a9f6c5a5766b358e944dc5444e3c536
2017-02-07 00:27:19 +01:00
allow bluetooth self:tun_socket create_socket_perms_no_ioctl;
allow bluetooth tun_device:chr_file rw_file_perms;
bluetooth: allow TUNGETIFF TUNSETIFF system/sepolicy commit 619c1ef2ac581fe6a3d628ee013fc3ec36b8dc07 started enforcing ioctl whitelisting requirements for /dev/tun. Bluetooth needs the ability to issue TUNSETIFF on /dev/tun, so allow access. We also allow access to TUNGETIFF for good measure. Addresses the following denial: avc: denied { ioctl } for comm=425420536572766963652043616C6C path="/dev/tun" dev="tmpfs" ino=20047 ioctlcmd=0x54ca scontext=u:r:bluetooth:s0 tcontext=u:object_r:tun_device:s0 tclass=chr_file permissive=0 Test: policy compiles Change-Id: Ie4c138fc774373cec266c59de6663db147d60423
2018-11-10 18:03:10 +01:00
allowxperm bluetooth tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF };
Move bluetooth policy to private This leaves only the existence of bluetooth domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules to do with bluetooth_current except those created by other domains' allow rules referencing bluetooth domain from public and vendor policy. Bug: 31364497 Change-Id: I3521b74a1a9f6c5a5766b358e944dc5444e3c536
2017-02-07 00:27:19 +01:00
allow bluetooth efs_file:dir search;
Allow Bluetooth process to access /dev/uhid in SELinux Policy Bug: 37476041 Test: make, pair and connect to HID device Change-Id: Ic7e81382994769e3f3a91255dcf3624edeaf6bfd
2017-04-19 03:06:41 +02:00
# allow Bluetooth to access uhid device for HID profile
allow bluetooth uhid_device:chr_file rw_file_perms;
Move bluetooth policy to private This leaves only the existence of bluetooth domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules to do with bluetooth_current except those created by other domains' allow rules referencing bluetooth domain from public and vendor policy. Bug: 31364497 Change-Id: I3521b74a1a9f6c5a5766b358e944dc5444e3c536
2017-02-07 00:27:19 +01:00
# proc access.
allow bluetooth proc_bluetooth_writable:file rw_file_perms;
# Allow write access to bluetooth specific properties
Support for more binder caches Bug: 140788621 This adds keys for several planned binder caches in the system server and in the bluetooth server. The actual cache code is not in this tree. Test: created a test build that contains the actual cache code and ran some system tests. Verified that no protection issues were seen. Change-Id: Ibaccb0c0ff8b127d14cf769ea4156f7d8b024bc1
2020-01-17 19:06:16 +01:00
set_prop(bluetooth, binder_cache_bluetooth_server_prop);
neverallow { domain -bluetooth -init }
binder_cache_bluetooth_server_prop:property_service set;
Whitelist vendor-init-settable bluetooth_prop and wifi_prop Values of the following properties are set by SoC vendors on some devices including Pixels. - persist.bluetooth.a2dp_offload.cap - persist.bluetooth.a2dp_offload.enable - persist.vendor.bluetooth.a2dp_offload.enable - ro.bt.bdaddr_path - wlan.driver.status So they should be whitelisted for compatibility. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: Ib2b81bcc1fd70ddd571dc7fb2b923b576d62b7d5
2018-04-09 05:07:32 +02:00
set_prop(bluetooth, bluetooth_a2dp_offload_prop)
Add rules for accessing the related bluetooth_audio_hal_prop This change allows those daemons of the audio and Bluetooth which include HALs to access the bluetooth_audio_hal_prop. This property is used to force disable the new BluetoothAudio HAL. - persist.bluetooth.bluetooth_audio_hal.disabled Bug: 128825244 Test: audio HAL can access the property Change-Id: I87a8ba57cfbcd7d3e4548aa96bc915d0cc6b2b74
2019-03-18 04:07:32 +01:00
set_prop(bluetooth, bluetooth_audio_hal_prop)
Move bluetooth policy to private This leaves only the existence of bluetooth domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules to do with bluetooth_current except those created by other domains' allow rules referencing bluetooth domain from public and vendor policy. Bug: 31364497 Change-Id: I3521b74a1a9f6c5a5766b358e944dc5444e3c536
2017-02-07 00:27:19 +01:00
set_prop(bluetooth, bluetooth_prop)
Whitelist vendor-init-settable bluetooth_prop and wifi_prop Values of the following properties are set by SoC vendors on some devices including Pixels. - persist.bluetooth.a2dp_offload.cap - persist.bluetooth.a2dp_offload.enable - persist.vendor.bluetooth.a2dp_offload.enable - ro.bt.bdaddr_path - wlan.driver.status So they should be whitelisted for compatibility. Bug: 77633703 Test: succeeded building and tested with Pixels Change-Id: Ib2b81bcc1fd70ddd571dc7fb2b923b576d62b7d5
2018-04-09 05:07:32 +02:00
set_prop(bluetooth, exported_bluetooth_prop)
Move bluetooth policy to private This leaves only the existence of bluetooth domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules to do with bluetooth_current except those created by other domains' allow rules referencing bluetooth domain from public and vendor policy. Bug: 31364497 Change-Id: I3521b74a1a9f6c5a5766b358e944dc5444e3c536
2017-02-07 00:27:19 +01:00
set_prop(bluetooth, pan_result_prop)
allow bluetooth audioserver_service:service_manager find;
allow bluetooth bluetooth_service:service_manager find;
allow bluetooth drmserver_service:service_manager find;
allow bluetooth mediaserver_service:service_manager find;
allow bluetooth radio_service:service_manager find;
allow bluetooth app_api_service:service_manager find;
allow bluetooth system_api_service:service_manager find;
Fix permissions for bluetooth tethering. Allow bluetooth to find the NetworkStack service so tethering can be started. Test: booted, BT tethering obtains IP address and denials not shown Bug: b/112869080 Change-Id: I726d818f4f9a9adcd98c834726ed22376076ac7b
2019-01-13 07:41:48 +01:00
allow bluetooth network_stack_service:service_manager find;
Allow Bluetooth to access SystemSuspend control service This allows the Bluetooth to communicate with the SystemSuspend to obtain system wakeup and wakelock information for Bluetooth activity attribution (BTAA) processing. BTAA is a process unit within the Bluetooth stack to aggregate Bluetooth traffics, wakeup, and wakelocks into per-app, per-device, and activity based statistical information. Test: Local test verified Bluetooth can acquire suspend_control Bug: 170315554 Change-Id: I7417132793c1000a8e3136c300cf8c1ba9cc3a14
2020-10-14 02:31:01 +02:00
allow bluetooth system_suspend_control_service:service_manager find;
Move bluetooth policy to private This leaves only the existence of bluetooth domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules to do with bluetooth_current except those created by other domains' allow rules referencing bluetooth domain from public and vendor policy. Bug: 31364497 Change-Id: I3521b74a1a9f6c5a5766b358e944dc5444e3c536
2017-02-07 00:27:19 +01:00
# already open bugreport file descriptors may be shared with
# the bluetooth process, from a file in
# /data/data/com.android.shell/files/bugreports/bugreport-*.
allow bluetooth shell_data_file:file read;
Allow Bluetooth sys_nice and system_server setsched for Bluetooth HAL Bluetooth needs the capability to set audio-related threads to be RT scheduled. Grant it sys_nice. system_server needs to set priority for the Bluetooth HAL. Allow it. Bug 37518404 Test: Play Bluetooth audio, confirm RT scheduling with systrace Change-Id: Iaf7b85a11a51883744d72a50addfd320b6fbbc2f
2017-03-23 18:03:49 +01:00
# Bluetooth audio needs RT scheduling to meet deadlines, allow sys_nice
sepolicy: Add rules for non-init namespaces In kernel 4.7, the capability and capability2 classes were split apart from cap_userns and cap2_userns (see kernel commit 8e4ff6f228e4722cac74db716e308d1da33d744f). Since then, Android cannot be run in a container with SELinux in enforcing mode. This change applies the existing capability rules to user namespaces as well as the root namespace so that Android running in a container behaves the same on pre- and post-4.7 kernels. This is essentially: 1. New global_capability_class_set and global_capability2_class_set that match capability+cap_userns and capability2+cap2_userns, respectively. 2. s/self:capability/self:global_capability_class_set/g 3. s/self:capability2/self:global_capability2_class_set/g 4. Add cap_userns and cap2_userns to the existing capability_class_set so that it covers all capabilities. This set was used by several neverallow and dontaudit rules, and I confirmed that the new classes are still appropriate. Test: diff new policy against old and confirm that all new rules add only cap_userns or cap2_userns; Boot ARC++ on a device with the 4.12 kernel. Bug: crbug.com/754831 Change-Id: I4007eb3a2ecd01b062c4c78d9afee71c530df95f
2017-11-09 23:51:26 +01:00
allow bluetooth self:global_capability_class_set sys_nice;
Allow Bluetooth sys_nice and system_server setsched for Bluetooth HAL Bluetooth needs the capability to set audio-related threads to be RT scheduled. Grant it sys_nice. system_server needs to set priority for the Bluetooth HAL. Allow it. Bug 37518404 Test: Play Bluetooth audio, confirm RT scheduling with systrace Change-Id: Iaf7b85a11a51883744d72a50addfd320b6fbbc2f
2017-03-23 18:03:49 +01:00
Switch Bluetooth HAL policy to _client/_server This switches Bluetooth HAL policy to the design which enables us to conditionally remove unnecessary rules from domains which are clients of Bluetooth HAL. Domains which are clients of Bluetooth HAL, such as bluetooth domain, are granted rules targeting hal_bluetooth only when the Bluetooth HAL runs in passthrough mode (i.e., inside the client's process). When the HAL runs in binderized mode (i.e., in another process/domain, with clients talking to the HAL over HwBinder IPC), rules targeting hal_bluetooth are not granted to client domains. Domains which offer a binderized implementation of Bluetooth HAL, such as hal_bluetooth_default domain, are always granted rules targeting hal_bluetooth. Test: Toggle Bluetooth off and on Test: Pair with another Android, and transfer a file to that Android over Bluetooth Test: Pair with a Bluetooth speaker, play music through that speaker over Bluetooth Test: Add bluetooth_hidl_hal_test to device.mk, build & add to device, adb shell stop, adb shell /data/nativetest64/bluetooth_hidl_hal_test/bluetooth_hidl_hal_test Bug: 34170079 Change-Id: I05c3ccf1e98cbbc1450a81bb1000c4fb75eb8a83
2017-02-17 05:14:56 +01:00
hal_client_domain(bluetooth, hal_bluetooth)
Annotate most remaining HALs with _client/_server This switches most remaining HALs to the _client/_server approach. To unblock efforts blocked on majority of HALs having to use this model, this change does not remove unnecessary rules from clients of these HALs. That work will be performed in follow-up commits. This commit only adds allow rules and thus does not break existing functionality. The HALs not yet on the _client/_server model after this commit are: * Allocator HAL, because it's non-trivial to declare all apps except isolated apps as clients of this HAL, which they are. * Boot HAL, because it's still on the non-attributized model and I'm waiting for update_engine folks to answer a couple of questions which will let me refactor the policy of this HAL. Test: mmm system/sepolicy Test: Device boots, no new denials Test: Device boots in recovery mode, no new denials Bug: 34170079 Change-Id: I03e6bcec2fa02f14bdf17d11f7367b62c68a14b9
2017-03-17 02:48:40 +01:00
hal_client_domain(bluetooth, hal_telephony)
Move bluetooth policy to private This leaves only the existence of bluetooth domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules to do with bluetooth_current except those created by other domains' allow rules referencing bluetooth domain from public and vendor policy. Bug: 31364497 Change-Id: I3521b74a1a9f6c5a5766b358e944dc5444e3c536
2017-02-07 00:27:19 +01:00
Bluetooth A2DP offload: Binder call to audio HAL Add rule to allow Binder call from Bluetooth process to Bluetooth audio HIDL interface running in audio HAL service process. Bug: 72242910 Test: Manual; TestTracker/148125 Change-Id: I1981a78bece10b8e516f218d3edde8b77943d130 (cherry picked from commit e8cfac90e8bf14466b6431a21bc5ccd4bf6ca3ea)
2017-10-30 20:58:20 +01:00
# Bluetooth A2DP offload requires binding with audio HAL
hal_client_domain(bluetooth, hal_audio)
Move bluetooth policy to private This leaves only the existence of bluetooth domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules to do with bluetooth_current except those created by other domains' allow rules referencing bluetooth domain from public and vendor policy. Bug: 31364497 Change-Id: I3521b74a1a9f6c5a5766b358e944dc5444e3c536
2017-02-07 00:27:19 +01:00
read_runtime_log_tags(bluetooth)
###
### Neverallow rules
###
### These are things that the bluetooth app should NEVER be able to do
###
# Superuser capabilities.
Allow Bluetooth sys_nice and system_server setsched for Bluetooth HAL Bluetooth needs the capability to set audio-related threads to be RT scheduled. Grant it sys_nice. system_server needs to set priority for the Bluetooth HAL. Allow it. Bug 37518404 Test: Play Bluetooth audio, confirm RT scheduling with systrace Change-Id: Iaf7b85a11a51883744d72a50addfd320b6fbbc2f
2017-03-23 18:03:49 +01:00
# Bluetooth requires net_{admin,raw,bind_service} and wake_alarm and block_suspend and sys_nice.
sepolicy: Add rules for non-init namespaces In kernel 4.7, the capability and capability2 classes were split apart from cap_userns and cap2_userns (see kernel commit 8e4ff6f228e4722cac74db716e308d1da33d744f). Since then, Android cannot be run in a container with SELinux in enforcing mode. This change applies the existing capability rules to user namespaces as well as the root namespace so that Android running in a container behaves the same on pre- and post-4.7 kernels. This is essentially: 1. New global_capability_class_set and global_capability2_class_set that match capability+cap_userns and capability2+cap2_userns, respectively. 2. s/self:capability/self:global_capability_class_set/g 3. s/self:capability2/self:global_capability2_class_set/g 4. Add cap_userns and cap2_userns to the existing capability_class_set so that it covers all capabilities. This set was used by several neverallow and dontaudit rules, and I confirmed that the new classes are still appropriate. Test: diff new policy against old and confirm that all new rules add only cap_userns or cap2_userns; Boot ARC++ on a device with the 4.12 kernel. Bug: crbug.com/754831 Change-Id: I4007eb3a2ecd01b062c4c78d9afee71c530df95f
2017-11-09 23:51:26 +01:00
neverallow bluetooth self:global_capability_class_set ~{ net_admin net_raw net_bind_service sys_nice};
neverallow bluetooth self:global_capability2_class_set ~{ wake_alarm block_suspend };
Reference in a new issue Copy permalink