tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/property_contexts

107 lines
4.5 KiB
Text
Raw Normal View History

Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
##########################
# property service keys
#
#
Align SELinux property policy with init property_perms. Introduce a net_radio_prop type for net. properties that can be set by radio or system. Introduce a system_radio_prop type for sys. properties that can be set by radio or system. Introduce a dhcp_prop type for properties that can be set by dhcp or system. Drop the rild_prop vs radio_prop distinction; this was an early experiment to see if we could separate properties settable by rild versus other radio UID processes but it did not pan out. Remove the ability to set properties from unconfineddomain. Allow init to set any property. Allow recovery to set ctl_default_prop to restart adbd. Change-Id: I5ccafcb31ec4004dfefcec8718907f6b6f3e0dfd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-19 16:27:02 +02:00
net.rmnet u:object_r:net_radio_prop:s0
net.gprs u:object_r:net_radio_prop:s0
net.ppp u:object_r:net_radio_prop:s0
net.qmi u:object_r:net_radio_prop:s0
net.lte u:object_r:net_radio_prop:s0
net.cdma u:object_r:net_radio_prop:s0
net.dns u:object_r:net_radio_prop:s0
sys.usb.config u:object_r:system_radio_prop:s0
ril. u:object_r:radio_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.ril. u:object_r:radio_prop:s0
Rework the radio vs rild property split. Only label properties with the ril. prefix with rild_prop. Allow rild and system (and radio) to set radio_prop. Only rild can set rild_prop presently.
2012-04-04 22:01:19 +02:00
gsm. u:object_r:radio_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
persist.radio u:object_r:radio_prop:s0
net. u:object_r:system_prop:s0
dev. u:object_r:system_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.runtime. u:object_r:system_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
hw. u:object_r:system_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.hw. u:object_r:system_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
sys. u:object_r:system_prop:s0
Allow cppreopts to work with selinux (cherry picked from commit d3edd6b577c1e40834af69420bd77b60c359ef8e) Bug: 29278988 Change-Id: I199572377a6b5c33116c718a545159ddcf50df30
2016-06-23 00:47:09 +02:00
sys.cppreopt u:object_r:cppreopt_prop:s0
Enable SELinux on vold This change enables SELinux security enforcement on vold. For the vold.te file ONLY, this change is conceptually a revert of 77d4731e9d30c8971e076e2469d6957619019921 and 50e37b93ac97631dcac6961285b92af5026557af, with the following additional changes: 1) Removal of "allow vold proc:file write;" and "allow vold self:capability { sys_boot };". As of system/vold change adfba3626e76c1931649634275d241b226cd1b9a, vold no longer performs it's own reboots, so these capabilities are no longer needed. 2) Addition of the powerctl property, which vold contacts to tell init to reboot. 3) Removal of "allow vold kernel:system module_request;". As of CTS commit f2cfdf5c057140d9442fcfeb4e4a648e8258b659, Android devices no longer ship with loadable modules, hence we don't require this rule. 4) Removal of "fsetid" from "self:capability". Any setuid / setgid bits SHOULD be cleared if vold is able to change the permissions of files. IMHO, it was a mistake to ever include this capability in the first place. Testing: As much as possible, I've tested filesystem related functionality, including factory reset and device encryption. I wasn't able to test fstrim functionality, which is a fairly new feature. I didn't see any policy denials in dmesg. It's quite possible I've missed something. If we experience problems, I happy to roll back this change. Bug: 9629920 Change-Id: I683afa0dffe9f28952287bfdb7ee4e0423c2e97a
2013-06-29 05:15:37 +02:00
sys.powerctl u:object_r:powerctl_prop:s0
allow adbd to set sys.usb.ffs.ready Needed for https://android-review.googlesource.com/147730 Change-Id: Iceb87f210e4c5d0f39426cc6c96a216a4644eaa9
2015-04-24 04:42:25 +02:00
sys.usb.ffs. u:object_r:ffs_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
service. u:object_r:system_prop:s0
Align SELinux property policy with init property_perms. Introduce a net_radio_prop type for net. properties that can be set by radio or system. Introduce a system_radio_prop type for sys. properties that can be set by radio or system. Introduce a dhcp_prop type for properties that can be set by dhcp or system. Drop the rild_prop vs radio_prop distinction; this was an early experiment to see if we could separate properties settable by rild versus other radio UID processes but it did not pan out. Remove the ability to set properties from unconfineddomain. Allow init to set any property. Allow recovery to set ctl_default_prop to restart adbd. Change-Id: I5ccafcb31ec4004dfefcec8718907f6b6f3e0dfd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-19 16:27:02 +02:00
dhcp. u:object_r:dhcp_prop:s0
Allow Bluetooth app to initiate DHCP service on bt-pan interface. bug:15407087 Change-Id: I3dea9c1110583f11f093d048455a1cc739d05658
2014-06-18 15:20:36 +02:00
dhcp.bt-pan.result u:object_r:pan_result_prop:s0
SELinux policy for Bluetooth properties. Properties under bluetooth. and persist.service.bdroid. are considered Bluetooth-related properties. Change-Id: Iee937d9a1184c2494deec46f9ed7090c643acda7
2013-05-06 19:18:27 +02:00
bluetooth. u:object_r:bluetooth_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
Give system_server / system_app ability to write some properties Allow writing to persist.sys and debug. This addresses the following denials (which are actually being enforced): <4>[ 131.700473] avc: denied { set } for property=debug.force_rtl scontext=u:r:system_server:s0 tcontext=u:object_r:shell_prop:s0 tclass=property_service <3>[ 131.700625] init: sys_prop: permission denied uid:1000 name:debug.force_rtl <4>[ 132.630062] avc: denied { set } for property=persist.sys.dalvik.vm.lib scontext=u:r:system_app:s0 tcontext=u:object_r:system_prop:s0 tclass=property_service <3>[ 132.630184] init: sys_prop: permission denied uid:1000 name:persist.sys.dalvik.vm.lib Change-Id: I5d114c0d963bf393f49f1bf13d1ed84137fbcca6
2013-11-01 18:45:03 +01:00
debug. u:object_r:debug_prop:s0
debuggerd: Allow "debug.db.uid" usage Allow the use of debug.db.uid on userdebug / eng builds. Setting this property allows debuggerd to suspend a process if it detects a crash. Make debug.db.uid only accessible to the su domain. This should not be used on a user build. Only support reading user input on userdebug / eng builds. Steps to reproduce with the "crasher" program: adb root adb shell setprop debug.db.uid 20000 mmm system/core/debuggerd adb sync adb shell crasher Addresses the following denials: <5>[ 580.637442] type=1400 audit(1392412124.612:149): avc: denied { read } for pid=182 comm="debuggerd" name="input" dev="tmpfs" ino=5665 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=dir <5>[ 580.637589] type=1400 audit(1392412124.612:150): avc: denied { open } for pid=182 comm="debuggerd" name="input" dev="tmpfs" ino=5665 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=dir <5>[ 580.637706] type=1400 audit(1392412124.612:151): avc: denied { read write } for pid=182 comm="debuggerd" name="event5" dev="tmpfs" ino=6723 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=chr_file <5>[ 580.637823] type=1400 audit(1392412124.612:152): avc: denied { open } for pid=182 comm="debuggerd" name="event5" dev="tmpfs" ino=6723 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=chr_file <5>[ 580.637958] type=1400 audit(1392412124.612:153): avc: denied { ioctl } for pid=182 comm="debuggerd" path="/dev/input/event5" dev="tmpfs" ino=6723 scontext=u:r:debuggerd:s0 tcontext=u:object_r:input_device:s0 tclass=chr_file Bug: 12532622 Change-Id: I63486edb73efb1ca12e9eb1994ac9e389251a3f1
2014-02-06 01:36:25 +01:00
debug.db. u:object_r:debuggerd_prop:s0
Increase communication surface between dumpstate and Shell: - Add a new 'dumpstate' context for system properties. This context will be used to share state between dumpstate and Shell. For example, as dumpstate progresses, it will update a system property, which Shell will use to display the progress in the UI as a system notification. The user could also rename the bugreport file, in which case Shell would use another system property to communicate such change to dumpstate. - Allow Shell to call 'ctl.bugreport stop' so the same system notification can be used to stop dumpstate. BUG: 25794470 Change-Id: I74b80bda07292a91358f2eea9eb8444caabc5895
2015-12-02 03:03:05 +01:00
dumpstate. u:object_r:dumpstate_prop:s0
Let system_server writes to dumpstate.options property. Currently, we define 4 hardcoded init services to launch dumpstate with different command-line options (since dumpstate must be launched by root): - bugreport - bugreportplus - bugreportwear - bugreportremote This approach does not scale well; a better option is to have just one service, and let the framework pass the extra arguments through a system property. BUG: 31649719 Test: manual Change-Id: I7ebbb7ce6a0fd3588baca6fd76653f87367ed0e5
2016-09-21 19:44:11 +02:00
dumpstate.options u:object_r:dumpstate_options_prop:s0
limit shell's access to log.* properties Restrict the ability of the shell to set the log.* properties. Namely: only allow the shell to set such properities on eng and userdebug builds. The shell (and other domains) can continue to read log.* properties on all builds. While there: harmonize permissions for log.* and persist.log.tag. Doing so introduces two changes: - log.* is now writable from from |system_app|. This mirrors the behavior of persist.log.tag, which is writable to support "Developer options" -> "Logger buffer sizes" -> "Off". (Since this option is visible on user builds, the permission is enabled for all builds.) - persist.log.tag can now be set from |shell| on userdebug_or_eng(). BUG=28221972 TEST=manual (see below) Testing details - user build (log.tag) $ adb shell setprop log.tag.foo V $ adb shell getprop log.tag <blank line> $ adb bugreport | grep log.tag.foo [ 146.525836] init: avc: denied { set } for property=log.tag.foo pid=4644 uid=2000 gid=2000 scontext=u:r:shell:s0 tcontext=u:object_r:log_prop:s0 tclass=property_service permissive=0 [ 146.525878] init: sys_prop: permission denied uid:2000 name:log.tag.foo - userdebug build (log.tag) $ adb shell getprop log.tag.foo <blank line> $ adb shell setprop log.tag.foo V $ adb shell getprop log.tag.foo V - user build (persist.log.tag) $ adb shell getprop | grep log.tag <no match> - Developer options -> Logger buffer sizes -> Off $ adb shell getprop | grep log.tag [persist.log.tag]: [Settings] [persist.log.tag.snet_event_log]: [I] Change-Id: Idf00e7a623723a7c46bf6d01e386aeca92b2ad75
2016-04-15 20:10:06 +02:00
log. u:object_r:log_prop:s0
Regression for log.tag properties Allow log.tag and persist.log.tag as log_tag_prop Bug: 28942894 Change-Id: I05766b99b9535a79a39adc55cad004decd52956e
2016-06-06 21:10:00 +02:00
log.tag u:object_r:log_tag_prop:s0
allow system server to set log.tag.WifiHAL On eng and userdebug builds (only), allow system server to change the value of log.tag.WifiHAL. WifiStateMachine will set this property to 'D' by default. If/when a user enables "Developer options -> Enable Wi-Fi Verbose Logging", WifiStateMachine change log.tag.WifiHAL to 'V'. BUG=27857554 TEST=manual (see below) Test detail 1. on user build: $ adb shell setprop log.tag.WifiHAL V $ adb shell getprop log.tag.WifiHAL <blank line> $ adb bugreport | grep log.tag.WifiHAL <11>[ 141.918517] init: avc: denied { set } for property=log.tag.WifiHAL pid=4583 uid=2000 gid=2000 scontext=u:r:shell:s0 tcontext=u:object_r:wifi_log_prop:s0 tclass=property_service permissive=0 <11>[ 141.918566] init: sys_prop: permission denied uid:2000 name:log.tag.WifiHAL 2. on userdebug build: $ adb shell getprop log.tag.WifiHAL $ <blank line> $ adb shell setprop log.tag.WifiHAL V $ adb shell getprop log.tag.WifiHAL V 3. on userdebug build with modified WifiStateMachine: $ adb shell getprop log.tag.WifiHAL D Change-Id: I9cdd52a2b47a3dd1065262ea8c329130b7b044db
2016-04-15 20:10:39 +02:00
log.tag.WifiHAL u:object_r:wifi_log_prop:s0
expose control over unpriv perf access to shell This allows the shell user to control whether unprivileged access to perf events is allowed. To enable unprivileged access to perf: adb shell setprop security.perf_harden 0 To disable it again: adb shell setprop security.perf_harden 1 This allows Android to disable this kernel attack surface by default, while still allowing profiling tools to work automatically. It can also be manually toggled, but most developers won't ever need to do that if tools end up incorporating this. Bug: 29054680 Change-Id: Idcf6a2f6cbb35b405587deced7da1f6749b16a5f
2016-05-31 22:01:08 +02:00
security.perf_harden u:object_r:shell_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
service.adb.root u:object_r:shell_prop:s0
service.adb.tcp.port u:object_r:shell_prop:s0
Label persist audio properties label all persist.audio.* properties and allow mediaserver access to them. Change-Id: If5755d9783dce298e66a25bcb7f17ff17bd83ea7
2012-11-28 02:34:54 +01:00
persist.audio. u:object_r:audio_prop:s0
Allow system apps (Settings) to configure Bluetooth properties Bug: 27078729 Change-Id: I74115521e1def661dea5575eb532b93fe7f1f4ad
2016-02-09 00:39:00 +01:00
persist.bluetooth. u:object_r:bluetooth_prop:s0
Add SELinux settings to support tracing during boot. This CL adds the SELinux settings required to support tracing during boot. https://android-review.googlesource.com/#/c/157163/ BUG: 21739901 Change-Id: Ib3a7107776141ac8cf4f1ca06674f47a0d4b6ae0
2015-06-24 08:24:17 +02:00
persist.debug. u:object_r:persist_debug_prop:s0
selinux: logd Development settings - logd Development Settings failed to access persist.logd.size Change-Id: I0732b44fcbffbf3c187bcb23df2db807fa3e8fde
2014-06-12 21:47:22 +02:00
persist.logd. u:object_r:logd_prop:s0
SELinux rule for ro.device_owner and persist.logd.security They are introduced for the device owner process logging feature. That is, for enterprise-owned devices with device owner app provisioned, the device owner may choose to turn on additional device-wide logging for auditing and intrusion detection purposes. Logging includes histories of app process startup, commands issued over ADB and lockscreen unlocking attempts. These logs will available to the device owner for analysis, potentially shipped to a remote server if it chooses to. ro.device_owner will be a master switch to turn off logging, if the device has no device owner provisioned. persist.logd.security is a switch that device owner can toggle (via DevicePoliyManager) to enable/disable logging. Writing to both properties should be only allowed by the system server. Bug: 22860162 Change-Id: Iabfe2347b094914813b9d6e0c808877c25ccd038
2016-01-04 16:20:45 +01:00
persist.logd.security u:object_r:device_logging_prop:s0
logpersist: reserve persist.logd.logpersistd shell, system_app and logd access granted on debug builds only Bug: 28936216 Change-Id: Ib9648e8565cc0ea0077cf0950b0e4ac6fe0a3135
2016-06-06 21:18:46 +02:00
persist.logd.logpersistd u:object_r:logpersistd_logging_prop:s0
logcatd: trampoline persist.logd.logpersistd to logd.logpersistd Bug: 28936216 Change-Id: I90dc7ca296dc5c9b6d13e7920ebb864981a112b5
2016-07-08 17:41:08 +02:00
logd.logpersistd u:object_r:logpersistd_logging_prop:s0
Regression for log.tag properties Allow log.tag and persist.log.tag as log_tag_prop Bug: 28942894 Change-Id: I05766b99b9535a79a39adc55cad004decd52956e
2016-06-06 21:10:00 +02:00
persist.log.tag u:object_r:log_tag_prop:s0
persist.mmc.* only set in init Bug: 26976972 Change-Id: I0e44bfc6774807a3bd2ba05637a432675d855118
2016-02-04 19:55:43 +01:00
persist.mmc. u:object_r:mmc_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
persist.sys. u:object_r:system_prop:s0
Allow logd.auditd to reboot to safe mode Bug: 26902605 Change-Id: Ica825cf2af74f5624cf4091544bd24bb5482dbe7
2016-02-06 00:42:32 +01:00
persist.sys.safemode u:object_r:safemode_prop:s0
Add ro.sys.safemode property. Bug: 28008032 Change-Id: I29e076ee9c62a0fb3b386f79509935a1961f95e1
2016-03-03 01:14:17 +01:00
ro.sys.safemode u:object_r:safemode_prop:s0
Allow logd.auditd to reboot to safe mode Bug: 26902605 Change-Id: Ica825cf2af74f5624cf4091544bd24bb5482dbe7
2016-02-06 00:42:32 +01:00
persist.sys.audit_safemode u:object_r:safemode_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
persist.service. u:object_r:system_prop:s0
SELinux policy for Bluetooth properties. Properties under bluetooth. and persist.service.bdroid. are considered Bluetooth-related properties. Change-Id: Iee937d9a1184c2494deec46f9ed7090c643acda7
2013-05-06 19:18:27 +02:00
persist.service.bdroid. u:object_r:bluetooth_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
persist.security. u:object_r:system_prop:s0
Add persist.vendor.overlay. to properties Allow the system_server to change. Allow the zygote to read it as well. Test: Have system_server set a property Change-Id: Ie90eec8b733fa7193861026a3a6e0fb0ba5d5318
2016-11-09 21:19:05 +01:00
persist.vendor.overlay. u:object_r:overlay_prop:s0
ro.boot.vendor.overlay. u:object_r:overlay_prop:s0
Assign a label to the ro.boottime.* properties system/core commit 331cf2fb7c16b5b25064f8d2f00284105a9b413f created a number of new properties of the form: [ro.boottime.init]: [5294587604] [ro.boottime.InputEventFind]: [10278767840] [ro.boottime.adbd]: [8359267180] ... These properties were assigned the default_prop SELinux label because a better label did not exist. Properties labeled with the default_prop label are readable to any SELinux domain, which is overly broad. bullhead:/ $ getprop -Z ro.boottime.adbd u:object_r:default_prop:s0 Instead, create a new label for the ro.boottime.* properties so we can apply more fine grain read access control to these properties. bullhead:/ $ getprop -Z ro.boottime.adbd u:object_r:boottime_prop:s0 New SELinux property labels have minimal permissions by default. As a result, after this change, ro.boottime.* properties will only be readable to system_server, bootstat, init (because it manages the property space), and "adb root" (because no SELinux permissions are enforced there). Additional read access can be granted as-needed. This is part of a larger effort to implement fine-grain access control on the properties managed by init. Test: Device boots and no SELinux denials on boot. Change-Id: Ibf981cb81898f4356fdc5c1b6f15dd93c0d6d84d
2016-12-14 04:50:36 +01:00
ro.boottime. u:object_r:boottime_prop:s0
Move policy files Update the file_contexts for the new location of the policy files, as well as update the policy for the management of these types. Change-Id: Idc475901ed437efb325807897e620904f4ff03e9
2013-01-23 23:02:43 +01:00
SELinux rule for ro.device_owner and persist.logd.security They are introduced for the device owner process logging feature. That is, for enterprise-owned devices with device owner app provisioned, the device owner may choose to turn on additional device-wide logging for auditing and intrusion detection purposes. Logging includes histories of app process startup, commands issued over ADB and lockscreen unlocking attempts. These logs will available to the device owner for analysis, potentially shipped to a remote server if it chooses to. ro.device_owner will be a master switch to turn off logging, if the device has no device owner provisioned. persist.logd.security is a switch that device owner can toggle (via DevicePoliyManager) to enable/disable logging. Writing to both properties should be only allowed by the system server. Bug: 22860162 Change-Id: Iabfe2347b094914813b9d6e0c808877c25ccd038
2016-01-04 16:20:45 +01:00
# Boolean property set by system server upon boot indicating
# if device owner is provisioned.
ro.device_owner u:object_r:device_logging_prop:s0
Move policy files Update the file_contexts for the new location of the policy files, as well as update the policy for the management of these types. Change-Id: Idc475901ed437efb325807897e620904f4ff03e9
2013-01-23 23:02:43 +01:00
# selinux non-persistent properties
New "selinux.restorecon" control property. This new property is used as a control verb for running a recursive restorecon at the path contained in the property value. Defines a new label and grants access to vold, which invokes it when mounting private adopted volumes. Bug: 21121357 Change-Id: I8ff12a146e54a505aa5b43a542578891563d647a
2015-06-09 20:01:04 +02:00
selinux.restorecon_recursive u:object_r:restorecon_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
# default property context
* u:object_r:default_prop:s0
# data partition encryption properties
vold. u:object_r:vold_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.crypto. u:object_r:vold_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
allow system_server to set ro.build.fingerprint Some devices leave "ro.build.fingerprint" undefined at build time, since they need to build it from the components at runtime. See https://android.googlesource.com/platform/frameworks/base/+/5568772e8161205b86905d815783505fd3d461d8 for details. Allow system_server to set ro.build.fingerprint Addresses the following denial/error: avc: denied { set } for property=build.fingerprint scontext=u:r:system_server:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service init: sys_prop: permission denied uid:1000 name:ro.build.fingerprint Bug: 18188956 Change-Id: I98b25773904a7be3e3d2926daa82c1d08f9bcc29
2014-11-18 23:36:23 +01:00
# ro.build.fingerprint is either set in /system/build.prop, or is
# set at runtime by system_server.
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.build.fingerprint u:object_r:fingerprint_prop:s0
allow system_server to set ro.build.fingerprint Some devices leave "ro.build.fingerprint" undefined at build time, since they need to build it from the components at runtime. See https://android.googlesource.com/platform/frameworks/base/+/5568772e8161205b86905d815783505fd3d461d8 for details. Allow system_server to set ro.build.fingerprint Addresses the following denial/error: avc: denied { set } for property=build.fingerprint scontext=u:r:system_server:s0 tcontext=u:object_r:default_prop:s0 tclass=property_service init: sys_prop: permission denied uid:1000 name:ro.build.fingerprint Bug: 18188956 Change-Id: I98b25773904a7be3e3d2926daa82c1d08f9bcc29
2014-11-18 23:36:23 +01:00
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
# ctl properties
Replace ctl_default_prop access with explicit service property keys. The ctl_default_prop label is a bit too generic for some of the priveleged domains when describing access rights. Instead, be explicit about which services are being started and stopped by introducing new ctl property keys. Change-Id: I1d0c6f6b3e8bd63da30bd6c7b084da44f063246a Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-02-18 19:24:26 +01:00
ctl.bootanim u:object_r:ctl_bootanim_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
ctl.dumpstate u:object_r:ctl_dumpstate_prop:s0
Replace ctl_default_prop access with explicit service property keys. The ctl_default_prop label is a bit too generic for some of the priveleged domains when describing access rights. Instead, be explicit about which services are being started and stopped by introducing new ctl property keys. Change-Id: I1d0c6f6b3e8bd63da30bd6c7b084da44f063246a Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-02-18 19:24:26 +01:00
ctl.fuse_ u:object_r:ctl_fuse_prop:s0
ctl.mdnsd u:object_r:ctl_mdnsd_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
ctl.ril-daemon u:object_r:ctl_rildaemon_prop:s0
Allow system_app to start bugreport and to create /data/anr/traces.txt. Resolves denials such as: avc: denied { set } for property =ctl.bugreport scontext=u:r:system_app:s0 tcontext=u:object_r:ctl_default_prop:s0 tclass=property_service avc: denied { write } for pid=4415 comm=5369676E616C2043617463686572 name="anr" dev="dm-0" ino=358337 scontext=u:r:system_app:s0 tcontext=u:object_r:anr_data_file:s0 tclass=dir avc: denied { add_name } for pid=4415 comm=5369676E616C2043617463686572 name="traces.txt" scontext=u:r:system_app:s0 tcontext=u:object_r:anr_data_file:s0 tclass=dir avc: denied { create } for pid=4415 comm=5369676E616C2043617463686572 name="traces.txt" scontext=u:r:system_app:s0 tcontext=u:object_r:anr_data_file:s0 tclass=file Change-Id: I71d0ede049136d72f28bdc85d52fcefa2f7d128f Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-03-06 20:47:22 +01:00
ctl.bugreport u:object_r:ctl_bugreport_prop:s0
Create context for ctl.console (cherry picked from commit c2e31a77825b4b404549396f5bcf1834d6ab0d3a) Change-Id: I92218709fa8cdb71c0369aca8fdd7922df45f7d0
2015-04-24 23:39:16 +02:00
ctl.console u:object_r:ctl_console_prop:s0
Add policy for property service. New property_contexts file for property selabel backend. New property.te file with property type declarations. New property_service security class and set permission. Allow rules for setting properties.
2012-04-04 16:11:16 +02:00
ctl. u:object_r:ctl_default_prop:s0
Allow NFC to read/write nfc. system properties. (cherry pick of commit 05383ebfb439bed8436912ed28db550e8842b343) Bug: 17298769 Change-Id: I1994ff9f9da9b13249099f6c9bcec88dcdc2bb97
2014-09-26 00:13:41 +02:00
# NFC properties
nfc. u:object_r:nfc_prop:s0
Dependencies for new goldfish service domains. In order to support the new goldfish service domains in a change with the same Change-Id for the build project, we need the following changes in external/sepolicy: - /system/bin/logcat needs its own type so that it can be used as an entrypoint for the goldfish-logcat service. A neverallow rule prevents us from allowing entrypoint to any type not in exec_type. - The config. and dalvik. property namespaces need to be labeled with something other than default_prop so that the qemu-props service can set them. A neverallow rule prevents us from allowing qemu-props to set default_prop. We allow rx_file_perms to logcat_exec for any domain that was previously allowed read_logd() as many programs will read the logs by running logcat. We do not do this for all domains as it would violate a neverallow rule on the kernel domain executing any file without transitioning to another domain, and as we ultimately want to apply the same restriction to the init domain (and possibly others). Change-Id: Idce1fb5ed9680af84788ae69a5ace684c6663974 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-04 14:44:49 +02:00
# These properties are not normally set by processes other than init.
# They are only distinguished here for setting by qemu-props on the
# emulator/goldfish.
config. u:object_r:config_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.config. u:object_r:config_prop:s0
Dependencies for new goldfish service domains. In order to support the new goldfish service domains in a change with the same Change-Id for the build project, we need the following changes in external/sepolicy: - /system/bin/logcat needs its own type so that it can be used as an entrypoint for the goldfish-logcat service. A neverallow rule prevents us from allowing entrypoint to any type not in exec_type. - The config. and dalvik. property namespaces need to be labeled with something other than default_prop so that the qemu-props service can set them. A neverallow rule prevents us from allowing qemu-props to set default_prop. We allow rx_file_perms to logcat_exec for any domain that was previously allowed read_logd() as many programs will read the logs by running logcat. We do not do this for all domains as it would violate a neverallow rule on the kernel domain executing any file without transitioning to another domain, and as we ultimately want to apply the same restriction to the init domain (and possibly others). Change-Id: Idce1fb5ed9680af84788ae69a5ace684c6663974 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-04 14:44:49 +02:00
dalvik. u:object_r:dalvik_prop:s0
Remove special case handling of "ro." properties Currently, properties that begin with "ro." are special cased to skip over the "ro." part of the prefix before matching with entries in property_contexts. A change to init is removing this special case and therefore, the "ro." prefixes must be explicitly added to property_contexts. Bug 26425619 Change-Id: I343f139a39abef99924e84e0d27699284f335d63
2016-01-11 22:06:25 +01:00
ro.dalvik. u:object_r:dalvik_prop:s0
Separate permissions to set WiFi related properties wificond would like to be able to set WiFi related properties without access to the rest of the system properties. Today, this only involves marking the driver as loaded or unloaded. avc: denied { write } for name="property_service" dev="tmpfs" ino=10100 scontext=u:r:wificond:s0 tcontext=u:object_r:property_socket:s0 tclass=sock_file permissive=0 Bug: 29579539 Test: No avc denials related to system properties across various WiFi events. Change-Id: I6d9f1de3fbef04cb7750cc3753634f9e02fdb71f (cherry picked from commit 1ebfdd6a14fb21705664c8e144f151b39c3d73f8)
2016-06-29 20:28:20 +02:00
# Shared between system server and wificond
wlan. u:object_r:wifi_prop:s0
sepolicy: allow hwservicemanager to set properties Allow hwservicemanager to set properties starting with the prefix "hwservicemanager." b/31458381 b/31240290 Test: passing build and runtime tests Change-Id: Id92e2170f52893bbf236987ee59383df2264952f Signed-off-by: Iliyan Malchev <malchev@google.com>
2016-09-20 00:23:41 +02:00
# hwservicemanager properties
hwservicemanager. u:object_r:hwservicemanager_prop:s0
Reference in a new issue Copy permalink