platform_system_sepolicy/tee.te

##
# trusted execution environment (tee) daemon
#
type tee, domain, domain_deprecated;
type tee_exec, exec_type, file_type;
type tee_device, dev_type;
type tee_data_file, file_type, data_file_type;

init_daemon_domain(tee)
allow tee self:capability { dac_override };
allow tee tee_device:chr_file rw_file_perms;
allow tee tee_data_file:dir rw_dir_perms;
allow tee tee_data_file:file create_file_perms;
allow tee self:netlink_socket create_socket_perms;
allow tee self:netlink_generic_socket create_socket_perms;
Trusted Execution Environment policy. 2012-08-13 12:09:39 +02:00			`##`
			`# trusted execution environment (tee) daemon`
			`#`
Create attribute for moving perms out of domain Motivation: Domain is overly permissive. Start removing permissions from domain and assign them to the domain_deprecated attribute. Domain_deprecated and domain can initially be assigned to all domains. The goal is to not assign domain_deprecated to new domains and to start removing domain_deprecated where it is not required or reassigning the appropriate permissions to the inheriting domain when necessary. Bug: 25433265 Change-Id: I8b11cb137df7bdd382629c98d916a73fe276413c 2015-11-03 18:54:39 +01:00			`type tee, domain, domain_deprecated;`
Trusted Execution Environment policy. 2012-08-13 12:09:39 +02:00			`type tee_exec, exec_type, file_type;`
			`type tee_device, dev_type;`
			`type tee_data_file, file_type, data_file_type;`

			`init_daemon_domain(tee)`
Confine tee, but leave it permissive for now. Change-Id: Id69b1fe80746429a550448b9168ac7e86c38aa9f Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2013-10-29 19:42:40 +01:00			`allow tee self:capability { dac_override };`
			`allow tee tee_device:chr_file rw_file_perms;`
			`allow tee tee_data_file:dir rw_dir_perms;`
			`allow tee tee_data_file:file create_file_perms;`
Clean up socket rules. Replace * or any permission set containing create with create_socket_perms or create_stream_socket_perms. Add net_domain() to all domains using network sockets and delete rules already covered by domain.te or net.te. For netlink_route_socket, only nlmsg_write needs to be separately granted to specific domains that are permitted to modify the routing table. Clarification: read/write permissions are just ability to perform read/recv() or write/send() on the socket, whereas nlmsg_read/ nlmsg_write permissions control ability to observe or modify the underlying kernel state accessed via the socket. See security/selinux/nlmsgtab.c in the kernel for the mapping of netlink message types to nlmsg_read or nlmsg_write. Delete legacy rule for b/12061011. This change does not touch any rules where only read/write were allowed to a socket created by another domain (inherited across exec or received across socket or binder IPC). We may wish to rewrite some or all of those rules with the rw_socket_perms macro but that is a separate change. Change-Id: Ib0637ab86f6d388043eff928e5d96beb02e5450e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2014-02-24 21:06:11 +01:00			`allow tee self:netlink_socket create_socket_perms;`
Update netlink socket classes. Define new netlink socket security classes introduced by upstream kernel commit 6c6d2e9bde1c1c87a7ead806f8f5e2181d41a652 ("selinux: update netlink socket classes"). This was merged in Linux 4.2 and is therefore only required for Android kernels based on 4.2 or newer (e.g. the android-4.4 branch of the kernel/common tree). Add the new socket classes to socket_class_set. Add an initial set of allow rules although further refinement will likely be necessary. Any allow rule previously written on :netlink_socket may need to be rewritten or duplicated for one or more of the more specific classes. For now, we retain the existing :netlink_socket rules for compatibility on older kernels. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> (cherry picked from commit 01d95c23ab8c14d72e4ce98b3dda64ce81ab6306) Change-Id: Ic00a0d474730cda91ba3bc387e0cc14482f82114 2015-05-21 22:17:26 +02:00			`allow tee self:netlink_generic_socket create_socket_perms;`