tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/zygote.te

67 lines
2.8 KiB
Text
Raw Normal View History

SE Android policy.
2012-01-04 18:33:27 +01:00
# zygote
type zygote, domain;
type zygote_exec, exec_type, file_type;
init_daemon_domain(zygote)
zygote: enable SELinux restrictions This change enables SELinux security enforcement on zygote (but not zygote spawned apps). For the zygote.te file only, this change is equivalent to reverting the following commits: * 50e37b93ac97631dcac6961285b92af5026557af * 77d4731e9d30c8971e076e2469d6957619019921 No other changes were required. Testing: As much as possible, I've tested that zygote properly starts up, and that there's no problem spawning zygote or zygote apps. There were no denials in the kernel dmesg log, and everything appears to work correctly. It's quite possible I've missed something. If we experience problems, I happy to roll back this change. Bug: 9657732 Change-Id: Id2a7adcbeebda5d1606cb13470fad6c3fcffd558
2013-07-01 21:07:03 +02:00
typeattribute zygote mlstrustedsubject;
# Override DAC on files and switch uid/gid.
Change zygote sepolicy whitelist. Allow the zygote to create instruction set specific directories under /data/dalvik-cache and to change their owner to the system UID. These subdirectories are required in order to support instruction set specific dex caches on devices that support multiple instruction sets. We can't ask init to create these directories for us, because init doesn't have any knowledge about the list of runtime instruction sets the device supports. The owner needs to be system because the package manager (running in the system_server) is allowed to manipulate files under this directory. (cherry picked from commit 032e5b0ae1ff14f9f9eeb6b7b749307124b49e1a) Change-Id: I3a85e8a6b4eed003a93490e7b93a4fd68c41a361
2014-04-28 16:17:29 +02:00
allow zygote self:capability { dac_override setgid setuid fowner chown };
zygote: enable SELinux restrictions This change enables SELinux security enforcement on zygote (but not zygote spawned apps). For the zygote.te file only, this change is equivalent to reverting the following commits: * 50e37b93ac97631dcac6961285b92af5026557af * 77d4731e9d30c8971e076e2469d6957619019921 No other changes were required. Testing: As much as possible, I've tested that zygote properly starts up, and that there's no problem spawning zygote or zygote apps. There were no denials in the kernel dmesg log, and everything appears to work correctly. It's quite possible I've missed something. If we experience problems, I happy to roll back this change. Bug: 9657732 Change-Id: Id2a7adcbeebda5d1606cb13470fad6c3fcffd558
2013-07-01 21:07:03 +02:00
# Drop capabilities from bounding set.
allow zygote self:capability setpcap;
# Switch SELinux context to app domains.
Restrict requesting contexts other than policy-defined defaults. Writing to the /proc/self/attr files (encapsulated by the libselinux set*con functions) enables a program to request a specific security context for various operations instead of the policy-defined defaults. The security context specified using these calls is checked by an operation-specific permission, e.g. dyntransition for setcon, transition for setexeccon, create for setfscreatecon or setsockcreatecon, but the ability to request a context at all is controlled by a process permission. Omit these permissions from domain.te and only add them back where required so that only specific domains can even request a context other than the default defined by the policy. Change-Id: I6a2fb1279318625a80f3ea8e3f0932bdbe6df676 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-23 17:26:19 +02:00
allow zygote self:process setcurrent;
1/2: Rename domain "system" to "system_server". This is a follow-up CL to the extraction of "system_app" domain from the "system" domain which left the "system" domain encompassing just the system_server. Since this change cannot be made atomically across different repositories, it temporarily adds a typealias "server" pointing to "system_server". Once all other repositories have been switched to "system_server", this alias will be removed. Change-Id: I90a6850603dcf60049963462c5572d36de62bc00
2013-09-14 00:59:04 +02:00
allow zygote system_server:process dyntransition;
zygote: enable SELinux restrictions This change enables SELinux security enforcement on zygote (but not zygote spawned apps). For the zygote.te file only, this change is equivalent to reverting the following commits: * 50e37b93ac97631dcac6961285b92af5026557af * 77d4731e9d30c8971e076e2469d6957619019921 No other changes were required. Testing: As much as possible, I've tested that zygote properly starts up, and that there's no problem spawning zygote or zygote apps. There were no denials in the kernel dmesg log, and everything appears to work correctly. It's quite possible I've missed something. If we experience problems, I happy to roll back this change. Bug: 9657732 Change-Id: Id2a7adcbeebda5d1606cb13470fad6c3fcffd558
2013-07-01 21:07:03 +02:00
allow zygote appdomain:process dyntransition;
zygote.te: fix comment. per the discussion in https://android-review.googlesource.com/#/c/65063/1/zygote.te adjust the comment in this file. Change-Id: I8db31e22ec34493442bc8e86bcd0bc0136b7bae4
2013-09-20 22:09:37 +02:00
# Allow zygote to read app /proc/pid dirs (b/10455872)
Fix denials encountered while getting bugreports. Bug: 10498304 Change-Id: I312665a2cd09fa16ae3f3978aebdb0da99cf1f74
2013-08-30 22:02:30 +02:00
allow zygote appdomain:dir { getattr search };
Revert "Give Zygote the ability to write app data files." This was a mistaken attempt to fix bug 10498304, but it didn't actually have any impact. Revert. This reverts commit fc2bd01b601b00bf682c313d1e859d86ce030b67. Bug: 10498304
2013-09-20 22:03:04 +02:00
allow zygote appdomain:file { r_file_perms };
zygote: enable SELinux restrictions This change enables SELinux security enforcement on zygote (but not zygote spawned apps). For the zygote.te file only, this change is equivalent to reverting the following commits: * 50e37b93ac97631dcac6961285b92af5026557af * 77d4731e9d30c8971e076e2469d6957619019921 No other changes were required. Testing: As much as possible, I've tested that zygote properly starts up, and that there's no problem spawning zygote or zygote apps. There were no denials in the kernel dmesg log, and everything appears to work correctly. It's quite possible I've missed something. If we experience problems, I happy to roll back this change. Bug: 9657732 Change-Id: Id2a7adcbeebda5d1606cb13470fad6c3fcffd558
2013-07-01 21:07:03 +02:00
# Move children into the peer process group.
1/2: Rename domain "system" to "system_server". This is a follow-up CL to the extraction of "system_app" domain from the "system" domain which left the "system" domain encompassing just the system_server. Since this change cannot be made atomically across different repositories, it temporarily adds a typealias "server" pointing to "system_server". Once all other repositories have been switched to "system_server", this alias will be removed. Change-Id: I90a6850603dcf60049963462c5572d36de62bc00
2013-09-14 00:59:04 +02:00
allow zygote system_server:process { getpgid setpgid };
zygote: enable SELinux restrictions This change enables SELinux security enforcement on zygote (but not zygote spawned apps). For the zygote.te file only, this change is equivalent to reverting the following commits: * 50e37b93ac97631dcac6961285b92af5026557af * 77d4731e9d30c8971e076e2469d6957619019921 No other changes were required. Testing: As much as possible, I've tested that zygote properly starts up, and that there's no problem spawning zygote or zygote apps. There were no denials in the kernel dmesg log, and everything appears to work correctly. It's quite possible I've missed something. If we experience problems, I happy to roll back this change. Bug: 9657732 Change-Id: Id2a7adcbeebda5d1606cb13470fad6c3fcffd558
2013-07-01 21:07:03 +02:00
allow zygote appdomain:process { getpgid setpgid };
Remove zygote write access to system_data_file. These rules seem to be a legacy of old Android or perhaps old policy before we began splitting types on /data. I have not been able to trigger the auditallow rules on AOSP master. Reduce the rules to only read access to system data. If we need write access to some specific directory under /data, we should introduce a type for it. Change-Id: I780835950cc366c97b7d0901fc73527d9ea479b1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-14 14:58:06 +02:00
# Read system data.
allow zygote system_data_file:dir r_dir_perms;
allow zygote system_data_file:file r_file_perms;
# Write to /data/dalvik-cache.
Change zygote sepolicy whitelist. Allow the zygote to create instruction set specific directories under /data/dalvik-cache and to change their owner to the system UID. These subdirectories are required in order to support instruction set specific dex caches on devices that support multiple instruction sets. We can't ask init to create these directories for us, because init doesn't have any knowledge about the list of runtime instruction sets the device supports. The owner needs to be system because the package manager (running in the system_server) is allowed to manipulate files under this directory. (cherry picked from commit 032e5b0ae1ff14f9f9eeb6b7b749307124b49e1a) Change-Id: I3a85e8a6b4eed003a93490e7b93a4fd68c41a361
2014-04-28 16:17:29 +02:00
allow zygote dalvikcache_data_file:dir create_dir_perms;
Do not allow zygote to execve dalvikcache files. x_file_perms and friends allow execve; we only want to permit mmap/mprotect PROT_EXEC here. Change-Id: I780f202c357f4611225cec25fda5cb9d207e085f Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-01-09 15:27:15 +01:00
allow zygote dalvikcache_data_file:file create_file_perms;
zygote/dex2oat: Grant additional symlink permissions * zygote needs to be able to symlink from dalvik cache to system to avoid having to copy boot.oat (when the boot.oat file was built with --compile-pic) * dex2oat needs to be able to read the symlink in the dalvik cache (the one that zygote creates) Bug: 18035729 Change-Id: Ie1acad81a0fd8b2f24e1f3f07a06e6fdb548be62
2014-10-24 23:22:12 +02:00
# Create symlinks in /data/dalvik-cache
allow zygote dalvikcache_data_file:lnk_file create_file_perms;
Fix SELinux policies to allow resource overlays. The following commits added support for runtime resource overlays. New command line tool 'idmap' * 65a05fd56dbc9fd9c2511a97f49c445a748fb3c5 Runtime resource overlay, iteration 2 * 48d22323ce39f9aab003dce74456889b6414af55 Runtime resource overlay, iteration 2, test cases * ad6ed950dbfa152c193dd7e49c369d9e831f1591 During SELinux tightening, support for these runtime resource overlays was unknowingly broken. Fix it. This change has been tested by hackbod and she reports that everything is working after this change. I haven't independently verified the functionality. Test cases are available for this by running: * python frameworks/base/core/tests/overlaytests/testrunner.py Change-Id: I1c70484011fd9041bec4ef34f93f7a5509906f40
2014-06-16 23:19:31 +02:00
# Write to /data/resource-cache
allow zygote resourcecache_data_file:dir rw_dir_perms;
allow zygote resourcecache_data_file:file create_file_perms;
Do not allow zygote to execve dalvikcache files. x_file_perms and friends allow execve; we only want to permit mmap/mprotect PROT_EXEC here. Change-Id: I780f202c357f4611225cec25fda5cb9d207e085f Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-01-09 15:27:15 +01:00
# For art.
allow zygote dalvikcache_data_file:file execute;
zygote: enable SELinux restrictions This change enables SELinux security enforcement on zygote (but not zygote spawned apps). For the zygote.te file only, this change is equivalent to reverting the following commits: * 50e37b93ac97631dcac6961285b92af5026557af * 77d4731e9d30c8971e076e2469d6957619019921 No other changes were required. Testing: As much as possible, I've tested that zygote properly starts up, and that there's no problem spawning zygote or zygote apps. There were no denials in the kernel dmesg log, and everything appears to work correctly. It's quite possible I've missed something. If we experience problems, I happy to roll back this change. Bug: 9657732 Change-Id: Id2a7adcbeebda5d1606cb13470fad6c3fcffd558
2013-07-01 21:07:03 +02:00
# Execute dexopt.
allow zygote system_file:file x_file_perms;
reconcile aosp (c103da877b72aae80616dbc192982aaf75dfe888) after branching. Please do not merge. Change-Id: Ic9dde806a30d3e7b9c4a066f247a9207fe9b94b4
2014-07-15 08:32:08 +02:00
allow zygote dex2oat_exec:file rx_file_perms;
zygote: enable SELinux restrictions This change enables SELinux security enforcement on zygote (but not zygote spawned apps). For the zygote.te file only, this change is equivalent to reverting the following commits: * 50e37b93ac97631dcac6961285b92af5026557af * 77d4731e9d30c8971e076e2469d6957619019921 No other changes were required. Testing: As much as possible, I've tested that zygote properly starts up, and that there's no problem spawning zygote or zygote apps. There were no denials in the kernel dmesg log, and everything appears to work correctly. It's quite possible I've missed something. If we experience problems, I happy to roll back this change. Bug: 9657732 Change-Id: Id2a7adcbeebda5d1606cb13470fad6c3fcffd558
2013-07-01 21:07:03 +02:00
# Control cgroups.
allow zygote cgroup:dir create_dir_perms;
allow zygote self:capability sys_admin;
# Check validity of SELinux context before use.
selinux_check_context(zygote)
# Check SELinux permissions.
selinux_check_access(zygote)
# Read /seapp_contexts and /data/security/seapp_contexts
security_access_policy(zygote)
zygote: allow replacing /proc/cpuinfo Android's native bridge functionality allows an Android native app written on one CPU architecture to run on a different architecture. For example, Android ARM apps may run on an x86 CPU. To support this, the native bridge functionality needs to replace /proc/cpuinfo with the version from /system/lib/<ISA>/cpuinfo using a bind mount. See commit ab0da5a9a6860046619629b8e6b83692d35dff86 in system/core. This change: 1) Creates a new label proc_cpuinfo, and assigns /proc/cpuinfo that label. 2) Grants read-only access to all SELinux domains, to avoid breaking pre-existing apps. 3) Grants zygote mounton capabilities for that file, so zygote can replace the file as necessary. Addresses the following denial: avc: denied { mounton } for path="/proc/cpuinfo" dev="proc" ino=4026532012 scontext=u:r:zygote:s0 tcontext=u:object_r:proc:s0 tclass=file Bug: 17671501 (cherry picked from commit 2de02877a30e73bdf30fb2bf9cc4957f9ddbf996) Change-Id: I2c2366bee4fe365288d14bca9778d23a43c368cb
2014-09-26 19:51:12 +02:00
# Native bridge functionality requires that zygote replaces
# /proc/cpuinfo with /system/lib/<ISA>/cpuinfo using a bind mount
allow zygote proc_cpuinfo:file mounton;
Updated policy for external storage. An upcoming platform release is redesigning how external storage works. At a high level, vold is taking on a more active role in managing devices that dynamically appear. This change also creates further restricted domains for tools doing low-level access of external storage devices, including sgdisk and blkid. It also extends sdcardd to be launchable by vold, since launching by init will eventually go away. For compatibility, rules required to keep AOSP builds working are marked with "TODO" to eventually remove. Slightly relax system_server external storage rules to allow calls like statfs(). Still neverallow open file descriptors, since they can cause kernel to kill us. Here are the relevant violations that this CL is designed to allow: avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
# Allow remounting rootfs as MS_SLAVE
zygote: enable SELinux restrictions This change enables SELinux security enforcement on zygote (but not zygote spawned apps). For the zygote.te file only, this change is equivalent to reverting the following commits: * 50e37b93ac97631dcac6961285b92af5026557af * 77d4731e9d30c8971e076e2469d6957619019921 No other changes were required. Testing: As much as possible, I've tested that zygote properly starts up, and that there's no problem spawning zygote or zygote apps. There were no denials in the kernel dmesg log, and everything appears to work correctly. It's quite possible I've missed something. If we experience problems, I happy to roll back this change. Bug: 9657732 Change-Id: Id2a7adcbeebda5d1606cb13470fad6c3fcffd558
2013-07-01 21:07:03 +02:00
allow zygote rootfs:dir mounton;
Updated policy for external storage. An upcoming platform release is redesigning how external storage works. At a high level, vold is taking on a more active role in managing devices that dynamically appear. This change also creates further restricted domains for tools doing low-level access of external storage devices, including sgdisk and blkid. It also extends sdcardd to be launchable by vold, since launching by init will eventually go away. For compatibility, rules required to keep AOSP builds working are marked with "TODO" to eventually remove. Slightly relax system_server external storage rules to allow calls like statfs(). Still neverallow open file descriptors, since they can cause kernel to kill us. Here are the relevant violations that this CL is designed to allow: avc: denied { search } for name="user" dev="tmpfs" ino=7441 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/mnt/user/0" dev="tmpfs" ino=6659 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { write } for name="user" dev="tmpfs" ino=6658 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { add_name } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { create } for name="10" scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { setattr } for name="10" dev="tmpfs" ino=11348 scontext=u:r:zygote:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:zygote:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=6659 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self" dev="tmpfs" ino=11348 scontext=u:r:untrusted_app:s0:c522,c768 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { read } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { open } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="/" dev="tmpfs" ino=6661 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { write } for name="data" dev="tmpfs" ino=11979 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { add_name } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { create } for name="com.google.android.music" scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { use } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { read write } for path="socket:[8297]" dev="sockfs" ino=8297 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=netlink_kobject_uevent_socket avc: denied { read } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { write } for path="pipe:[8298]" dev="pipefs" ino=8298 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { mounton } for path="/storage/emulated" dev="tmpfs" ino=8913 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage" dev="tmpfs" ino=7444 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { getattr } for path="/storage/self/primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { read } for name="primary" dev="tmpfs" ino=7447 scontext=u:r:system_server:s0 tcontext=u:object_r:storage_file:s0 tclass=lnk_file avc: denied { getattr } for path="/mnt/user" dev="tmpfs" ino=7441 scontext=u:r:system_server:s0 tcontext=u:object_r:mnt_user_file:s0 tclass=dir avc: denied { read } for name="disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { getattr } for path="/dev/block/vold/disk:179,128" dev="tmpfs" ino=3224 scontext=u:r:sgdisk:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="/" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { open } for path="/storage/public:81F3-13EC" dev="fuse" ino=0 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { write } for name="data" dev="fuse" ino=2 scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { add_name } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { create } for name="com.google.android.googlequicksearchbox" scontext=u:r:vold:s0 tcontext=u:object_r:fuse:s0 tclass=dir avc: denied { getattr } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { read } for name="public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { open } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { ioctl } for path="/dev/block/vold/public:179,129" dev="tmpfs" ino=16953 scontext=u:r:blkid:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[3264]" dev="pipefs" ino=3264 scontext=u:r:sgdisk:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="block" dev="tmpfs" ino=2494 scontext=u:r:sgdisk:s0 tcontext=u:object_r:block_device:s0 tclass=dir avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4200]" dev="pipefs" ino=4200 scontext=u:r:sdcardd:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { search } for name="/" dev="tmpfs" ino=3131 scontext=u:r:sdcardd:s0 tcontext=u:object_r:storage_file:s0 tclass=dir avc: denied { search } for name="media_rw" dev="tmpfs" ino=3127 scontext=u:r:sdcardd:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir avc: denied { getattr } for path="pipe:[3648]" dev="pipefs" ino=3648 scontext=u:r:blkid:s0 tcontext=u:r:vold:s0 tclass=fifo_file avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="/dev/pts/12" dev="devpts" ino=15 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd avc: denied { use } for path="pipe:[4182]" dev="pipefs" ino=4182 scontext=u:r:fsck:s0 tcontext=u:r:vold:s0 tclass=fd Change-Id: Idf3b8561baecf7faa603fac5ababdcc5708288e1
2015-03-27 19:25:39 +01:00
allow zygote sdcard_type:dir { write search setattr create add_name mounton }; # TODO: deprecated in M
dontaudit zygote self:capability fsetid; # TODO: deprecated in M
allow zygote tmpfs:dir { write create add_name setattr mounton search }; # TODO: deprecated in M
allow zygote tmpfs:filesystem mount; # TODO: deprecated in M
allow zygote labeledfs:filesystem remount; # TODO: deprecated in M
# Allowed to create user-specific storage source if started before vold
allow zygote mnt_user_file:dir create_dir_perms;
allow zygote mnt_user_file:lnk_file create_file_perms;
# Allowed to mount user-specific storage into place
allow zygote storage_file:dir { search mounton };
zygote: enable SELinux restrictions This change enables SELinux security enforcement on zygote (but not zygote spawned apps). For the zygote.te file only, this change is equivalent to reverting the following commits: * 50e37b93ac97631dcac6961285b92af5026557af * 77d4731e9d30c8971e076e2469d6957619019921 No other changes were required. Testing: As much as possible, I've tested that zygote properly starts up, and that there's no problem spawning zygote or zygote apps. There were no denials in the kernel dmesg log, and everything appears to work correctly. It's quite possible I've missed something. If we experience problems, I happy to roll back this change. Bug: 9657732 Change-Id: Id2a7adcbeebda5d1606cb13470fad6c3fcffd558
2013-07-01 21:07:03 +02:00
# Handle --invoke-with command when launching Zygote with a wrapper command.
Allow stat of /system/bin/app_process by zygote. This resolves denials such as: type=1400 audit(7803852.559:251): avc: denied { getattr } for pid=5702 comm="main" path="/system/bin/app_process" dev="mmcblk0p25" ino=60 scontext=u:r:zygote:s0 tcontext=u:object_r:zygote_exec:s0 tclass=file (triggered on an art crash seen in recent AOSP master) Rather than just adding this permission individually, just rewrite the existing rule to use the rx_file_perms macro. We already allowed most of these permissions by way of the domain_auto_trans() rule via init_daemon_domain() and the rule for the --invoke-with support. Using macros helps reduce policy fragility/brittleness. Change-Id: Ib7edc17469c47bde9edd89f0e6cf5cd7f90fdb76 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-03-10 15:31:09 +01:00
allow zygote zygote_exec:file rx_file_perms;
Reference in a new issue Copy permalink