tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/su.te

54 lines
2 KiB
Text
Raw Normal View History

Make sure all public types are defined regardless of build variants The types need to be exported so userdebug system.img can still build the policy with a user vendor.img at boot time. All permissions and attributes for these types are still kept under conditional userdebug_or_eng macro Bug: 37433251 Test: Boot sailfish-user build with generic_arm64_ab system.img on sailfish and make sure sepolicy compilation succeeds Change-Id: I98e8428c414546dfc74641700d4846edcf9355b1 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-20 20:40:24 +02:00
# All types must be defined regardless of build variant to ensure
# policy compilation succeeds with userdebug/user combination at boot
type su, domain;
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
# File types must be defined for file_contexts.
type su_exec, exec_type, file_type;
userdebug_or_eng(`
# Domain used for su processes, as well as for adbd and adb shell
# after performing an adb root command. The domain definition is
# wrapped to ensure that it does not exist at all on -user builds.
Make sure all public types are defined regardless of build variants The types need to be exported so userdebug system.img can still build the policy with a user vendor.img at boot time. All permissions and attributes for these types are still kept under conditional userdebug_or_eng macro Bug: 37433251 Test: Boot sailfish-user build with generic_arm64_ab system.img on sailfish and make sure sepolicy compilation succeeds Change-Id: I98e8428c414546dfc74641700d4846edcf9355b1 Signed-off-by: Sandeep Patil <sspatil@google.com>
2017-04-20 20:40:24 +02:00
typeattribute su mlstrustedsubject;
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
# Add su to various domains
net_domain(su)
Allow 'su' domain access to vndbinder. For example, for listing vndbinder services using 'adb shell service -v list' Test: adb shell service -v list Bug: 36987120 Change-Id: Ibf3050710720ae4c920bc4807c9a90ba43717f3b
2017-04-07 02:29:49 +02:00
# grant su access to vndbinder
vndbinder_use(su)
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
dontaudit su self:capability_class_set *;
dontaudit su kernel:security *;
dontaudit su kernel:system *;
dontaudit su self:memprotect *;
dontaudit su domain:process *;
dontaudit su domain:fd *;
dontaudit su domain:dir *;
dontaudit su domain:lnk_file *;
dontaudit su domain:{ fifo_file file } *;
dontaudit su domain:socket_class_set *;
dontaudit su domain:ipc_class_set *;
dontaudit su domain:key *;
dontaudit su fs_type:filesystem *;
dontaudit su {fs_type dev_type file_type}:dir_file_class_set *;
dontaudit su node_type:node *;
dontaudit su node_type:{ tcp_socket udp_socket rawip_socket } *;
dontaudit su netif_type:netif *;
dontaudit su port_type:socket_class_set *;
dontaudit su port_type:{ tcp_socket dccp_socket } *;
dontaudit su domain:peer *;
dontaudit su domain:binder *;
dontaudit su property_type:property_service *;
dontaudit su property_type:file *;
dontaudit su service_manager_type:service_manager *;
Allow 'su' domain access to vndbinder. For example, for listing vndbinder services using 'adb shell service -v list' Test: adb shell service -v list Bug: 36987120 Change-Id: Ibf3050710720ae4c920bc4807c9a90ba43717f3b
2017-04-07 02:29:49 +02:00
dontaudit su hwservice_manager_type:hwservice_manager *;
Remove vndservice_manager object classes. vndservicemanager is a copy of servicemanager, and so has the exact same properties. This should be reflected in the sharing of an object manager in SELinux policy, rather than creating a second one, which is effectively an attempt at namespacing based on object rather than type labels. hwservicemanager, however, provides different and additional functionality that may be reflected in changed permissions, though they currently map to the existing servicemanager permissions. Keep the new hwservice_manager object manager but remove the vndservice_manager one. Bug: 34454312 Bug: 36052864 Test: policy builds and device boots. Change-Id: I9e0c2757be4026101e32ba780f1fa67130cfa14e
2017-04-14 22:50:34 +02:00
dontaudit su vndservice_manager_type:service_manager *;
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
dontaudit su servicemanager:service_manager list;
Add hwservice_contexts and support for querying it. hwservicemanager can check hwservice_contexts files both from the framework and vendor partitions. Initially, have a wildcard '*' in hwservice_contexts that maps to a label that can be added/found from domain. This needs to be removed when the proper policy is in place. Also, grant su/shell access to hwservicemanager list operations, so tools like 'lshal' continue to work. Bug: 34454312 Test: Marlin boots Change-Id: I3a02d97a82458692b528d85c1b8e78b6f82ea1bc
2017-04-08 01:14:43 +02:00
dontaudit su hwservicemanager:hwservice_manager list;
Remove vndservice_manager object classes. vndservicemanager is a copy of servicemanager, and so has the exact same properties. This should be reflected in the sharing of an object manager in SELinux policy, rather than creating a second one, which is effectively an attempt at namespacing based on object rather than type labels. hwservicemanager, however, provides different and additional functionality that may be reflected in changed permissions, though they currently map to the existing servicemanager permissions. Keep the new hwservice_manager object manager but remove the vndservice_manager one. Bug: 34454312 Bug: 36052864 Test: policy builds and device boots. Change-Id: I9e0c2757be4026101e32ba780f1fa67130cfa14e
2017-04-14 22:50:34 +02:00
dontaudit su vndservicemanager:service_manager list;
sepolicy: add version_policy tool and version non-platform policy. In order to support platform changes without simultaneous updates from non-platform components, the platform and non-platform policies must be split. In order to provide a guarantee that policy written for non-platform objects continues to provide the same access, all types exposed to non-platform policy are versioned by converting them and the policy using them into attributes. This change performs that split, the subsequent versioning and also generates a mapping file to glue the different policy components together. Test: Device boots and runs. Bug: 31369363 Change-Id: Ibfd3eb077bd9b8e2ff3b2e6a0ca87e44d78b1317
2016-10-12 23:58:09 +02:00
dontaudit su keystore:keystore_key *;
dontaudit su domain:drmservice *;
dontaudit su unlabeled:filesystem *;
dontaudit su postinstall_file:filesystem *;
')
Reference in a new issue Copy permalink