tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/bootanim.te

46 lines
1.3 KiB
Text
Raw Normal View History

Define a domain for the bootanim service. Leave the domain permissive initially until it gets more testing. Change-Id: I9d88d76d1ffdc79a2eff4545d37a9e615482df50 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-11 21:17:53 +01:00
# bootanimation oneshot service
bootanim: Remove domain_deprecated Remove domain_deprecated from bootanim. This removes some unnecessarily permissive rules. As part of this, re-allow access to cgroups, proc and sysfs, removed as a result of removing domain_deprecated. Bug: 25433265 Change-Id: I58658712666c719c8f5a39fe2076c4f6d166616c
2015-12-02 22:29:20 +01:00
type bootanim, domain;
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 19:21:37 +02:00
type bootanim_exec, system_file_type, exec_type, file_type;
Define a domain for the bootanim service. Leave the domain permissive initially until it gets more testing. Change-Id: I9d88d76d1ffdc79a2eff4545d37a9e615482df50 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-11 21:17:53 +01:00
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
hal_client_domain(bootanim, hal_configstore)
Allow hals to read hwservicemanager prop. Test: no relevant denials on marlin while booting Test: no relevant denials on angler while booting Bug: 36278706 Change-Id: Ieba79e1c8fca4f74c63bc63e6dd0bdcf59204ca2
2017-03-22 17:16:49 +01:00
hal_client_domain(bootanim, hal_graphics_allocator)
hal_client_domain(bootanim, hal_graphics_composer)
Define a domain for the bootanim service. Leave the domain permissive initially until it gets more testing. Change-Id: I9d88d76d1ffdc79a2eff4545d37a9e615482df50 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-11 21:17:53 +01:00
binder_use(bootanim)
binder_call(bootanim, surfaceflinger)
Allow audioserver for bootanim. Required for using native audio in BootAnimation Bug: 29055299 Change-Id: Ie75d35219be95a8dc697cc3c0384a4de90ea3478
2016-06-29 23:14:34 +02:00
binder_call(bootanim, audioserver)
Define a domain for the bootanim service. Leave the domain permissive initially until it gets more testing. Change-Id: I9d88d76d1ffdc79a2eff4545d37a9e615482df50 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-11 21:17:53 +01:00
Allow bootanimation to talk to hwservicemanager. Because bootanimation uses the graphics mapper HIDL service (which is always passthrough), it makes a call to hwservicemanager to let it know it has obtained a reference to it. Bug: 35207188 Test: no more denials from bootanim Change-Id: I99ea57a0d7777cb84eeaca26426ea38bf72ee933
2017-02-15 13:38:33 +01:00
hwbinder_use(bootanim)
Define a domain for the bootanim service. Leave the domain permissive initially until it gets more testing. Change-Id: I9d88d76d1ffdc79a2eff4545d37a9e615482df50 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-11 21:17:53 +01:00
allow bootanim gpu_device:chr_file rw_file_perms;
Adds GPU sepolicy to support devices with DRM gralloc/rendering ... such as Cuttlefish (Cloud Android virtual device) which has a DRM virtio-gpu based gralloc and (sometimes) DRM virtio-gpu based rendering (when forwarding rendering commands to the host machine with Mesa3D in the guest and virglrenderer on the host). After this change is submitted, changes such as aosp/1997572 can be submitted to removed sepolicy that is currently duplicated across device/google/cuttlefish and device/linaro/dragonboard as well. Adds a sysfs_gpu type (existing replicated sysfs_gpu definitions across several devices are removed in the attached topic). The uses of `sysfs_gpu:file` comes from Mesa using libdrm's `drmGetDevices2()` which calls into `drmParsePciDeviceInfo()` to get vendor id, device id, version etc. Bug: b/161819018 Test: launch_cvd Test: launch_cvd --gpu_mode=gfxstream Change-Id: I4f7d4b0fb90bfeef72f94396ff0c5fe44d53510c Merged-In: I4f7d4b0fb90bfeef72f94396ff0c5fe44d53510c
2022-02-24 19:32:16 +01:00
allow bootanim gpu_device:dir r_dir_perms;
allow bootanim sysfs_gpu:file r_file_perms;
reconcile aosp (3a8c5dc05fb7696dd81b8a7c1b2524224154e8ea) after branching. Please do not merge. Change-Id: Ic8ee83ed6ffef02bddd17e1175416fc2481db7b2
2014-07-15 08:31:31 +02:00
# /oem access
allow bootanim oemfs:dir search;
sepolicy for oem cutomization Added read permissions for bootanimation Bug: 16635599 Change-Id: Ib5d0ba5a6d1144ff831f4f0eda092879f853c376
2014-09-22 22:03:52 +02:00
allow bootanim oemfs:file r_file_perms;
Resync lmp-dev-plus-aosp with master A DO NOT MERGE change merged from lmp-dev to lmp-dev-plus-aosp. This is expected, but it's causing unnecessary merge conflicts when handling AOSP contributions. Resolve those conflicts. This is essentially a revert of bf696327246833c9aba55a645e6c433e9f321e27 for lmp-dev-plus-aosp only. Change-Id: Icc66def7113ab45176ae015f659cb442d53bce5c
2014-07-26 00:19:47 +02:00
Give bootanimation access to /dev/snd files so it can use tinyalsa Bug: 17674304 Change-Id: Ide32833809bca8d3ed8ddc898748e25d7a692319
2014-09-29 15:18:19 +02:00
allow bootanim audio_device:dir r_dir_perms;
allow bootanim audio_device:chr_file rw_file_perms;
resolved conflicts for merge of 0a52df50 to lmp-dev-plus-aosp Change-Id: I3c6af086fc8ca3e9600c2267c439718c9a572dfb
2014-10-06 20:56:31 +02:00
Allow audioserver for bootanim. Required for using native audio in BootAnimation Bug: 29055299 Change-Id: Ie75d35219be95a8dc697cc3c0384a4de90ea3478
2016-06-29 23:14:34 +02:00
allow bootanim audioserver_service:service_manager find;
Restrict service_manager find and list access. All domains are currently granted list and find service_manager permissions, but this is not necessary. Pare the permissions which did not trigger any of the auditallow reporting. Bug: 18106000 Change-Id: Ie0ce8de2af8af2cbe4ce388a2dcf4534694c994a
2014-12-12 01:01:27 +01:00
allow bootanim surfaceflinger_service:service_manager find;
Allow the boot animation to receive display events Test: manually make sure that boot animation is resizing when display is changed Bug: 156448328 Change-Id: I9f754900a0b32551f656ce2097a3a41245b02218
2020-05-20 14:29:05 +02:00
allow bootanim surfaceflinger:unix_stream_socket { read write };
bootanim: Remove domain_deprecated Remove domain_deprecated from bootanim. This removes some unnecessarily permissive rules. As part of this, re-allow access to cgroups, proc and sysfs, removed as a result of removing domain_deprecated. Bug: 25433265 Change-Id: I58658712666c719c8f5a39fe2076c4f6d166616c
2015-12-02 22:29:20 +01:00
# Allow access to ion memory allocation device
allow bootanim ion_device:chr_file rw_file_perms;
Add missing permission for accessing the DMA-BUF system heap This patch fixes the following denials: avc: denied { open } for comm="composer@2.4-se" path="/dev/dma_heap/system" dev="tmpfs" ino=700 scontext=u:r:hal_graphics_composer_default:s0 tcontext=u:object_r:dmabuf_system_heap_device:s0 tclass=chr_file permissive=1 avc: denied { open } for comm="android.hardwar" path="/dev/dma_heap/system" dev="tmpfs" ino=700 scontext=u:r:hal_sensors_default:s0 tcontext=u:object_r:dmabuf_system_heap_device:s0 tclass=chr_file permissive=1 avc: denied { open } for comm="android.hardwar" path="/dev/dma_heap/system" dev="tmpfs" ino=700 scontext=u:r:hal_camera_default:s0 tcontext=u:object_r:dmabuf_system_heap_device:s0 tclass=chr_file permissive=1 avc: denied { open } for comm="BootAnimation" path="/dev/dma_heap/system" dev="tmpfs" ino=700 scontext=u:r:bootanim:s0 tcontext=u:object_r:dmabuf_system_heap_device:s0 tclass=chr_file permissive=1 avc: denied { open } for comm="Binder:470_2" path="/dev/dma_heap/system" dev="tmpfs" ino=700 scontext=u:r:surfaceflinger:s0 tcontext=u:object_r:dmabuf_system_heap_device:s0 tclass=chr_file permissive=1 avc: denied { read } for comm="HwBinder:946_2" name="system" dev="tmpfs" ino=588 scontext=u:r:cameraserver:s0 tcontext=u:object_r:dmabuf_system_heap_device:s0 tclass=chr_file permissive=1 avc: denied { open } for comm="HwBinder:946_2" path="/dev/dma_heap/system" dev="tmpfs" ino=588 scontext=u:r:cameraserver:s0 tcontext=u:object_r:dmabuf_system_heap_device:s0 tclass=chr_file permissive=1 Bug: 178865267 Test: boot without these denials Signed-off-by: Hyesoo Yu <hyesoo.yu@samsung.com> Change-Id: Ic31dffd1328a8693b721433e1dcbbc650d3a3c07
2021-02-16 06:57:42 +01:00
# Allow access to DMA-BUF system heap
allow bootanim dmabuf_system_heap_device:chr_file r_file_perms;
resolve merge conflicts of 837a6f2 to master Test: make Change-Id: Icf77940472c7b7776b731c0ce0c1f53ac8bd198c
2016-11-14 03:22:31 +01:00
allow bootanim hal_graphics_allocator:fd use;
bootanim: Remove domain_deprecated Remove domain_deprecated from bootanim. This removes some unnecessarily permissive rules. As part of this, re-allow access to cgroups, proc and sysfs, removed as a result of removing domain_deprecated. Bug: 25433265 Change-Id: I58658712666c719c8f5a39fe2076c4f6d166616c
2015-12-02 22:29:20 +01:00
Add sepolicy for hwcomposer HAL Allow SurfaceFlinger to call into IComposer, and vice versa for IComposerCallback. Specifically, hwbinder_use(...) for avc: denied { call } for scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=1 avc: denied { transfer } for scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=1 binder_call(..., surfaceflinger) for avc: denied { call } for scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:surfaceflinger:s0 tclass=binder permissive=1 allow ... gpu_device:chr_file rw_file_perms for avc: denied { read write } for name="kgsl-3d0" dev="tmpfs" ino=14956 scontext=u:r:hal_graphics_composer:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1 avc: denied { open } for path="/dev/kgsl-3d0" dev="tmpfs" ino=14956 scontext=u:r:hal_graphics_composer:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1 avc: denied { ioctl } for path="/dev/kgsl-3d0" dev="tmpfs" ino=14956 ioctlcmd=940 scontext=u:r:hal_graphics_composer:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1 allow ... ion_device:chr_file r_file_perms for avc: denied { ioctl } for path="/dev/ion" dev="tmpfs" ino=15014 ioctlcmd=4900 scontext=u:r:hal_graphics_composer:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1 allow ... graphics_device ... for avc: denied { ioctl } for path="/dev/graphics/fb0" dev="tmpfs" ino=15121 ioctlcmd=5380 scontext=u:r:hal_graphics_composer:s0 tcontext=u:object_r:graphics_device:s0 tclass=chr_file permissive=1 allow ... ...:fd use for avc: denied { use } for path="anon_inode:dmabuf" dev="anon_inodefs" ino=12794 scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:hal_graphics_allocator_service:s0 tclass=fd permissive=1 avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=12794 scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:bootanim:s0 tclass=fd permissive=1 avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=12794 scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:surfaceflinger:s0 tclass=fd permissive=1 avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=12794 scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:platform_app:s0:c512,c768 tclass=fd permissive=1 binder_call(surfaceflinger, ...) for avc: denied { call } for scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_composer:s0 tclass=binder permissive=1 avc: denied { transfer } for scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_composer:s0 tclass=binder permissive=1 avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=12794 ioctlcmd=3e02 scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_composer:s0 tclass=fd permissive=1 avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=12794 scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_composer:s0 tclass=fd permissive=1 allow bootanim ...:fd use for avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=11947 scontext=u:r:bootanim:s0 tcontext=u:r:hal_graphics_composer:s0 tclass=fd permissive=1 Bug: 32021609 Test: make bootimage Change-Id: I036cdbebf0c619fef7559f294f1865f381b17588
2016-10-18 04:58:22 +02:00
# Fences
allow bootanim hal_graphics_composer:fd use;
bootanim: Remove domain_deprecated Remove domain_deprecated from bootanim. This removes some unnecessarily permissive rules. As part of this, re-allow access to cgroups, proc and sysfs, removed as a result of removing domain_deprecated. Bug: 25433265 Change-Id: I58658712666c719c8f5a39fe2076c4f6d166616c
2015-12-02 22:29:20 +01:00
# Read access to pseudo filesystems.
bootanim: allow /proc/meminfo read Allow /proc/meminfo to be read by bootanim. Not sure why it's needed, but harmless enough. Modify domain_deprecated so it doesn't use r_dir_file(). /proc/meminfo is neither a symlink nor a directory, so it doesn't make sense to create allow rules for those classes of objects. Addresses the following denial: avc: denied { read } for comm="BootAnimation" name="meminfo" dev="proc" ino=4026536593 scontext=u:r:bootanim:s0 tcontext=u:object_r:proc_meminfo:s0 tclass=file permissive=0 This denial is only showing up on flounder, flounder_lte, or dragon devices. I'm not sure why. Change-Id: I0f808bcae47fc2fda512cd147c3b44593835cac5
2016-03-31 23:11:50 +02:00
allow bootanim proc_meminfo:file r_file_perms;
bootanim: Remove domain_deprecated Remove domain_deprecated from bootanim. This removes some unnecessarily permissive rules. As part of this, re-allow access to cgroups, proc and sysfs, removed as a result of removing domain_deprecated. Bug: 25433265 Change-Id: I58658712666c719c8f5a39fe2076c4f6d166616c
2015-12-02 22:29:20 +01:00
# System file accesses.
allow bootanim system_file:dir r_dir_perms;
Reference in a new issue Copy permalink