tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/public/property.te

95 lines
3.2 KiB
Text
Raw Normal View History

property.te: sort entries Sort the entries in property.te. This will make it slightly easier to read, and avoids merge conflicts by discouraging the common practice of adding entries to the bottom of this file. Test: policy compiles. Change-Id: I87ae96b33156dba73fb7eafc0f9a2a961b689853
2016-11-11 11:43:08 +01:00
type audio_prop, property_type, core_property_type;
Assign a label to the ro.boottime.* properties system/core commit 331cf2fb7c16b5b25064f8d2f00284105a9b413f created a number of new properties of the form: [ro.boottime.init]: [5294587604] [ro.boottime.InputEventFind]: [10278767840] [ro.boottime.adbd]: [8359267180] ... These properties were assigned the default_prop SELinux label because a better label did not exist. Properties labeled with the default_prop label are readable to any SELinux domain, which is overly broad. bullhead:/ $ getprop -Z ro.boottime.adbd u:object_r:default_prop:s0 Instead, create a new label for the ro.boottime.* properties so we can apply more fine grain read access control to these properties. bullhead:/ $ getprop -Z ro.boottime.adbd u:object_r:boottime_prop:s0 New SELinux property labels have minimal permissions by default. As a result, after this change, ro.boottime.* properties will only be readable to system_server, bootstat, init (because it manages the property space), and "adb root" (because no SELinux permissions are enforced there). Additional read access can be granted as-needed. This is part of a larger effort to implement fine-grain access control on the properties managed by init. Test: Device boots and no SELinux denials on boot. Change-Id: Ibf981cb81898f4356fdc5c1b6f15dd93c0d6d84d
2016-12-14 04:50:36 +01:00
type boottime_prop, property_type;
Restrict access to Bluetooth system properties This removes access to Bluetooth system properties from arbitrary SELinux domains. Access remains granted to init, bluetooth, and system_app domains. neverallow rules / CTS enforce that access is not granted to Zygote and processes spawned from Zygote expcept for system_app and bluetooth. The reason is that some of these properties may leak persistent identifiers not resettable by the user. Test: Bluetooth pairing and data transfer works Bug: 33700679 Change-Id: Icdcb3927a423c4011a62942340a498cc1b302472
2016-12-28 03:05:46 +01:00
type bluetooth_prop, property_type;
Switch /data/misc/reboot/last_reboot_reason to persistent property Switch from /data/misc/reboot/last_reboot_reason to persistent Android property persist.sys.boot.reason for indicating why the device is rebooted or shutdown. Introduce protection for all boot reason properties Protect the following properties with these labels ro.boot.bootreason u:object_r:bootloader_boot_reason_prop:s0 sys.boot.reason u:object_r:sys_boot_reason_prop:s0 persist.sys.boot.reason u:object_r:last_boot_reason_prop:s0 Setup the current as-need access rules for each. ToDo: Remove u:object_r:reboot_data_file after internal fixes. Test: system/core/bootstat/boot_reason_test.sh Bug: 64687998 Change-Id: I3771c73933e8ae2d94aee936c7a38b6282611b80
2017-08-14 23:25:10 +02:00
type bootloader_boot_reason_prop, property_type;
property.te: sort entries Sort the entries in property.te. This will make it slightly easier to read, and avoids merge conflicts by discouraging the common practice of adding entries to the bottom of this file. Test: policy compiles. Change-Id: I87ae96b33156dba73fb7eafc0f9a2a961b689853
2016-11-11 11:43:08 +01:00
type config_prop, property_type, core_property_type;
type cppreopt_prop, property_type, core_property_type;
Remove core_property_type from ctl_* properties Per https://android-review.googlesource.com/185392 , ctl.* properties are not represented as files in the filesystem. So there's no need to grant read access to them, since it's pointless. Remove core_property_type from these properties, which has the net effect of removing read access to these non-existent files. Change-Id: Ic1ca574668a3511c335a7036a2bb7993ff02c1e3
2015-12-09 17:47:02 +01:00
type ctl_bootanim_prop, property_type;
property.te: sort entries Sort the entries in property.te. This will make it slightly easier to read, and avoids merge conflicts by discouraging the common practice of adding entries to the bottom of this file. Test: policy compiles. Change-Id: I87ae96b33156dba73fb7eafc0f9a2a961b689853
2016-11-11 11:43:08 +01:00
type ctl_bugreport_prop, property_type;
type ctl_console_prop, property_type;
Remove core_property_type from ctl_* properties Per https://android-review.googlesource.com/185392 , ctl.* properties are not represented as files in the filesystem. So there's no need to grant read access to them, since it's pointless. Remove core_property_type from these properties, which has the net effect of removing read access to these non-existent files. Change-Id: Ic1ca574668a3511c335a7036a2bb7993ff02c1e3
2015-12-09 17:47:02 +01:00
type ctl_default_prop, property_type;
type ctl_dumpstate_prop, property_type;
type ctl_fuse_prop, property_type;
type ctl_mdnsd_prop, property_type;
type ctl_rildaemon_prop, property_type;
property.te: sort entries Sort the entries in property.te. This will make it slightly easier to read, and avoids merge conflicts by discouraging the common practice of adding entries to the bottom of this file. Test: policy compiles. Change-Id: I87ae96b33156dba73fb7eafc0f9a2a961b689853
2016-11-11 11:43:08 +01:00
type dalvik_prop, property_type, core_property_type;
type debuggerd_prop, property_type, core_property_type;
type debug_prop, property_type, core_property_type;
type default_prop, property_type, core_property_type;
type device_logging_prop, property_type;
type dhcp_prop, property_type, core_property_type;
type dumpstate_options_prop, property_type;
type dumpstate_prop, property_type, core_property_type;
type ffs_prop, property_type, core_property_type;
type fingerprint_prop, property_type, core_property_type;
Remove access to ro.runtime.firstboot from apps ro.runtime.firstboot system property is only used internally by system_server to distinguish between first start after boot from consecutive starts (for example, this happens when full-disk encryption is enabled). The value of the property is a millisecond-precise timestamp which can help track individual device. Thus apps should not have access to this property. Test: Device boots fine, reading ro.runtime.firstboot from an app results in an error and SELinux denial. Bug: 33700679 Change-Id: I4c3c26a35c5dd840bced3a3e53d071f45317f63c
2016-12-27 23:05:46 +01:00
type firstboot_prop, property_type;
property.te: sort entries Sort the entries in property.te. This will make it slightly easier to read, and avoids merge conflicts by discouraging the common practice of adding entries to the bottom of this file. Test: policy compiles. Change-Id: I87ae96b33156dba73fb7eafc0f9a2a961b689853
2016-11-11 11:43:08 +01:00
type hwservicemanager_prop, property_type;
Switch /data/misc/reboot/last_reboot_reason to persistent property Switch from /data/misc/reboot/last_reboot_reason to persistent Android property persist.sys.boot.reason for indicating why the device is rebooted or shutdown. Introduce protection for all boot reason properties Protect the following properties with these labels ro.boot.bootreason u:object_r:bootloader_boot_reason_prop:s0 sys.boot.reason u:object_r:sys_boot_reason_prop:s0 persist.sys.boot.reason u:object_r:last_boot_reason_prop:s0 Setup the current as-need access rules for each. ToDo: Remove u:object_r:reboot_data_file after internal fixes. Test: system/core/bootstat/boot_reason_test.sh Bug: 64687998 Change-Id: I3771c73933e8ae2d94aee936c7a38b6282611b80
2017-08-14 23:25:10 +02:00
type last_boot_reason_prop, property_type;
Remove property read access for non-core properties Instead of allowing global read access to all properties, only allow read access to the properties which are part of core SELinux policy. Device-specific policies are no longer readable by default and need to be granted in device-specific policy. Grant read-access to any property where the person has write access. In most cases, anyone who wants to write a property needs read access to that property. Change-Id: I2bd24583067b79f31b3bb0940b4c07fc33d09918
2015-12-08 23:45:50 +01:00
type logd_prop, property_type, core_property_type;
logpersist: reserve persist.logd.logpersistd shell, system_app and logd access granted on debug builds only Bug: 28936216 Change-Id: Ib9648e8565cc0ea0077cf0950b0e4ac6fe0a3135
2016-06-06 21:18:46 +02:00
type logpersistd_logging_prop, property_type;
property.te: sort entries Sort the entries in property.te. This will make it slightly easier to read, and avoids merge conflicts by discouraging the common practice of adding entries to the bottom of this file. Test: policy compiles. Change-Id: I87ae96b33156dba73fb7eafc0f9a2a961b689853
2016-11-11 11:43:08 +01:00
type log_prop, property_type, log_property_type;
type log_tag_prop, property_type, log_property_type;
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 21:58:29 +02:00
type lowpan_prop, property_type;
persist.mmc.* only set in init Bug: 26976972 Change-Id: I0e44bfc6774807a3bd2ba05637a432675d855118
2016-02-04 19:55:43 +01:00
type mmc_prop, property_type;
Move net.dns* to it's own label. Move net.dns* from net_radio_prop to the newly created label net_dns_prop. This allows finer grain control over this specific property. Prior to this change, this property was readable to all SELinux domains, and writable by the following SELinux domains: * system_server * system_app (apps which run as UID=system) * netmgrd * radio This change: 1) Removes read access to this property to everyone EXCEPT untrusted_app and system_server. 2) Limit write access to system_server. In particular, this change removes read access to priv_apps. Any priv_app which ships with the system should not be reading this property. Bug: 34115651 Test: Device boots, wifi turns on, no problems browsing the internet Change-Id: I8a32e98c4f573d634485c4feac91baa35d021d38
2017-02-10 01:08:11 +01:00
type net_dns_prop, property_type;
property.te: sort entries Sort the entries in property.te. This will make it slightly easier to read, and avoids merge conflicts by discouraging the common practice of adding entries to the bottom of this file. Test: policy compiles. Change-Id: I87ae96b33156dba73fb7eafc0f9a2a961b689853
2016-11-11 11:43:08 +01:00
type net_radio_prop, property_type, core_property_type;
Revert "Temporarily revert the SELinux policy for persist.netd.stable_secret." This change must only be submitted when device-specific policies have been reverted. This reverts commit 07e631d2e0a01226ea83e517305d1eceb1b1a158. Bug: 17613910 Test: builds Change-Id: Ie33e293107bf1eba2498f2422d941544c76b8cad Merged-In: I356c39a5dc955b3d7c28d8c7baf2887a17beb272
2017-07-11 02:43:19 +02:00
type netd_stable_secret_prop, property_type;
property.te: sort entries Sort the entries in property.te. This will make it slightly easier to read, and avoids merge conflicts by discouraging the common practice of adding entries to the bottom of this file. Test: policy compiles. Change-Id: I87ae96b33156dba73fb7eafc0f9a2a961b689853
2016-11-11 11:43:08 +01:00
type nfc_prop, property_type, core_property_type;
type overlay_prop, property_type;
Remove property read access for non-core properties Instead of allowing global read access to all properties, only allow read access to the properties which are part of core SELinux policy. Device-specific policies are no longer readable by default and need to be granted in device-specific policy. Grant read-access to any property where the person has write access. In most cases, anyone who wants to write a property needs read access to that property. Change-Id: I2bd24583067b79f31b3bb0940b4c07fc33d09918
2015-12-08 23:45:50 +01:00
type pan_result_prop, property_type, core_property_type;
property.te: sort entries Sort the entries in property.te. This will make it slightly easier to read, and avoids merge conflicts by discouraging the common practice of adding entries to the bottom of this file. Test: policy compiles. Change-Id: I87ae96b33156dba73fb7eafc0f9a2a961b689853
2016-11-11 11:43:08 +01:00
type persist_debug_prop, property_type, core_property_type;
make ro.persistent_properties.ready accessible for hidl client - compared to ro.boottime, this one does not pass time info bug: 35178781 bug: 34274385 Test: reboot Change-Id: I6a7bf636a3f201653e2890751d5fa210274c9ede
2017-03-01 04:21:31 +01:00
type persistent_properties_ready_prop, property_type;
Revert "Revert "Put pm.* property in new pm_prop context"" This reverts commit 248b6dc64444ea3260fba8e9cb390e59e2b941ab. Reason for revert: The dashboard complains that devices don't boot after this revert. Change-Id: I6a4648b64b096cbaa97c67aae6bc38b76d54cb48
2017-11-16 06:28:14 +01:00
type pm_prop, property_type;
Remove property read access for non-core properties Instead of allowing global read access to all properties, only allow read access to the properties which are part of core SELinux policy. Device-specific policies are no longer readable by default and need to be granted in device-specific policy. Grant read-access to any property where the person has write access. In most cases, anyone who wants to write a property needs read access to that property. Change-Id: I2bd24583067b79f31b3bb0940b4c07fc33d09918
2015-12-08 23:45:50 +01:00
type powerctl_prop, property_type, core_property_type;
property.te: sort entries Sort the entries in property.te. This will make it slightly easier to read, and avoids merge conflicts by discouraging the common practice of adding entries to the bottom of this file. Test: policy compiles. Change-Id: I87ae96b33156dba73fb7eafc0f9a2a961b689853
2016-11-11 11:43:08 +01:00
type radio_prop, property_type, core_property_type;
type restorecon_prop, property_type, core_property_type;
Allow logd.auditd to reboot to safe mode Bug: 26902605 Change-Id: Ica825cf2af74f5624cf4091544bd24bb5482dbe7 (cherry picked from commit 9c168711d5f79642a5357cd4c58ad5e88a9795ba)
2016-02-06 00:42:32 +01:00
type safemode_prop, property_type;
Restrict access to ro.serialno and ro.boot.serialno This restricts access to ro.serialno and ro.boot.serialno, the two system properties which contain the device's serial number, to a select few SELinux domains which need the access. In particular, this removes access to these properties from Android apps. Apps can access the serial number via the public android.os.Build API. System properties are not public API for apps. The reason for the restriction is that serial number is a globally unique identifier which cannot be reset by the user. Thus, it can be used as a super-cookie by apps. Apps need to wean themselves off of identifiers not resettable by the user. Test: Set up fresh GMS device, install some apps via Play, update some apps, use Chrome Test: Access the device via ADB (ADBD exposes serial number) Test: Enable MTP over USB, use mtp-detect to confirm that serial number is reported in MTP DeviceInfo Bug: 31402365 Bug: 33700679 Change-Id: I4713133b8d78dbc63d8272503e80cd2ffd63a2a7
2016-12-21 00:31:37 +01:00
type serialno_prop, property_type;
property.te: sort entries Sort the entries in property.te. This will make it slightly easier to read, and avoids merge conflicts by discouraging the common practice of adding entries to the bottom of this file. Test: policy compiles. Change-Id: I87ae96b33156dba73fb7eafc0f9a2a961b689853
2016-11-11 11:43:08 +01:00
type shell_prop, property_type, core_property_type;
Switch /data/misc/reboot/last_reboot_reason to persistent property Switch from /data/misc/reboot/last_reboot_reason to persistent Android property persist.sys.boot.reason for indicating why the device is rebooted or shutdown. Introduce protection for all boot reason properties Protect the following properties with these labels ro.boot.bootreason u:object_r:bootloader_boot_reason_prop:s0 sys.boot.reason u:object_r:sys_boot_reason_prop:s0 persist.sys.boot.reason u:object_r:last_boot_reason_prop:s0 Setup the current as-need access rules for each. ToDo: Remove u:object_r:reboot_data_file after internal fixes. Test: system/core/bootstat/boot_reason_test.sh Bug: 64687998 Change-Id: I3771c73933e8ae2d94aee936c7a38b6282611b80
2017-08-14 23:25:10 +02:00
type system_boot_reason_prop, property_type;
property.te: sort entries Sort the entries in property.te. This will make it slightly easier to read, and avoids merge conflicts by discouraging the common practice of adding entries to the bottom of this file. Test: policy compiles. Change-Id: I87ae96b33156dba73fb7eafc0f9a2a961b689853
2016-11-11 11:43:08 +01:00
type system_prop, property_type, core_property_type;
type system_radio_prop, property_type, core_property_type;
type vold_prop, property_type, core_property_type;
type wifi_log_prop, property_type, log_property_type;
type wifi_prop, property_type;
Support fine grain read access control for properties Properties are now broken up from a single /dev/__properties__ file into multiple files, one per property label. This commit provides the mechanism to control read access to each of these files and therefore sets of properties. This allows full access for all domains to each of these new property files to match the current permissions of /dev/__properties__. Future commits will restrict the access. Bug: 21852512 Change-Id: Ie9e43968acc7ac3b88e354a0bdfac75b8a710094
2015-12-02 01:58:27 +01:00
allow property_type tmpfs:filesystem associate;
Do not allow new additions to core_property_type core_property_type is an attribute which was given to all existing properties known to core SELinux policy. Any property with this label is readable to all SELinux domains, which is overly broad. The long term goal is to remove the core_property_type attribute entirely. Add a neverallow rule prohibiting the introduction of new properties with the core_property_type attribute. Device specific properties, or new properties in core SELinux policy, should not have this attribute. Test: policy compiles Change-Id: Ie89a9f0d81c8561616001ff8451496ce2278dbb2
2016-12-14 00:59:33 +01:00
###
### Neverallow rules
###
# core_property_type should not be used for new properties or
# device specific properties. Properties with this attribute
# are readable to everyone, which is overly broad and should
# be avoided.
# New properties should have appropriate read / write access
# control rules written.
neverallow * {
core_property_type
-audio_prop
-config_prop
-cppreopt_prop
-dalvik_prop
-debuggerd_prop
-debug_prop
-default_prop
-dhcp_prop
-dumpstate_prop
-ffs_prop
-fingerprint_prop
-logd_prop
-net_radio_prop
-nfc_prop
-pan_result_prop
-persist_debug_prop
-powerctl_prop
-radio_prop
-restorecon_prop
-shell_prop
-system_prop
-system_radio_prop
-vold_prop
}:file no_rw_file_perms;
Reference in a new issue Copy permalink