tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/unconfined.te

95 lines
3.6 KiB
Text
Raw Normal View History

Clarify the expectations for the unconfined template. In https://android-review.googlesource.com/66562 , there was a discussion about the role the unconfined template plays. Document the unconfined template so that those expectations are better understood. Change-Id: I20ac01ac2d4496b8425b6f63d4106e8021bc9b2f
2013-10-21 22:32:31 +02:00
#######################################################
#
# This is the unconfined template. This template is the base policy
# which is used by daemons and other privileged components of
# Android.
#
# Historically, this template was called "unconfined" because it
# allowed the domain to do anything it wanted. Over time,
# this has changed, and will continue to change in the future.
# The rules in this file will be removed when no remaining
# unconfined domains require it, or when the rules contradict
# Android security best practices. Domains which need rules not
# provided by the unconfined template should add them directly to
# the relevant policy.
#
# The use of this template is discouraged.
######################################################
unconfined: remove linux_immutable As far as I know, this is never used. Get rid of it. Change-Id: Iee0fb4e3f3952a0c4cc28d0aa96ca6c462ba5211
2014-05-20 07:54:07 +02:00
allow unconfineddomain self:capability ~{ sys_ptrace sys_rawio mknod sys_module audit_write audit_control linux_immutable };
Remove MAC capabilities from unconfined domains. Linux defines two capabilities for Mandatory Access Control (MAC) security modules, CAP_MAC_OVERRIDE (override MAC access restrictions) and CAP_MAC_ADMIN (allow MAC configuration or state changes). SELinux predates these capabilities and did not originally use them, but later made use of CAP_MAC_ADMIN as a way to control the ability to set security context values unknown to the currently loaded SELinux policy on files. That facility is used in Linux for e.g. livecd creation where a file security context that is being set on a generated filesystem is not known to the build host policy. Internally, files with such labels are treated as having the unlabeled security context for permission checking purposes until/unless the context is later defined through a policy reload. CAP_MAC_OVERRIDE is never checked by SELinux, so it never needs to be allowed. CAP_MAC_ADMIN is only checked if setting an unknown security context value; the only legitimate use I can see in Android is the recovery console, where a context may need to be set on /system that is not defined in the recovery policy. Remove these capabilities from unconfined domains, allow mac_admin for the recovery domain, and add neverallow rules. Change-Id: Ief673e12bc3caf695f3fb67cabe63e68f5f58150 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-01-30 19:23:08 +01:00
allow unconfineddomain self:capability2 ~{ mac_override mac_admin };
Deduplicate neverallow rules on selinuxfs operations. We already have neverallow rules for all domains about loading policy, setting enforcing mode, and setting checkreqprot, so we can drop redundant ones from netd and appdomain. Add neverallow rules to domain.te for setbool and setsecparam and exclude them from unconfined to allow fully eliminating separate neverallow rules on the :security class from anything other than domain.te. Change-Id: I0122e23ccb2b243f4c5376893e0c894f01f548fc Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-03-06 19:02:50 +01:00
allow unconfineddomain kernel:security ~{ load_policy setenforce setcheckreqprot setbool setsecparam };
remove syslog_* from unconfined As suggested in https://android-review.googlesource.com/95966 , remove various syslog_* from unconfined. SELinux domains which want to use syslog_* can declare it themselves. Change-Id: I7a8335850d1b8d3463491b4ef8c657f57384cfa4
2014-05-28 22:48:52 +02:00
allow unconfineddomain kernel:system ~{ syslog_read syslog_mod syslog_console };
Changed unconfined process policy to a whitelist. Rewrote the process policy in external/sepolicy/unconfined.te from a blacklist to a whitelist to be more easily understood. There were previously 11 disallowed permissions and now there are 19 allowed permissions. Change-Id: Ida4dc881c5fedc56980324774f40e09a9b8a830a
2014-05-31 02:07:36 +02:00
allow unconfineddomain domain:process {
fork
sigchld
sigkill
sigstop
signull
signal
getsched
setsched
getsession
getpgid
setpgid
getcap
setcap
share
getattr
noatsecure
siginh
setrlimit
rlimitinh
};
SE Android policy.
2012-01-04 18:33:27 +01:00
allow unconfineddomain domain:fd *;
allow unconfineddomain domain:dir r_dir_perms;
allow unconfineddomain domain:lnk_file r_file_perms;
allow unconfineddomain domain:{ fifo_file file } rw_file_perms;
allow unconfineddomain domain:socket_class_set *;
allow unconfineddomain domain:ipc_class_set *;
allow unconfineddomain domain:key *;
Restrict use of context= mount options. Prior to this change, the init and recovery domains were allowed unrestricted use of context= mount options to force all files within a given filesystem to be treated as having a security context specified at mount time. The context= mount option can be used in device-specific fstab.<board> files to assign a context to filesystems that do not support labeling such as vfat where the default label of sdcard_external is not appropriate (e.g. /firmware on hammerhead). Restrict the use of context= mount options to types marked with the contextmount_type attribute, and then remove write access from such types from unconfineddomain and prohibit write access to such types via neverallow. This ensures that the no write to /system restriction cannot be bypassed via context= mount. Change-Id: I4e773fadc9e11328d13a0acec164124ad6e840c1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-16 19:05:38 +02:00
allow unconfineddomain {fs_type -contextmount_type}:{ dir lnk_file sock_file fifo_file } ~relabelto;
allow unconfineddomain dev_type:{ dir lnk_file sock_file fifo_file } ~relabelto;
remove shell_data_file from unconfined. Domains which want to access /data/local/tmp must do so by creating their own SELinux domain. Bug: 15164984 Change-Id: I0061129c64e659c552cf6565058b0786fba59ae0
2014-06-07 19:00:59 +02:00
allow unconfineddomain {
file_type
-keystore_data_file
-property_data_file
-system_file
-exec_type
-security_file
-shell_data_file
}:{ dir lnk_file sock_file fifo_file } ~relabelto;
entrypoint should always be explicitly allowed. Also rewrite to use positive permission sets, macros, and eliminate duplication. Change-Id: I4dc340784f770e569160025a5db2dc3da90d2629 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-17 21:59:58 +02:00
allow unconfineddomain exec_type:dir r_dir_perms;
Remove execute_no_trans from unconfineddomain. execute_no_trans controls whether a domain can execve a program without switching to another domain. Exclude this permission from unconfineddomain, add it back to init, init_shell, and recovery for files in / and /system, and to kernel for files in / (to permit execution of init prior to setcon). Prohibit it otherwise for the kernel domain via neverallow. This ensures that if a kernel task attempts to execute a kernel usermodehelper for which no domain transition is defined, the exec will fail. Change-Id: Ie7b2349923672dd4f5faf7c068a6e5994fd0e4e3 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-19 15:07:17 +02:00
allow unconfineddomain exec_type:file { r_file_perms execute execmod };
entrypoint should always be explicitly allowed. Also rewrite to use positive permission sets, macros, and eliminate duplication. Change-Id: I4dc340784f770e569160025a5db2dc3da90d2629 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-17 21:59:58 +02:00
allow unconfineddomain exec_type:lnk_file r_file_perms;
allow unconfineddomain system_file:dir r_dir_perms;
Remove execute_no_trans from unconfineddomain. execute_no_trans controls whether a domain can execve a program without switching to another domain. Exclude this permission from unconfineddomain, add it back to init, init_shell, and recovery for files in / and /system, and to kernel for files in / (to permit execution of init prior to setcon). Prohibit it otherwise for the kernel domain via neverallow. This ensures that if a kernel task attempts to execute a kernel usermodehelper for which no domain transition is defined, the exec will fail. Change-Id: Ie7b2349923672dd4f5faf7c068a6e5994fd0e4e3 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-19 15:07:17 +02:00
allow unconfineddomain system_file:file { r_file_perms execute execmod };
entrypoint should always be explicitly allowed. Also rewrite to use positive permission sets, macros, and eliminate duplication. Change-Id: I4dc340784f770e569160025a5db2dc3da90d2629 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-17 21:59:58 +02:00
allow unconfineddomain system_file:lnk_file r_file_perms;
Restrict use of context= mount options. Prior to this change, the init and recovery domains were allowed unrestricted use of context= mount options to force all files within a given filesystem to be treated as having a security context specified at mount time. The context= mount option can be used in device-specific fstab.<board> files to assign a context to filesystems that do not support labeling such as vfat where the default label of sdcard_external is not appropriate (e.g. /firmware on hammerhead). Restrict the use of context= mount options to types marked with the contextmount_type attribute, and then remove write access from such types from unconfineddomain and prohibit write access to such types via neverallow. This ensures that the no write to /system restriction cannot be bypassed via context= mount. Change-Id: I4e773fadc9e11328d13a0acec164124ad6e840c1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-16 19:05:38 +02:00
allow unconfineddomain {
fs_type
-usermodehelper
-proc_security
-contextmount_type
Remove execute_no_trans from unconfineddomain. execute_no_trans controls whether a domain can execve a program without switching to another domain. Exclude this permission from unconfineddomain, add it back to init, init_shell, and recovery for files in / and /system, and to kernel for files in / (to permit execution of init prior to setcon). Prohibit it otherwise for the kernel domain via neverallow. This ensures that if a kernel task attempts to execute a kernel usermodehelper for which no domain transition is defined, the exec will fail. Change-Id: Ie7b2349923672dd4f5faf7c068a6e5994fd0e4e3 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-19 15:07:17 +02:00
}:{ chr_file file } ~{entrypoint execute_no_trans execmod execute relabelto};
allow unconfineddomain {dev_type -kmem_device}:{ chr_file file } ~{entrypoint execute_no_trans execmod execute relabelto};
remove shell_data_file from unconfined. Domains which want to access /data/local/tmp must do so by creating their own SELinux domain. Bug: 15164984 Change-Id: I0061129c64e659c552cf6565058b0786fba59ae0
2014-06-07 19:00:59 +02:00
allow unconfineddomain {
file_type
-keystore_data_file
-property_data_file
-system_file
-exec_type
-security_file
-shell_data_file
Remove execute_no_trans from unconfineddomain. execute_no_trans controls whether a domain can execve a program without switching to another domain. Exclude this permission from unconfineddomain, add it back to init, init_shell, and recovery for files in / and /system, and to kernel for files in / (to permit execution of init prior to setcon). Prohibit it otherwise for the kernel domain via neverallow. This ensures that if a kernel task attempts to execute a kernel usermodehelper for which no domain transition is defined, the exec will fail. Change-Id: Ie7b2349923672dd4f5faf7c068a6e5994fd0e4e3 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-19 15:07:17 +02:00
}:{ chr_file file } ~{entrypoint execute_no_trans execmod execute relabelto};
entrypoint should always be explicitly allowed. Also rewrite to use positive permission sets, macros, and eliminate duplication. Change-Id: I4dc340784f770e569160025a5db2dc3da90d2629 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-17 21:59:58 +02:00
allow unconfineddomain rootfs:file execute;
Restrict use of context= mount options. Prior to this change, the init and recovery domains were allowed unrestricted use of context= mount options to force all files within a given filesystem to be treated as having a security context specified at mount time. The context= mount option can be used in device-specific fstab.<board> files to assign a context to filesystems that do not support labeling such as vfat where the default label of sdcard_external is not appropriate (e.g. /firmware on hammerhead). Restrict the use of context= mount options to types marked with the contextmount_type attribute, and then remove write access from such types from unconfineddomain and prohibit write access to such types via neverallow. This ensures that the no write to /system restriction cannot be bypassed via context= mount. Change-Id: I4e773fadc9e11328d13a0acec164124ad6e840c1 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-06-16 19:05:38 +02:00
allow unconfineddomain contextmount_type:dir r_dir_perms;
allow unconfineddomain contextmount_type:notdevfile_class_set r_file_perms;
SE Android policy.
2012-01-04 18:33:27 +01:00
allow unconfineddomain node_type:node *;
Clean up remaining denials. Bug: 8424461 Change-Id: I8f0b01cdb19b4a479d5de842f4e4844aeab00622
2013-05-22 22:19:58 +02:00
allow unconfineddomain node_type:{ tcp_socket udp_socket rawip_socket } node_bind;
SE Android policy.
2012-01-04 18:33:27 +01:00
allow unconfineddomain netif_type:netif *;
allow unconfineddomain port_type:socket_class_set name_bind;
allow unconfineddomain port_type:{ tcp_socket dccp_socket } name_connect;
allow unconfineddomain domain:peer recv;
Don't allow zygote init:binder call init can't handle binder calls. It's always incorrect to allow init:binder call, and represents a binder call to a service without an SELinux domain. Adding this allow rule was a mistake; the dumpstate SELinux domain didn't exist at the time this rule was written, and dumpstate was running under init's domain. Add a neverallow rule to prevent the reintroduction of this bug. Change-Id: I78d35e675fd142d880f15329471778c18972bf50
2014-01-04 05:44:07 +01:00
allow unconfineddomain { domain -init }:binder { call transfer set_context_mgr };
Restrict /data/security and setprop selinux.reload_policy access. Remove /data/security and setprop selinux.reload_policy access from unconfineddomain, and only add back what is needed to init (system_server already gets the required allow rules via the selinux_manage_policy macro). init (via init.rc post-fs-data) originally creates /data/security and may later restorecon it. init also sets the property (also from init.rc post-fs-data) to trigger a reload once /data is mounted. The system_server (SELinuxPolicyInstallReceiver in particular) creates subdirectories under /data/security for updates, writes files to these subdirectories, creates the /data/security/current symlink to the update directory, and sets the property to trigger a reload when an update bundle is received. Add neverallow rules to ensure that we do not allow undesired access to security_file or security_prop. This is only truly meaningful if the support for /data/security policies is restored, but is harmless otherwise. Also drop the persist.mmac property_contexts entry; it was never used in AOSP, only in our tree (for middleware MAC) and is obsolete. Change-Id: I5ad5e3b6fc7abaafd314d31723f37b708d8fcf89 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-30 16:25:00 +02:00
allow unconfineddomain { property_type -security_prop }:property_service set;
Reference in a new issue Copy permalink