tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "sepolicy: Make wpa_supplicant a HIDL service"

Browse source 
am: 87039898ad

Change-Id: If796c95bc4a0537821e7641c72bf50f333340772
This commit is contained in:
Roshan Pius 2017-03-07 17:29:25 +00:00 committed by android-build-merger
commit 04a4817776
11 changed files with 71 additions and 70 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
private/file_contexts
View file

@ -204,7 +204,6 @@
/system/bin/crash_dump32 u:object_r:crash_dump_exec:s0
/system/bin/crash_dump64 u:object_r:crash_dump_exec:s0
/system/bin/tombstoned u:object_r:tombstoned_exec:s0
/system/bin/wpa_supplicant u:object_r:wpa_exec:s0
/system/bin/recovery-persist u:object_r:recovery_persist_exec:s0
/system/bin/recovery-refresh u:object_r:recovery_refresh_exec:s0
/system/bin/sdcard u:object_r:sdcardd_exec:s0

1
private/service_contexts
View file

@ -165,5 +165,4 @@ wifi u:object_r:wifi_service:s0
wificond u:object_r:wificond_service:s0
wifiaware u:object_r:wifiaware_service:s0
window u:object_r:window_service:s0
wpa u:object_r:wpa_supplicant_service:s0
* u:object_r:default_android_service:s0

5
private/system_server.te
View file

@ -158,7 +158,8 @@ unix_socket_connect(system_server, vold, vold)
unix_socket_connect(system_server, webview_zygote, webview_zygote)
unix_socket_connect(system_server, zygote, zygote)
unix_socket_connect(system_server, racoon, racoon)
unix_socket_send(system_server, wpa, wpa)
# TODO(b/35707797): Remove this socket access.
unix_socket_send(system_server, wpa, hal_wifi_supplicant_server)
unix_socket_connect(system_server, uncrypt, uncrypt)
# Communicate over a socket created by surfaceflinger.
@ -194,7 +195,7 @@ binder_call(system_server, hal_usb)
binder_call(system_server, hal_vibrator)
binder_call(system_server, hal_vr)
hal_client_domain(system_server, hal_wifi)
binder_call(system_server, wpa)
hal_client_domain(system_server, hal_wifi_supplicant)
# Talk to tombstoned to get ANR traces.
unix_socket_connect(system_server, tombstoned_intercept, tombstoned)

6
private/wpa.te
View file

@ -1,6 +0,0 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
init_daemon_domain(wpa)
# Create a socket for receiving info from wpa
type_transition wpa wifi_data_file:dir wpa_socket "sockets";

3
public/attributes
View file

@ -168,3 +168,6 @@ attribute hal_vr;
attribute hal_wifi;
attribute hal_wifi_client;
attribute hal_wifi_server;
attribute hal_wifi_supplicant;
attribute hal_wifi_supplicant_client;
attribute hal_wifi_supplicant_server;

3
public/domain_deprecated.te
View file

@ -228,7 +228,6 @@ auditallow {
-tee
-ueventd
-vold
-wpa
} sysfs:dir { open getattr read ioctl lock }; # search granted in domain
auditallow {
domain_deprecated
@ -243,7 +242,6 @@ auditallow {
-tee
-ueventd
-vold
-wpa
} sysfs:file r_file_perms;
auditallow {
domain_deprecated
@ -258,7 +256,6 @@ auditallow {
-tee
-ueventd
-vold
-wpa
} sysfs:lnk_file { getattr open ioctl lock }; # read granted in domain
auditallow {
domain_deprecated

55
public/hal_wifi_supplicant.te Normal file
View file

@ -0,0 +1,55 @@
# HwBinder IPC from client to server
binder_call(hal_wifi_supplicant_client, hal_wifi_supplicant_server)
binder_call(hal_wifi_supplicant_server, hal_wifi_supplicant_client)
# in addition to ioctls whitelisted for all domains, grant hal_wifi_supplicant priv_sock_ioctls.
allowxperm hal_wifi_supplicant self:udp_socket ioctl priv_sock_ioctls;
r_dir_file(hal_wifi_supplicant, sysfs_type)
r_dir_file(hal_wifi_supplicant, proc_net)
allow hal_wifi_supplicant kernel:system module_request;
allow hal_wifi_supplicant self:capability { setuid net_admin setgid net_raw };
allow hal_wifi_supplicant cgroup:dir create_dir_perms;
allow hal_wifi_supplicant self:netlink_route_socket nlmsg_write;
allow hal_wifi_supplicant self:netlink_socket create_socket_perms_no_ioctl;
allow hal_wifi_supplicant self:netlink_generic_socket create_socket_perms_no_ioctl;
allow hal_wifi_supplicant self:packet_socket create_socket_perms;
allowxperm hal_wifi_supplicant self:packet_socket ioctl { unpriv_sock_ioctls priv_sock_ioctls unpriv_tty_ioctls };
allow hal_wifi_supplicant wifi_data_file:dir create_dir_perms;
allow hal_wifi_supplicant wifi_data_file:file create_file_perms;
# TODO(b/35707797): Remove this socket access.
unix_socket_send(hal_wifi_supplicant, system_wpa, system_server)
# HIDL interface exposed by WPA.
hwbinder_use(hal_wifi_supplicant)
binder_call(hal_wifi_supplicant, system_server)
# Create a socket for receiving info from wpa
allow hal_wifi_supplicant wpa_socket:dir create_dir_perms;
allow hal_wifi_supplicant wpa_socket:sock_file create_file_perms;
# TODO(b/34131400): Use hwbinder to access keystore.
use_keystore(hal_wifi_supplicant)
binder_use(hal_wifi_supplicant)
# WPA (wifi) has a restricted set of permissions from the default.
allow hal_wifi_supplicant keystore:keystore_key {
get
sign
verify
};
# Allow wpa_cli to work. wpa_cli creates a socket in
# /data/misc/wifi/sockets which hal_wifi_supplicant supplicant communicates with.
userdebug_or_eng(`
unix_socket_send(hal_wifi_supplicant, wpa, su)
')
###
### neverallow rules
###
# wpa_supplicant should not trust any data from sdcards
neverallow hal_wifi_supplicant_server sdcard_type:dir ~getattr;
neverallow hal_wifi_supplicant_server sdcard_type:file *;

1
public/service.te
View file

@ -142,4 +142,3 @@ type wifi_service, app_api_service, system_server_service, service_manager_type;
type wificond_service, service_manager_type;
type wifiaware_service, app_api_service, system_server_service, service_manager_type;
type window_service, system_api_service, system_server_service, service_manager_type;
type wpa_supplicant_service, system_server_service, service_manager_type;

56
public/wpa.te
View file

@ -1,56 +0,0 @@
# wpa - wpa supplicant or equivalent
type wpa, domain, domain_deprecated;
type wpa_exec, exec_type, file_type;
net_domain(wpa)
# in addition to ioctls whitelisted for all domains, grant wpa priv_sock_ioctls.
allowxperm wpa self:udp_socket ioctl priv_sock_ioctls;
r_dir_file(wpa, sysfs_type)
r_dir_file(wpa, proc_net)
allow wpa kernel:system module_request;
allow wpa self:capability { setuid net_admin setgid net_raw };
allow wpa cgroup:dir create_dir_perms;
allow wpa self:netlink_route_socket nlmsg_write;
allow wpa self:netlink_socket create_socket_perms_no_ioctl;
allow wpa self:netlink_generic_socket create_socket_perms_no_ioctl;
allow wpa self:packet_socket create_socket_perms;
allowxperm wpa self:packet_socket ioctl { unpriv_sock_ioctls priv_sock_ioctls unpriv_tty_ioctls };
allow wpa wifi_data_file:dir create_dir_perms;
allow wpa wifi_data_file:file create_file_perms;
unix_socket_send(wpa, system_wpa, system_server)
# Keystore access via binder.
binder_use(wpa)
# HIDL interface exposed by WPA.
hwbinder_use(wpa)
binder_call(wpa, system_server)
# Create a socket for receiving info from wpa
allow wpa wpa_socket:dir create_dir_perms;
allow wpa wpa_socket:sock_file create_file_perms;
use_keystore(wpa)
# WPA (wifi) has a restricted set of permissions from the default.
allow wpa keystore:keystore_key {
get
sign
verify
};
# Allow wpa_cli to work. wpa_cli creates a socket in
# /data/misc/wifi/sockets which wpa supplicant communicates with.
userdebug_or_eng(`
unix_socket_send(wpa, wpa, su)
')
###
### neverallow rules
###
# wpa_supplicant should not trust any data from sdcards
neverallow wpa sdcard_type:dir ~getattr;
neverallow wpa sdcard_type:file *;

1
vendor/file_contexts vendored
View file

@ -28,3 +28,4 @@
/(vendor|system/vendor)/bin/hw/android\.hardware\.vibrator@1\.0-service u:object_r:hal_vibrator_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.vr@1\.0-service u:object_r:hal_vr_default_exec:s0
/(vendor|system/vendor)/bin/hw/android\.hardware\.wifi@1\.0-service u:object_r:hal_wifi_default_exec:s0
/(vendor|system/vendor)/bin/hw/wpa_supplicant u:object_r:hal_wifi_supplicant_default_exec:s0

9
vendor/hal_wifi_supplicant_default.te vendored Normal file
View file

@ -0,0 +1,9 @@
# wpa supplicant or equivalent
type hal_wifi_supplicant_default, domain;
hal_server_domain(hal_wifi_supplicant_default, hal_wifi_supplicant)
type hal_wifi_supplicant_default_exec, exec_type, file_type;
init_daemon_domain(hal_wifi_supplicant_default)
net_domain(hal_wifi_supplicant_default)
# Create a socket for receiving info from wpa
type_transition hal_wifi_supplicant_default wifi_data_file:dir wpa_socket "sockets";