tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Further lock down app data

Browse source 
Assert that only apps and installd may open private app files.

Remove "open" permission for mediaserver/vold and remove their
neverallow exemption.

Test: verify no related audit messages in the logs.
Test: build
Fixes: 80300620
Fixes: 80418809
Bug: 80190017
Change-Id: If0c1862a273af1fedd8898f334c9b0aa6b9be728
This commit is contained in:
Jeff Vander Stoep 2018-09-22 22:28:20 -07:00
parent 7087bf1256
commit 0b67bb88e5
4 changed files with 1 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
private/domain.te
View file

@ -142,12 +142,10 @@ neverallow {
-dexoptanalyzer
-init
-installd
-mediaserver # b/80300620
userdebug_or_eng(`-perfprofd')
-profman
-runas
-system_server
-vold
} { privapp_data_file app_data_file }:dir *;
# Only apps should be modifying app data. init and installd are exempted for
@ -163,9 +161,7 @@ neverallow {
domain
-appdomain
-installd
-mediaserver # b/80300620
userdebug_or_eng(`-perfprofd')
-vold # b/80418809
} { privapp_data_file app_data_file }:file_class_set open;
neverallow {

1
public/domain.te
View file

@ -1280,7 +1280,6 @@ neverallow {
domain
-appdomain
-installd
-uncrypt # TODO: see if we can remove
} { app_data_file privapp_data_file }:lnk_file read;
neverallow {

6
public/mediaserver.te
View file

@ -27,11 +27,7 @@ binder_service(mediaserver)
allow mediaserver media_data_file:dir create_dir_perms;
allow mediaserver media_data_file:file create_file_perms;
# TODO(b/80190017, b/80300620): remove direct access to private app data
userdebug_or_eng(`auditallow mediaserver { app_data_file privapp_data_file }:dir search;')
allow mediaserver { app_data_file privapp_data_file }:dir search;
userdebug_or_eng(`auditallow mediaserver { app_data_file privapp_data_file }:file open;')
allow mediaserver { app_data_file privapp_data_file }:file rw_file_perms;
allow mediaserver { app_data_file privapp_data_file }:file { append getattr ioctl lock map read write };
allow mediaserver sdcard_type:file write;
allow mediaserver gpu_device:chr_file rw_file_perms;
allow mediaserver video_device:dir r_dir_perms;

5
public/vold.te
View file

@ -81,11 +81,6 @@ allow vold tmpfs:dir create_dir_perms;
allow vold tmpfs:dir mounton;
allow vold self:global_capability_class_set { net_admin dac_override dac_read_search mknod sys_admin chown fowner fsetid };
allow vold self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
# TODO(b/80418809): remove direct access to private app data
userdebug_or_eng(`auditallow vold { app_data_file privapp_data_file }:dir search;')
allow vold { app_data_file privapp_data_file }:dir search;
userdebug_or_eng(`auditallow vold { app_data_file privapp_data_file }:file rw_file_perms;')
allow vold { app_data_file privapp_data_file }:file rw_file_perms;
allow vold loop_control_device:chr_file rw_file_perms;
allow vold loop_device:blk_file { create setattr unlink rw_file_perms };
allow vold vold_device:blk_file { create setattr unlink rw_file_perms };