tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

sepolicy: Add label to userdata file node

Browse source 
The userdata file node should be labeled to
avoid avc denied.

Bug: 171760673
Bug: 177364376
Test: build pass
Signed-off-by: Randall Huang <huangrandall@google.com>
Change-Id: I9ba89c75c120864c64ea278934b15edc3ba18a6c
This commit is contained in:
Randall Huang 2021-02-19 07:45:02 +08:00
parent 1aad552cfd
commit 10d42cec51
6 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
private/compat/30.0/30.0.ignore.cil
View file

@ -106,6 +106,7 @@
texttospeech_service
transformer_service
update_engine_stable_service
userdata_sysdev
usermanager_service
userspace_reboot_metadata_file
vcn_management_service

1
private/file_contexts
View file

@ -173,6 +173,7 @@
/dev/socket/usap_pool_primary u:object_r:zygote_socket:s0
/dev/socket/usap_pool_secondary u:object_r:zygote_socket:s0
/dev/spdif_out.* u:object_r:audio_device:s0
/dev/sys/fs/by-name/userdata(/.*)? u:object_r:userdata_sysdev:s0
/dev/tty u:object_r:owntty_device:s0
/dev/tty[0-9]* u:object_r:tty_device:s0
/dev/ttyS[0-9]* u:object_r:serial_device:s0

3
public/device.te
View file

@ -117,3 +117,6 @@ type super_block_device, super_block_device_type, dev_type;
# separate device node. gsid, however, accesses the original devide node
# created through uevents, so we use a separate label.
type sdcard_block_device, dev_type;
# Userdata device file for filesystem tunables
type userdata_sysdev, dev_type;

3
public/init.te
View file

@ -600,6 +600,9 @@ allow init system_bootstrap_lib_file:file { execute read open getattr map };
# stat the root dir of fuse filesystems (for the mount handler)
allow init fuse:dir { search getattr };
# allow filesystem tuning
allow init userdata_sysdev:file create_file_perms;
###
### neverallow rules
###

1
public/userdata_sysdev.te Normal file
View file

@ -0,0 +1 @@
allow userdata_sysdev sysfs:filesystem associate;

3
public/vendor_init.te
View file

@ -197,6 +197,9 @@ allow vendor_init misc_block_device:blk_file w_file_perms;
allow vendor_init system_bootstrap_lib_file:dir r_dir_perms;
allow vendor_init system_bootstrap_lib_file:file { execute read open getattr map };
# allow filesystem tuning
allow vendor_init userdata_sysdev:file create_file_perms;
# Everything is labeled as rootfs in recovery mode. Vendor init has to execute
# the dynamic linker and shared libraries.
recovery_only(`