tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "aconfigd: create aconfig daemon selinux policy" into main am: 067f7db593

Browse source 
Original change: https://android-review.googlesource.com/c/platform/system/sepolicy/+/2976451

Change-Id: Ib86e806430e8decea25e8de9b5f314891561e521
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
This commit is contained in:
Dennis Shen 2024-02-28 13:21:35 +00:00 committed by Automerger Merge Worker
commit 154a08ef7e
8 changed files with 44 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
contexts/plat_file_contexts_test
View file

@ -189,6 +189,7 @@
/dev/socket socket_device
/dev/socket/does_not_exist socket_device
/dev/socket/adbd adbd_socket
/dev/socket/aconfigd aconfigd_socket
/dev/socket/dnsproxyd dnsproxyd_socket
/dev/socket/dumpstate dumpstate_socket
/dev/socket/fwmarkd fwmarkd_socket
@ -462,6 +463,7 @@
/system/usr/share/zoneinfo system_zoneinfo_file
/system/usr/share/zoneinfo/0 system_zoneinfo_file
/system/bin/adbd adbd_exec
/system/bin/aconfigd aconfigd_exec
/system/bin/vold_prepare_subdirs vold_prepare_subdirs_exec
/system/bin/stats stats_exec
/system/bin/statsd statsd_exec

28
private/aconfigd.te Normal file
View file

@ -0,0 +1,28 @@
# aconfigd -- manager for aconfig flags
type aconfigd, domain;
type aconfigd_exec, exec_type, file_type, system_file_type;
typeattribute aconfigd coredomain;
init_daemon_domain(aconfigd)
# only init is allowed to enter the aconfigd domain
neverallow { domain -init } aconfigd:process transition;
neverallow * aconfigd:process dyntransition;
allow aconfigd metadata_file:dir search;
allow aconfigd {
aconfig_storage_metadata_file
aconfig_storage_flags_metadata_file
}:dir create_dir_perms;
allow aconfigd {
aconfig_storage_metadata_file
aconfig_storage_flags_metadata_file
}:file create_file_perms;
allow aconfigd aconfigd_socket:sock_file rw_file_perms;
# allow aconfigd to log to the kernel.
allow aconfigd kmsg_device:chr_file w_file_perms;

3
private/compat/34.0/34.0.ignore.cil
View file

@ -46,4 +46,7 @@
profiling_service
aconfig_storage_metadata_file
aconfig_storage_flags_metadata_file
aconfigd
aconfigd_exec
aconfigd_socket
))

4
private/domain.te
View file

@ -808,3 +808,7 @@ neverallow { domain -init } mtectrl:process { dyntransition transition };
# For now, don't allow processes other than gmscore to access /data/misc_ce/<userid>/checkin
neverallow { domain -gmscore_app -init -vold_prepare_subdirs } checkin_data_file:{dir file} *;
# Do not allow write access to aconfig flag value files except init and aconfigd
neverallow { domain -init -aconfigd } aconfig_storage_metadata_file:dir *;
neverallow { domain -init -aconfigd } aconfig_storage_metadata_file:file no_w_file_perms;

3
private/file.te
View file

@ -148,3 +148,6 @@ type system_font_fallback_file, system_file_type, file_type;
# Type for /sys/devices/uprobe.
type sysfs_uprobe, fs_type, sysfs_type;
# Type for aconfig daemon socket
type aconfigd_socket, file_type, coredomain_socket;

2
private/file_contexts
View file

@ -155,6 +155,7 @@
/dev/snd(/.*)? u:object_r:audio_device:s0
/dev/socket(/.*)? u:object_r:socket_device:s0
/dev/socket/adbd u:object_r:adbd_socket:s0
/dev/socket/aconfigd u:object_r:aconfigd_socket:s0
/dev/socket/dnsproxyd u:object_r:dnsproxyd_socket:s0
/dev/socket/dumpstate u:object_r:dumpstate_socket:s0
/dev/socket/fwmarkd u:object_r:fwmarkd_socket:s0
@ -386,6 +387,7 @@
/system/bin/bpfloader u:object_r:bpfloader_exec:s0
/system/bin/netbpfload u:object_r:bpfloader_exec:s0
/system/bin/watchdogd u:object_r:watchdogd_exec:s0
/system/bin/aconfigd u:object_r:aconfigd_exec:s0
/system/bin/apexd u:object_r:apexd_exec:s0
/system/bin/gsid u:object_r:gsid_exec:s0
/system/bin/simpleperf u:object_r:simpleperf_exec:s0

5
private/system_server.te
View file

@ -1528,9 +1528,8 @@ neverallow { domain -init -system_server } userspace_reboot_metadata_file:dir *;
neverallow { domain -init -system_server } userspace_reboot_metadata_file:file no_rw_file_perms;
# Only system server should access /metadata/aconfig
# TODO: add storage daemon to neverallow exception when it is introduced
neverallow { domain -init -system_server } aconfig_storage_flags_metadata_file:dir *;
neverallow { domain -init -system_server } aconfig_storage_flags_metadata_file:file no_rw_file_perms;
neverallow { domain -init -system_server -aconfigd } aconfig_storage_flags_metadata_file:dir *;
neverallow { domain -init -system_server -aconfigd } aconfig_storage_flags_metadata_file:file no_rw_file_perms;
# Allow systemserver to read/write the invalidation property
set_prop(system_server, binder_cache_system_server_prop)

5
public/domain.te
View file

@ -630,11 +630,6 @@ neverallow hwservicemanager vndbinder_device:chr_file no_rw_file_perms;
neverallow vndservicemanager binder_device:chr_file no_rw_file_perms;
neverallow vndservicemanager hwbinder_device:chr_file no_rw_file_perms;
# Do not allow write access to the general aconfig pb file and boot flag value files except init
# TODO: need to add storage daemon into this exception list once it is created
neverallow { domain -init } aconfig_storage_metadata_file:dir *;
neverallow { domain -init } aconfig_storage_metadata_file:file no_w_file_perms;
full_treble_only(`
# Vendor apps are permited to use only stable public services. If they were to use arbitrary
# services which can change any time framework/core is updated, breakage is likely.