tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

SElinux: Clean up code related to foreign dex use

Browse source 
am: 2b291121b9

Change-Id: I4da5fd5c5185eab1a80b427dc49bd49472831882
This commit is contained in:
Calin Juravle 2017-03-07 19:06:12 +00:00 committed by android-build-merger
commit 3227d2ce1f
8 changed files with 0 additions and 26 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
private/app.te
View file

@ -121,13 +121,6 @@ allow appdomain shell_data_file:file { write getattr };
# Write profiles /data/misc/profiles
allow appdomain user_profile_data_file:dir { search write add_name };
allow appdomain user_profile_data_file:file create_file_perms;
# Profiles for foreign dex files are just markers and only need create permissions.
allow appdomain user_profile_foreign_dex_data_file:dir { search write add_name };
allow appdomain user_profile_foreign_dex_data_file:file create;
# There is no way to create user_profile_foreign_dex_data_file without
# generating open/read denials. These permissions should not be granted and the
# denial is harmless. dontaudit to suppress the denial.
dontaudit appdomain user_profile_foreign_dex_data_file:file { open read };
# Send heap dumps to system_server via an already open file descriptor
# % adb shell am set-watch-heap com.android.systemui 1048576
@ -471,10 +464,6 @@ neverallow {
-apk_data_file
}:file no_x_file_perms;
# Foreign dex profiles are just markers. Prevent apps to do anything but touch them.
neverallow appdomain user_profile_foreign_dex_data_file:file rw_file_perms;
neverallow appdomain user_profile_foreign_dex_data_file:dir { open getattr read ioctl remove_name };
# Applications should use the activity model for receiving events
neverallow {
appdomain

1
private/app_neverallows.te
View file

@ -81,7 +81,6 @@ neverallow all_untrusted_apps {
-media_rw_data_file # Internal storage. Known that apps can
# leave artfacts here after uninstall.
-user_profile_data_file # Access to profile files
-user_profile_foreign_dex_data_file # Access to profile files
userdebug_or_eng(`
-method_trace_data_file # only on ro.debuggable=1
-coredump_file # userdebug/eng only

1
private/file_contexts
View file

@ -334,7 +334,6 @@
# TODO(calin) label profile reference differently so that only
# profman run as a special user can write to them
/data/misc/profiles/cur(/.*)? u:object_r:user_profile_data_file:s0
/data/misc/profiles/cur/[0-9]+/foreign-dex(/.*)? u:object_r:user_profile_foreign_dex_data_file:s0
/data/misc/profiles/ref(/.*)? u:object_r:user_profile_data_file:s0
/data/misc/profman(/.*)? u:object_r:profman_dump_data_file:s0

7
private/system_server.te
View file

@ -22,13 +22,6 @@ type_transition system_server wpa_socket:sock_file system_wpa_socket;
allow system_server dalvikcache_data_file:dir r_dir_perms;
allow system_server dalvikcache_data_file:file { r_file_perms execute };
# Enable system server to check the foreign dex usage markers.
# We need search on top level directories so that we can get to the files
allow system_server user_profile_data_file:dir search;
allow system_server user_profile_data_file:file getattr;
allow system_server user_profile_foreign_dex_data_file:dir { add_name open read write search remove_name };
allow system_server user_profile_foreign_dex_data_file:file { getattr rename unlink };
# /data/resource-cache
allow system_server resourcecache_data_file:file r_file_perms;
allow system_server resourcecache_data_file:dir r_dir_perms;

2
public/dumpstate.te
View file

@ -155,8 +155,6 @@ allow dumpstate recovery_data_file:file r_file_perms;
userdebug_or_eng(`
allow dumpstate user_profile_data_file:dir r_dir_perms;
allow dumpstate user_profile_data_file:file r_file_perms;
allow dumpstate user_profile_foreign_dex_data_file:dir r_dir_perms;
allow dumpstate user_profile_foreign_dex_data_file:file r_file_perms;
')
# Access /data/misc/logd

1
public/file.te
View file

@ -113,7 +113,6 @@ type ota_data_file, file_type, data_file_type;
type ota_package_file, file_type, data_file_type, mlstrustedobject;
# /data/misc/profiles
type user_profile_data_file, file_type, data_file_type, mlstrustedobject;
type user_profile_foreign_dex_data_file, file_type, data_file_type, mlstrustedobject;
# /data/misc/profman
type profman_dump_data_file, file_type, data_file_type;
# /data/resource-cache

2
public/installd.te
View file

@ -104,8 +104,6 @@ allow installd user_profile_data_file:dir create_dir_perms;
allow installd user_profile_data_file:file create_file_perms;
allow installd user_profile_data_file:dir rmdir;
allow installd user_profile_data_file:file unlink;
allow installd user_profile_foreign_dex_data_file:dir { add_name getattr rmdir open read write search remove_name };
allow installd user_profile_foreign_dex_data_file:file { getattr rename unlink };
# Files created/updated by profman dumps.
allow installd profman_dump_data_file:dir { search add_name write };

1
public/vold.te
View file

@ -169,7 +169,6 @@ allow vold toolbox_exec:file rx_file_perms;
# Prepare profile dir for users.
allow vold user_profile_data_file:dir create_dir_perms;
allow vold user_profile_foreign_dex_data_file:dir { getattr setattr };
# Raw writes to misc block device
allow vold misc_block_device:blk_file w_file_perms;