From 4ab64c940f611d716b7e2939b703bb1020ecb15b Mon Sep 17 00:00:00 2001 From: Florian Mayer Date: Tue, 19 Mar 2019 18:14:38 +0000 Subject: [PATCH] Relabel /data/system/packages.list to new type. Conservatively grant access to packages_list_file to everything that had access to system_data_file:file even if the comment in the SELinux policy suggests it was for another use. Ran a diff on the resulting SEPolicy, the only difference of domains being granted is those that had system_data_file:dir permissiosn which is clearly not applicable for packages.list diff -u0 <(sesearch --allow -t system_data_file ~/sepolicy | sed 's/system_data_file/packages_list_file/') <(sesearch --allow -t packages_list_file ~/sepolicy_new) --- /proc/self/fd/16 2019-03-19 20:01:44.378409146 +0000 +++ /proc/self/fd/18 2019-03-19 20:01:44.378409146 +0000 @@ -3 +2,0 @@ -allow appdomain packages_list_file:dir getattr; @@ -6 +4,0 @@ -allow coredomain packages_list_file:dir getattr; @@ -8 +5,0 @@ -allow domain packages_list_file:dir search; @@ -35 +31,0 @@ -allow system_server packages_list_file:dir { rename search setattr read lock create reparent getattr write relabelfrom ioctl rmdir remove_name open add_name }; @@ -40 +35,0 @@ -allow tee packages_list_file:dir { search read lock getattr ioctl open }; @@ -43,3 +37,0 @@ -allow traced_probes packages_list_file:dir { read getattr open search }; -allow vendor_init packages_list_file:dir { search setattr read create getattr write relabelfrom ioctl rmdir remove_name open add_name }; -allow vold packages_list_file:dir { search setattr read lock create getattr mounton write ioctl rmdir remove_name open add_name }; @@ -48 +39,0 @@ -allow vold_prepare_subdirs packages_list_file:dir { read write relabelfrom rmdir remove_name open add_name }; @@ -50 +40,0 @@ -allow zygote packages_list_file:dir { search read lock getattr ioctl open }; Bug: 123186697 Change-Id: Ieabf313653deb5314872b63cd47dadd535af7b07 --- private/compat/28.0/28.0.cil | 3 ++- private/file_contexts | 1 + private/storaged.te | 1 + private/system_server.te | 5 +++++ public/file.te | 4 ++++ public/logd.te | 3 ++- public/runas.te | 1 + public/sdcardd.te | 1 + public/simpleperf_app_runner.te | 1 + 9 files changed, 18 insertions(+), 2 deletions(-) diff --git a/private/compat/28.0/28.0.cil b/private/compat/28.0/28.0.cil index 29efc2211..a102ab0e5 100644 --- a/private/compat/28.0/28.0.cil +++ b/private/compat/28.0/28.0.cil @@ -1581,7 +1581,8 @@ (typeattributeset system_boot_reason_prop_28_0 (system_boot_reason_prop)) (typeattributeset system_data_file_28_0 ( dropbox_data_file - system_data_file)) + system_data_file + packages_list_file)) (typeattributeset system_file_28_0 ( system_file system_asan_options_file diff --git a/private/file_contexts b/private/file_contexts index b913e941f..cd1df0aba 100644 --- a/private/file_contexts +++ b/private/file_contexts @@ -421,6 +421,7 @@ # propagate to the "Expanded data files" section. # /data(/.*)? u:object_r:system_data_file:s0 +/data/system/packages\.list u:object_r:packages_list_file:s0 /data/.layout_version u:object_r:install_data_file:s0 /data/unencrypted(/.*)? u:object_r:unencrypted_data_file:s0 /data/backup(/.*)? u:object_r:backup_data_file:s0 diff --git a/private/storaged.te b/private/storaged.te index 0e31483ff..3ed24b233 100644 --- a/private/storaged.te +++ b/private/storaged.te @@ -12,6 +12,7 @@ allow storaged proc_uid_io_stats:file r_file_perms; # Read /data/system/packages.list allow storaged system_data_file:file r_file_perms; +allow storaged packages_list_file:file r_file_perms; # Store storaged proto file allow storaged storaged_data_file:dir rw_dir_perms; diff --git a/private/system_server.te b/private/system_server.te index 8fff84832..bf9c95041 100644 --- a/private/system_server.te +++ b/private/system_server.te @@ -357,6 +357,7 @@ allow system_server ota_package_file:file create_file_perms; # Manage system data files. allow system_server system_data_file:dir create_dir_perms; allow system_server system_data_file:notdevfile_class_set create_file_perms; +allow system_server packages_list_file:file create_file_perms; allow system_server keychain_data_file:dir create_dir_perms; allow system_server keychain_data_file:file create_file_perms; allow system_server keychain_data_file:lnk_file create_file_perms; @@ -525,6 +526,10 @@ allow system_server media_rw_data_file:dir { search getattr open read }; # Also used for measuring disk usage. allow system_server media_rw_data_file:file { getattr read write append }; +# System server needs to setfscreate to packages_list_file when writing +# /data/system/packages.list +allow system_server system_server:process setfscreate; + # Relabel apk files. allow system_server { apk_tmp_file apk_private_tmp_file }:{ dir file } { relabelfrom relabelto }; allow system_server { apk_data_file apk_private_data_file }:{ dir file } { relabelfrom relabelto }; diff --git a/public/file.te b/public/file.te index 883f4a3c5..ccf6d85ca 100644 --- a/public/file.te +++ b/public/file.te @@ -221,6 +221,10 @@ type cgroup_rc_file, file_type; type coredump_file, file_type; # Default type for anything under /data. type system_data_file, file_type, data_file_type, core_data_file_type; +# Type for /data/system/packages.list. +# TODO(b/129332765): Narrow down permissions to this. +# Find out users of system_data_file that should be granted only this. +type packages_list_file, file_type, data_file_type, core_data_file_type; # Default type for anything under /data/vendor{_ce,_de}. type vendor_data_file, file_type, data_file_type; # Unencrypted data diff --git a/public/logd.te b/public/logd.te index 0cbefb43a..57e29d940 100644 --- a/public/logd.te +++ b/public/logd.te @@ -13,6 +13,7 @@ allow logd self:netlink_audit_socket { create_socket_perms_no_ioctl nlmsg_write allow logd kernel:system syslog_read; allow logd kmsg_device:chr_file { getattr w_file_perms }; allow logd system_data_file:{ file lnk_file } r_file_perms; +allow logd packages_list_file:file r_file_perms; allow logd pstorefs:dir search; allow logd pstorefs:file r_file_perms; userdebug_or_eng(` @@ -58,7 +59,7 @@ neverallow { domain userdebug_or_eng(`-crash_dump -llkd') } logd:process ptrace; neverallow logd system_file:dir_file_class_set write; # Write to files in /data/data or system files on /data -neverallow logd { app_data_file privapp_data_file system_data_file }:dir_file_class_set write; +neverallow logd { app_data_file privapp_data_file system_data_file packages_list_file }:dir_file_class_set write; # Only init is allowed to enter the logd domain via exec() neverallow { domain -init } logd:process transition; diff --git a/public/runas.te b/public/runas.te index b1daa31b9..356a0190c 100644 --- a/public/runas.te +++ b/public/runas.te @@ -13,6 +13,7 @@ allow runas shell_data_file:file { read write }; # run-as reads package information. allow runas system_data_file:file r_file_perms; allow runas system_data_file:lnk_file getattr; +allow runas packages_list_file:file r_file_perms; # The app's data dir may be accessed through a symlink. allow runas system_data_file:lnk_file read; diff --git a/public/sdcardd.te b/public/sdcardd.te index 6d9edfab5..83c184018 100644 --- a/public/sdcardd.te +++ b/public/sdcardd.te @@ -20,6 +20,7 @@ allow sdcardd media_rw_data_file:file create_file_perms; # Read /data/system/packages.list. allow sdcardd system_data_file:file r_file_perms; +allow sdcardd packages_list_file:file r_file_perms; # Read /data/.layout_version allow sdcardd install_data_file:file r_file_perms; diff --git a/public/simpleperf_app_runner.te b/public/simpleperf_app_runner.te index 9f8e6e404..b7ff7a032 100644 --- a/public/simpleperf_app_runner.te +++ b/public/simpleperf_app_runner.te @@ -9,6 +9,7 @@ allow simpleperf_app_runner devpts:chr_file { read write ioctl }; # simpleperf_app_runner reads package information. allow simpleperf_app_runner system_data_file:file r_file_perms; allow simpleperf_app_runner system_data_file:lnk_file getattr; +allow simpleperf_app_runner packages_list_file:file r_file_perms; # The app's data dir may be accessed through a symlink. allow simpleperf_app_runner system_data_file:lnk_file read;