tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

neverallow mounton lnk_file fifo_file sock_file

Browse source 
Add a compile time assertion that no SELinux rule exists which
allows mounting on top of symbolic links, fifo files, or socket
files. Remove the capability from unconfined domains.

Change-Id: I6d7cc95cd17e2e5f165fa5948563800ed206bb71
This commit is contained in:
Nick Kralevich 2015-02-23 12:33:34 -08:00
parent 68a8f780d2
commit 74ddf301a0
2 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
domain.te
View file

@ -362,3 +362,7 @@ neverallow {
# that over time, the kernel global tables used to implement SysV IPCs will fill
# up.
neverallow domain domain:{ shm sem msg msgq } *;
# Do not mount on top of symlinks, fifos, or sockets.
# Feature parity with Chromium LSM.
neverallow domain { file_type fs_type dev_type }:{ lnk_file fifo_file sock_file } mounton;

6
unconfined.te
View file

@ -43,8 +43,8 @@ allow unconfineddomain domain:{
tun_socket
} *;
allow unconfineddomain domain:key *;
allow unconfineddomain {fs_type -contextmount_type -sdcard_type}:{ dir lnk_file sock_file fifo_file } ~relabelto;
allow unconfineddomain dev_type:{ dir lnk_file sock_file fifo_file } ~relabelto;
allow unconfineddomain {fs_type -contextmount_type -sdcard_type}:{ dir lnk_file sock_file fifo_file } ~{ relabelto mounton };
allow unconfineddomain dev_type:{ dir lnk_file sock_file fifo_file } ~{ relabelto mounton };
allow unconfineddomain {
file_type
-keystore_data_file
@ -55,7 +55,7 @@ allow unconfineddomain {
-shell_data_file
-app_data_file
-unlabeled
}:{ dir lnk_file sock_file fifo_file } ~relabelto;
}:{ dir lnk_file sock_file fifo_file } ~{ relabelto mounton };
allow unconfineddomain exec_type:dir r_dir_perms;
allow unconfineddomain exec_type:file { r_file_perms execute };
allow unconfineddomain exec_type:lnk_file r_file_perms;