tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Replace unix_socket_connect() and explicit property sets with macro"

Browse source
This commit is contained in:
Nick Kralevich 2015-05-07 00:06:23 +00:00 committed by Gerrit Code Review
commit 82966219e6
17 changed files with 71 additions and 73 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
adbd.te
View file

@ -42,10 +42,9 @@ allow adbd anr_data_file:dir r_dir_perms;
allow adbd anr_data_file:file r_file_perms; allow adbd anr_data_file:file r_file_perms;
# Set service.adb.*, sys.powerctl, and sys.usb.ffs.ready properties. # Set service.adb.*, sys.powerctl, and sys.usb.ffs.ready properties.
unix_socket_connect(adbd, property, init) set_prop(adbd, shell_prop)
allow adbd shell_prop:property_service set; set_prop(adbd, powerctl_prop)
allow adbd powerctl_prop:property_service set; set_prop(adbd, ffs_prop)
allow adbd ffs_prop:property_service set;
# Run /system/bin/bu # Run /system/bin/bu
allow adbd system_file:file rx_file_perms; allow adbd system_file:file rx_file_perms;

9
bluetooth.te
View file

@ -38,16 +38,13 @@ allow bluetoothdomain bluetooth:unix_stream_socket { getopt setopt getattr read
allow bluetooth self:tun_socket create_socket_perms; allow bluetooth self:tun_socket create_socket_perms;
allow bluetooth efs_file:dir search; allow bluetooth efs_file:dir search;
# Talk to init over the property socket.
unix_socket_connect(bluetooth, property, init)
# proc access. # proc access.
allow bluetooth proc_bluetooth_writable:file rw_file_perms; allow bluetooth proc_bluetooth_writable:file rw_file_perms;
# Allow write access to bluetooth specific properties # Allow write access to bluetooth specific properties
allow bluetooth bluetooth_prop:property_service set; set_prop(bluetooth, bluetooth_prop)
allow bluetooth pan_result_prop:property_service set; set_prop(bluetooth, pan_result_prop)
allow bluetooth ctl_dhcp_pan_prop:property_service set; set_prop(bluetooth, ctl_dhcp_pan_prop)
allow bluetooth bluetooth_service:service_manager find; allow bluetooth bluetooth_service:service_manager find;
allow bluetooth mediaserver_service:service_manager find; allow bluetooth mediaserver_service:service_manager find;

6
dhcp.te
View file

@ -13,9 +13,9 @@ allow dhcp shell_exec:file rx_file_perms;
allow dhcp system_file:file rx_file_perms; allow dhcp system_file:file rx_file_perms;
# For /proc/sys/net/ipv4/conf/*/promote_secondaries # For /proc/sys/net/ipv4/conf/*/promote_secondaries
allow dhcp proc_net:file write; allow dhcp proc_net:file write;
allow dhcp dhcp_prop:property_service set;
allow dhcp pan_result_prop:property_service set; set_prop(dhcp, dhcp_prop)
unix_socket_connect(dhcp, property, init) set_prop(dhcp, pan_result_prop)
type_transition dhcp system_data_file:{ dir file } dhcp_data_file; type_transition dhcp system_data_file:{ dir file } dhcp_data_file;
allow dhcp dhcp_data_file:dir create_dir_perms; allow dhcp dhcp_data_file:dir create_dir_perms;

3
healthd.te
View file

@ -42,5 +42,4 @@ allow healthd healthd_service:service_manager { add find };
# Healthd needs to tell init to continue the boot # Healthd needs to tell init to continue the boot
# process when running in charger mode. # process when running in charger mode.
unix_socket_connect(healthd, property, init) set_prop(healthd, system_prop)
allow healthd system_prop:property_service set;

4
mediaserver.te
View file

@ -6,7 +6,6 @@ typeattribute mediaserver mlstrustedsubject;
net_domain(mediaserver) net_domain(mediaserver)
init_daemon_domain(mediaserver) init_daemon_domain(mediaserver)
unix_socket_connect(mediaserver, property, init)
r_dir_file(mediaserver, sdcard_type) r_dir_file(mediaserver, sdcard_type)
@ -27,7 +26,8 @@ allow mediaserver video_device:dir r_dir_perms;
allow mediaserver video_device:chr_file rw_file_perms; allow mediaserver video_device:chr_file rw_file_perms;
allow mediaserver audio_device:dir r_dir_perms; allow mediaserver audio_device:dir r_dir_perms;
allow mediaserver tee_device:chr_file rw_file_perms; allow mediaserver tee_device:chr_file rw_file_perms;
allow mediaserver audio_prop:property_service set;
set_prop(mediaserver, audio_prop)
# Access audio devices at all. # Access audio devices at all.
allow mediaserver audio_device:chr_file rw_file_perms; allow mediaserver audio_device:chr_file rw_file_perms;

7
netd.te
View file

@ -30,9 +30,8 @@ allow netd proc_net:file write;
allow netd sysfs:file write; allow netd sysfs:file write;
# Set dhcp lease for PAN connection # Set dhcp lease for PAN connection
unix_socket_connect(netd, property, init) set_prop(netd, dhcp_prop)
allow netd dhcp_prop:property_service set; set_prop(netd, system_prop)
allow netd system_prop:property_service set;
auditallow netd system_prop:property_service set; auditallow netd system_prop:property_service set;
# Connect to PAN # Connect to PAN
@ -62,7 +61,7 @@ allow netd dnsmasq:process signal;
domain_auto_trans(netd, clatd_exec, clatd) domain_auto_trans(netd, clatd_exec, clatd)
allow netd clatd:process signal; allow netd clatd:process signal;
allow netd ctl_mdnsd_prop:property_service set; set_prop(netd, ctl_mdnsd_prop)
# Allow netd to operate on sockets that are passed to it. # Allow netd to operate on sockets that are passed to it.
allow netd netdomain:{tcp_socket udp_socket rawip_socket dccp_socket tun_socket} {read write getattr setattr getopt setopt}; allow netd netdomain:{tcp_socket udp_socket rawip_socket dccp_socket tun_socket} {read write getattr setattr getopt setopt};

3
nfc.te
View file

@ -5,8 +5,7 @@ net_domain(nfc)
binder_service(nfc) binder_service(nfc)
# Set NFC properties # Set NFC properties
unix_socket_connect(nfc, property, init) set_prop(nfc, nfc_prop)
allow nfc nfc_prop:property_service set;
# NFC device access. # NFC device access.
allow nfc nfc_device:chr_file rw_file_perms; allow nfc nfc_device:chr_file rw_file_perms;

11
radio.te
View file

@ -5,9 +5,6 @@ net_domain(radio)
bluetooth_domain(radio) bluetooth_domain(radio)
binder_service(radio) binder_service(radio)
# Talks to init via the property socket.
unix_socket_connect(radio, property, init)
# Talks to rild via the rild socket. # Talks to rild via the rild socket.
unix_socket_connect(radio, rild, rild) unix_socket_connect(radio, rild, rild)
@ -21,14 +18,14 @@ allow radio net_data_file:dir search;
allow radio net_data_file:file r_file_perms; allow radio net_data_file:file r_file_perms;
# Property service # Property service
allow radio radio_prop:property_service set; set_prop(radio, radio_prop)
allow radio net_radio_prop:property_service set; set_prop(radio, system_radio_prop)
allow radio system_radio_prop:property_service set; set_prop(radio, net_radio_prop)
auditallow radio net_radio_prop:property_service set; auditallow radio net_radio_prop:property_service set;
auditallow radio system_radio_prop:property_service set; auditallow radio system_radio_prop:property_service set;
# ctl interface # ctl interface
allow radio ctl_rildaemon_prop:property_service set; set_prop(radio, ctl_rildaemon_prop)
allow radio drmserver_service:service_manager find; allow radio drmserver_service:service_manager find;
allow radio mediaserver_service:service_manager find; allow radio mediaserver_service:service_manager find;

5
recovery.te
View file

@ -78,11 +78,10 @@ recovery_only(`
allow recovery cache_file:file create_file_perms; allow recovery cache_file:file create_file_perms;
# Reboot the device # Reboot the device
allow recovery powerctl_prop:property_service set; set_prop(recovery, powerctl_prop)
unix_socket_connect(recovery, property, init)
# Start/stop adbd via ctl.start adbd # Start/stop adbd via ctl.start adbd
allow recovery ctl_default_prop:property_service set; set_prop(recovery, ctl_default_prop)
# Use setfscreatecon() to label files for OTA updates. # Use setfscreatecon() to label files for OTA updates.
allow recovery self:process setfscreate; allow recovery self:process setfscreate;

7
rild.te
View file

@ -6,7 +6,6 @@ init_daemon_domain(rild)
net_domain(rild) net_domain(rild)
allow rild self:netlink_route_socket nlmsg_write; allow rild self:netlink_route_socket nlmsg_write;
allow rild kernel:system module_request; allow rild kernel:system module_request;
unix_socket_connect(rild, property, init)
allow rild self:capability { setuid net_admin net_raw }; allow rild self:capability { setuid net_admin net_raw };
allow rild alarm_device:chr_file rw_file_perms; allow rild alarm_device:chr_file rw_file_perms;
allow rild cgroup:dir create_dir_perms; allow rild cgroup:dir create_dir_perms;
@ -26,9 +25,9 @@ allow rild system_data_file:file r_file_perms;
allow rild system_file:file x_file_perms; allow rild system_file:file x_file_perms;
# property service # property service
allow rild radio_prop:property_service set; set_prop(rild, radio_prop)
allow rild net_radio_prop:property_service set; set_prop(rild, net_radio_prop)
allow rild system_radio_prop:property_service set; set_prop(rild, system_radio_prop)
auditallow rild net_radio_prop:property_service set; auditallow rild net_radio_prop:property_service set;
auditallow rild system_radio_prop:property_service set; auditallow rild system_radio_prop:property_service set;

9
shell.te
View file

@ -41,11 +41,10 @@ allow shell zygote_exec:file rx_file_perms;
r_dir_file(shell, apk_data_file) r_dir_file(shell, apk_data_file)
# Set properties. # Set properties.
unix_socket_connect(shell, property, init) set_prop(shell, shell_prop)
allow shell shell_prop:property_service set; set_prop(shell, ctl_dumpstate_prop)
allow shell ctl_dumpstate_prop:property_service set; set_prop(shell, debug_prop)
allow shell debug_prop:property_service set; set_prop(shell, powerctl_prop)
allow shell powerctl_prop:property_service set;
# systrace support - allow atrace to run # systrace support - allow atrace to run
# debugfs doesn't support labeling individual files, so we have # debugfs doesn't support labeling individual files, so we have

7
surfaceflinger.te
View file

@ -5,9 +5,6 @@ type surfaceflinger_exec, exec_type, file_type;
init_daemon_domain(surfaceflinger) init_daemon_domain(surfaceflinger)
typeattribute surfaceflinger mlstrustedsubject; typeattribute surfaceflinger mlstrustedsubject;
# Talk to init over the property socket.
unix_socket_connect(surfaceflinger, property, init)
# Perform Binder IPC. # Perform Binder IPC.
binder_use(surfaceflinger) binder_use(surfaceflinger)
binder_call(surfaceflinger, binderservicedomain) binder_call(surfaceflinger, binderservicedomain)
@ -37,8 +34,8 @@ allow surfaceflinger video_device:chr_file rw_file_perms;
allow surfaceflinger self:netlink_kobject_uevent_socket create_socket_perms; allow surfaceflinger self:netlink_kobject_uevent_socket create_socket_perms;
# Set properties. # Set properties.
allow surfaceflinger system_prop:property_service set; set_prop(surfaceflinger, system_prop)
allow surfaceflinger ctl_bootanim_prop:property_service set; set_prop(surfaceflinger, ctl_bootanim_prop)
# Use open files supplied by an app. # Use open files supplied by an app.
allow surfaceflinger appdomain:fd use; allow surfaceflinger appdomain:fd use;

13
system_app.te
View file

@ -31,15 +31,14 @@ auditallow system_app system_data_file:file { create setattr append write link u
allow system_app wallpaper_file:file r_file_perms; allow system_app wallpaper_file:file r_file_perms;
# Write to properties # Write to properties
unix_socket_connect(system_app, property, init) set_prop(system_app, debug_prop)
allow system_app debug_prop:property_service set; set_prop(system_app, system_prop)
allow system_app net_radio_prop:property_service set; set_prop(system_app, ctl_bugreport_prop)
allow system_app system_radio_prop:property_service set; set_prop(system_app, logd_prop)
set_prop(system_app, net_radio_prop)
set_prop(system_app, system_radio_prop)
auditallow system_app net_radio_prop:property_service set; auditallow system_app net_radio_prop:property_service set;
auditallow system_app system_radio_prop:property_service set; auditallow system_app system_radio_prop:property_service set;
allow system_app system_prop:property_service set;
allow system_app ctl_bugreport_prop:property_service set;
allow system_app logd_prop:property_service set;
# Create /data/anr/traces.txt. # Create /data/anr/traces.txt.
allow system_app anr_data_file:dir ra_dir_perms; allow system_app anr_data_file:dir ra_dir_perms;

21
system_server.te
View file

@ -105,7 +105,6 @@ allow system_server self:tun_socket create_socket_perms;
allow system_server init:process sigchld; allow system_server init:process sigchld;
# Talk to init and various daemons via sockets. # Talk to init and various daemons via sockets.
unix_socket_connect(system_server, property, init)
unix_socket_connect(system_server, installd, installd) unix_socket_connect(system_server, installd, installd)
unix_socket_connect(system_server, lmkd, lmkd) unix_socket_connect(system_server, lmkd, lmkd)
unix_socket_connect(system_server, mtpd, mtp) unix_socket_connect(system_server, mtpd, mtp)
@ -273,18 +272,18 @@ allow system_server system_data_file:dir relabelfrom;
allow system_server anr_data_file:dir relabelto; allow system_server anr_data_file:dir relabelto;
# Property Service write # Property Service write
allow system_server system_prop:property_service set; set_prop(system_server, system_prop)
allow system_server dhcp_prop:property_service set; set_prop(system_server, dhcp_prop)
allow system_server net_radio_prop:property_service set; set_prop(system_server, net_radio_prop)
allow system_server system_radio_prop:property_service set; set_prop(system_server, system_radio_prop)
allow system_server debug_prop:property_service set; set_prop(system_server, debug_prop)
allow system_server powerctl_prop:property_service set; set_prop(system_server, powerctl_prop)
allow system_server fingerprint_prop:property_service set; set_prop(system_server, fingerprint_prop)
# ctl interface # ctl interface
allow system_server ctl_default_prop:property_service set; set_prop(system_server, ctl_default_prop)
allow system_server ctl_dhcp_pan_prop:property_service set; set_prop(system_server, ctl_dhcp_pan_prop)
allow system_server ctl_bugreport_prop:property_service set; set_prop(system_server, ctl_bugreport_prop)
# Create a socket for receiving info from wpa. # Create a socket for receiving info from wpa.
type_transition system_server wifi_data_file:sock_file system_wpa_socket; type_transition system_server wifi_data_file:sock_file system_wpa_socket;

20
te_macros
View file

@ -118,11 +118,31 @@ typeattribute $1 bluetoothdomain;
# unix_socket_connect(clientdomain, socket, serverdomain) # unix_socket_connect(clientdomain, socket, serverdomain)
# Allow a local socket connection from clientdomain via # Allow a local socket connection from clientdomain via
# socket to serverdomain. # socket to serverdomain.
#
# Note: If you see denial records that distill to the
# following allow rules:
# allow clientdomain property_socket:sock_file write;
# allow clientdomain init:unix_stream_socket connectto;
# allow clientdomain something_prop:property_service set;
#
# This sequence is indicative of attempting to set a property.
# use set_prop(sourcedomain, targetproperty)
#
define(`unix_socket_connect', ` define(`unix_socket_connect', `
allow $1 $2_socket:sock_file write; allow $1 $2_socket:sock_file write;
allow $1 $3:unix_stream_socket connectto; allow $1 $3:unix_stream_socket connectto;
') ')
#####################################
# set_prop(sourcedomain, targetproperty)
# Allows source domain to set the
# targetproperty.
#
define(`set_prop', `
unix_socket_connect($1, property, init)
allow $1 $2:property_service set;
')
##################################### #####################################
# unix_socket_send(clientdomain, socket, serverdomain) # unix_socket_send(clientdomain, socket, serverdomain)
# Allow a local socket send from clientdomain via # Allow a local socket send from clientdomain via

3
uncrypt.te
View file

@ -21,8 +21,7 @@ allow uncrypt cache_file:dir rw_dir_perms;
allow uncrypt cache_file:file create_file_perms; allow uncrypt cache_file:file create_file_perms;
# Set a property to reboot the device. # Set a property to reboot the device.
unix_socket_connect(uncrypt, property, init) set_prop(uncrypt, powerctl_prop)
allow uncrypt powerctl_prop:property_service set;
# Raw writes to block device # Raw writes to block device
allow uncrypt self:capability sys_rawio; allow uncrypt self:capability sys_rawio;

9
vold.te
View file

@ -94,9 +94,6 @@ allow vold fscklogs:file create_file_perms;
# Rules to support encrypted fs support. # Rules to support encrypted fs support.
# #
# Set property.
unix_socket_connect(vold, property, init)
# Unmount and mount the fs. # Unmount and mount the fs.
allow vold labeledfs:filesystem { mount unmount remount }; allow vold labeledfs:filesystem { mount unmount remount };
@ -111,9 +108,9 @@ allow vold system_data_file:dir { create rw_dir_perms mounton setattr rmdir };
allow vold kernel:process setsched; allow vold kernel:process setsched;
# Property Service # Property Service
allow vold vold_prop:property_service set; set_prop(vold, vold_prop)
allow vold powerctl_prop:property_service set; set_prop(vold, powerctl_prop)
allow vold ctl_fuse_prop:property_service set; set_prop(vold, ctl_fuse_prop)
# ASEC # ASEC
allow vold asec_image_file:file create_file_perms; allow vold asec_image_file:file create_file_perms;