From 8a814a7604afd20f12c9ff3dcdae7d10e9b75f84 Mon Sep 17 00:00:00 2001 From: Stephen Smalley Date: Tue, 12 Mar 2013 10:00:18 -0400 Subject: [PATCH] Various minor policy fixes based on CTS. Change-Id: I5a3584b6cc5eda2b7d82e85452f9fe457877f1d1 Signed-off-by: Stephen Smalley --- adbd.te | 3 +++ app.te | 3 ++- dhcp.te | 15 +++++++-------- drmserver.te | 4 ++++ file_contexts | 2 +- mediaserver.te | 3 ++- shell.te | 3 ++- surfaceflinger.te | 4 ++++ system.te | 3 +++ 9 files changed, 28 insertions(+), 12 deletions(-) diff --git a/adbd.te b/adbd.te index f92414953..074f35b00 100644 --- a/adbd.te +++ b/adbd.te @@ -15,6 +15,9 @@ allow adbd cgroup:dir { write add_name create }; allow adbd labeledfs:filesystem remount; allow adbd shell_data_file:dir rw_dir_perms; allow adbd shell_data_file:file create_file_perms; +allow adbd sdcard_type:dir create_dir_perms; +allow adbd sdcard_type:file create_file_perms; + allow adbd graphics_device:dir search; allow adbd graphics_device:chr_file r_file_perms; allow adbd log_device:chr_file r_file_perms; diff --git a/app.te b/app.te index cb8091b64..6a4c0b758 100644 --- a/app.te +++ b/app.te @@ -118,6 +118,7 @@ bool app_bluetooth false; if (app_bluetooth or android_cts) { # No specific SELinux class for bluetooth sockets presently. allow untrusted_app self:socket *; +allow untrusted_app bluetooth:unix_stream_socket { read write shutdown }; } # Internal SDCard rw access. bool app_internal_sdcard_rw true; @@ -161,7 +162,7 @@ allow appdomain zygote:process sigchld; # Communicate over a FIFO or socket created by the system_server. allow appdomain system:fifo_file rw_file_perms; -allow appdomain system:unix_stream_socket { read write }; +allow appdomain system:unix_stream_socket { read write setopt }; # Communicate over a socket created by surfaceflinger. allow appdomain surfaceflinger:unix_stream_socket { read write setopt }; diff --git a/dhcp.te b/dhcp.te index 0c533eb40..10ab788ed 100644 --- a/dhcp.te +++ b/dhcp.te @@ -4,16 +4,15 @@ type dhcp_data_file, file_type, data_file_type; type dhcp_system_file, file_type, data_file_type; init_daemon_domain(dhcp) +net_domain(dhcp) -allow dhcp cgroup:dir { create add_name }; -allow dhcp self:capability { setgid setuid net_admin net_raw }; -allow dhcp self:packet_socket { create setopt bind write read }; -allow dhcp self:netlink_route_socket { write nlmsg_write read create bind }; -allow dhcp self:udp_socket { create ioctl }; -allow dhcp shell_exec:file { read open execute }; -allow dhcp system_file:file execute_no_trans; +allow dhcp cgroup:dir { create write add_name }; +allow dhcp self:capability { setgid setuid net_admin net_raw net_bind_service }; +allow dhcp self:packet_socket create_socket_perms; +allow dhcp self:netlink_route_socket { create_socket_perms nlmsg_write }; +allow dhcp shell_exec:file rx_file_perms; +allow dhcp system_file:file rx_file_perms; allow dhcp proc:file write; -allow dhcp property_socket:sock_file write ; allow dhcp system_prop:property_service set ; allow dhcp dhcp_system_file:file rx_file_perms; allow dhcp dhcp_system_file:dir r_dir_perms; diff --git a/drmserver.te b/drmserver.te index dcf3cc952..9ef3189a8 100644 --- a/drmserver.te +++ b/drmserver.te @@ -18,4 +18,8 @@ allow drmserver sdcard_type:dir search; allow drmserver drm_data_file:dir create_dir_perms; allow drmserver drm_data_file:file create_file_perms; allow drmserver self:{ tcp_socket udp_socket } *; +allow drmserver port:tcp_socket name_connect; allow drmserver tee_device:chr_file rw_file_perms; +allow drmserver platform_app_data_file:file { read write getattr }; +allow drmserver app_data_file:file { read write getattr }; +allow drmserver sdcard_type:file { read write getattr }; diff --git a/file_contexts b/file_contexts index 0d2db388b..d81d5a45d 100644 --- a/file_contexts +++ b/file_contexts @@ -153,7 +153,7 @@ /data/app(/.*)? u:object_r:apk_data_file:s0 /data/app/vmdl.*\.tmp u:object_r:apk_tmp_file:s0 /data/tombstones(/.*)? u:object_r:tombstone_data_file:s0 -/data/local(/.*)? u:object_r:shell_data_file:s0 +/data/local/tmp(/.*)? u:object_r:shell_data_file:s0 # Misc data /data/misc/bluetoothd(/.*)? u:object_r:bluetoothd_data_file:s0 /data/misc/bluetooth(/.*)? u:object_r:bluetooth_data_file:s0 diff --git a/mediaserver.te b/mediaserver.te index 0696331cd..9a0ef1d72 100644 --- a/mediaserver.te +++ b/mediaserver.te @@ -17,7 +17,8 @@ binder_service(mediaserver) allow mediaserver kernel:system module_request; allow mediaserver app_data_file:dir search; -allow mediaserver app_data_file:file r_file_perms; +allow mediaserver app_data_file:file rw_file_perms; +allow mediaserver platform_app_data_file:file { getattr read }; allow mediaserver sdcard_type:file write; allow mediaserver camera_device:chr_file rw_file_perms; allow mediaserver graphics_device:chr_file rw_file_perms; diff --git a/shell.te b/shell.te index bf9ee44a5..2f1dd439f 100644 --- a/shell.te +++ b/shell.te @@ -5,6 +5,7 @@ allow shell rootfs:dir r_dir_perms; allow shell devpts:chr_file rw_file_perms; allow shell tty_device:chr_file rw_file_perms; allow shell console_device:chr_file rw_file_perms; +allow shell input_device:chr_file rw_file_perms; allow shell system_file:file x_file_perms; allow shell shell_exec:file rx_file_perms; allow shell zygote_exec:file rx_file_perms; @@ -17,7 +18,7 @@ allow shell sdcard_type:dir rw_dir_perms; allow shell sdcard_type:file create_file_perms; r_dir_file(shell, apk_data_file) -allow shell dalvikcache_data_file:file write; +allow shell dalvikcache_data_file:file { write setattr }; # Run logcat. allow shell log_device:chr_file r_file_perms; diff --git a/surfaceflinger.te b/surfaceflinger.te index 30b181688..a383ec11e 100644 --- a/surfaceflinger.te +++ b/surfaceflinger.te @@ -28,3 +28,7 @@ allow surfaceflinger self:netlink_kobject_uevent_socket *; allow surfaceflinger system_prop:property_service set; allow surfaceflinger ctl_default_prop:property_service set; +# Use open files supplied by an app. +allow surfaceflinger appdomain:fd use; +allow surfaceflinger platform_app_data_file:file { read write }; +allow surfaceflinger app_data_file:file { read write }; diff --git a/system.te b/system.te index 62240feb9..a2a576c06 100644 --- a/system.te +++ b/system.te @@ -66,6 +66,9 @@ bluetooth_domain(system) # XXX See if we can remove some of these. allow system self:capability { kill net_bind_service net_broadcast net_admin net_raw sys_module sys_boot sys_nice sys_resource sys_time sys_tty_config }; +# Triggered by /proc/pid accesses, not allowed. +dontaudit system self:capability sys_ptrace; + # Trigger module auto-load. allow system kernel:system module_request;