tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge changes I5a3584b6,Ic7252a8e,I2d4ace75

Browse source 
* changes:
  Various minor policy fixes based on CTS.
  Split internal and external sdcards
  Give sdcard sys_admin capability.
This commit is contained in:
Geremy Condra 2013-03-22 21:13:59 +00:00 committed by Gerrit Code Review
commit 9c0f2df183
16 changed files with 61 additions and 36 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
adbd.te
View file

@ -15,6 +15,9 @@ allow adbd cgroup:dir { write add_name create };
allow adbd labeledfs:filesystem remount;
allow adbd shell_data_file:dir rw_dir_perms;
allow adbd shell_data_file:file create_file_perms;
allow adbd sdcard_type:dir create_dir_perms;
allow adbd sdcard_type:file create_file_perms;
allow adbd graphics_device:dir search;
allow adbd graphics_device:chr_file r_file_perms;
allow adbd log_device:chr_file r_file_perms;

23
app.te
View file

@ -89,8 +89,8 @@ net_domain(browser_app)
allow platformappdomain platform_app_data_file:dir create_dir_perms;
allow platformappdomain platform_app_data_file:notdevfile_class_set create_file_perms;
# App sdcard file accesses
allow platformappdomain sdcard:dir create_dir_perms;
allow platformappdomain sdcard:file create_file_perms;
allow platformappdomain sdcard_type:dir create_dir_perms;
allow platformappdomain sdcard_type:file create_file_perms;
# System data file accesses (e.g, shared objects from the lib directory)
allow platformappdomain system_data_file:file { execute open };
@ -118,12 +118,19 @@ bool app_bluetooth false;
if (app_bluetooth or android_cts) {
# No specific SELinux class for bluetooth sockets presently.
allow untrusted_app self:socket *;
allow untrusted_app bluetooth:unix_stream_socket { read write shutdown };
}
# SDCard rw access.
bool app_sdcard_rw true;
if (app_sdcard_rw) {
allow untrusted_app sdcard:dir create_dir_perms;
allow untrusted_app sdcard:file create_file_perms;
# Internal SDCard rw access.
bool app_internal_sdcard_rw true;
if (app_internal_sdcard_rw) {
allow untrusted_app sdcard_internal:dir create_dir_perms;
allow untrusted_app sdcard_internal:file create_file_perms;
}
# External SDCard rw access.
bool app_external_sdcard_rw true;
if (app_external_sdcard_rw) {
allow untrusted_app sdcard_external:dir create_dir_perms;
allow untrusted_app sdcard_external:file create_file_perms;
}
# Native app support.
bool app_ndk false;
@ -155,7 +162,7 @@ allow appdomain zygote:process sigchld;
# Communicate over a FIFO or socket created by the system_server.
allow appdomain system:fifo_file rw_file_perms;
allow appdomain system:unix_stream_socket { read write };
allow appdomain system:unix_stream_socket { read write setopt };
# Communicate over a socket created by surfaceflinger.
allow appdomain surfaceflinger:unix_stream_socket { read write setopt };

3
attributes
View file

@ -24,6 +24,9 @@ attribute data_file_type;
# All types use for sysfs files.
attribute sysfs_type;
# Attribute used for all sdcards
attribute sdcard_type;
# All types used for nodes/hosts.
attribute node_type;

15
dhcp.te
View file

@ -4,16 +4,15 @@ type dhcp_data_file, file_type, data_file_type;
type dhcp_system_file, file_type, data_file_type;
init_daemon_domain(dhcp)
net_domain(dhcp)
allow dhcp cgroup:dir { create add_name };
allow dhcp self:capability { setgid setuid net_admin net_raw };
allow dhcp self:packet_socket { create setopt bind write read };
allow dhcp self:netlink_route_socket { write nlmsg_write read create bind };
allow dhcp self:udp_socket { create ioctl };
allow dhcp shell_exec:file { read open execute };
allow dhcp system_file:file execute_no_trans;
allow dhcp cgroup:dir { create write add_name };
allow dhcp self:capability { setgid setuid net_admin net_raw net_bind_service };
allow dhcp self:packet_socket create_socket_perms;
allow dhcp self:netlink_route_socket { create_socket_perms nlmsg_write };
allow dhcp shell_exec:file rx_file_perms;
allow dhcp system_file:file rx_file_perms;
allow dhcp proc:file write;
allow dhcp property_socket:sock_file write ;
allow dhcp system_prop:property_service set ;
allow dhcp dhcp_system_file:file rx_file_perms;
allow dhcp dhcp_system_file:dir r_dir_perms;

6
drmserver.te
View file

@ -14,8 +14,12 @@ binder_service(drmserver)
# Perform Binder IPC to mediaserver
binder_call(drmserver, mediaserver)
allow drmserver sdcard:dir search;
allow drmserver sdcard_type:dir search;
allow drmserver drm_data_file:dir create_dir_perms;
allow drmserver drm_data_file:file create_file_perms;
allow drmserver self:{ tcp_socket udp_socket } *;
allow drmserver port:tcp_socket name_connect;
allow drmserver tee_device:chr_file rw_file_perms;
allow drmserver platform_app_data_file:file { read write getattr };
allow drmserver app_data_file:file { read write getattr };
allow drmserver sdcard_type:file { read write getattr };

3
file.te
View file

@ -16,7 +16,8 @@ type devpts, fs_type, mlstrustedobject;
type tmpfs, fs_type;
type shm, fs_type;
type mqueue, fs_type;
type sdcard, fs_type, mlstrustedobject;
type sdcard_internal, sdcard_type, fs_type, mlstrustedobject;
type sdcard_external, sdcard_type, fs_type, mlstrustedobject;
type debugfs, fs_type, mlstrustedobject;
# File types

2
file_contexts
View file

@ -153,7 +153,7 @@
/data/app(/.*)? u:object_r:apk_data_file:s0
/data/app/vmdl.*\.tmp u:object_r:apk_tmp_file:s0
/data/tombstones(/.*)? u:object_r:tombstone_data_file:s0
/data/local(/.*)? u:object_r:shell_data_file:s0
/data/local/tmp(/.*)? u:object_r:shell_data_file:s0
# Misc data
/data/misc/bluetoothd(/.*)? u:object_r:bluetoothd_data_file:s0
/data/misc/bluetooth(/.*)? u:object_r:bluetooth_data_file:s0

4
genfs_contexts
View file

@ -9,6 +9,6 @@ genfscon cgroup / u:object_r:cgroup:s0
# sysfs labels can be set by userspace.
genfscon sysfs / u:object_r:sysfs:s0
genfscon inotifyfs / u:object_r:inotify:s0
genfscon vfat / u:object_r:sdcard:s0
genfscon vfat / u:object_r:sdcard_external:s0
genfscon debugfs / u:object_r:debugfs:s0
genfscon fuse / u:object_r:sdcard:s0
genfscon fuse / u:object_r:sdcard_internal:s0

7
mediaserver.te
View file

@ -8,7 +8,7 @@ net_domain(mediaserver)
init_daemon_domain(mediaserver)
unix_socket_connect(mediaserver, property, init)
r_dir_file(mediaserver, sdcard)
r_dir_file(mediaserver, sdcard_type)
binder_use(mediaserver)
binder_call(mediaserver, binderservicedomain)
@ -17,8 +17,9 @@ binder_service(mediaserver)
allow mediaserver kernel:system module_request;
allow mediaserver app_data_file:dir search;
allow mediaserver app_data_file:file r_file_perms;
allow mediaserver sdcard:file write;
allow mediaserver app_data_file:file rw_file_perms;
allow mediaserver platform_app_data_file:file { getattr read };
allow mediaserver sdcard_type:file write;
allow mediaserver camera_device:chr_file rw_file_perms;
allow mediaserver graphics_device:chr_file rw_file_perms;
allow mediaserver video_device:chr_file rw_file_perms;

2
rild.te
View file

@ -23,7 +23,7 @@ allow rild bluetooth_efs_file:dir r_dir_perms;
allow rild radio_data_file:dir r_dir_perms;
allow rild radio_data_file:file rw_file_perms;
allow rild radio_device:lnk_file r_file_perms;
allow rild sdcard:dir r_dir_perms;
allow rild sdcard_type:dir r_dir_perms;
allow rild system_data_file:dir create_dir_perms;
allow rild system_data_file:file create_file_perms;
allow rild system_file:file x_file_perms;

5
sdcardd.te
View file

@ -6,8 +6,7 @@ init_daemon_domain(sdcardd)
allow sdcardd cgroup:dir create_dir_perms;
allow sdcardd fuse_device:chr_file rw_file_perms;
allow sdcardd rootfs:dir mounton;
allow sdcardd sdcard:filesystem mount;
allow sdcardd self:capability { setuid setgid dac_override };
allow sdcardd sdcard_type:filesystem mount;
allow sdcardd self:capability { setuid setgid dac_override sys_admin };
allow sdcardd system_data_file:dir create_dir_perms;
allow sdcardd system_data_file:file create_file_perms;

7
shell.te
View file

@ -5,6 +5,7 @@ allow shell rootfs:dir r_dir_perms;
allow shell devpts:chr_file rw_file_perms;
allow shell tty_device:chr_file rw_file_perms;
allow shell console_device:chr_file rw_file_perms;
allow shell input_device:chr_file rw_file_perms;
allow shell system_file:file x_file_perms;
allow shell shell_exec:file rx_file_perms;
allow shell zygote_exec:file rx_file_perms;
@ -13,11 +14,11 @@ allow shell shell_data_file:file create_file_perms;
allow shell shell_data_file:file rx_file_perms;
# Access sdcard.
allow shell sdcard:dir rw_dir_perms;
allow shell sdcard:file create_file_perms;
allow shell sdcard_type:dir rw_dir_perms;
allow shell sdcard_type:file create_file_perms;
r_dir_file(shell, apk_data_file)
allow shell dalvikcache_data_file:file write;
allow shell dalvikcache_data_file:file { write setattr };
# Run logcat.
allow shell log_device:chr_file r_file_perms;

4
surfaceflinger.te
View file

@ -28,3 +28,7 @@ allow surfaceflinger self:netlink_kobject_uevent_socket *;
allow surfaceflinger system_prop:property_service set;
allow surfaceflinger ctl_default_prop:property_service set;
# Use open files supplied by an app.
allow surfaceflinger appdomain:fd use;
allow surfaceflinger platform_app_data_file:file { read write };
allow surfaceflinger app_data_file:file { read write };

5
system.te
View file

@ -28,7 +28,7 @@ selinux_getenforce(system)
selinux_getenforce(system_app)
# Settings app reads sdcard for storage stats
allow system_app sdcard:dir r_dir_perms;
allow system_app sdcard_type:dir r_dir_perms;
bool manage_selinux true;
if (manage_selinux) {
@ -66,6 +66,9 @@ bluetooth_domain(system)
# XXX See if we can remove some of these.
allow system self:capability { kill net_bind_service net_broadcast net_admin net_raw sys_module sys_boot sys_nice sys_resource sys_time sys_tty_config };
# Triggered by /proc/pid accesses, not allowed.
dontaudit system self:capability sys_ptrace;
# Trigger module auto-load.
allow system kernel:system module_request;

6
vold.te
View file

@ -10,9 +10,9 @@ allow vold block_device:blk_file create_file_perms;
allow vold block_device:lnk_file read;
allow vold devpts:chr_file rw_file_perms;
allow vold rootfs:dir mounton;
allow vold sdcard:dir mounton;
allow vold sdcard:filesystem { mount remount unmount };
allow vold sdcard:dir create_dir_perms;
allow vold sdcard_type:dir mounton;
allow vold sdcard_type:filesystem { mount remount unmount };
allow vold sdcard_type:dir create_dir_perms;
allow vold tmpfs:filesystem { mount unmount };
allow vold tmpfs:dir create_dir_perms;
allow vold tmpfs:dir mounton;

2
zygote.te
View file

@ -33,7 +33,7 @@ allow zygote rootfs:file r_file_perms;
# Setting up /storage/emulated.
allow zygote rootfs:dir mounton;
allow zygote sdcard:dir { write search setattr create add_name mounton };
allow zygote sdcard_type:dir { write search setattr create add_name mounton };
dontaudit zygote self:capability fsetid;
allow zygote tmpfs:dir { write create add_name setattr mounton };
allow zygote tmpfs:filesystem mount;