tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Allow shell and adb to read tombstones" into main

Browse source
This commit is contained in:
Florian Mayer 2024-02-26 21:12:25 +00:00 committed by Gerrit Code Review
commit 9d7d3c4a0e
3 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
private/adbd.te
View file

@ -226,6 +226,10 @@ allow adbd staging_data_file:file r_file_perms;
# Allow adbd to pull /apex/apex-info-list.xml for CTS tests.
allow adbd apex_info_file:file r_file_perms;
# allow reading tombstones. users can already use bugreports to get those.
allow adbd tombstone_data_file:dir r_dir_perms;
allow adbd tombstone_data_file:file r_file_perms;
###
### Neverallow rules
###

4
private/app.te
View file

@ -132,9 +132,9 @@ allow appdomain apex_art_data_file:dir r_dir_perms;
allow appdomain apex_art_data_file:file rx_file_perms;
# Allow access to tombstones if an fd to one is given to you.
# This is restricted by unix permissions, so an app must go through system_server to get one.
# An app cannot open the tombstone itself because it lacks `open`.
allow appdomain tombstone_data_file:file { getattr read };
neverallow appdomain tombstone_data_file:file ~{ getattr read };
neverallow { appdomain -shell } tombstone_data_file:file ~{ getattr read };
# Execute the shell or other system executables.
allow { appdomain -ephemeral_app -sdk_sandbox_all } shell_exec:file rx_file_perms;

4
private/shell.te
View file

@ -17,6 +17,10 @@ userdebug_or_eng(`
# read config.gz for CTS purposes
allow shell config_gz:file r_file_perms;
# allow reading tombstones. users can already use bugreports to get those.
allow shell tombstone_data_file:dir r_dir_perms;
allow shell tombstone_data_file:file r_file_perms;
# Run app_process.
# XXX Transition into its own domain?
app_domain(shell)