tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Add sepolicy for FUSE control filesystem.

Browse source 
To allow vold to abort it.

Bug: 153411204
Test: vold can access it
Merged-In: I334eaf3459905c27d614db8eda18c27e62bea5fa
Change-Id: I334eaf3459905c27d614db8eda18c27e62bea5fa
This commit is contained in:
Martijn Coenen 2020-05-28 15:04:48 +02:00
parent 47a7b78d43
commit aa2cb5129e
10 changed files with 22 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
prebuilts/api/30.0/private/compat/29.0/29.0.ignore.cil
View file

@ -45,6 +45,7 @@
exported_camera_prop
file_integrity_service
fwk_automotive_display_hwservice
fusectlfs
gmscore_app
hal_can_bus_hwservice
hal_can_controller_hwservice

2
prebuilts/api/30.0/private/genfs_contexts
View file

@ -98,6 +98,8 @@ genfscon proc /vmallocinfo u:object_r:proc_vmallocinfo:s0
genfscon proc /vmstat u:object_r:proc_vmstat:s0
genfscon proc /zoneinfo u:object_r:proc_zoneinfo:s0
genfscon fusectl / u:object_r:fusectlfs:s0
# selinuxfs booleans can be individually labeled.
genfscon selinuxfs / u:object_r:selinuxfs:s0
genfscon cgroup / u:object_r:cgroup:s0

3
prebuilts/api/30.0/public/domain.te
View file

@ -1295,6 +1295,9 @@ neverallow { domain -init -vendor_init -dumpstate } debugfs:{ file lnk_file } no
# Do not allow executable files in debugfs.
neverallow domain debugfs_type:file { execute execute_no_trans };
# Don't allow access to the FUSE control filesystem, except to vold and init's
neverallow { domain -vold -init -vendor_init } fusectlfs:file no_rw_file_perms;
# Profiles contain untrusted data and profman parses that. We should only run
# in from installd forked processes.
neverallow {

1
prebuilts/api/30.0/public/file.te
View file

@ -75,6 +75,7 @@ type proc_vmallocinfo, fs_type, proc_type;
type proc_vmstat, fs_type, proc_type;
type proc_zoneinfo, fs_type, proc_type;
type selinuxfs, fs_type, mlstrustedobject;
type fusectlfs, fs_type;
type cgroup, fs_type, mlstrustedobject;
type cgroup_bpf, fs_type;
type sysfs, fs_type, sysfs_type, mlstrustedobject;

4
prebuilts/api/30.0/public/vold.te
View file

@ -202,6 +202,10 @@ allow vold asec_public_file:file { relabelto setattr };
allow vold unlabeled:dir { r_dir_perms setattr relabelfrom };
allow vold unlabeled:file { r_file_perms setattr relabelfrom };
# Access to FUSE control filesystem to hard-abort FUSE mounts
allow vold fusectlfs:file rw_file_perms;
allow vold fusectlfs:dir rw_dir_perms;
# Handle wake locks (used for device encryption)
wakelock_use(vold)

1
private/compat/29.0/29.0.ignore.cil
View file

@ -46,6 +46,7 @@
fastbootd_protocol_prop
file_integrity_service
fwk_automotive_display_hwservice
fusectlfs
gmscore_app
gnss_device
hal_can_bus_hwservice

2
private/genfs_contexts
View file

@ -98,6 +98,8 @@ genfscon proc /vmallocinfo u:object_r:proc_vmallocinfo:s0
genfscon proc /vmstat u:object_r:proc_vmstat:s0
genfscon proc /zoneinfo u:object_r:proc_zoneinfo:s0
genfscon fusectl / u:object_r:fusectlfs:s0
# selinuxfs booleans can be individually labeled.
genfscon selinuxfs / u:object_r:selinuxfs:s0
genfscon cgroup / u:object_r:cgroup:s0

3
public/domain.te
View file

@ -1305,6 +1305,9 @@ neverallow { domain -init -vendor_init -dumpstate } debugfs:{ file lnk_file } no
# Do not allow executable files in debugfs.
neverallow domain debugfs_type:file { execute execute_no_trans };
# Don't allow access to the FUSE control filesystem, except to vold and init's
neverallow { domain -vold -init -vendor_init } fusectlfs:file no_rw_file_perms;
# Profiles contain untrusted data and profman parses that. We should only run
# in from installd forked processes.
neverallow {

1
public/file.te
View file

@ -75,6 +75,7 @@ type proc_vmallocinfo, fs_type, proc_type;
type proc_vmstat, fs_type, proc_type;
type proc_zoneinfo, fs_type, proc_type;
type selinuxfs, fs_type, mlstrustedobject;
type fusectlfs, fs_type;
type cgroup, fs_type, mlstrustedobject;
type cgroup_bpf, fs_type;
type sysfs, fs_type, sysfs_type, mlstrustedobject;

4
public/vold.te
View file

@ -202,6 +202,10 @@ allow vold asec_public_file:file { relabelto setattr };
allow vold unlabeled:dir { r_dir_perms setattr relabelfrom };
allow vold unlabeled:file { r_file_perms setattr relabelfrom };
# Access to FUSE control filesystem to hard-abort FUSE mounts
allow vold fusectlfs:file rw_file_perms;
allow vold fusectlfs:dir rw_dir_perms;
# Handle wake locks (used for device encryption)
wakelock_use(vold)