tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Allow postinstall_file to be an entrypoint.

Browse source 
postinstall_file was an exec_type so it could be an entrypoint for the
domain_auto_trans from update_engine domain to postinstall domain. This
patch removes the exec_type from postinstall_file and exempts it from
the neverallow rule to become an entrypoint.

Bug: 28008031
TEST=postinstall_example still runs as the "postinstall" domain on edison-eng.

(cherry picked from commit a9671c6b9e)

Change-Id: I2e1f61ed42f8549e959edbe047c56513903e8e9c
This commit is contained in:
Alex Deymo 2016-04-05 16:07:25 -07:00
parent 541e9d50d1
commit ac52f460c0
3 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
domain.te
View file

@ -217,8 +217,8 @@ neverallow { domain -init } kernel:security setsecparam;
# Only init, ueventd and system_server should be able to access HW RNG
neverallow { domain -init -system_server -ueventd } hw_random_device:chr_file *;
# Ensure that all entrypoint executables are in exec_type.
neverallow * { file_type -exec_type }:file entrypoint;
# Ensure that all entrypoint executables are in exec_type or postinstall_file.
neverallow * { file_type -exec_type -postinstall_file }:file entrypoint;
# Ensure that nothing in userspace can access /dev/mem or /dev/kmem
neverallow { domain -kernel -ueventd -init } kmem_device:chr_file *;

2
file.te
View file

@ -124,7 +124,7 @@ type storage_stub_file, file_type;
# /postinstall: Mount point used by update_engine to run postinstall.
type postinstall_mnt_dir, file_type;
# Files inside the /postinstall mountpoint are all labeled as postinstall_file.
type postinstall_file, file_type, exec_type;
type postinstall_file, file_type;
# /data/misc subdirectories
type adb_keys_file, file_type, data_file_type;

4
postinstall.te
View file

@ -18,3 +18,7 @@ allow postinstall postinstall_file:dir r_dir_perms;
allow postinstall shell_exec:file rx_file_perms;
allow postinstall system_file:file rx_file_perms;
allow postinstall toolbox_exec:file rx_file_perms;
# No domain other than update_engine should transition to postinstall, as it is
# only meant to run during the update.
neverallow { domain -update_engine } postinstall:process { transition dyntransition };