tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Revert^2 "Start tracking vendor seapp coredomain violations"

Browse source 
This reverts commit 6ec4e5f048.

Reason for revert: breaking build

Change-Id: If99f309fd8d5dd5b42a871259451c10530e1769d
This commit is contained in:
Inseob Kim 2023-09-15 03:58:00 +00:00 committed by Gerrit Code Review
parent 6ec4e5f048
commit b193c80986
2 changed files with 13 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
public/attributes
View file

@ -299,6 +299,11 @@ expandattribute untrusted_app_visible_hwservice_violators false;
attribute untrusted_app_visible_halserver_violators; attribute untrusted_app_visible_halserver_violators;
expandattribute untrusted_app_visible_halserver_violators false; expandattribute untrusted_app_visible_halserver_violators false;
# All system domains which are assignable with vendor's seapp_contexts files.
# TODO(b/280547417): Remove this once there are no violations
attribute vendor_seapp_assigns_coredomain_violators;
expandattribute vendor_seapp_assigns_coredomain_violators false;
# PDX services # PDX services
attribute pdx_endpoint_dir_type; attribute pdx_endpoint_dir_type;
attribute pdx_endpoint_socket_type; attribute pdx_endpoint_socket_type;

9
tools/check_seapp.c
View file

@ -22,6 +22,7 @@
#define APP_DATA_REQUIRED_ATTRIB "app_data_file_type" #define APP_DATA_REQUIRED_ATTRIB "app_data_file_type"
#define COREDOMAIN "coredomain" #define COREDOMAIN "coredomain"
#define VENDOR_SEAPP_ASSIGNS_COREDOMAIN_VIOLATORS "vendor_seapp_assigns_coredomain_violators"
/** /**
* Initializes an empty, static list. * Initializes an empty, static list.
@ -449,7 +450,13 @@ static bool validate_domain(char *value, const char *filename, int lineno, char
return false; return false;
} }
if (type_has_attribute(pol.db, type_dat, attrib_dat)) { type_datum_t *attrib_violators = find_type(pol.db,
VENDOR_SEAPP_ASSIGNS_COREDOMAIN_VIOLATORS,
TYPE_ATTRIB);
bool allowlisted = attrib_violators != NULL &&
type_has_attribute(pol.db, type_dat, attrib_violators);
if (type_has_attribute(pol.db, type_dat, attrib_dat) && !allowlisted) {
coredomain_violation_entry *entry = (coredomain_violation_entry *)malloc(sizeof(*entry)); coredomain_violation_entry *entry = (coredomain_violation_entry *)malloc(sizeof(*entry));
entry->domain = strdup(value); entry->domain = strdup(value);
entry->filename = strdup(filename); entry->filename = strdup(filename);