From d4c78f4b3fed1ca77aa9f13e757644aca3ed2b21 Mon Sep 17 00:00:00 2001 From: dcashman Date: Mon, 6 Apr 2015 17:27:42 -0700 Subject: [PATCH] Enforce more specific service access. Move the following services from tmp_system_server_service to appropriate attributes: battery bluetooth_manager clipboard commontime_management connectivity content country_detector device_policy deviceidle Bug: 18106000 Change-Id: I0d0f2a075c0509a783631d88ba453ac13399cdf2 --- bluetooth.te | 2 -- nfc.te | 3 --- platform_app.te | 4 ---- radio.te | 4 ---- service.te | 19 +++++++++---------- service_contexts | 1 - system_app.te | 4 ---- system_server.te | 5 ----- untrusted_app.te | 7 ------- 9 files changed, 9 insertions(+), 40 deletions(-) diff --git a/bluetooth.te b/bluetooth.te index 95307021a..b90e48feb 100644 --- a/bluetooth.te +++ b/bluetooth.te @@ -60,8 +60,6 @@ allow bluetooth system_api_service:service_manager find; service_manager_local_audit_domain(bluetooth) auditallow bluetooth { tmp_system_server_service - -bluetooth_manager_service - -connectivity_service -display_service -dropbox_service -media_session_service diff --git a/nfc.te b/nfc.te index 0cfc44724..156aeb703 100644 --- a/nfc.te +++ b/nfc.te @@ -30,9 +30,6 @@ allow nfc system_api_service:service_manager find; service_manager_local_audit_domain(nfc) auditallow nfc { tmp_system_server_service - -bluetooth_manager_service - -connectivity_service - -content_service -display_service -dropbox_service -network_management_service diff --git a/platform_app.te b/platform_app.te index 2f1b87cef..0016f2070 100644 --- a/platform_app.te +++ b/platform_app.te @@ -39,10 +39,6 @@ allow platform_app system_api_service:service_manager find; service_manager_local_audit_domain(platform_app) auditallow platform_app { tmp_system_server_service - -bluetooth_manager_service - -connectivity_service - -content_service - -device_policy_service -display_service -dreams_service -dropbox_service diff --git a/radio.te b/radio.te index 76ffda767..060c3a612 100644 --- a/radio.te +++ b/radio.te @@ -41,10 +41,6 @@ allow radio system_api_service:service_manager find; service_manager_local_audit_domain(radio) auditallow radio { tmp_system_server_service - -bluetooth_manager_service - -connectivity_service - -content_service - -country_detector_service -display_service -dropbox_service -imms_service diff --git a/service.te b/service.te index 2341ff0f1..b4925acdf 100644 --- a/service.te +++ b/service.te @@ -22,20 +22,19 @@ type assetatlas_service, app_api_service, system_server_service, service_manager type audio_service, app_api_service, system_server_service, service_manager_type; type backup_service, system_api_service, system_server_service, service_manager_type; type batterystats_service, app_api_service, system_server_service, service_manager_type; -type battery_service, tmp_system_server_service, service_manager_type; -type bluetooth_manager_service, tmp_system_server_service, service_manager_type; -type clipboard_service, tmp_system_server_service, service_manager_type; -type IMms_service, tmp_system_server_service, service_manager_type; +type battery_service, system_server_service, service_manager_type; +type bluetooth_manager_service, system_api_service, system_server_service, service_manager_type; +type clipboard_service, app_api_service, system_server_service, service_manager_type; type IProxyService_service, system_api_service, system_server_service, service_manager_type; -type commontime_management_service, tmp_system_server_service, service_manager_type; -type connectivity_service, tmp_system_server_service, service_manager_type; +type commontime_management_service, system_server_service, service_manager_type; +type connectivity_service, app_api_service, system_server_service, service_manager_type; type consumer_ir_service, app_api_service, system_server_service, service_manager_type; -type content_service, tmp_system_server_service, service_manager_type; -type country_detector_service, tmp_system_server_service, service_manager_type; +type content_service, app_api_service, system_server_service, service_manager_type; +type country_detector_service, system_api_service, system_server_service, service_manager_type; type cpuinfo_service, system_api_service, system_server_service, service_manager_type; type dbinfo_service, system_api_service, system_server_service, service_manager_type; -type device_policy_service, tmp_system_server_service, service_manager_type; -type deviceidle_service, tmp_system_server_service, service_manager_type; +type device_policy_service, app_api_service, system_server_service, service_manager_type; +type deviceidle_service, system_server_service, service_manager_type; type devicestoragemonitor_service, system_server_service, service_manager_type; type diskstats_service, tmp_system_server_service, service_manager_type; type display_service, tmp_system_server_service, service_manager_type; diff --git a/service_contexts b/service_contexts index 003a858f0..49773b779 100644 --- a/service_contexts +++ b/service_contexts @@ -17,7 +17,6 @@ bluetooth_manager u:object_r:bluetooth_manager_service:s bluetooth u:object_r:bluetooth_service:s0 carrier_config u:object_r:radio_service:s0 clipboard u:object_r:clipboard_service:s0 -com.android.internal.telephony.mms.IMms u:object_r:IMms_service:s0 com.android.net.IProxyService u:object_r:IProxyService_service:s0 commontime_management u:object_r:commontime_management_service:s0 common_time.clock u:object_r:mediaserver_service:s0 diff --git a/system_app.te b/system_app.te index 565db598e..e55525e41 100644 --- a/system_app.te +++ b/system_app.te @@ -60,10 +60,6 @@ allow system_app system_api_service:service_manager find; service_manager_local_audit_domain(system_app) auditallow system_app { tmp_system_server_service - -bluetooth_manager_service - -connectivity_service - -content_service - -device_policy_service -display_service -dreams_service -dropbox_service diff --git a/system_server.te b/system_server.te index 02acf4e10..38658d4b3 100644 --- a/system_server.te +++ b/system_server.te @@ -371,11 +371,6 @@ allow system_server tmp_system_server_service:service_manager { add find }; service_manager_local_audit_domain(system_server) auditallow system_server { tmp_system_server_service - -bluetooth_manager_service - -connectivity_service - -content_service - -country_detector_service - -device_policy_service -display_service -dreams_service -dropbox_service diff --git a/untrusted_app.te b/untrusted_app.te index 7026a8438..a139799dd 100644 --- a/untrusted_app.te +++ b/untrusted_app.te @@ -90,13 +90,6 @@ allow untrusted_app system_api_service:service_manager find; service_manager_local_audit_domain(untrusted_app) auditallow untrusted_app { tmp_system_server_service - -bluetooth_manager_service - -clipboard_service - -connectivity_service - -content_service - -country_detector_service - -default_android_service - -device_policy_service -diskstats_service -display_service -dropbox_service