tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Stop granting permission to get_state of keystore2

Browse source 
The get_state permission of the "keystore2" class only guarded the
Binder API IKeystoreMaintenance#getState() served by keystore2.  That
API has been removed because it was unused
(https://r.android.com/2768246).  Therefore, stop granting the get_state
permission.

Don't actually remove the permission from private/access_vectors.  That
would break the build because it's referenced by rules in prebuilts/.

Bug: 296464083
Test: atest CtsKeystoreTestCases
Change-Id: Ie6c7b17a8652f86a75d48c134a6e71a634d63772
This commit is contained in:
Eric Biggers 2023-10-16 21:44:26 +00:00
parent cc5cb431ee
commit d7fe10be98
3 changed files with 0 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
private/app.te
View file

@ -179,7 +179,6 @@ control_logd({ appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all })
allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } keystore:keystore2_key { delete use get_info rebind update };
allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } keystore_maintenance_service:service_manager find;
allow { appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all } keystore:keystore2 get_state;
use_keystore({ appdomain -isolated_app_all -ephemeral_app -sdk_sandbox_all })

1
private/binderservicedomain.te
View file

@ -18,7 +18,6 @@ allow binderservicedomain appdomain:fifo_file write;
# allow all services to run permission checks
allow binderservicedomain permission_service:service_manager find;
allow binderservicedomain keystore:keystore2 { get_state };
allow binderservicedomain keystore:keystore2_key { delete get_info rebind use };
use_keystore(binderservicedomain)

1
private/system_server.te
View file

@ -979,7 +979,6 @@ allow system_server keystore:keystore2 {
change_user
clear_ns
clear_uid
get_state
lock
pull_metrics
reset