tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Restrict the ability to set SELinux enforcing mode to init.

Browse source 
Also make su and shell permissive in non-user builds to allow
use of setenforce without violating the neverallow rule.

Change-Id: Ie76ee04e90d5a76dfaa5f56e9e3eb7e283328a3f
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
This commit is contained in:
Stephen Smalley 2013-12-02 14:18:11 -05:00
parent 51ce2f00c5
commit d99e6d5fa1
8 changed files with 22 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
Android.mk
View file

@ -11,8 +11,10 @@ MLS_SENS=1
MLS_CATS=1024
ifeq ($(TARGET_BUILD_VARIANT),user)
BOARD_SEPOLICY_IGNORE+=external/sepolicy/shell.te
BOARD_SEPOLICY_IGNORE+=external/sepolicy/su.te
else
BOARD_SEPOLICY_IGNORE+=external/sepolicy/shell_user.te
BOARD_SEPOLICY_IGNORE+=external/sepolicy/su_user.te
endif

4
domain.te
View file

@ -131,8 +131,8 @@ neverallow { domain -relabeltodomain } *:dir_file_class_set relabelto;
### neverallow rules
###
# Only init should be able to load SELinux policies
neverallow { domain -init } kernel:security load_policy;
# Only init should be able to load SELinux policies and set enforcing mode.
neverallow { domain -init } kernel:security { load_policy setenforce };
# Only init, ueventd and system_server should be able to access HW RNG
neverallow { domain -init -system_server -ueventd -unconfineddomain } hw_random_device:chr_file *;

2
init.te
View file

@ -8,4 +8,4 @@ relabelto_domain(init)
allow init unlabeled:filesystem mount;
allow init {fs_type dev_type file_type}:dir_file_class_set relabelto;
allow init kernel:security load_policy;
allow init kernel:security { load_policy setenforce };

3
shell.te
View file

@ -6,3 +6,6 @@ unconfined_domain(shell)
# Run app_process.
# XXX Split into its own domain?
app_domain(shell)
# shell is also permissive to permit setenforce.
permissive shell;

8
shell_user.te Normal file
View file

@ -0,0 +1,8 @@
# Domain for shell processes spawned by ADB
type shell, domain;
type shell_exec, exec_type, file_type;
unconfined_domain(shell)
# Run app_process.
# XXX Split into its own domain?
app_domain(shell)

3
su.te
View file

@ -4,3 +4,6 @@ domain_auto_trans(shell, su_exec, su)
# su is unconfined.
unconfined_domain(su)
# su is also permissive to permit setenforce.
permissive su;

8
te_macros
View file

@ -250,13 +250,9 @@ allow $1 rootfs:file r_file_perms;
#####################################
# selinux_manage_policy(domain)
# Ability to manage policy files,
# trigger runtime reload, change
# enforcing mode, manipulate booleans
# and access kernel logs.
# Ability to manage policy files and
# trigger runtime reload.
define(`selinux_manage_policy', `
selinux_setenforce($1)
selinux_setbool($1)
security_access_policy($1)
unix_socket_connect($1, property, init)
allow $1 security_file:dir create_dir_perms;

2
unconfined.te
View file

@ -17,7 +17,7 @@
######################################################
allow unconfineddomain self:capability_class_set *;
allow unconfineddomain kernel:security ~load_policy;
allow unconfineddomain kernel:security ~{ load_policy setenforce };
allow unconfineddomain kernel:system *;
allow unconfineddomain self:memprotect *;
allow unconfineddomain domain:process *;