tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Revert "Various minor policy fixes based on CTS.""

Browse source
This commit is contained in:
Geremy Condra 2013-03-22 21:41:50 +00:00 committed by Gerrit Code Review
commit dbb82fd8f0
9 changed files with 12 additions and 28 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
adbd.te
View file

@ -15,9 +15,6 @@ allow adbd cgroup:dir { write add_name create };
allow adbd labeledfs:filesystem remount; allow adbd labeledfs:filesystem remount;
allow adbd shell_data_file:dir rw_dir_perms; allow adbd shell_data_file:dir rw_dir_perms;
allow adbd shell_data_file:file create_file_perms; allow adbd shell_data_file:file create_file_perms;
allow adbd sdcard_type:dir create_dir_perms;
allow adbd sdcard_type:file create_file_perms;
allow adbd graphics_device:dir search; allow adbd graphics_device:dir search;
allow adbd graphics_device:chr_file r_file_perms; allow adbd graphics_device:chr_file r_file_perms;
allow adbd log_device:chr_file r_file_perms; allow adbd log_device:chr_file r_file_perms;

3
app.te
View file

@ -118,7 +118,6 @@ bool app_bluetooth false;
if (app_bluetooth or android_cts) { if (app_bluetooth or android_cts) {
# No specific SELinux class for bluetooth sockets presently. # No specific SELinux class for bluetooth sockets presently.
allow untrusted_app self:socket *; allow untrusted_app self:socket *;
allow untrusted_app bluetooth:unix_stream_socket { read write shutdown };
} }
# Internal SDCard rw access. # Internal SDCard rw access.
bool app_internal_sdcard_rw true; bool app_internal_sdcard_rw true;
@ -162,7 +161,7 @@ allow appdomain zygote:process sigchld;
# Communicate over a FIFO or socket created by the system_server. # Communicate over a FIFO or socket created by the system_server.
allow appdomain system:fifo_file rw_file_perms; allow appdomain system:fifo_file rw_file_perms;
allow appdomain system:unix_stream_socket { read write setopt }; allow appdomain system:unix_stream_socket { read write };
# Communicate over a socket created by surfaceflinger. # Communicate over a socket created by surfaceflinger.
allow appdomain surfaceflinger:unix_stream_socket { read write setopt }; allow appdomain surfaceflinger:unix_stream_socket { read write setopt };

15
dhcp.te
View file

@ -4,15 +4,16 @@ type dhcp_data_file, file_type, data_file_type;
type dhcp_system_file, file_type, data_file_type; type dhcp_system_file, file_type, data_file_type;
init_daemon_domain(dhcp) init_daemon_domain(dhcp)
net_domain(dhcp)
allow dhcp cgroup:dir { create write add_name }; allow dhcp cgroup:dir { create add_name };
allow dhcp self:capability { setgid setuid net_admin net_raw net_bind_service }; allow dhcp self:capability { setgid setuid net_admin net_raw };
allow dhcp self:packet_socket create_socket_perms; allow dhcp self:packet_socket { create setopt bind write read };
allow dhcp self:netlink_route_socket { create_socket_perms nlmsg_write }; allow dhcp self:netlink_route_socket { write nlmsg_write read create bind };
allow dhcp shell_exec:file rx_file_perms; allow dhcp self:udp_socket { create ioctl };
allow dhcp system_file:file rx_file_perms; allow dhcp shell_exec:file { read open execute };
allow dhcp system_file:file execute_no_trans;
allow dhcp proc:file write; allow dhcp proc:file write;
allow dhcp property_socket:sock_file write ;
allow dhcp system_prop:property_service set ; allow dhcp system_prop:property_service set ;
allow dhcp dhcp_system_file:file rx_file_perms; allow dhcp dhcp_system_file:file rx_file_perms;
allow dhcp dhcp_system_file:dir r_dir_perms; allow dhcp dhcp_system_file:dir r_dir_perms;

4
drmserver.te
View file

@ -18,8 +18,4 @@ allow drmserver sdcard_type:dir search;
allow drmserver drm_data_file:dir create_dir_perms; allow drmserver drm_data_file:dir create_dir_perms;
allow drmserver drm_data_file:file create_file_perms; allow drmserver drm_data_file:file create_file_perms;
allow drmserver self:{ tcp_socket udp_socket } *; allow drmserver self:{ tcp_socket udp_socket } *;
allow drmserver port:tcp_socket name_connect;
allow drmserver tee_device:chr_file rw_file_perms; allow drmserver tee_device:chr_file rw_file_perms;
allow drmserver platform_app_data_file:file { read write getattr };
allow drmserver app_data_file:file { read write getattr };
allow drmserver sdcard_type:file { read write getattr };

2
file_contexts
View file

@ -153,7 +153,7 @@
/data/app(/.*)? u:object_r:apk_data_file:s0 /data/app(/.*)? u:object_r:apk_data_file:s0
/data/app/vmdl.*\.tmp u:object_r:apk_tmp_file:s0 /data/app/vmdl.*\.tmp u:object_r:apk_tmp_file:s0
/data/tombstones(/.*)? u:object_r:tombstone_data_file:s0 /data/tombstones(/.*)? u:object_r:tombstone_data_file:s0
/data/local/tmp(/.*)? u:object_r:shell_data_file:s0 /data/local(/.*)? u:object_r:shell_data_file:s0
# Misc data # Misc data
/data/misc/bluetoothd(/.*)? u:object_r:bluetoothd_data_file:s0 /data/misc/bluetoothd(/.*)? u:object_r:bluetoothd_data_file:s0
/data/misc/bluetooth(/.*)? u:object_r:bluetooth_data_file:s0 /data/misc/bluetooth(/.*)? u:object_r:bluetooth_data_file:s0

3
mediaserver.te
View file

@ -17,8 +17,7 @@ binder_service(mediaserver)
allow mediaserver kernel:system module_request; allow mediaserver kernel:system module_request;
allow mediaserver app_data_file:dir search; allow mediaserver app_data_file:dir search;
allow mediaserver app_data_file:file rw_file_perms; allow mediaserver app_data_file:file r_file_perms;
allow mediaserver platform_app_data_file:file { getattr read };
allow mediaserver sdcard_type:file write; allow mediaserver sdcard_type:file write;
allow mediaserver camera_device:chr_file rw_file_perms; allow mediaserver camera_device:chr_file rw_file_perms;
allow mediaserver graphics_device:chr_file rw_file_perms; allow mediaserver graphics_device:chr_file rw_file_perms;

3
shell.te
View file

@ -5,7 +5,6 @@ allow shell rootfs:dir r_dir_perms;
allow shell devpts:chr_file rw_file_perms; allow shell devpts:chr_file rw_file_perms;
allow shell tty_device:chr_file rw_file_perms; allow shell tty_device:chr_file rw_file_perms;
allow shell console_device:chr_file rw_file_perms; allow shell console_device:chr_file rw_file_perms;
allow shell input_device:chr_file rw_file_perms;
allow shell system_file:file x_file_perms; allow shell system_file:file x_file_perms;
allow shell shell_exec:file rx_file_perms; allow shell shell_exec:file rx_file_perms;
allow shell zygote_exec:file rx_file_perms; allow shell zygote_exec:file rx_file_perms;
@ -18,7 +17,7 @@ allow shell sdcard_type:dir rw_dir_perms;
allow shell sdcard_type:file create_file_perms; allow shell sdcard_type:file create_file_perms;
r_dir_file(shell, apk_data_file) r_dir_file(shell, apk_data_file)
allow shell dalvikcache_data_file:file { write setattr }; allow shell dalvikcache_data_file:file write;
# Run logcat. # Run logcat.
allow shell log_device:chr_file r_file_perms; allow shell log_device:chr_file r_file_perms;

4
surfaceflinger.te
View file

@ -28,7 +28,3 @@ allow surfaceflinger self:netlink_kobject_uevent_socket *;
allow surfaceflinger system_prop:property_service set; allow surfaceflinger system_prop:property_service set;
allow surfaceflinger ctl_default_prop:property_service set; allow surfaceflinger ctl_default_prop:property_service set;
# Use open files supplied by an app.
allow surfaceflinger appdomain:fd use;
allow surfaceflinger platform_app_data_file:file { read write };
allow surfaceflinger app_data_file:file { read write };

3
system.te
View file

@ -66,9 +66,6 @@ bluetooth_domain(system)
# XXX See if we can remove some of these. # XXX See if we can remove some of these.
allow system self:capability { kill net_bind_service net_broadcast net_admin net_raw sys_module sys_boot sys_nice sys_resource sys_time sys_tty_config }; allow system self:capability { kill net_bind_service net_broadcast net_admin net_raw sys_module sys_boot sys_nice sys_resource sys_time sys_tty_config };
# Triggered by /proc/pid accesses, not allowed.
dontaudit system self:capability sys_ptrace;
# Trigger module auto-load. # Trigger module auto-load.
allow system kernel:system module_request; allow system kernel:system module_request;