tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix coredomain violation for modprobe

Browse source 
modprobe domain was allowed to launch vendor toolbox even if its a
coredomain. That violates the treble separation. Fix that by creating a
separate 'vendor_modprobe' domain that init is allowed to transition to
through vendor_toolbox.

Bug: 37008075
Test: Build and boot sailfish

Change-Id: Ic3331797691bb5d1fdc05a674aa4aa313e1f86b2
Signed-off-by: Sandeep Patil <sspatil@google.com>
(cherry picked from commit 9e366a0e49)
This commit is contained in:
Sandeep Patil 2017-06-02 16:09:26 -07:00
parent bdfc0301a1
commit e41af20397
3 changed files with 14 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
private/init.te
View file

@ -13,7 +13,7 @@ recovery_only(`
domain_trans(init, shell_exec, shell)
domain_trans(init, init_exec, ueventd)
domain_trans(init, init_exec, watchdogd)
domain_trans(init, { rootfs toolbox_exec vendor_toolbox_exec }, modprobe)
domain_trans(init, { rootfs toolbox_exec }, modprobe)
# case where logpersistd is actually logcat -f in logd context (nee: logcatd)
userdebug_or_eng(`
domain_auto_trans(init, logcat_exec, logpersist)

4
public/modprobe.te
View file

@ -7,5 +7,5 @@ recovery_only(`
allow modprobe rootfs:system module_load;
allow modprobe rootfs:file r_file_perms;
')
allow modprobe { system_file vendor_file }:system module_load;
r_dir_file(modprobe, { system_file vendor_file })
allow modprobe { system_file }:system module_load;
r_dir_file(modprobe, { system_file })

11
vendor/vendor_modprobe.te vendored Normal file
View file

@ -0,0 +1,11 @@
type vendor_modprobe, domain;
# For the use of /vendor/bin/modprobe from vendor init.rc fragments
domain_trans(init, vendor_toolbox_exec, vendor_modprobe)
allow vendor_modprobe proc_modules:file r_file_perms;
allow vendor_modprobe self:capability sys_module;
allow vendor_modprobe kernel:key search;
allow vendor_modprobe { vendor_file }:system module_load;
r_dir_file(vendor_modprobe, { vendor_file })