tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

create separate usermodehelper type for sysfs

Browse source 
Prevent files in /proc from incorrectly having sysfs_type attribute.

Rework neverallows so that ueventd has write access to all of
/sys which it needs to handle uevents.

Bug: 63147833
Test: Build. Flash angler, verify files are correctly labeled and no
    new denials are in the logs.

Change-Id: Ib94d44e78cee0e83e2ac924f1c72e611e8e73558
This commit is contained in:
Jeff Vander Stoep 2017-07-12 10:37:57 -07:00
parent dff3f37693
commit ece21859fc
6 changed files with 12 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
prebuilts/api/26.0/26.0.cil
View file

@ -645,7 +645,7 @@
(typeattributeset usbfs_26_0 (usbfs))
(typeattributeset usb_service_26_0 (usb_service))
(typeattributeset userdata_block_device_26_0 (userdata_block_device))
(typeattributeset usermodehelper_26_0 (usermodehelper))
(typeattributeset usermodehelper_26_0 (sysfs_usermodehelper usermodehelper))
(typeattributeset user_profile_data_file_26_0 (user_profile_data_file))
(typeattributeset user_service_26_0 (user_service))
(typeattributeset vcs_device_26_0 (vcs_device))

2
private/genfs_contexts
View file

@ -59,7 +59,7 @@ genfscon sysfs /devices/virtual/misc/hw_random u:object_r:sysfs_hwrandom:s0
genfscon sysfs /fs/ext4/features u:object_r:sysfs_fs_ext4_features:s0
genfscon sysfs /power/wake_lock u:object_r:sysfs_wake_lock:s0
genfscon sysfs /power/wake_unlock u:object_r:sysfs_wake_lock:s0
genfscon sysfs /kernel/uevent_helper u:object_r:usermodehelper:s0
genfscon sysfs /kernel/uevent_helper u:object_r:sysfs_usermodehelper:s0
genfscon sysfs /module/lowmemorykiller u:object_r:sysfs_lowmemorykiller:s0
genfscon sysfs /module/wlan/parameters/fwpath u:object_r:sysfs_wlan_fwpath:s0
genfscon sysfs /devices/virtual/timed_output/vibrator/enable u:object_r:sysfs_vibrator:s0

1
public/domain.te
View file

@ -317,6 +317,7 @@ neverallow * port_device:chr_file ~{ create relabelto unlink setattr getattr };
# Only init should be able to configure kernel usermodehelpers or
# security-sensitive proc settings.
neverallow { domain -init } usermodehelper:file { append write };
neverallow { domain -init -ueventd } sysfs_usermodehelper:file { append write };
neverallow { domain -init } proc_security:file { append open read write };
# No domain should be allowed to ptrace init.

3
public/file.te
View file

@ -9,7 +9,8 @@ type proc_security, fs_type;
type proc_drop_caches, fs_type;
type proc_overcommit_memory, fs_type;
# proc, sysfs, or other nodes that permit configuration of kernel usermodehelpers.
type usermodehelper, fs_type, sysfs_type;
type usermodehelper, fs_type;
type sysfs_usermodehelper, fs_type, sysfs_type;
type qtaguid_proc, fs_type, mlstrustedobject;
type proc_bluetooth_writable, fs_type;
type proc_cpuinfo, fs_type;

2
public/init.te
View file

@ -252,7 +252,7 @@ allow init kernel:system syslog_mod;
allow init self:capability2 syslog;
# Set usermodehelpers and /proc security settings.
allow init usermodehelper:file rw_file_perms;
allow init { usermodehelper sysfs_usermodehelper }:file rw_file_perms;
allow init proc_security:file rw_file_perms;
# Write to /proc/sys/kernel/panic_on_oops.

14
public/ueventd.te
View file

@ -8,15 +8,13 @@ allow ueventd kmsg_device:chr_file rw_file_perms;
allow ueventd self:capability { chown mknod net_admin setgid fsetid sys_rawio dac_override fowner };
allow ueventd device:file create_file_perms;
r_dir_file(ueventd, sysfs_type)
r_dir_file(ueventd, rootfs)
allow ueventd sysfs:file w_file_perms;
allow ueventd sysfs_usb:file w_file_perms;
allow ueventd sysfs_hwrandom:file w_file_perms;
allow ueventd sysfs_zram_uevent:file w_file_perms;
allow ueventd sysfs_type:{ file lnk_file } { relabelfrom relabelto setattr getattr };
allow ueventd sysfs_type:dir { relabelfrom relabelto setattr r_dir_perms };
allow ueventd sysfs_devices_system_cpu:file rw_file_perms;
# ueventd needs write access to files in /sys to regenerate uevents
allow ueventd sysfs_type:file w_file_perms;
r_dir_file(ueventd, sysfs_type)
allow ueventd sysfs_type:{ file lnk_file } { relabelfrom relabelto setattr };
allow ueventd sysfs_type:dir { relabelfrom relabelto setattr };
allow ueventd tmpfs:chr_file rw_file_perms;
allow ueventd dev_type:dir create_dir_perms;
allow ueventd dev_type:lnk_file { create unlink };