diff --git a/microdroid/Android.bp b/microdroid/Android.bp index 3c82d4b4e..cfc6f7fbd 100644 --- a/microdroid/Android.bp +++ b/microdroid/Android.bp @@ -288,11 +288,3 @@ prebuilt_etc { relative_install_path: "selinux", installable: false, } - -prebuilt_etc { - name: "microdroid_keystore2_key_contexts", - filename: "plat_keystore2_key_contexts", - src: "system/private/keystore2_key_contexts", - relative_install_path: "selinux", - installable: false, -} diff --git a/microdroid/reqd_mask/access_vectors b/microdroid/reqd_mask/access_vectors index 22f2ffa1d..0c33acaf5 100644 --- a/microdroid/reqd_mask/access_vectors +++ b/microdroid/reqd_mask/access_vectors @@ -691,61 +691,6 @@ class hwservice_manager list } -class keystore_key -{ - get_state - get - insert - delete - exist - list - reset - password - lock - unlock - is_empty - sign - verify - grant - duplicate - clear_uid - add_auth - user_changed - gen_unique_id -} - -class keystore2 -{ - add_auth - change_password - change_user - clear_ns - clear_uid - early_boot_ended - get_auth_token - get_state - list - lock - report_off_body - reset - unlock -} - -class keystore2_key -{ - convert_storage_key_to_ephemeral - delete - gen_unique_id - get_info - grant - manage_blob - rebind - req_forced_op - update - use - use_dev_id -} - class drmservice { consumeRights setPlaybackStatus diff --git a/microdroid/reqd_mask/security_classes b/microdroid/reqd_mask/security_classes index 200b030cc..9fdb7c80e 100644 --- a/microdroid/reqd_mask/security_classes +++ b/microdroid/reqd_mask/security_classes @@ -154,14 +154,5 @@ class service_manager # userspace # hardware service manager # userspace class hwservice_manager -# Legacy Keystore key permissions -class keystore_key # userspace - -# Keystore 2.0 permissions -class keystore2 # userspace - -# Keystore 2.0 key permissions -class keystore2_key # userspace - class drmservice # userspace # FLASK diff --git a/microdroid/system/private/access_vectors b/microdroid/system/private/access_vectors index 477f78f66..04cc453ac 100644 --- a/microdroid/system/private/access_vectors +++ b/microdroid/system/private/access_vectors @@ -691,61 +691,6 @@ class hwservice_manager list } -class keystore_key -{ - get_state - get - insert - delete - exist - list - reset - password - lock - unlock - is_empty - sign - verify - grant - duplicate - clear_uid - add_auth - user_changed - gen_unique_id -} - -class keystore2 -{ - add_auth - change_password - change_user - clear_ns - clear_uid - early_boot_ended - get_auth_token - get_state - list - lock - report_off_body - reset - unlock -} - -class keystore2_key -{ - convert_storage_key_to_ephemeral - delete - gen_unique_id - get_info - grant - manage_blob - rebind - req_forced_op - update - use - use_dev_id -} - class diced { demote diff --git a/microdroid/system/private/binderservicedomain.te b/microdroid/system/private/binderservicedomain.te deleted file mode 100644 index 99006bff8..000000000 --- a/microdroid/system/private/binderservicedomain.te +++ /dev/null @@ -1,5 +0,0 @@ -allow binderservicedomain keystore:keystore_key { get_state get insert delete exist list sign verify }; -allow binderservicedomain keystore:keystore2 { get_state }; -allow binderservicedomain keystore:keystore2_key { delete get_info rebind use }; - -use_keystore(binderservicedomain) diff --git a/microdroid/system/private/crash_dump.te b/microdroid/system/private/crash_dump.te index 90587fa4d..a636e9c4f 100644 --- a/microdroid/system/private/crash_dump.te +++ b/microdroid/system/private/crash_dump.te @@ -56,7 +56,6 @@ allow crash_dump { -crash_dump -init -kernel - -keystore -logd -ueventd -vendor_init @@ -65,7 +64,6 @@ allow crash_dump { userdebug_or_eng(` allow crash_dump { apexd - keystore logd }:process { ptrace signal sigchld sigstop sigkill }; ') diff --git a/microdroid/system/private/file_contexts b/microdroid/system/private/file_contexts index 7f832b4f6..af06d98cb 100644 --- a/microdroid/system/private/file_contexts +++ b/microdroid/system/private/file_contexts @@ -111,7 +111,6 @@ /system/bin/servicemanager.microdroid u:object_r:servicemanager_exec:s0 /system/bin/hwservicemanager u:object_r:hwservicemanager_exec:s0 /system/bin/init u:object_r:init_exec:s0 -/system/bin/keystore2 u:object_r:keystore_exec:s0 /system/bin/logcat -- u:object_r:logcat_exec:s0 /system/bin/logd u:object_r:logd_exec:s0 /system/bin/run-as -- u:object_r:runas_exec:s0 @@ -138,7 +137,6 @@ /system/etc/selinux/plat_property_contexts u:object_r:property_contexts_file:s0 /system/etc/selinux/plat_service_contexts u:object_r:service_contexts_file:s0 /system/etc/selinux/plat_hwservice_contexts u:object_r:hwservice_contexts_file:s0 -/system/etc/selinux/plat_keystore2_key_contexts u:object_r:keystore2_key_contexts_file:s0 /system/etc/selinux/plat_file_contexts u:object_r:file_contexts_file:s0 /system/etc/selinux/plat_seapp_contexts u:object_r:seapp_contexts_file:s0 /system/etc/selinux/plat_sepolicy\.cil u:object_r:sepolicy_file:s0 @@ -165,7 +163,6 @@ /data/local/tmp(/.*)? u:object_r:shell_data_file:s0 /data/local/tmp/ltp(/.*)? u:object_r:nativetest_data_file:s0 /data/local/traces(/.*)? u:object_r:trace_data_file:s0 -/data/misc/keystore(/.*)? u:object_r:keystore_data_file:s0 /data/misc/authfs(/.*)? u:object_r:authfs_data_file:s0 /data/tombstones(/.*)? u:object_r:tombstone_data_file:s0 /data/vendor(/.*)? u:object_r:vendor_data_file:s0 diff --git a/microdroid/system/private/init.te b/microdroid/system/private/init.te index b8db74ad4..ff75f75b5 100644 --- a/microdroid/system/private/init.te +++ b/microdroid/system/private/init.te @@ -171,7 +171,6 @@ allow init { allow init { file_type -exec_type - -keystore_data_file -shell_data_file -system_file_type -vendor_file_type @@ -181,7 +180,6 @@ allow init { file_type -apex_info_file -exec_type - -keystore_data_file -runtime_event_log_tags_file -shell_data_file -system_file_type @@ -193,7 +191,6 @@ allow init tracefs_type:file { create_file_perms relabelfrom }; allow init { file_type -exec_type - -keystore_data_file -shell_data_file -system_file_type -vendor_file_type @@ -203,7 +200,6 @@ allow init { file_type -apex_mnt_dir -exec_type - -keystore_data_file -shell_data_file -system_file_type -vendor_file_type @@ -356,11 +352,6 @@ allow init self:global_capability_class_set sys_boot; allow init self:global_capability_class_set kill; allow init domain:process { getpgid sigkill signal }; -# Init creates keystore's directory on boot, and walks through -# the directory as part of a recursive restorecon. -allow init keystore_data_file:dir { open create read getattr setattr search }; -allow init keystore_data_file:file { getattr }; - # Init creates /data/local/tmp at boot allow init shell_data_file:dir { open create read getattr setattr search }; allow init shell_data_file:file { getattr }; diff --git a/microdroid/system/private/keystore.te b/microdroid/system/private/keystore.te deleted file mode 100644 index ee109108c..000000000 --- a/microdroid/system/private/keystore.te +++ /dev/null @@ -1,20 +0,0 @@ -typeattribute keystore coredomain; - -init_daemon_domain(keystore) - -# talk to keymint -hal_client_domain(keystore, hal_keymint) - -# Allow keystore to write to statsd. -unix_socket_send(keystore, statsdw, statsd) - -# Keystore need access to the keystore_key context files to load the keystore key backend. -allow keystore keystore2_key_contexts_file:file r_file_perms; - -# microdroid doesn't use keymaster HAL -dontaudit keystore hal_keymaster_hwservice:hwservice_manager find; - -# microdroid isn't related to F2FS, but sqlite3 tries to query F2FS features. -dontauditxperm keystore keystore_data_file:file ioctl F2FS_IOC_GET_FEATURES; - -set_prop(keystore, keystore_crash_prop) diff --git a/microdroid/system/private/keystore2_key_contexts b/microdroid/system/private/keystore2_key_contexts deleted file mode 100644 index 02cdd5e6c..000000000 --- a/microdroid/system/private/keystore2_key_contexts +++ /dev/null @@ -1,11 +0,0 @@ -# Keystore 2.0 key contexts. -# This file defines Keystore 2.0 namespaces and maps them to labels. -# Format: -#