Addresses denials such as:
avc: denied { read write } for comm="dnsmasq" path="socket:[1054090]" dev="sockfs" ino=1054090 scontext=u:r:dnsmasq:s0 tcontext=u:r:netd:s0 tclass=udp_socket
This may not be needed (need to check netd to see if it should be closing
all of these sockets before exec'ing other programs), but should be harmless.
Change-Id: I77c7af5e050e039fd48322914eeabbcb8a716040
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Originally we used the shell domain for ADB shell only and
the init_shell domain for the console service, both transitioned
via automatic domain transitions on sh. So they originally
shared a common set of rules. Then init_shell started to be used
for sh commands invoked by init.<board>.rc files, and we switched
the console service to just use the shell domain via seclabel entry
in init.rc. Even most of the sh command instances in init.<board>.rc
files have been converted to use explicit seclabel options with
more specific domains (one lingering use is touch_fw_update service
in init.grouper.rc). The primary purpose of init_shell at this point
is just to shed certain permissions from the init domain when init invokes
a shell command. And init_shell and shell are quite different in
their permission requirements since the former is used now for
uid-0 processes spawned by init whereas the latter is used for
uid-shell processes spawned by adb or init.
Given these differences, drop the shelldomain attribute and take those
rules directly into shell.te. init_shell was an unconfined_domain(),
so it loses nothing from this change. Also switch init_shell to
permissive_or_unconfined() so that we can see its actual denials
in the future in userdebug/eng builds.
Change-Id: I6e7e45724d1aa3a6bcce8df676857bc8eef568f0
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Need this for changing the max_cpufreq and min_cpufreq for the low power
mode.
Denials:
type=1400 audit(1402431554.756:14): avc: denied { write } for pid=854
comm="PowerManagerSer" name="scaling_max_freq" dev="sysfs" ino=9175
scontext=u:r:system_server:s0 tcontext=u:object_r:sysfs_devices_system_cpu:s0
tclass=file
Change required for Change-Id: I1cf458c4f128818ad1286e5a90b0d359b6913bb8
Change-Id: Ic5ce3c8327e973bfa1d53f298c07dcea1550b646
Signed-off-by: Ruchi Kandoi<kandoiruchi@google.com>
single quotes make the m4 parser think it's at the end of
a block, and generates the following compile time warning:
external/sepolicy/recovery.te:9:WARNING 'unrecognized character' at token ''' on line 7720:
Change-Id: I2502f16f0d9ec7528ec0fc2ee65ad65635d0101b
dumpstate calls screencap to take a screenshot. screencap
requires the ability to access the gpu device. Allow it.
Bug: 15514427
Change-Id: Iad8451b6108786653146de471f6be2d26b0e3297
Right now usbfs doesn't have any labels, generating the
following kernel warnings:
<7>[ 3.009582] SELinux: initialized (dev usbfs, type usbfs), not configured for labeling
and the occasional SELinux unlabeled auditallow logs:
<4>[ 285.579254] type=1400 audit(1402010345.094:16): avc: granted { search } for pid=371 comm="qcks" name="/" dev="usbfs" ino=15794 scontext=u:r:kickstart:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir
<4>[ 285.632354] type=1400 audit(1402010345.154:18): avc: granted { search } for pid=371 comm="qcks" name="001" dev="usbfs" ino=15796 scontext=u:r:kickstart:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir
Make sure usbfs is assigned via genfscon
Change-Id: I7191f2584014ba55a3c3a98e7efd0350dc958782
Domains which want to access /data/local/tmp must do so by
creating their own SELinux domain.
Bug: 15164984
Change-Id: I0061129c64e659c552cf6565058b0786fba59ae0
Modeled after http://oss.tresys.com/pipermail/refpolicy/2013-January/006283.html
Addresses the following kernel error message:
<6>[ 3.855423] SELinux: Permission attach_queue in class tun_socket not defined in policy.
<6>[ 3.862482] SELinux: the above unknown classes and permissions will be denied
<7>[ 3.869668] SELinux: Completing initialization.
Change-Id: Iad87fcd5348d121a808dbe7ae3c63f8c90fc09fc
The shell user needs to be able to run commands like
"cat /data/anr/traces.txt". Allow it.
We also need to be able to pull the file via adb.
"adb pull /data/anr/traces.txt". Allow it.
Addresses the following denials:
<4>[ 20.212398] type=1400 audit(1402000262.433:11): avc: denied { getattr } for pid=1479 comm="adbd" path="/data/anr/traces.txt" dev="mmcblk0p28" ino=325763 scontext=u:r:adbd:s0 tcontext=u:object_r:anr_data_file:s0 tclass=file
<4>[ 20.252182] type=1400 audit(1402000262.473:12): avc: denied { read } for pid=1479 comm="adbd" name="traces.txt" dev="mmcblk0p28" ino=325763 scontext=u:r:adbd:s0 tcontext=u:object_r:anr_data_file:s0 tclass=file
<4>[ 20.252579] type=1400 audit(1402000262.473:13): avc: denied { open } for pid=1479 comm="adbd" name="traces.txt" dev="mmcblk0p28" ino=325763 scontext=u:r:adbd:s0 tcontext=u:object_r:anr_data_file:s0 tclass=file
<4>[ 27.104068] type=1400 audit(1402000268.479:14): avc: denied { read } for pid=2377 comm="sh" name="traces.txt" dev="mmcblk0p28" ino=325763 scontext=u:r:shell:s0 tcontext=u:object_r:anr_data_file:s0 tclass=file
Bug: 15450720
Change-Id: I767102a7182895112838559b0ade1cd7c14459ab
write_logd() is allowed for domain, which means that all domains
are permitted read/write access to /dev. That's overly permissive
and causes substantial differences between user and userdebug/eng
devices.
Remove domain device:dir rw_dir_perms access. It's not needed.
Allow all domains to write/append to logd_debug. logd is responsible
for creating this file if need be. Remove logd_debug file create
permissions. This also eliminates the need for the type_transition
rules.
Bug: 15419803
Change-Id: I7dc3c4df8d413c649c24ae7bc15546d64226ce3b
