tequilaOS/platform_system_sepolicy

8297 commits 1 branch 0 tags 50 MiB

Author	SHA1	Message	Date
Calin Juravle	01ee59a7b4	Remove SElinux audit to libart_file Since it was introduced it caused quite a few issues and it spams the SElinux logs unnecessary. The end goal of the audit was to whitelist the access to the interpreter. However that's unfeasible for now given the complexity. Test: devices boots and everything works as expected no more auditallow logs Bug: 29795519 Bug: 32871170 Change-Id: I9a7a65835e1e1d3f81be635bed2a3acf75a264f6	2017-01-31 23:43:14 +00:00
Nick Kralevich	364fd19782	profman/debuggerd: allow libart_file:file r_file_perms Addresses the following auditallow spam: avc: granted { read open } for comm="profman" path="/system/lib/libart.so" dev="dm-0" ino=1368 scontext=u:r:profman:s0 tcontext=u:object_r:libart_file:s0 tclass=file avc: granted { read open } for comm="debuggerd64" path="/system/lib64/libart.so" dev="dm-0" ino=1897 scontext=u:r:debuggerd:s0 tcontext=u:object_r:libart_file:s0 tclass=file avc: granted { getattr } for comm="debuggerd64" path="/system/lib64/libart.so" dev="dm-0" ino=1837 scontext=u:r:debuggerd:s0 tcontext=u:object_r:libart_file:s0 tclass=file Test: Policy compiles. Not a tightening of rules. Change-Id: I501b0a6a343c61b3ca6283647a18a9a15deddf2a	2016-11-08 09:28:28 -08:00
dcashman	cc39f63773	Split general policy into public and private components. Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c	2016-10-06 13:09:06 -07:00

Author

SHA1

Message

Date

Calin Juravle

01ee59a7b4

Remove SElinux audit to libart_file

Since it was introduced it caused quite a few issues and it spams the
SElinux logs unnecessary.

The end goal of the audit was to whitelist the access to the
interpreter. However that's unfeasible for now given the complexity.

Test: devices boots and everything works as expected
      no more auditallow logs

Bug: 29795519
Bug: 32871170
Change-Id: I9a7a65835e1e1d3f81be635bed2a3acf75a264f6

2017-01-31 23:43:14 +00:00

Nick Kralevich

364fd19782

profman/debuggerd: allow libart_file:file r_file_perms

Addresses the following auditallow spam:

avc: granted { read open } for comm="profman"
path="/system/lib/libart.so" dev="dm-0" ino=1368 scontext=u:r:profman:s0
tcontext=u:object_r:libart_file:s0 tclass=file

avc: granted { read open } for comm="debuggerd64"
path="/system/lib64/libart.so" dev="dm-0" ino=1897
scontext=u:r:debuggerd:s0 tcontext=u:object_r:libart_file:s0 tclass=file

avc: granted { getattr } for comm="debuggerd64"
path="/system/lib64/libart.so" dev="dm-0" ino=1837
scontext=u:r:debuggerd:s0 tcontext=u:object_r:libart_file:s0 tclass=file

Test: Policy compiles. Not a tightening of rules.
Change-Id: I501b0a6a343c61b3ca6283647a18a9a15deddf2a

2016-11-08 09:28:28 -08:00

dcashman

cc39f63773

Split general policy into public and private components.

Divide policy into public and private components.  This is the first
step in splitting the policy creation for platform and non-platform
policies.  The policy in the public directory will be exported for use
in non-platform policy creation.  Backwards compatibility with it will
be achieved by converting the exported policy into attribute-based
policy when included as part of the non-platform policy and a mapping
file will be maintained to be included with the platform policy that
maps exported attributes of previous versions to the current platform
version.

Eventually we would like to create a clear interface between the
platform and non-platform device components so that the exported policy,
and the need for attributes is minimal.  For now, almost all types and
avrules are left in public.

Test: Tested by building policy and running on device.

Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c

2016-10-06 13:09:06 -07:00

Renamed from profman.te (Browse further)

3 commits