4 commits
Author | SHA1 | Message | Date | |
---|---|---|---|---|
Nick Kralevich
|
68f233648e |
installd: r_dir_file(installd, system_file)
Allow installd to read through files, directories, and symlinks on /system. This is needed to support installd using files in /system/app and /system/priv-app Addresses the following auditallow spam: avc: granted { getattr } for comm="installd" path="/system/app/Bluetooth/lib/arm/libbluetooth_jni.so" dev="mmcblk0p41" ino=19 scontext=u:r:installd:s0 tcontext=u:object_r:system_file:s0 tclass=lnk_file avc: granted { getattr } for comm="installd" path="/system/priv-app/MtpDocumentsProvider/lib/arm64/libappfuse_jni.so" dev="dm-0" ino=2305 scontext=u:r:installd:s0 tcontext=u:object_r:system_file:s0 tclass=lnk_file avc: granted { read open } for comm="installd" path="/system/priv-app/TelephonyProvider" dev="mmcblk0p43" ino=1839 scontext=u:r:installd:s0 tcontext=u:object_r:system_file:s0 tclass=dir avc: granted { read } for comm="installd" name="Velvet" dev="mmcblk0p43" ino=1841 scontext=u:r:installd:s0 tcontext=u:object_r:system_file:s0 tclass=dir avc: granted { read open } for comm="installd" path="/system/priv-app/GoogleOneTimeInitializer" dev="mmcblk0p43" ino=1778 scontext=u:r:installd:s0 tcontext=u:object_r:system_file:s0 tclass=dir avc: granted { read open } for comm="installd" path="/system/app/PlayAutoInstallConfig" dev="mmcblk0p43" ino=112 scontext=u:r:installd:s0 tcontext=u:object_r:system_file:s0 tclass=dir Test: policy compiles Change-Id: I5d14ea2cd7d281f949d0651b9723d5b7fae2e1f2 |
||
Nick Kralevich
|
2c8ea36ad8 |
Get rid of more auditallow spam
Addresses the following audit messages: [ 7.984957] type=1400 audit(33873666.610:40): avc: granted { getattr } for pid=1 comm="init" name="system@framework@boot-ext.art" dev="dm-2" ino=106324 scontext=u:r:init:s0 tcontext=u:object_r:dalvikcache_data_file:s0 tclass=file [ 65.528068] type=1400 audit(1477751916.508:96): avc: granted { search } for pid=6330 comm="main" name="/" dev="cgroup" ino=12428 scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=dir [ 65.530425] type=1400 audit(1477751916.508:97): avc: granted { search } for pid=6330 comm="main" name="/" dev="cgroup" ino=12428 scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=dir [ 65.530487] type=1400 audit(1477751916.508:98): avc: granted { open } for pid=6330 comm="main" path="/dev/cpuctl/tasks" dev="cgroup" ino=12429 scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=file [ 65.530800] type=1400 audit(1477751916.508:98): avc: granted { open } for pid=6330 comm="main" path="/dev/cpuctl/tasks" dev="cgroup" ino=12429 scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=file [ 65.530842] type=1400 audit(1477751916.508:99): avc: granted { search } for pid=6330 comm="main" name="/" dev="cgroup" ino=12428 scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=dir [ 65.531138] type=1400 audit(1477751916.508:99): avc: granted { search } for pid=6330 comm="main" name="/" dev="cgroup" ino=12428 scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=dir [ 65.531176] type=1400 audit(1477751916.508:100): avc: granted { search } for pid=6330 comm="main" name="bg_non_interactive" dev="cgroup" ino=12444 scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=dir [ 65.531465] type=1400 audit(1477751916.508:100): avc: granted { search } for pid=6330 comm="main" name="bg_non_interactive" dev="cgroup" ino=12444 scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=dir [ 65.531502] type=1400 audit(1477751916.508:101): avc: granted { open } for pid=6330 comm="main" path="/dev/cpuctl/bg_non_interactive/tasks" dev="cgroup" ino=12445 scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=file [ 65.531789] type=1400 audit(1477751916.508:101): avc: granted { open } for pid=6330 comm="main" path="/dev/cpuctl/bg_non_interactive/tasks" dev="cgroup" ino=12445 scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=file [ 65.531827] type=1400 audit(1477751916.508:102): avc: granted { search } for pid=6330 comm="main" name="/" dev="cgroup" ino=12459 scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=dir [ 65.713056] type=1400 audit(1477751916.508:102): avc: granted { search } for pid=6330 comm="main" name="/" dev="cgroup" ino=12459 scontext=u:r:dumpstate:s0 tcontext=u:object_r:cgroup:s0 tclass=dir Bug: 32246161 Test: policy compiles Test: dumpstate no longer generates the audit messages above. Change-Id: Id5afe2ebeb24f8a7407aac1a0a09806b1521b0e4 |
||
Nick Kralevich
|
79a08e13bd |
Get rid of auditallow spam.
Fixes the following SELinux messages when running adb bugreport: avc: granted { read } for name="libart.so" dev="dm-0" ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0 tclass=file avc: granted { read open } for path="/system/lib64/libart.so" dev="dm-0" ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0 tclass=file avc: granted { getattr } for path="/system/lib64/libart.so" dev="dm-0" ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0 tclass=file avc: granted { read } for path="/system/lib64/libart.so" dev="dm-0" ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0 tclass=file avc: granted { read } for path="/system/lib64/libart.so" dev="dm-0" ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0 tclass=file avc: granted { read } for path="/system/lib64/libart.so" dev="dm-0" ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0 tclass=file avc: granted { read } for path="/system/lib64/libart.so" dev="dm-0" ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0 tclass=file avc: granted { read execute } for path="/system/lib64/libart.so" dev="dm-0" ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0 tclass=file avc: granted { read } for path="/system/lib64/libart.so" dev="dm-0" ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0 tclass=file avc: granted { read } for path="/system/lib64/libart.so" dev="dm-0" ino=1886 scontext=u:r:dumpstate:s0 tcontext=u:object_r:libart_file:s0 tclass=file avc: granted { search } for name="dalvik-cache" dev="dm-2" ino=106289 scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0 tclass=dir avc: granted { getattr } for path="/data/dalvik-cache/arm64" dev="dm-2" ino=106290 scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0 tclass=dir avc: granted { search } for name="dalvik-cache" dev="dm-2" ino=106289 scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0 tclass=dir avc: granted { search } for name="arm64" dev="dm-2" ino=106290 scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0 tclass=dir avc: granted { getattr } for path="/data/dalvik-cache/arm64/system@framework@boot.art" dev="dm-2" ino=106318 scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0 tclass=file avc: granted { search } for name="dalvik-cache" dev="dm-2" ino=106289 scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0 tclass=dir avc: granted { search } for name="arm64" dev="dm-2" ino=106290 scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0 tclass=dir avc: granted { read } for name="system@framework@boot.art" dev="dm-2" ino=106318 scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0 tclass=file avc: granted { read open } for path="/data/dalvik-cache/arm64/system@framework@boot.art" dev="dm-2" ino=106318 scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0 tclass=file avc: granted { search } for name="dalvik-cache" dev="dm-2" ino=106289 scontext=u:r:dumpstate:s0 tcontext=u:object_r:dalvikcache_data_file:s0 tclass=dir [ 169.349480] type=1400 audit(1477679159.734:129): avc: granted { read } for pid=6413 comm="main" name="ipv6_route" dev="proc" ino=4026535947 scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file [ 169.350030] type=1400 audit(1477679159.734:130): avc: granted { read open } for pid=6413 comm="main" path="/proc/6413/net/ipv6_route" dev="proc" ino=4026535947 scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file [ 169.350361] type=1400 audit(1477679159.734:130): avc: granted { read open } for pid=6413 comm="main" path="/proc/6413/net/ipv6_route" dev="proc" ino=4026535947 scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file [ 169.350399] type=1400 audit(1477679159.734:131): avc: granted { getattr } for pid=6413 comm="main" path="/proc/6413/net/ipv6_route" dev="proc" ino=4026535947 scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file [ 169.350963] type=1400 audit(1477679159.734:131): avc: granted { getattr } for pid=6413 comm="main" path="/proc/6413/net/ipv6_route" dev="proc" ino=4026535947 scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file [ 169.351002] type=1400 audit(1477679159.734:132): avc: granted { read } for pid=6413 comm="main" name="if_inet6" dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file [ 169.351330] type=1400 audit(1477679159.734:132): avc: granted { read } for pid=6413 comm="main" name="if_inet6" dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file [ 169.351366] type=1400 audit(1477679159.734:133): avc: granted { read open } for pid=6413 comm="main" path="/proc/6413/net/if_inet6" dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file [ 169.351861] type=1400 audit(1477679159.734:133): avc: granted { read open } for pid=6413 comm="main" path="/proc/6413/net/if_inet6" dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file [ 169.351910] type=1400 audit(1477679159.734:134): avc: granted { getattr } for pid=6413 comm="main" path="/proc/6413/net/if_inet6" dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file [ 169.353105] type=1400 audit(1477679159.734:134): avc: granted { getattr } for pid=6413 comm="main" path="/proc/6413/net/if_inet6" dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file [ 169.353186] type=1400 audit(1477679159.734:135): avc: granted { read } for pid=6413 comm="main" name="if_inet6" dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file [ 169.353594] type=1400 audit(1477679159.734:135): avc: granted { read } for pid=6413 comm="main" name="if_inet6" dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file [ 169.353636] type=1400 audit(1477679159.734:136): avc: granted { read open } for pid=6413 comm="main" path="/proc/6413/net/if_inet6" dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file [ 169.354230] type=1400 audit(1477679159.734:136): avc: granted { read open } for pid=6413 comm="main" path="/proc/6413/net/if_inet6" dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file [ 169.354437] type=1400 audit(1477679159.734:137): avc: granted { getattr } for pid=6413 comm="main" path="/proc/6413/net/if_inet6" dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file [ 169.395359] type=1400 audit(1477679159.734:137): avc: granted { getattr } for pid=6413 comm="main" path="/proc/6413/net/if_inet6" dev="proc" ino=4026535946 scontext=u:r:dumpstate:s0 tcontext=u:object_r:proc_net:s0 tclass=file Test: policy compiles Test: adb bugreport runs without auditallow messages above. Bug: 32246161 Change-Id: Ie0ab2ed3c6babc1f93d3b8ae47c92dd905ebc93a |
||
dcashman
|
cc39f63773 |
Split general policy into public and private components.
Divide policy into public and private components. This is the first step in splitting the policy creation for platform and non-platform policies. The policy in the public directory will be exported for use in non-platform policy creation. Backwards compatibility with it will be achieved by converting the exported policy into attribute-based policy when included as part of the non-platform policy and a mapping file will be maintained to be included with the platform policy that maps exported attributes of previous versions to the current platform version. Eventually we would like to create a clear interface between the platform and non-platform device components so that the exported policy, and the need for attributes is minimal. For now, almost all types and avrules are left in public. Test: Tested by building policy and running on device. Change-Id: Idef796c9ec169259787c3f9d8f423edf4ce27f8c |
Renamed from domain_deprecated.te (Browse further)