Nick Kralevich
9cb9c4bdfa
Merge "fine-grained policy for access to /proc/zoneinfo"
...
am: 89a8ed4e9a
2016-08-14 18:28:49 +00:00
Daniel Micay
7078e8b67a
fine-grained policy for access to /proc/zoneinfo
...
Change-Id: Ica9a16311075f5cc3744d0e0833ed876e201029f
2016-08-08 13:48:01 -04:00
Jeff Vander Stoep
11c79b20d7
lmkd: grant read access to all of /sys
...
avc: denied { search } for pid=394 comm="lmkd" name="lowmemorykiller" dev="sysfs" ino=7541 scontext=u:r:lmkd:s0 tcontext=u:object_r:sysfs_lowmemorykiller:s0 tclass=dir permissive=0
(Cherry picked from commit 30a3ee4ce9
2016-06-23 06:53:46 +00:00
Jeff Vander Stoep
30a3ee4ce9
lmkd: grant read access to all of /sys
...
avc: denied { search } for pid=394 comm="lmkd" name="lowmemorykiller" dev="sysfs" ino=7541 scontext=u:r:lmkd:s0 tcontext=u:object_r:sysfs_lowmemorykiller:s0 tclass=dir permissive=0
Bug: 29558514
Change-Id: Iaae907a92976af2a9dcb58be5643b8614dcde174
2016-06-22 22:26:28 -07:00
Nick Kralevich
7898352245
Replace "neverallow domain" by "neverallow *" am: 35a1451430
...
am: 8f611b6eda
2016-02-05 23:44:02 +00:00
Nick Kralevich
35a1451430
Replace "neverallow domain" by "neverallow *"
...
Modify many "neverallow domain" rules to be "neverallow *" rules
instead. This will catch more SELinux policy bugs where a label
is assigned an irrelevant rule, as well as catch situations where
a domain attribute is not assigned to a process.
Change-Id: I5b83a2504c13b384f9dff616a70ca733b648ccdf
2016-02-05 14:54:04 -08:00
Jeff Vander Stoep
ae72bf241d
Populate autoplay_app with minimal set of permissions
...
Change-Id: Ia90fb531cfd99d49d179921f041dd93c7325ad50
2015-11-25 09:41:05 -08:00
Jeff Vander Stoep
d22987b4da
Create attribute for moving perms out of domain
...
Motivation: Domain is overly permissive. Start removing permissions
from domain and assign them to the domain_deprecated attribute.
Domain_deprecated and domain can initially be assigned to all
domains. The goal is to not assign domain_deprecated to new domains
and to start removing domain_deprecated where it is not required or
reassigning the appropriate permissions to the inheriting domain
when necessary.
Bug: 25433265
Change-Id: I8b11cb137df7bdd382629c98d916a73fe276413c
2015-11-03 23:11:11 +00:00
Stephen Smalley
cbc5279a43
More MLS trusted subject/object annotations.
...
dumpstate and lmkd need to act on apps running at any level.
Various file types need to be writable by apps running at any
level.
Change-Id: Idf574d96ba961cc110a48d0a00d30807df6777ba
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-15 19:22:23 +00:00
Nick Kralevich
8a5b28d259
lmkd: avoid locking libsigchain into memory
...
https://android-review.googlesource.com/94851 added an LD_PRELOAD
line to init.environ.rc.in. This has the effect of loading
libsigchain.so into every process' memory space, regardless of
whether it wants it or not.
For lmkd, it doesn't need libsigchain, so it doesn't make any sense
to load it and keep it locked in memory.
Disable noatsecure for lmkd. This sets AT_SECURE=1, which instructs the
linker to not honor security sensitive environment variables such
as LD_PRELOAD. This prevents libsigchain.so from being loaded into
lmkd's memory.
Change-Id: I6378ba28ff3a1077747fe87c080e1f9f7ca8132e
2014-07-17 02:05:55 +00:00
Nick Kralevich
6a1405d745
lmkd: allow lmkd to lock itself in memory
...
addresses the following denial:
type=1400 audit(1.871:3): avc: denied { ipc_lock } for pid=1406 comm="lmkd" capability=14 scontext=u:r:lmkd:s0 tcontext=u:r:lmkd:s0 tclass=capability
Bug: 16236289
Change-Id: Id9923c16c6db026dd5d28996126f503c5c1d7c87
2014-07-16 12:06:35 -07:00
Colin Cross
5329731802
lmkd: allow removing cgroups and setting self to SCHED_FIFO
...
Addresses the following selinux denials:
type=1400 audit(1405383429.107:22): avc: denied { remove_name } for pid=137 comm="lmkd" name="uid_10060" dev="cgroup" ino=18368 scontext=u:r:lmkd:s0 tcontext=u:object_r:cgroup:s0 tclass=dir permissive=0
type=1400 audit(1405383794.109:6): avc: denied { sys_nice } for pid=1619 comm="lmkd" capability=23 scontext=u:r:lmkd:s0 tcontext=u:r:lmkd:s0 tclass=capability permissive=0
Change-Id: I7b6e5a396bf345c4768defd7b39af2435631a35b
2014-07-14 17:43:32 -07:00
Nick Kralevich
23a52e6b30
allow lmkd to kill processes.
...
The previous patch wasn't sufficient. Allow the kill signal.
Addresses the following denial:
<5>[ 775.819223] type=1400 audit(1393978653.489:18): avc: denied { sigkill } for pid=118 comm="lmkd" scontext=u:r:lmkd:s0 tcontext=u:r:untrusted_app:s0 tclass=process
Bug: 13084787
Change-Id: I6af1ed4343b590049809a59e4f2797f6049f12e4
2014-03-04 17:16:21 -08:00
Nick Kralevich
24be391681
Give lmkd kill capability
...
lmkd needs the capability to kill processes.
Addresses the following denial:
<5>[12619.064604] type=1400 audit(1393540506.745:2565): avc: denied { kill } for pid=116 comm="lmkd" capability=5 scontext=u:r:lmkd:s0 tcontext=u:r:lmkd:s0 tclass=capability
Addresses the following errors:
02-27 13:13:50.995 116 116 I lowmemorykiller: Killing 'com.google.android.deskclock' (7133), adj 15
02-27 13:13:50.995 116 116 I lowmemorykiller: to free 33836kB because cache 118512kB is below limit 122880kB for oom_adj 15
02-27 13:13:50.995 116 116 I lowmemorykiller: Free memory is -28472kB below reserved
02-27 13:13:50.995 116 116 E lowmemorykiller: kill(7133): errno=1
Change-Id: I7cca238610307aba9d77aa2e52a32ebd6aec3f3c
2014-02-27 15:42:23 -08:00
Nick Kralevich
1c73a5cd92
lmkd: add sys_resource
...
Addresses the following denial / error:
E/lowmemorykiller( 187): Error writing /proc/1148/oom_adj; errno=13
[ 118.264668] type=1400 audit(947231128.209:140): avc: denied { sys_resource } for pid=187 comm="lmkd" capability=24 scontext=u:r:lmkd:s0 tcontext=u:r:lmkd:s0 tclass=capability
Change-Id: Ief2a7ead9cdd8a33e3add111ee99f7a29c12a3f2
2014-02-19 11:40:53 -08:00
Nick Kralevich
5fa2a19f21
Make lmkd enforcing.
...
Start enforcing SELinux rules for lmkd. Security policy
violations will return an error instead of being allowed.
Change-Id: I2bad2c2094d93ebbcb8ccc4b7f3369419004a3f0
2014-02-14 10:05:44 -08:00
Nick Kralevich
5467fce636
initial lmkd policy.
...
* Allow writes to /proc/PID/oom_score_adj
* Allow writes to /sys/module/lowmemorykiller/*
Addresses the following denials:
<5>[ 3.825371] type=1400 audit(9781555.430:5): avc: denied { write } for pid=176 comm="lmkd" name="minfree" dev="sysfs" ino=6056 scontext=u:r:lmkd:s0 tcontext=u:object_r:sysfs:s0 tclass=file
<5>[ 48.874747] type=1400 audit(9781600.639:16): avc: denied { search } for pid=176 comm="lmkd" name="896" dev="proc" ino=9589 scontext=u:r:lmkd:s0 tcontext=u:r:system_server:s0 tclass=dir
<5>[ 48.874889] type=1400 audit(9781600.639:17): avc: denied { dac_override } for pid=176 comm="lmkd" capability=1 scontext=u:r:lmkd:s0 tcontext=u:r:lmkd:s0 tclass=capability
<5>[ 48.874982] type=1400 audit(9781600.639:18): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=8942 scontext=u:r:lmkd:s0 tcontext=u:r:system_server:s0 tclass=file
<5>[ 48.875075] type=1400 audit(9781600.639:19): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=8942 scontext=u:r:lmkd:s0 tcontext=u:r:system_server:s0 tclass=file
<5>[ 49.409231] type=1400 audit(9781601.169:20): avc: denied { write } for pid=176 comm="lmkd" name="minfree" dev="sysfs" ino=6056 scontext=u:r:lmkd:s0 tcontext=u:object_r:sysfs:s0 tclass=file
<5>[ 209.081990] type=1400 audit(9781760.839:24): avc: denied { search } for pid=176 comm="lmkd" name="1556" dev="proc" ino=10961 scontext=u:r:lmkd:s0 tcontext=u:r:platform_app:s0 tclass=dir
<5>[ 209.082240] type=1400 audit(9781760.839:25): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11654 scontext=u:r:lmkd:s0 tcontext=u:r:platform_app:s0 tclass=file
<5>[ 209.082498] type=1400 audit(9781760.839:26): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11654 scontext=u:r:lmkd:s0 tcontext=u:r:platform_app:s0 tclass=file
<5>[ 209.119673] type=1400 audit(9781760.879:27): avc: denied { search } for pid=176 comm="lmkd" name="1577" dev="proc" ino=12708 scontext=u:r:lmkd:s0 tcontext=u:r:release_app:s0 tclass=dir
<5>[ 209.119937] type=1400 audit(9781760.879:28): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11657 scontext=u:r:lmkd:s0 tcontext=u:r:release_app:s0 tclass=file
<5>[ 209.120105] type=1400 audit(9781760.879:29): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11657 scontext=u:r:lmkd:s0 tcontext=u:r:release_app:s0 tclass=file
<5>[ 209.235597] type=1400 audit(9781760.999:30): avc: denied { search } for pid=176 comm="lmkd" name="1600" dev="proc" ino=11659 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=dir
<5>[ 209.235798] type=1400 audit(9781760.999:31): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11667 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=file
<5>[ 209.236006] type=1400 audit(9781760.999:32): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11667 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=file
<5>[ 214.297283] type=1400 audit(9781766.059:64): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11211 scontext=u:r:lmkd:s0 tcontext=u:r:untrusted_app:s0 tclass=file
<5>[ 214.297415] type=1400 audit(9781766.059:65): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=11211 scontext=u:r:lmkd:s0 tcontext=u:r:untrusted_app:s0 tclass=file
<5>[ 214.355060] type=1400 audit(9781766.119:66): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12907 scontext=u:r:lmkd:s0 tcontext=u:r:system_app:s0 tclass=file
<5>[ 214.355236] type=1400 audit(9781766.119:67): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12907 scontext=u:r:lmkd:s0 tcontext=u:r:system_app:s0 tclass=file
<5>[ 214.516920] type=1400 audit(9781766.279:68): avc: denied { search } for pid=176 comm="lmkd" name="1907" dev="proc" ino=11742 scontext=u:r:lmkd:s0 tcontext=u:r:media_app:s0 tclass=dir
<5>[ 214.678861] type=1400 audit(9781766.439:69): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12915 scontext=u:r:lmkd:s0 tcontext=u:r:media_app:s0 tclass=file
<5>[ 214.678992] type=1400 audit(9781766.439:70): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12915 scontext=u:r:lmkd:s0 tcontext=u:r:media_app:s0 tclass=file
<5>[ 214.708284] type=1400 audit(9781766.469:71): avc: denied { search } for pid=176 comm="lmkd" name="1765" dev="proc" ino=12851 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=dir
<5>[ 214.708435] type=1400 audit(9781766.469:72): avc: denied { write } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12870 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=file
<5>[ 214.708648] type=1400 audit(9781766.469:73): avc: denied { open } for pid=176 comm="lmkd" name="oom_score_adj" dev="proc" ino=12870 scontext=u:r:lmkd:s0 tcontext=u:r:shared_app:s0 tclass=file
Change-Id: Ie3c1ab8ce9e77742d0cc3c73f40010afd018ccd4
2014-02-13 13:48:33 -08:00
Stephen Smalley
2561a9afbe
Make lmkd permissive or unconfined.
...
Otherwise we'll never see denials in userdebug or eng builds and
never make progress on confining it. Of course we cannot truly
test until it is released into AOSP, but this prepares the way
and potentially allows for internal testing and collection of denials.
Change-Id: Ic9d1ba872d43f322e39ca6cffa0e725f1e223e7b
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-02-11 09:44:43 -05:00
Nick Kralevich
2b392fccf3
Move lmkd into it's own domain.
...
lmkd low memory killer daemon
The kernel low memory killer logic has been moved to a new daemon
called lmkd. ActivityManager communicates with this daemon over a
named socket.
This is just a placeholder policy, starting off in unconfined_domain.
Change-Id: Ia3f9a18432c2ae37d4f5526850e11432fd633e10
2013-12-06 08:16:39 -08:00
