Add keystore_key class and an action for each action supported
by keystore. Add policies that replicate the access control that
already exists in keystore. Add auditallow rules for actions
not known to be used frequently. Add macro for those domains
wishing to access keystore.
Change-Id: Iddd8672b9e9b72b45ee208e6eda608cc9dc61edc
Add a service_mananger class with the verb add.
Add a type that groups the services for each of the
processes that is allowed to start services in service.te
and an attribute for all services controlled by the service
manager. Add the service_contexts file which maps service
name to target label.
Bug: 12909011
Change-Id: I017032a50bc90c57b536e80b972118016d340c7d
Modeled after http://oss.tresys.com/pipermail/refpolicy/2013-January/006283.html
Addresses the following kernel error message:
<6>[ 3.855423] SELinux: Permission attach_queue in class tun_socket not defined in policy.
<6>[ 3.862482] SELinux: the above unknown classes and permissions will be denied
<7>[ 3.869668] SELinux: Completing initialization.
Change-Id: Iad87fcd5348d121a808dbe7ae3c63f8c90fc09fc
specifycapabilities is no longer specified by the zygote userspace manager.
It was removed in commit: 42a4bb5730266f80585e67262c73505d0bfffbf8. Remove
this permission from policy.
Change-Id: I866a25b590a375a68de6eec9af1b3ef779889985
The binder_transfer_binder hook was changed in the kernel, obsoleting
the receive permission and changing the target of the transfer permission.
Update the binder-related policy to match the revised permission checking.
Change-Id: I1ed0dadfde2efa93296e967eb44ca1314cf28586
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
New property_contexts file for property selabel backend.
New property.te file with property type declarations.
New property_service security class and set permission.
Allow rules for setting properties.
