Commit graph

435 commits

Author SHA1 Message Date
Inseob Kim
d58166165a Migrate freeze test to Soong
Bug: 33691272
Test: m selinux_policy on sc-dev
Change-Id: Ie536d885034e5d888f1329ac189fd0bf9723a6c4
2021-09-16 05:08:56 +00:00
Inseob Kim
4f20ff73ee Add 31.0 mapping files
Steps taken to produce the mapping files:

1. Add prebuilts/api/31.0/plat_pub_versioned.cil from the
/vendor/etc/selinux/plat_pub_versioned.cil file built on sc-dev with
lunch target aosp_arm64-eng. Add prebuilts/api/31.0/vendor_sepolicy.cil
as an empty file.

2. Add new file private/compat/31.0/31.0.cil by doing the following:
- copy /system/etc/selinux/mapping/31.0.cil from sc-dev aosp_arm64-eng
device to private/compat/31.0/31.0.cil
- remove all attribute declaration statement (typeattribute ...) and
sort lines alphabetically
- some selinux types were added/renamed/deleted w.r.t 31 sepolicy.
Find all such types using treble_sepolicy_tests_31.0 test.
- for all these types figure out where to map them by looking at
30.0.[ignore.]cil files and add approprite entries to 31.0.[ignore.]cil.

This change also enables treble_sepolicy_tests_31.0 and installs
31.0.cil mapping file onto the device.

Bug: 189161483
Test: m treble_sepolicy_tests_31.0
Test: m 31.0_compat_test
Test: m selinux_policy
Change-Id: I6264b9cf77b80543dfea93157b45b864157e2b14
2021-06-15 12:08:22 +00:00
Inseob Kim
58f2b83eaa Merge "Adding sepolicy testcase for system_ext and product." 2021-05-20 09:25:14 +00:00
P.Adarsh Reddy
07dd59ff14 Adding sepolicy testcase for system_ext and product.
Types defined in system_ext/public or product/public
can be referenced by vendor side so it is important
to make sure functionality is not broken across version
bumps. So we are adding the treble sepolicy test cases
for system_ext and product sepolicy.

Bug: 173571515
Change-Id: Ia45979497029f83b1ae6712d2d26ffab263a7f91
2021-05-12 18:14:26 +05:30
Inseob Kim
731182a4a1 Migrate precompiled sepolicy hashes to Android.bp
Bug: 33691272
Test: build with odm and build without odm
Test: boot and see precompiled sepolicy used
Change-Id: Id84cca38f81ba3ecf7480d41a704085c7fff8b87
2021-05-06 11:44:37 +00:00
Hridya Valsaraju
a885dd84c7 Revert "Revert "Add a neverallow for debugfs mounting""
This reverts commit f9dbb72654.
Issues with GSI testing fixed with
https://android-review.googlesource.com/c/platform/build/+/1686425/

Bug: 184381659
Test: manual
Change-Id: Icd07430c606e294dfaad2fc9b37d34e3dae8cbfc
2021-05-02 21:41:53 -07:00
Inseob Kim
6cc75f4587 Revert^4 "Build userdebug_plat_sepolicy.cil with Android.bp"
This reverts commit a46d61cd3f.

Reason for revert: fixed debug_ramdisk partition problem

Change-Id: If2350f115f5ff74ee50dac4e5a87c4d171067282
2021-04-30 14:53:25 +09:00
Inseob Kim
785ac2bf1a Merge "Add precompiled hash only when policy exists" 2021-04-30 01:14:15 +00:00
Inseob Kim
1c056b1ad0 Add sepolicy_vers for plat_sepolicy_vers.txt
plat_sepolicy_vers.txt stores the version of vendor policy. This change
adds sepolicy_vers module to migrate plat_sepolicy_vers.txt to
Android.bp.

- Device's plat_sepolicy_vers: should be BOARD_SEPOLICY_VERS
- Microdroid's plat_sepolicy_vers: should be PLATFORM_SEPOLICY_VERSION
because all microdroid artifacts are bound to platform

Bug: 33691272
Test: boot device && boot microdroid
Change-Id: Ida293e1cb785b44fa1d01543d52d3f8e15b055c2
2021-04-30 00:17:39 +09:00
Inseob Kim
a76c0c8540 Add precompiled hash only when policy exists
precompiled_system_ext_and_mapping.sha256 and
precompiled_product_and_mapping.sha256 has been installed, regardless of
existence of system_ext and product policies. This change only installs
such hash files when policy files exist, for consistency.

Bug: 186727553
Test: boot yukawa and see precompiled sepolicy is used
Change-Id: Iaad827cefdbe82e68288cd6cc59b55b5f28c229d
2021-04-29 19:45:50 +09:00
Hridya Valsaraju
7362f58895 Merge changes from topic "revert-1668411-MWQWEZISXF"
* changes:
  Revert "Add a neverallow for debugfs mounting"
  Revert "Add neverallows for debugfs access"
  Revert "Exclude vendor_modprobe from debugfs neverallow restrictions"
  Revert "Check that tracefs files are labelled as tracefs_type"
2021-04-23 22:06:31 +00:00
Hridya Valsaraju
f9dbb72654 Revert "Add a neverallow for debugfs mounting"
Revert submission 1668411

Reason for revert: Suspect for b/186173384
Reverted Changes:
Iaa4fce9f0:Check that tracefs files are labelled as tracefs_t...
I743a81489:Exclude vendor_modprobe from debugfs neverallow re...
I63a22402c:Add neverallows for debugfs access
I289f2d256:Add a neverallow for debugfs mounting

Change-Id: Ie04d7a4265ace43ba21a108af85f82ec137c6af0
2021-04-23 16:38:20 +00:00
Treehugger Robot
f02af9d91c Merge "Revert^3 "Build userdebug_plat_sepolicy.cil with Android.bp"" 2021-04-23 13:09:24 +00:00
Inseob Kim
a46d61cd3f Revert^3 "Build userdebug_plat_sepolicy.cil with Android.bp"
e10ceab330

Change-Id: Ia1b38d6b709edb0e819ea4700e70ba68b1b61332
2021-04-22 23:14:58 +00:00
Florian Mayer
e10ceab330 Revert^2 "Build userdebug_plat_sepolicy.cil with Android.bp"
0177004c7f

Change-Id: I40aa5025d487922decd9909c0d35c9e3a6b8dd61
2021-04-22 16:38:47 +00:00
Bowgo Tsai
0177004c7f Revert "Build userdebug_plat_sepolicy.cil with Android.bp"
This reverts commit 57b64bd282.

Because it breaks the usage of boot-debug.img and
vendor_boot-debug.img.

Bug: 185970130
Bug: 185990198
Test: make bootimage_debug
Change-Id: I2c7c4f9954540a9be301b3ed0a6c2f0af2019803
2021-04-22 09:55:21 +08:00
Hridya Valsaraju
1c3d898d87 Add a neverallow for debugfs mounting
Android R launching devices and newer must not ship with debugfs
mounted. For Android S launching devices and newer, debugfs must only be
mounted in userdebug/eng builds by init(for boot time initializations)
and dumpstate(for grabbing debug information from debugfs). This patch
adds a neverallow statement that prevents processes other than init
from being provided access to mount debugfs in non-user builds
when the flag PRODUCT_SET_DEBUGFS_RESTRICTIONS is set to true.

Test: make with/without PRODUCT_SET_DEBUGFS_RESTRICTIONS
Bug: 184381659
Change-Id: I289f2d25662a78678929e29f83cb31cebd8ca737
2021-04-21 14:13:02 -07:00
Inseob Kim
57b64bd282 Build userdebug_plat_sepolicy.cil with Android.bp
Bug: 33691272
Test: build and see $OUT/debug_ramdisk
Change-Id: I7994857a3dd4e54f2c2d35ff8e362ecae93ea7a2
2021-04-14 15:54:26 +09:00
Yi-Yo Chiang
8be93c00b1 Add system_ext_$(ver).compat.cil
These are the system_ext counterpart of $(ver).compat.cil. They would
contain device specific compat rules that compliment $(ver).compat.cil,
which are the platform specific compat rules.

Bug: 183362912
Test: Add a $(ver).compat.cil under SYSTEM_EXT_PRIVATE_SEPOLICY_DIR and
  verify the file is installed under /system_ext/etc/selinux/mapping/
Change-Id: I2fb9b10bb3bcf112e33f504964fb705e3b63782b
2021-04-13 02:58:21 +08:00
Inseob Kim
039175bcfe Migrate mapping files to Android.bp
Bug: 33691272
Test: boot cf && boot microdroid && see precompiled sepolicy works
Change-Id: I92c9cb873506d24b335cc0fd489269df216280be
2021-03-25 07:42:52 +00:00
Inseob Kim
a49e724038 Reland "Build platform side policy with Soong"
This reverts commit d869d02758.

Reason for revert: fixed breakage

The breakage was due to the difference between plat_sepolicy.conf and
microdroid_vendor_sepolicy.conf. Now vendor_sepolicy.conf is built with
se_policy_conf module, so it is synced with plat_sepolicy.conf

Test: boot microdroid with and without SANITIZE_TARGET=address
Change-Id: Ia7d79f5a1eba323b23682d2322a61159dd170441
2021-03-22 13:40:13 +09:00
Inseob Kim
d869d02758 Revert "Build platform side policy with Soong"
This reverts commit 7629e86053.

Reason for revert: broke build

Change-Id: I97dc1ea78901cab62404780e7ee096ad45c0b21b
2021-03-19 07:04:51 +00:00
Inseob Kim
7629e86053 Build platform side policy with Soong
This replaces the following policy files with Android.bp modules:

  - reqd_policy_mask.cil
  - plat_sepolicy.cil
  - system_ext_sepolicy.cil
  - product_sepolicy.cil
  - plat_pub_policy.cil
  - system_ext_pub_policy.cil
  - pub_policy.cil
  - general_sepolicy.conf (for CTS)

Also microdroid's system policy now uses above.

Bug: 33691272
Bug: 178993690
Test: policy files stay same
Test: boot normal device and microdroid, see sepolicy works
Test: build CtsSecurityHostTestCases
Change-Id: I908a33badee04fbbdadc6780aab52e989923ba57
2021-03-18 19:54:35 +09:00
Bob Badour
601ebb43a3 [LSC] Add LOCAL_LICENSE_KINDS to system/sepolicy
Added SPDX-license-identifier-Apache-2.0 to:
  build/Android.bp
  build/soong/Android.bp
  tests/Android.bp
  tools/Android.bp

Added SPDX-license-identifier-Apache-2.0 legacy_unencumbered to:
  Android.bp
  Android.mk
  compat.mk
  contexts_tests.mk
  mac_permissions.mk
  seapp_contexts.mk
  treble_sepolicy_tests_for_release.mk

Added legacy_unencumbered to:
  apex/Android.bp
  tools/sepolicy-analyze/Android.bp

Bug: 68860345
Bug: 151177513
Bug: 151953481

Test: m all

Exempt-From-Owner-Approval: janitorial work
Change-Id: I1ab286543ef1bdcb494cf74f2b35e35a08225d28
2021-02-05 01:28:24 -08:00
Inseob Kim
8ada8a7c1b Support building mixed versions of sepolicy
Now newer system policy and older vendor policy can be built together by
setting following variables:

- BOARD_SEPOLICY_VERS
- BOARD_REQD_MASK_POLICY (copy of older system/sepolicy/reqd_mask)
- BOARD_PLAT_VENDOR_POLICY (copy of older system/sepolicy/vendor)
- BOARD_(SYSTEM_EXT|PRODUCT)_(PUBLIC|PRIVATE)_PREBUILT_DIRS (copy of
  older system_ext and product policies)

Bug: 168159977
Test: try normal build and mixed build
Test: boot and check selinux denials
Change-Id: Ie239580433ffd293fa6891cd665fb5ef83c0a14f
2021-01-06 10:46:15 +09:00
Bowgo Tsai
72b2acb327 Revert "Android.mk: Enforce SYSTEM_EXT_* vars on API >= 31"
This reverts commit 6c99a6781c.

Reason for revert: build breaks on build test
Bug: 171847597
Test: None

Change-Id: I7d3556aa0f06684b43f80f09e4c8194c6c44336c
2020-10-28 05:04:39 +00:00
Felix Elsner
6c99a6781c Android.mk: Enforce SYSTEM_EXT_* vars on API >= 31
Devices launched with S must use the new variable naming
scheme introduced in If8188feb365eb9e500f2270241fa190a20e9de01
"Android.mk: Support SYSTEM_EXT* sepolicy".

The old variable name
`BOARD_PLAT_{PUBLIC,PRIVATE}_SEPOLICY_DIR` does no longer
accurately reflect its usage and as such is deprecated.

Test: `make selinux_policy` with PRODUCT_SHIPPING_API_LEVEL=26
      `BOARD_PLAT_{PUBLIC,PRIVATE}_SEPOLICY_DIR}` set,
      observe additions in `$(TARGET_COPY_OUT_SYSTEM_EXT)/etc/selinux`
Test: `make selinux_policy` with PRODUCT_SHIPPING_API_LEVEL=31
      `BOARD_PLAT_{PUBLIC,PRIVATE}_SEPOLICY_DIR}` set,
      observe error

Signed-off-by: Felix Elsner <google@ix5.org>
Change-Id: Ic4d1164be611836f6aa697fbf1cb1f1c73a3cd39
2020-10-27 03:30:17 +00:00
Inseob Kim
afc09932f6 Enforce sysprop owner
Every property should have an appropriate owner attribute, which can be
one of: system_property_type, product_property_type, or
vendor_property_type. This will be enforced for devices launching with S
or later. Devices launching with R or eariler can relax this by setting
following under BoardConfig.mk:

BUILD_BROKEN_ENFORCE_SYSPROP_OWNER := true

Bug: 131162102
Test: system/sepolicy/tools/build_policies.sh
Change-Id: I7914ef1b7463c9ec00812b9720094531fd63f0c7
2020-10-19 05:07:05 +00:00
Yiming Jing
8fea06a779 Merge "Expand the scope of sepolicy_freeze_test" 2020-10-14 19:33:43 +00:00
Yiming Jing
d4103eed2b Expand the scope of sepolicy_freeze_test
The existing freeze test only covers the policy files in system/sepolicy
alone. There's demand from product teams that would like to implement a
freeze test for their sepolicy. Instead of letting them fork the freeze
test, we believe expanding the scope of the exising one is in the best
interest.

$FREEZE_TEST_EXTRA_DIRS and $FREEZE_TEST_EXTRA_PREBUILT_DIRS are added.
These build variables could be appended like $PRODUCT_PUBLIC_POLICY. The
product team are expected to maintain their policy prebuilts.

Bug: 166455099
Test: manual
Change-Id: I6f350e1e3db2807be4dbfd0ceb34f0d89f94d629
2020-10-13 22:51:56 +00:00
Treehugger Robot
5b238f9799 Merge "Android.mk: Support SYSTEM_EXT* sepolicy" 2020-10-12 03:49:24 +00:00
Justin Yun
0f722695e0 Create selinux_policy_* for /product and /system_ext
Separate selinux_policy_system_ext and selinux_policy_product from
the selinux_policy_nonsystem module. With this CL,
selinux_policy_nonsystem will include the files for /vendor and /odm
partitions only. It will still include selinux_policy_system_ext and
selinux_policy_product as required modules.

Bug: 170282998
Test: build and check boot
Change-Id: Ie2f646a217ec86ede95caec101622bc530d12cfc
2020-10-07 18:28:47 +09:00
Jooyung Han
9cd0f8e73d Merge "Use file_contexts files for flattened APEXes" 2020-10-06 03:26:14 +00:00
Jooyung Han
0606ce79c9 Use file_contexts files for flattened APEXes
Previously, soong emitted APEX_FILE_CONTEXTS_INFOS make var which lists
"all" APEXes and file_contexts.bin used all of them regardless whether
an APEX is installed or not.

This doesn't work when there's a vendor specific APEX which uses vendor
specific labels. Other lunch target may fail to build due to "unknown
label" which is introduced by the vendor APEX which is fact not supposed
to be installed.

Now build/make/core/Makefile creates file_contexts.modules.tmp which is
a collection of file_contexts for flattend apexes which are to be
intalled.

Bug: 166518492
Test: m file_contexts.bin
      check contents of file_contexts.concat.tmp
Change-Id: I00c6b87bdc75fc1e04e6f8ecddae6f18762d888a
2020-09-23 15:44:11 +00:00
Chris Gross
12c0b247ad Only require compat mapping files if they exist.
Call build_policy when determing which compat mapping files should be
included for a given partition.

Bug: 168637766
Test: Built aosp_bonito-userdebug and saw that the compat mapping files
in product/etc/sepolicy/mapping were no longer present.
Test: Added a test 30.0.cil file to bonito's product private compat
directory and saw that it was present at product/etc/sepolicy/mapping.

Change-Id: I83cc28a159b24c0a2c0717dae461983250ab6c25
2020-09-22 11:55:40 -07:00
Janis Danisevskis
c40681f1b5 Add libselinux keystore_key backend.
We add a new back end for SELinux based keystore2_key namespaces.
This patch adds the rump policy and build system infrastructure
for installing keystore2_key context files on the target devices.

Bug: 158500146
Bug: 159466840
Test: None
Change-Id: I423c9e68ad259926e4a315d052dfda97fa502106
Merged-In: I423c9e68ad259926e4a315d052dfda97fa502106
2020-08-05 16:11:48 +00:00
Felix
8c53a331c3 Android.mk: Support SYSTEM_EXT* sepolicy
The new variable name reflects its actual usage.

Keep compatibility with BOARD_PLAT_* because it has been a
convention for years.

Amend the README to document the new variables.

Test: `make selinux_policy` with
      `SYSTEM_EXT_{PUBLIC,PRIVATE}_SEPOLICY_DIRS` set,
      observe additions in `$(TARGET_COPY_OUT_SYSTEM_EXT)/etc/selinux`

Signed-off-by: Felix <google@ix5.org>
Change-Id: If8188feb365eb9e500f2270241fa190a20e9de01
2020-07-14 21:28:51 +02:00
linpeter
87c7261f0a sepolicy: label vendor_service_contexts as vendor_service_contexts_file
Due to AIDL HAL introduction, vendors can publish services
with servicemanager. vendor_service_contexts is labeled as
vendor_service_contexts_file, not nonplat_service_contexts_file.
And pack it to vendor partition.

Bug: 154066722

Test: check file label
Change-Id: Ic74b12e4c8e60079c0872b6c27ab2f018fb43969
2020-06-15 17:09:46 +08:00
Inseob Kim
ace36abec5 Add 30.0 mapping files
Steps taken to produce the mapping files:

1. Add prebuilts/api/30.0/plat_pub_versioned.cil from the
/vendor/etc/selinux/plat_pub_versioned.cil file built on rvc-dev with
lunch target aosp_arm64-eng. Add prebuilts/api/30.0/vendor_sepolicy.cil
as an empty file.

2. Add new file private/compat/30.0/30.0.cil by doing the following:
- copy /system/etc/selinux/mapping/30.0.cil from rvc-dev aosp_arm64-eng
device to private/compat/30.0/30.0.cil
- remove all attribute declaration statement (typeattribute ...) and
sort lines alphabetically
- some selinux types were added/renamed/deleted w.r.t 30 sepolicy.
Find all such types using treble_sepolicy_tests_30.0 test.
- for all these types figure out where to map them by looking at
29.0.[ignore.]cil files and add approprite entries to 30.0.[ignore.]cil.

This change also enables treble_sepolicy_tests_30.0 and installs
30.0.cil mapping file onto the device.

Bug: 153661471
Test: m treble_sepolicy_tests_30.0
Test: m 30.0_compat_test
Test: m selinux_policy
Change-Id: I6dfae41fbd5f245119ede540d2c321688d6e7929
2020-05-11 04:32:00 +00:00
Oliver Nguyen
fad5f819e7 Clang coverage also enables global write to /data/misc/trace.
Bug: 143977934
Test: kill -37 <pid>, check for file in /data/misc/trace and no selinux
denials

Change-Id: I0d61f9ed4cae9b27694434521d6a066b22ae5f6c
2019-12-09 16:37:59 -08:00
Jooyung Han
a9324749cc Make file_contexts as "android:path" property
Till now, file_contexts has been treated differently that other input
src files. Now it is tagged as `android:"path"` because it is.

Bug: 144732805
Test: m
Change-Id: I6b22a8d22417b75c5cb8cd3b2e534d67e958b074
2019-11-20 17:54:34 +09:00
Tri Vo
94b0e84094 Merge "sepolicy: build error if non-platform classes present" 2019-10-18 20:21:52 +00:00
Tri Vo
6d6ed352ce Merge "sepolicy: support /system_ext and /product mapping files" 2019-10-16 19:25:36 +00:00
Inseob Kim
e2ef86fc9e Fix treble sysprop neverallow rules on system_ext
Bug: 131162102
Bug: 142684203
Test: m sepolicy_tests
Change-Id: Ib21adee404a1ee7d57bc9ff54f3ae1831cdf3b81
2019-10-16 14:14:12 +09:00
Inseob Kim
ed59c22ffc Add BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW
A new sysprop neverallow rules are mandatory only for devices launching
with R or later. For devices already launched, neverallow rules can be
relaxed with adding following line to BoardConfig.mk:

BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true

Bug: 131162102
Test: Set PRODUCT_SHIPPING_API_LEVEL := 30 and try building with
changing some system_public_prop to system_internal_prop
Test: m cts sepolicy_tests

Change-Id: Id978b4d81a8683a57304bb639961105e2d91fa9a
Merged-In: Id978b4d81a8683a57304bb639961105e2d91fa9a
(cherry picked from commit 3be11e7abb)
2019-10-15 09:25:57 +09:00
Tri Vo
71f12392e3 sepolicy: build error if non-platform classes present
Error out if we detect that there is a security_classes or
access_vectors file outside of system/sepolicy.

Of course, this test can't enforce any requirements, as it's not part of
CTS. But it can still serve as an early signal.

Fixes: 142153384
Test: add access_vectors to device policy, observe build error
Change-Id: Ib94b7f85e184340de8ec7943c8da88a0af3427e8
2019-10-14 21:49:52 +00:00
Tri Vo
6117855015 sepolicy: support /system_ext and /product mapping files
Install mapping files in SYSTEM_EXT_PRIVATE_POLICY and
PRODUCT_PRIVATE_POLICY into /system_ext and /product respectively.

Bug: 141084341
Test: boot taimen
Test: system mapping files are unchanged
Test: create mapping files in device/google/wahoo/sepolicy/ and check
that they are correctly expanded and installed.
Change-Id: I4d251c957b30a16df71eec47c871e24e5fc773a4
2019-10-11 12:32:12 -07:00
Jooyung Han
e2c256cadb Fix file_contexts for flattened apexes
APEX modules can be configured with apex_name and file_contexts
properties.
- apex_name overrides the activation point
  for example, if apex_name is 'foo', it will be flattened under
  /system/apex/foo even if its name is 'bar'.
- file_contexts overrides file_contexts filename
  for example, it file_contexts is 'foo',
  /system/sepolicy/apex/foo-file_contexts should be used even if its
  name is 'bar'.

Previously, file_contexts files for flattened apexes are assumed to have
names like "/system/sepolicy/apex/<apex_name>-file_contexts". But, as
described above, calculating <apex_name> from file entries might be
wrong

Now, it relies on Soong's makevar APEX_FILE_CONTEXTS_INFOS which is list of
<apex_name>:<file_contexts> pairs.

Bug: 123314817
Bug: 142300241
Test: add apex module(foo) with apex_name:bar and file_contexts:baz
Test: OVERRIDE_TARGET_FLATTEN_APEX=true m file_contexts.bin
Test: check intermediate files for file_contexts
Change-Id: I3793c0f01469baaa0ddb1965093a56304a10e99c
2019-10-10 12:51:43 +09:00
Ashwini Oruganti
8491445d63 Merge "Show bug_map links on user builds" 2019-10-07 16:37:35 +00:00
Ashwini Oruganti
76beaface5 Show bug_map links on user builds
Android.mk now includes the SELinux denial metadata on user builds.

Bug: 141695494
Test: Generated a tracked denial on a user build and verified that the
bug number shows up in the logs.

Change-Id: I908c08e0d6542fa248d7c798c20a66027f39c390
2019-10-04 10:28:56 -07:00