02cfce49ae
The kernel domain exists solely on boot, and is used by kernel threads. Because of the way the system starts, there is never an entrypoint for that domain, not even a file on rootfs. So tighten up the neverallow restriction. Remove an obsolete comment. The *.rc files no longer have a setcon statement, and the transition from the kernel domain to init occurs because init re-execs itself. The statement no longer applies. Test: bullhead policy compiles. Change-Id: Ibe75f3d25804453507dbb05c7a07bba1d37a1c7b
92 lines
3.4 KiB
Text
92 lines
3.4 KiB
Text
# Life begins with the kernel.
|
|
type kernel, domain, mlstrustedsubject;
|
|
|
|
allow kernel self:capability sys_nice;
|
|
|
|
# Root fs.
|
|
r_dir_file(kernel, rootfs)
|
|
r_dir_file(kernel, proc)
|
|
|
|
# Get SELinux enforcing status.
|
|
allow kernel selinuxfs:dir r_dir_perms;
|
|
allow kernel selinuxfs:file r_file_perms;
|
|
|
|
# Allow init relabel itself.
|
|
allow kernel rootfs:file relabelfrom;
|
|
allow kernel init_exec:file relabelto;
|
|
# TODO: investigate why we need this.
|
|
allow kernel init:process share;
|
|
|
|
# cgroup filesystem initialization prior to setting the cgroup root directory label.
|
|
allow kernel unlabeled:dir search;
|
|
|
|
# Mount usbfs.
|
|
allow kernel usbfs:filesystem mount;
|
|
allow kernel usbfs:dir search;
|
|
|
|
# Initial setenforce by init prior to switching to init domain.
|
|
# We use dontaudit instead of allow to prevent a kernel spawned userspace
|
|
# process from turning off SELinux once enabled.
|
|
dontaudit kernel self:security setenforce;
|
|
|
|
# Write to /proc/1/oom_adj prior to switching to init domain.
|
|
allow kernel self:capability sys_resource;
|
|
|
|
# Init reboot before switching selinux domains under certain error
|
|
# conditions. Allow it.
|
|
# As part of rebooting, init writes "u" to /proc/sysrq-trigger to
|
|
# remount filesystems read-only. /data is not mounted at this point,
|
|
# so we could ignore this. For now, we allow it.
|
|
allow kernel self:capability sys_boot;
|
|
allow kernel proc_sysrq:file w_file_perms;
|
|
|
|
# Allow writing to /dev/kmsg which was created prior to loading policy.
|
|
allow kernel tmpfs:chr_file write;
|
|
|
|
# Set checkreqprot by init.rc prior to switching to init domain.
|
|
allow kernel selinuxfs:file write;
|
|
allow kernel self:security setcheckreqprot;
|
|
|
|
# MTP sync (b/15835289)
|
|
# kernel thread "loop0", used by the loop block device, for ASECs (b/17158723)
|
|
allow kernel priv_app:fd use;
|
|
allow kernel sdcard_type:file { read write };
|
|
|
|
# Allow the kernel to read OBB files from app directories. (b/17428116)
|
|
# Kernel thread "loop0" reads a vold supplied file descriptor.
|
|
# Fixes CTS tests:
|
|
# * android.os.storage.cts.StorageManagerTest#testMountAndUnmountObbNormal
|
|
# * android.os.storage.cts.StorageManagerTest#testMountAndUnmountTwoObbs
|
|
allow kernel vold:fd use;
|
|
allow kernel app_data_file:file read;
|
|
allow kernel asec_image_file:file read;
|
|
|
|
# Allow reading loop device in update_engine_unittests. (b/28319454)
|
|
userdebug_or_eng(`
|
|
allow kernel update_engine_data_file:file read;
|
|
allow kernel nativetest_data_file:file read;
|
|
')
|
|
|
|
# Access to /data/media.
|
|
# This should be removed if sdcardfs is modified to alter the secontext for its
|
|
# accesses to the underlying FS.
|
|
allow kernel media_rw_data_file:dir create_dir_perms;
|
|
allow kernel media_rw_data_file:file create_file_perms;
|
|
|
|
###
|
|
### neverallow rules
|
|
###
|
|
|
|
# The initial task starts in the kernel domain (assigned via
|
|
# initial_sid_contexts), but nothing ever transitions to it.
|
|
neverallow * kernel:process { transition dyntransition };
|
|
|
|
# The kernel domain is never entered via an exec, nor should it
|
|
# ever execute a program outside the rootfs without changing to another domain.
|
|
# If you encounter an execute_no_trans denial on the kernel domain, then
|
|
# possible causes include:
|
|
# - The program is a kernel usermodehelper. In this case, define a domain
|
|
# for the program and domain_auto_trans() to it.
|
|
# - You are running an exploit which switched to the init task credentials
|
|
# and is then trying to exec a shell or other program. You lose!
|
|
neverallow kernel *:file { entrypoint execute_no_trans };
|