ab82125fc8
In particular, add assertions limiting which processes may directly open files owned by apps. Reduce this to just apps, init, and installd. App data is protected by a combination of selinux permissions and Unix permissions, so limiting the open permission to just apps (which are not allowed to have CAP_DAC_OVERRIDE or CAP_DAC_READ_SEARCH) ensures that only installd and init have complete access an app's private directory. In addition to apps/init/installd, other processes currently granted open are mediaserver, uncrypt, and vold. Uncrypt's access appears to be deprecated (b/80299612). Uncrypt now uses /data/ota_package instead. b/80418809 and b/80300620 track removal for vold and mediaserver. Test: build/boot aosp_taimen-userdebug. Verify no "granted" audit messages in the logs. Bug: 80190017 Bug: 80300620 Bug: 80418809 Fixes: 80299612 Change-Id: I153bc7b62294b36ccd596254a5976dd887fed046
42 lines
1.2 KiB
Text
42 lines
1.2 KiB
Text
# uncrypt
|
|
type uncrypt, domain, mlstrustedsubject;
|
|
type uncrypt_exec, exec_type, file_type;
|
|
|
|
allow uncrypt self:global_capability_class_set dac_override;
|
|
|
|
userdebug_or_eng(`
|
|
# For debugging, allow /data/local/tmp access
|
|
r_dir_file(uncrypt, shell_data_file)
|
|
')
|
|
|
|
# Read /cache/recovery/command
|
|
# Read /cache/recovery/uncrypt_file
|
|
allow uncrypt cache_file:dir search;
|
|
allow uncrypt cache_recovery_file:dir rw_dir_perms;
|
|
allow uncrypt cache_recovery_file:file create_file_perms;
|
|
|
|
# Read OTA zip file at /data/ota_package/.
|
|
allow uncrypt ota_package_file:dir r_dir_perms;
|
|
allow uncrypt ota_package_file:file r_file_perms;
|
|
|
|
# Write to /dev/socket/uncrypt
|
|
unix_socket_connect(uncrypt, uncrypt, uncrypt)
|
|
|
|
# Set a property to reboot the device.
|
|
set_prop(uncrypt, powerctl_prop)
|
|
|
|
# Raw writes to block device
|
|
allow uncrypt self:global_capability_class_set sys_rawio;
|
|
allow uncrypt misc_block_device:blk_file w_file_perms;
|
|
allow uncrypt block_device:dir r_dir_perms;
|
|
|
|
# Access userdata block device.
|
|
allow uncrypt userdata_block_device:blk_file w_file_perms;
|
|
|
|
r_dir_file(uncrypt, rootfs)
|
|
|
|
# uncrypt reads /proc/cmdline
|
|
allow uncrypt proc_cmdline:file r_file_perms;
|
|
|
|
# Read files in /sys
|
|
r_dir_file(uncrypt, sysfs_dt_firmware_android)
|