4ac4bc0584
Change-Id: I09b4e33b1c9ea201a96d2f07cb74bdb804b5aad2 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
39 lines
1.4 KiB
Text
39 lines
1.4 KiB
Text
#
|
|
# Rules to allow the Android CTS to run.
|
|
# Do not enable in production policy.
|
|
#
|
|
|
|
bool android_cts false;
|
|
if (android_cts) {
|
|
# For TestDeviceSetup (RootProcessScanner).
|
|
# Reads /proc/pid/status and statm entries to check that
|
|
# no unexpected root processes are running.
|
|
# Also for android.security.cts.VoldExploitTest.
|
|
# Requires ability to read /proc/pid/cmdline of vold.
|
|
allow appdomain domain:dir r_dir_perms;
|
|
allow appdomain domain:{ file lnk_file } r_file_perms;
|
|
|
|
# Will still fail when trying to read other app /proc/pid
|
|
# entries due to MLS constraints. Just silence the denials.
|
|
dontaudit appdomain appdomain:dir r_dir_perms;
|
|
dontaudit appdomain appdomain:file r_file_perms;
|
|
|
|
# For android.permission.cts.FileSystemPermissionTest.
|
|
# Walk the file tree, stat any file in order to check file permissions.
|
|
allow appdomain fs_type:dir r_dir_perms;
|
|
allow appdomain dev_type:dir r_dir_perms;
|
|
allow appdomain file_type:dir_file_class_set getattr;
|
|
allow appdomain dev_type:dir_file_class_set getattr;
|
|
allow appdomain fs_type:dir_file_class_set getattr;
|
|
|
|
# Tries to open /dev/alarm for writing but expects failure.
|
|
dontaudit appdomain alarm_device:chr_file write;
|
|
|
|
# For android.security.cts.VoldExploitTest.
|
|
# Tries to create and use a netlink kobject uevent socket
|
|
# to test for a vulnerable vold.
|
|
dontaudit appdomain self:netlink_kobject_uevent_socket create;
|
|
|
|
# Tries to override DAC restrictions but expects to fail.
|
|
dontaudit shell self:capability dac_override;
|
|
}
|