27b515e70a
We are adding the ability for apps to create "storage areas", which are transparently encrypted directories that can only be opened when the device is unlocked. This CL makes the required SELinux policy changes. First, assign the type "system_userdir_file" to the new top-level directory /data/storage_area (non-recursively). This is the same type used by the other top-level directories containing app data, such as /data/user, and it restricts access to the directory in the desired way. Second, add new types to represent an app's directory of storage areas, the storage areas themselves, and their contents: `storage_area_app_dir`, `storage_area_dir`, and `storage_area_content_file` respectively. All are `app_data_file_type`s. The directory structure and their associated labels is as follows (note that they also all get the categories of the user+package): /data/storage_area/userId/pkgName storage_area_app_dir /data/storage_area/userId/pkgName/storageAreaName storage_area_dir /data/storage_area/userId/pkgName/storageAreaName/myFile.txt storage_area_content_file /data/storage_area/userId/pkgName/storageAreaName/mySubDir storage_area_content_file These new types allow us to restrict how and which processes interact with storage areas. The new type for the contents of storage areas allows us to add new, desirable restrictions that we cannot add to the more general `app_data_file` type in order to maintain backwards-compatibility, e.g., we block apps from executing any files in their storage areas. Third, allow: -- vold_prepare_subdirs to create and delete storage areas on behalf of apps, and assign them the SElinux type `storage_area_dir` i.e. create directories /data/storage_area/$userId/$pkgName/$storageAreaName -- vold to assign encryption policies to storage area directories -- installd to create an app's directory of storage areas on app install, and delete them on app uninstall, and assign them the SElinux type `storage_area_app_dir`, i.e. directories /data/storage_area/$userId/$pkgName We also add a new SELinux type to represent the storage area encryption keys: `storage_area_key_file`. The keys are created by vold on storage area creation, and deleted either by vold if an app calls the `deleteStorageArea` API function explicitly, or by installd on app uninstall. These keys are stored in `/data/misc_ce/$userId/storage_area_keys`, and only installd and vold have access to them. Bug: 325121608 Test: atest StorageAreaTest Change-Id: I74805d249f59226fc6963693f682c70949bfad93
57 lines
1.9 KiB
Text
57 lines
1.9 KiB
Text
// Copyright (C) 2023 The Android Open Source Project
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
// This module contains a list of build time flags (defined on AOSP) for sepolicy.
|
|
// Additional se_flags modules can be added anywhere for additional flags.
|
|
se_flags {
|
|
name: "aosp_selinux_flags",
|
|
flags: [
|
|
"RELEASE_AVF_SUPPORT_CUSTOM_VM_WITH_PARAVIRTUALIZED_DEVICES",
|
|
"RELEASE_AVF_ENABLE_DEVICE_ASSIGNMENT",
|
|
"RELEASE_AVF_ENABLE_LLPVM_CHANGES",
|
|
"RELEASE_HARDWARE_BLUETOOTH_RANGING_SERVICE",
|
|
"RELEASE_UNLOCKED_STORAGE_API",
|
|
],
|
|
export_to: ["all_selinux_flags"],
|
|
}
|
|
|
|
// se_flags_collector collects flags from exported se_flags modules and converts it to build flags.
|
|
se_flags_collector {
|
|
name: "all_selinux_flags",
|
|
}
|
|
|
|
se_policy_conf_defaults {
|
|
name: "se_policy_conf_flags_defaults",
|
|
srcs: [":sepolicy_flagging_macros"],
|
|
build_flags: ["all_selinux_flags"],
|
|
}
|
|
|
|
se_policy_conf_defaults {
|
|
name: "se_policy_conf_public_flags_defaults",
|
|
srcs: [":sepolicy_flagging_macros"],
|
|
build_flags: ["all_selinux_flags"],
|
|
board_api_level_guard: true,
|
|
}
|
|
|
|
contexts_defaults {
|
|
name: "contexts_flags_defaults",
|
|
srcs: [":sepolicy_flagging_macros"],
|
|
neverallow_files: [":sepolicy_flagging_macros"], // for seapp_contexts
|
|
build_flags: ["all_selinux_flags"],
|
|
}
|
|
|
|
filegroup {
|
|
name: "sepolicy_flagging_macros",
|
|
srcs: ["te_macros"],
|
|
}
|