1601132086
Replace * or any permission set containing create with create_socket_perms or create_stream_socket_perms. Add net_domain() to all domains using network sockets and delete rules already covered by domain.te or net.te. For netlink_route_socket, only nlmsg_write needs to be separately granted to specific domains that are permitted to modify the routing table. Clarification: read/write permissions are just ability to perform read/recv() or write/send() on the socket, whereas nlmsg_read/ nlmsg_write permissions control ability to observe or modify the underlying kernel state accessed via the socket. See security/selinux/nlmsgtab.c in the kernel for the mapping of netlink message types to nlmsg_read or nlmsg_write. Delete legacy rule for b/12061011. This change does not touch any rules where only read/write were allowed to a socket created by another domain (inherited across exec or received across socket or binder IPC). We may wish to rewrite some or all of those rules with the rw_socket_perms macro but that is a separate change. Change-Id: Ib0637ab86f6d388043eff928e5d96beb02e5450e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
33 lines
784 B
Text
33 lines
784 B
Text
# android user-space log manager
|
|
type logd, domain;
|
|
type logd_exec, exec_type, file_type;
|
|
|
|
init_daemon_domain(logd)
|
|
|
|
allow logd self:capability { setuid setgid sys_nice };
|
|
|
|
r_dir_file(logd, domain)
|
|
|
|
userdebug_or_eng(`
|
|
# Debug output
|
|
type_transition logd device:file logd_debug;
|
|
allow logd device:dir rw_dir_perms;
|
|
allow logd logd_debug:file create_file_perms;
|
|
')
|
|
|
|
###
|
|
### Neverallow rules
|
|
###
|
|
### logd should NEVER do any of this
|
|
|
|
# Block device access.
|
|
neverallow logd dev_type:blk_file { read write };
|
|
|
|
# ptrace any other app
|
|
neverallow logd domain:process ptrace;
|
|
|
|
# Write to /system.
|
|
neverallow logd system_file:dir_file_class_set write;
|
|
|
|
# Write to files in /data/data or system files on /data
|
|
neverallow logd { app_data_file system_data_file }:dir_file_class_set write;
|