platform_system_sepolicy/zygote.te
Stephen Smalley e468016b1b zygote requires setpcap in order to drop from its bounding set.
I8560fa5ad125bf31f0d13be513431697bc7d22bb changed the zygote
to limit the bounding capability set to CAP_NET_RAW.  This triggers
a CAP_SETPCAP check by the kernel, which requires SELinux setpcap permission.

Change-Id: Ib910d97dcf708273e2806e2824f4abe9fc239d6d
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-02-19 13:20:55 -05:00

39 lines
1.5 KiB
Text

# zygote
type zygote, domain;
type zygote_exec, exec_type, file_type;
init_daemon_domain(zygote)
typeattribute zygote mlstrustedsubject;
# Override DAC on files and switch uid/gid.
allow zygote self:capability { dac_override setgid setuid };
# Drop capabilities from bounding set.
allow zygote self:capability setpcap;
# Switch SELinux context to app domains.
allow zygote system:process dyntransition;
allow zygote appdomain:process dyntransition;
# Move children into the peer process group.
allow zygote system:process { getpgid setpgid };
allow zygote appdomain:process { getpgid setpgid };
# Write to system data.
allow zygote system_data_file:dir rw_dir_perms;
allow zygote system_data_file:file create_file_perms;
allow zygote dalvikcache_data_file:dir rw_dir_perms;
allow zygote dalvikcache_data_file:file create_file_perms;
# Execute dexopt.
allow zygote system_file:file x_file_perms;
# Control cgroups.
allow zygote cgroup:dir create_dir_perms;
allow zygote self:capability sys_admin;
# Check validity of SELinux context before use.
selinux_check_context(zygote)
# Check SELinux permissions.
selinux_check_access(zygote)
# Read /seapp_contexts, presently on the rootfs.
allow zygote rootfs:file r_file_perms;
# Setting up /storage/emulated.
allow zygote rootfs:dir mounton;
allow zygote sdcard:dir { write search setattr create add_name mounton };
dontaudit zygote self:capability fsetid;
allow zygote tmpfs:dir { write create add_name setattr mounton };
allow zygote tmpfs:filesystem mount;