7aa40413ae
user_profile_data_file is mlstrustedobject. And it needs to be, because we want untrusted apps to be able to write to their profile files, but they do not have levels. But now we want to apply levels in the parent directories that have the same label, and we want them to work so they need to not be MLS-exempt. To resolve that we introduce a new label, user_profile_root_file, which is applied to those directories (but no files). We grant mostly the same access to the new label as directories with the existing label. Apart from appdomain, almost every domain which accesses user_profile_data_file, and now user_profile_root_file, is already mlstrustedsubject and so can't be affected by this change. The exception is postinstall_dexopt which we now make mlstrustedobject. Bug: 141677108 Bug: 175311045 Test: Manual: flash with wipe Test: Manual: flash on top of older version Test: Manual: install & uninstall apps Test: Manual: create & remove user Test: Presubmits. Change-Id: I4e0def3d513b129d6c292f7edb076db341b4a2b3
55 lines
2.5 KiB
Text
55 lines
2.5 KiB
Text
# volume manager
|
|
type iorap_prefetcherd, domain;
|
|
type iorap_prefetcherd_exec, exec_type, file_type, system_file_type;
|
|
type iorap_prefetcherd_tmpfs, file_type;
|
|
|
|
r_dir_file(iorap_prefetcherd, rootfs)
|
|
|
|
# Allow read/write /proc/sys/vm/drop/caches
|
|
allow iorap_prefetcherd proc_drop_caches:file rw_file_perms;
|
|
|
|
# iorap_prefetcherd temporarily changes its priority when running benchmarks
|
|
allow iorap_prefetcherd self:global_capability_class_set sys_nice;
|
|
|
|
# Allow usage of pipes (--input-fd=# and --output-fd=# command line parameters).
|
|
allow iorap_prefetcherd iorapd:fd use;
|
|
allow iorap_prefetcherd iorapd:fifo_file { read write };
|
|
|
|
# Allow reading most files under / ignoring usual access controls.
|
|
allow iorap_prefetcherd self:capability dac_read_search;
|
|
|
|
typeattribute iorap_prefetcherd mlstrustedsubject;
|
|
|
|
# Grant logcat access
|
|
allow iorap_prefetcherd logcat_exec:file { open read };
|
|
|
|
# Grant access to open most of the files under /
|
|
allow iorap_prefetcherd apk_data_file:dir { open read search };
|
|
allow iorap_prefetcherd apk_data_file:file { open read };
|
|
allow iorap_prefetcherd app_data_file:dir { open read search };
|
|
allow iorap_prefetcherd app_data_file:file { open read };
|
|
allow iorap_prefetcherd dalvikcache_data_file:dir { open read search };
|
|
allow iorap_prefetcherd dalvikcache_data_file:file{ open read };
|
|
allow iorap_prefetcherd packages_list_file:dir { open read search };
|
|
allow iorap_prefetcherd packages_list_file:file { open read };
|
|
allow iorap_prefetcherd privapp_data_file:dir { open read search };
|
|
allow iorap_prefetcherd privapp_data_file:file { open read };
|
|
allow iorap_prefetcherd same_process_hal_file:dir{ open read search };
|
|
allow iorap_prefetcherd same_process_hal_file:file { open read };
|
|
allow iorap_prefetcherd system_data_file:dir { open read search };
|
|
allow iorap_prefetcherd system_data_file:file { open read };
|
|
allow iorap_prefetcherd system_data_file:lnk_file { open read };
|
|
allow iorap_prefetcherd user_profile_root_file:dir { open read search };
|
|
allow iorap_prefetcherd user_profile_data_file:dir { open read search };
|
|
allow iorap_prefetcherd user_profile_data_file:file { open read };
|
|
allow iorap_prefetcherd vendor_overlay_file:dir { open read search };
|
|
allow iorap_prefetcherd vendor_overlay_file:file { open read };
|
|
# Note: Do not add any /vendor labels because they can be customized
|
|
# by the vendor and we won't know about them beforehand.
|
|
|
|
###
|
|
### neverallow rules
|
|
###
|
|
|
|
neverallow { domain -init -iorapd } iorap_prefetcherd:process { transition dyntransition };
|
|
neverallow iorap_prefetcherd domain:{ tcp_socket udp_socket rawip_socket } *;
|