9b2e0cbeea
In kernel 4.7, the capability and capability2 classes were split apart
from cap_userns and cap2_userns (see kernel commit
8e4ff6f228e4722cac74db716e308d1da33d744f). Since then, Android cannot be
run in a container with SELinux in enforcing mode.
This change applies the existing capability rules to user namespaces as
well as the root namespace so that Android running in a container
behaves the same on pre- and post-4.7 kernels.
This is essentially:
1. New global_capability_class_set and global_capability2_class_set
that match capability+cap_userns and capability2+cap2_userns,
respectively.
2. s/self:capability/self:global_capability_class_set/g
3. s/self:capability2/self:global_capability2_class_set/g
4. Add cap_userns and cap2_userns to the existing capability_class_set
so that it covers all capabilities. This set was used by several
neverallow and dontaudit rules, and I confirmed that the new
classes are still appropriate.
Test: diff new policy against old and confirm that all new rules add
only cap_userns or cap2_userns;
Boot ARC++ on a device with the 4.12 kernel.
Bug: crbug.com/754831
Change-Id: I4007eb3a2ecd01b062c4c78d9afee71c530df95f
127 lines
2.4 KiB
Text
127 lines
2.4 KiB
Text
# Transition to crash_dump when /system/bin/crash_dump* is executed.
|
|
# This occurs when the process crashes.
|
|
domain_auto_trans(domain, crash_dump_exec, crash_dump);
|
|
allow domain crash_dump:process sigchld;
|
|
|
|
# Limit ability to ptrace or read sensitive /proc/pid files of processes
|
|
# with other UIDs to these whitelisted domains.
|
|
neverallow {
|
|
domain
|
|
-vold
|
|
-dumpstate
|
|
-storaged
|
|
-system_server
|
|
userdebug_or_eng(`-perfprofd')
|
|
} self:global_capability_class_set sys_ptrace;
|
|
|
|
# Limit ability to generate hardware unique device ID attestations to priv_apps
|
|
neverallow { domain -priv_app } *:keystore_key gen_unique_id;
|
|
|
|
# Core domains are not permitted to use kernel interfaces which are not
|
|
# explicitly labeled.
|
|
# TODO(b/65643247): Apply these neverallow rules to all coredomain.
|
|
full_treble_only(`
|
|
# /proc
|
|
neverallow {
|
|
coredomain
|
|
-dumpstate
|
|
-platform_app
|
|
-priv_app
|
|
-system_app
|
|
-vold
|
|
-vendor_init
|
|
} proc:file no_rw_file_perms;
|
|
|
|
# /sys
|
|
neverallow {
|
|
coredomain
|
|
-charger
|
|
-dumpstate
|
|
-healthd
|
|
-init
|
|
-priv_app
|
|
-storaged
|
|
-system_app
|
|
-ueventd
|
|
-vold
|
|
-vendor_init
|
|
} sysfs:file no_rw_file_perms;
|
|
|
|
# /dev
|
|
neverallow {
|
|
coredomain
|
|
-fsck
|
|
-init
|
|
-shell
|
|
-ueventd
|
|
-vendor_init
|
|
} device:{ blk_file file } no_rw_file_perms;
|
|
|
|
# debugfs
|
|
neverallow {
|
|
coredomain
|
|
-dumpstate
|
|
-init
|
|
-system_server
|
|
-vendor_init
|
|
} debugfs:file no_rw_file_perms;
|
|
|
|
# tracefs
|
|
neverallow {
|
|
coredomain
|
|
userdebug_or_eng(`-atrace')
|
|
-dumpstate
|
|
-init
|
|
-perfprofd
|
|
-shell
|
|
-vendor_init
|
|
} debugfs_tracing:file no_rw_file_perms;
|
|
|
|
# inotifyfs
|
|
neverallow {
|
|
coredomain
|
|
-init
|
|
-vendor_init
|
|
} inotify:file no_rw_file_perms;
|
|
|
|
# pstorefs
|
|
neverallow {
|
|
coredomain
|
|
-bootstat
|
|
-charger
|
|
-dumpstate
|
|
-healthd
|
|
-init
|
|
-logd
|
|
-logpersist
|
|
-recovery_persist
|
|
-recovery_refresh
|
|
-shell
|
|
-system_server
|
|
-vendor_init
|
|
} pstorefs:file no_rw_file_perms;
|
|
|
|
# configfs
|
|
neverallow {
|
|
coredomain
|
|
-init
|
|
-system_server
|
|
-vendor_init
|
|
} configfs:file no_rw_file_perms;
|
|
|
|
# functionfs
|
|
neverallow {
|
|
coredomain
|
|
-adbd
|
|
-init
|
|
-mediaprovider
|
|
-vendor_init
|
|
}functionfs:file no_rw_file_perms;
|
|
|
|
# usbfs and binfmt_miscfs
|
|
neverallow {
|
|
coredomain
|
|
-init
|
|
-vendor_init
|
|
}{ usbfs binfmt_miscfs }:file no_rw_file_perms;
|
|
')
|