7adb999e70
Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
43 lines
2.2 KiB
Text
43 lines
2.2 KiB
Text
#######################################################
|
|
#
|
|
# This is the unconfined template. This template is the base policy
|
|
# which is used by daemons and other privileged components of
|
|
# Android.
|
|
#
|
|
# Historically, this template was called "unconfined" because it
|
|
# allowed the domain to do anything it wanted. Over time,
|
|
# this has changed, and will continue to change in the future.
|
|
# The rules in this file will be removed when no remaining
|
|
# unconfined domains require it, or when the rules contradict
|
|
# Android security best practices. Domains which need rules not
|
|
# provided by the unconfined template should add them directly to
|
|
# the relevant policy.
|
|
#
|
|
# The use of this template is discouraged.
|
|
######################################################
|
|
|
|
allow unconfineddomain self:capability_class_set *;
|
|
allow unconfineddomain kernel:security ~{ load_policy setenforce };
|
|
allow unconfineddomain kernel:system *;
|
|
allow unconfineddomain self:memprotect *;
|
|
allow unconfineddomain domain:process *;
|
|
allow unconfineddomain domain:fd *;
|
|
allow unconfineddomain domain:dir r_dir_perms;
|
|
allow unconfineddomain domain:lnk_file r_file_perms;
|
|
allow unconfineddomain domain:{ fifo_file file } rw_file_perms;
|
|
allow unconfineddomain domain:socket_class_set *;
|
|
allow unconfineddomain domain:ipc_class_set *;
|
|
allow unconfineddomain domain:key *;
|
|
allow unconfineddomain fs_type:filesystem *;
|
|
allow unconfineddomain {fs_type dev_type file_type}:{ dir blk_file lnk_file sock_file fifo_file } ~relabelto;
|
|
allow unconfineddomain {fs_type -usermodehelper -proc_security}:{ chr_file file } ~{entrypoint relabelto};
|
|
allow unconfineddomain {dev_type -kmem_device}:{ chr_file file } ~{entrypoint relabelto};
|
|
allow unconfineddomain file_type:{ chr_file file } ~{entrypoint relabelto};
|
|
allow unconfineddomain node_type:node *;
|
|
allow unconfineddomain node_type:{ tcp_socket udp_socket rawip_socket } node_bind;
|
|
allow unconfineddomain netif_type:netif *;
|
|
allow unconfineddomain port_type:socket_class_set name_bind;
|
|
allow unconfineddomain port_type:{ tcp_socket dccp_socket } name_connect;
|
|
allow unconfineddomain domain:peer recv;
|
|
allow unconfineddomain domain:binder { call transfer set_context_mgr };
|
|
allow unconfineddomain property_type:property_service set;
|