214294ce75
Brings in the io_uring class and associated restrictions and adds a new macro, `io_uring_use`, to sepolicy. In more detail, this change: * Adds a new macro expands to ensure the domain it is passed can undergo a type transition to a new type, `<domain>_iouring`, when the anon_inode being accessed is labeled `[io_uring]`. It also allows the domain to create, read, write, and map the io_uring anon_inode. * Adds the ability for a domain to use the `IORING_SETUP_SQPOLL` flag during `io_uring_setup` so that a syscall to `io_uring_enter` is not required by the caller each time it wishes to submit IO. This can be enabled securely as long as we don't enable sharing of io_uring file descriptors across domains. The kernel polling thread created by `SQPOLL` will inherit the credentials of the thread that created the io_uring [1]. * Removes the selinux policy that restricted all domains that make use of the `userfault_fd` macro from any `anon_inode` created by another domain. This is overly restrictive, as it prohibits the use of two different `anon_inode` use cases in a single domain e.g. userfaultfd and io_uring. This change also replaces existing sepolicy in fastbootd and snapuserd that enabled the use of io_uring. [1] https://patchwork.kernel.org/project/linux-security-module/patch/163159041500.470089.11310853524829799938.stgit@olly/ Bug: 253385258 Test: m selinux_policy Test: cd external/liburing; mm; atest liburing_test; # requires WIP CL ag/20291423 Test: Manually deliver OTAs (built with m dist) to a recent Pixel device and ensure snapuserd functions correctly (no io_uring failures) Change-Id: I96f38760b3df64a1d33dcd6e5905445ccb125d3f
56 lines
1.8 KiB
Text
56 lines
1.8 KiB
Text
typeattribute fastbootd coredomain;
|
|
|
|
# The allow rules are only included in the recovery policy.
|
|
# Otherwise fastbootd is only allowed the domain rules.
|
|
recovery_only(`
|
|
# Reboot the device
|
|
set_prop(fastbootd, powerctl_prop)
|
|
|
|
# Read serial number of the device from system properties
|
|
get_prop(fastbootd, serialno_prop)
|
|
|
|
# Set sys.usb.ffs.ready.
|
|
get_prop(fastbootd, ffs_config_prop)
|
|
set_prop(fastbootd, ffs_control_prop)
|
|
|
|
userdebug_or_eng(`
|
|
get_prop(fastbootd, persistent_properties_ready_prop)
|
|
')
|
|
|
|
set_prop(fastbootd, gsid_prop)
|
|
|
|
# Determine allocation scheme (whether B partitions needs to be
|
|
# at the second half of super.
|
|
get_prop(fastbootd, virtual_ab_prop)
|
|
get_prop(fastbootd, snapuserd_prop)
|
|
|
|
# Needed for TCP protocol
|
|
allow fastbootd node:tcp_socket node_bind;
|
|
allow fastbootd port:tcp_socket name_bind;
|
|
allow fastbootd self:tcp_socket { create_socket_perms_no_ioctl listen accept };
|
|
|
|
# Start snapuserd for merging VABC updates
|
|
set_prop(fastbootd, ctl_snapuserd_prop)
|
|
|
|
# Needed to communicate with snapuserd to complete merges.
|
|
allow fastbootd snapuserd_socket:sock_file write;
|
|
allow fastbootd snapuserd:unix_stream_socket connectto;
|
|
allow fastbootd dm_user_device:dir r_dir_perms;
|
|
|
|
# Get fastbootd protocol property
|
|
get_prop(fastbootd, fastbootd_protocol_prop)
|
|
|
|
# Mount /metadata to interact with Virtual A/B snapshots.
|
|
allow fastbootd labeledfs:filesystem { mount unmount };
|
|
|
|
# Needed for reading boot properties.
|
|
allow fastbootd proc_bootconfig:file r_file_perms;
|
|
# Let this domain use the hal fastboot service
|
|
binder_use(fastbootd)
|
|
hal_client_domain(fastbootd, hal_fastboot)
|
|
')
|
|
|
|
# This capability allows fastbootd to circumvent memlock rlimits while using
|
|
# io_uring. An Alternative would be to up the memlock rlimit for the fastbootd service.
|
|
allow fastbootd self:capability ipc_lock;
|
|
io_uring_use(fastbootd)
|