1035ba1023
Previously I've resisted granting write access to these files, since it allows the instance image to be altered. But that doesn't allow an attacker to do anything other than render it invalid, since it's protected by the VM key. Note that logs are only written when the VM is debuggable, which is currently only when only non-protected VMs are available. Bug: 235350758 Test: Force debug on, stage APEX, compile, reboot -> see vm logs Test: Presubmit Change-Id: I17c9a17db83d15adfab97b8cfe4ccd67393a08c1
24 lines
912 B
Text
24 lines
912 B
Text
# Run by odsign to verify a CompOS signature
|
|
type compos_verify, domain, coredomain;
|
|
type compos_verify_exec, exec_type, file_type, system_file_type;
|
|
|
|
# Start a VM
|
|
binder_use(compos_verify);
|
|
virtualizationservice_use(compos_verify);
|
|
|
|
# Read instance image & write VM logs
|
|
allow compos_verify apex_module_data_file:dir search;
|
|
allow compos_verify apex_compos_data_file:dir rw_dir_perms;
|
|
allow compos_verify apex_compos_data_file:file { rw_file_perms create };
|
|
|
|
# Read CompOS info & signature files
|
|
allow compos_verify apex_art_data_file:dir search;
|
|
allow compos_verify apex_art_data_file:file r_file_perms;
|
|
|
|
# Allow odsign to redirect our stdout/stderr to log
|
|
allow compos_verify odsign:fd use;
|
|
allow compos_verify odsign_devpts:chr_file { read write };
|
|
|
|
# Only odsign can enter the domain via exec
|
|
neverallow { domain -odsign } compos_verify:process transition;
|
|
neverallow * compos_verify:process dyntransition;
|