353c72e3b0
This change removes the permissive line from unconfined domains. Unconfined domains can do (mostly) anything, so moving these domains into enforcing should be a no-op. The following domains were deliberately NOT changed: 1) kernel 2) init In the future, this gives us the ability to tighten up the rules in unconfined, and have those tightened rules actually work. When we're ready to tighten up the rules for these domains, we can: 1) Remove unconfined_domain and re-add the permissive line. 2) Submit the domain in permissive but NOT unconfined. 3) Remove the permissive line 4) Wait a few days and submit the no-permissive change. For instance, if we were ready to do this for adb, we'd identify a list of possible rules which allow adbd to work, re-add the permissive line, and then upload those changes to AOSP. After sufficient testing, we'd then move adb to enforcing. We'd repeat this for each domain until everything is enforcing and out of unconfined. Change-Id: If674190de3262969322fb2e93d9a0e734f8b9245
49 lines
1.6 KiB
Text
49 lines
1.6 KiB
Text
#
|
|
# System Server aka system_server spawned by zygote.
|
|
# Most of the framework services run in this process.
|
|
#
|
|
type system_server, domain;
|
|
unconfined_domain(system_server);
|
|
relabelto_domain(system_server);
|
|
|
|
# These are the capabilities assigned by the zygote to the
|
|
# system server.
|
|
allow system_server self:capability {
|
|
kill
|
|
net_admin
|
|
net_bind_service
|
|
net_broadcast
|
|
net_raw
|
|
sys_boot
|
|
sys_module
|
|
sys_nice
|
|
sys_resource
|
|
sys_time
|
|
sys_tty_config
|
|
};
|
|
|
|
# Create a socket for receiving info from wpa.
|
|
type_transition system_server wifi_data_file:sock_file system_wpa_socket;
|
|
allow system_server system_wpa_socket:sock_file create_file_perms;
|
|
|
|
# Create a socket for connections from debuggerd.
|
|
type_transition system_server system_data_file:sock_file system_ndebug_socket "ndebugsocket";
|
|
allow system_server system_ndebug_socket:sock_file create_file_perms;
|
|
|
|
allow system_server self:zygote { specifyids specifyrlimits specifyseinfo };
|
|
|
|
# Read from HW RNG (needed by EntropyMixer).
|
|
allow system_server hw_random_device:chr_file r_file_perms;
|
|
|
|
allow system_server backup_data_file:dir relabelto;
|
|
allow system_server cache_backup_file:dir relabelto;
|
|
allow system_server anr_data_file:dir relabelto;
|
|
allow system_server system_data_file:dir relabelto;
|
|
allow system_server apk_data_file:file relabelto;
|
|
allow system_server apk_tmp_file:file relabelto;
|
|
allow system_server cache_backup_file:file relabelto;
|
|
allow system_server apk_private_tmp_file:file relabelto;
|
|
allow system_server wallpaper_file:file relabelto;
|
|
|
|
# Access to wake locks
|
|
allow system_server sysfs_wake_lock:file rw_file_perms;
|