PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
02dac03a8c
android_system_sepolicy/installd.te

51 lines
2.7 KiB
Plaintext
Raw Normal View History

SE Android policy.
2012-01-04 09:33:27 -08:00
# installer daemon
type installd, domain;
type installd_exec, exec_type, file_type;
init_daemon_domain(installd)
installd: enable SELinux restrictions This change enables SELinux security enforcement on the installd process. For the installd.te file only, this change is equivalent to reverting the following commits: * 50e37b93ac97631dcac6961285b92af5026557af * 77d4731e9d30c8971e076e2469d6957619019921 No other changes were required. Testing: As much as possible, I've tested that package installation works, from both adb and via Android market. There were no denials in the kernel dmesg log, and everything appears to be working correctly. It's quite possible I've missed something. If we experience problems, I'm happy to roll back this change. Bug: 9662644 Change-Id: Id93d4ee7b517dfa28c9a0b1d45d936b56892ac0a
2013-07-01 17:08:11 -07:00
typeattribute installd mlstrustedsubject;
allow installd self:capability { chown dac_override fowner fsetid setgid setuid };
allow installd system_data_file:file create_file_perms;
allow installd system_data_file:lnk_file create;
allow installd dalvikcache_data_file:file create_file_perms;
Define a type for /data/dalvik-cache/profiles. I9b8e59e3bd7df8a1bf60fa7ffd376a24ba0eb42f added a profiles subdirectory to /data/dalvik-cache with files that must be app-writable. As a result, we have denials such as: W/Profiler( 3328): type=1400 audit(0.0:199): avc: denied { write } for name="com.google.android.setupwizard" dev="mmcblk0p28" ino=106067 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:dalvikcache_data_file:s0 tclass=file W/Profiler( 3328): type=1300 audit(0.0:199): arch=40000028 syscall=322 per=800000 success=yes exit=33 a0=ffffff9c a1=b8362708 a2=20002 a3=0 items=1 ppid=194 auid=4294967295 uid=10019 gid=10019 euid=10019 suid=10019 fsuid=10019 egid=10019 sgid=10019 fsgid=10019 tty=(none) ses=4294967295 exe="/system/bin/app_process" subj=u:r:untrusted_app:s0 key=(null) W/auditd ( 286): type=1307 audit(0.0:199): cwd="/" W/auditd ( 286): type=1302 audit(0.0:199): item=0 name="/data/dalvik-cache/profiles/com.google.android.setupwizard" inode=106067 dev=b3:1c mode=0100664 ouid=1012 ogid=50019 rdev=00:00 obj=u:object_r:dalvikcache_data_file:s0 We do not want to allow untrusted app domains to write to the existing type on other /data/dalvik-cache files as that could be used for code injection into another app domain, the zygote or the system_server. So define a new type for this subdirectory. The restorecon_recursive /data in init.rc will fix the labeling on devices that already have a profiles directory created. For correct labeling on first creation, we also need a separate change to installd under the same change id. Bug: 13927667 Change-Id: I4857d031f9e7e60d48b8c72fcb22a81b3a2ebaaa Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-04-09 11:24:33 -07:00
allow installd dalvikcache_profiles_data_file:dir create_dir_perms;
allow installd dalvikcache_profiles_data_file:file create_file_perms;
Protect keystore's files. Only keystore itself should be reading / writing it's files. Remove keystore file access from other SELinux domains, including unconfined. Add neverallow rules to protect against regressions. Allow init limited access to recurse into keystore's directory. Change-Id: I0bb5de7804f4314997c16fac18507933014bcadf
2014-05-08 23:28:52 -07:00
allow installd { data_file_type -keystore_data_file }:dir create_dir_perms;
allow installd { data_file_type -keystore_data_file }:dir { relabelfrom relabelto };
allow installd { data_file_type -keystore_data_file }:{ file_class_set } { getattr unlink };
installd: enable SELinux restrictions This change enables SELinux security enforcement on the installd process. For the installd.te file only, this change is equivalent to reverting the following commits: * 50e37b93ac97631dcac6961285b92af5026557af * 77d4731e9d30c8971e076e2469d6957619019921 No other changes were required. Testing: As much as possible, I've tested that package installation works, from both adb and via Android market. There were no denials in the kernel dmesg log, and everything appears to be working correctly. It's quite possible I've missed something. If we experience problems, I'm happy to roll back this change. Bug: 9662644 Change-Id: Id93d4ee7b517dfa28c9a0b1d45d936b56892ac0a
2013-07-01 17:08:11 -07:00
allow installd apk_data_file:file r_file_perms;
allow installd apk_tmp_file:file r_file_perms;
Let installd dexopt OEM apps. avc: denied { search } for pid=118 comm="installd" name="/" dev="mmcblk0p12" ino=2 scontext=u:r:installd:s0 tcontext=u:object_r:oemfs:s0 tclass=dir Bug: 13340779 Change-Id: Id42f45080ba2c736921691dadfdfa429cf006663
2014-04-25 13:59:52 -07:00
allow installd oemfs:dir r_dir_perms;
allow installd oemfs:file r_file_perms;
installd: enable SELinux restrictions This change enables SELinux security enforcement on the installd process. For the installd.te file only, this change is equivalent to reverting the following commits: * 50e37b93ac97631dcac6961285b92af5026557af * 77d4731e9d30c8971e076e2469d6957619019921 No other changes were required. Testing: As much as possible, I've tested that package installation works, from both adb and via Android market. There were no denials in the kernel dmesg log, and everything appears to be working correctly. It's quite possible I've missed something. If we experience problems, I'm happy to roll back this change. Bug: 9662644 Change-Id: Id93d4ee7b517dfa28c9a0b1d45d936b56892ac0a
2013-07-01 17:08:11 -07:00
allow installd system_file:file x_file_perms;
allow installd cgroup:dir create_dir_perms;
# Check validity of SELinux context before use.
selinux_check_context(installd)
# Read /seapp_contexts and /data/security/seapp_contexts
security_access_policy(installd)
# ASEC
allow installd app_data_file:lnk_file { create setattr };
allow installd asec_apk_file:file r_file_perms;
Make bluetooth, nfc, radio and shell adb-installable bluetooth, nfc, radio and shell are not explicitly declared in installd.te. This prevents applications in those group from upgrading by "adb install -r". You can reproduce the issue by following step: 1. adb pull /system/priv-app/Shell.apk 2. adb install -r Shell.apk 3. install failed with the error log blow [Error in logcat] E/installd( 338): couldn't symlink directory '/data/data/com.android.shell/lib' -> '/data/app-lib/com.android.shell-1': Permission denied E/installd( 338): couldn't symlink directory '/data/data/com.android.shell/lib' -> '/data/app-lib/Shell': Permission denied [Error in dmesg] <5>[ 112.053301] type=1400 audit(1387412796.071:10): avc: denied { create } for pid=337 comm="installd" name="lib" scontext=u:r:installd:s0 tcontext=u:object_r:shell_data_file:s0 tclass=lnk_file This operation fails only if the app belongs to any of the groups specified in the commit title. Change-Id: I7572df9fb6e471fad34f61137f0eeeda4c82659d
2013-11-26 03:19:08 -08:00
allow installd bluetooth_data_file:lnk_file { create setattr };
allow installd nfc_data_file:lnk_file { create setattr };
allow installd radio_data_file:lnk_file { create setattr };
allow installd shell_data_file:lnk_file { create setattr };
Allow installd to create the lib symlink for system_app_data_file 91a4f8d4fdab7df8474c2ffaa996c879166d8a4c created system_app_data_file, and assigned all system_apps to use this file type. For testing purposes, our automated testing infrastructure sideloads shared system UID apks. Installd does not have permission to create the lib symlink, so the installation fails. Allow installd to create this symlink. repro: adb install AppLaunch.apk 276 KB/s (8414 bytes in 0.029s) pkg: /data/local/tmp/AppLaunch.apk Failure [INSTALL_FAILED_INTERNAL_ERROR] logcat: 05-08 23:16:36.336 605 637 I PackageManager: Copying native libraries to /data/app-lib/vmdl609237490 05-08 23:16:36.338 605 637 W asset : Installing empty resources in to table 0x5e89a368 05-08 23:16:36.359 193 193 W installd: type=1400 audit(0.0:29): avc: denied { create } for name="lib" scontext=u:r:installd:s0 tcontext=u:object_r:system_app_data_file:s0 tclass=lnk_file 05-08 23:16:36.363 193 193 E installd: couldn't symlink directory '/data/data/com.android.tests.applaunch/lib' -> '/data/app-lib/com.android.tests.applaunch-1': Permission denied 05-08 23:16:36.364 605 637 W PackageManager: Failed linking native library dir (user=0) 05-08 23:16:36.364 605 637 W PackageManager: Package couldn't be installed in /data/app/com.android.tests.applaunch-1.apk Bug: 14659632 Change-Id: Iac4890302cd070aa3f71553af217f343ed7b8bc3
2014-05-09 11:17:51 -07:00
allow installd system_app_data_file:lnk_file { create setattr };
Allow installd to restorecon /data/data. Ability to relabel from/to any of the types that can be assigned to /data/data directories as per seapp_contexts type= assignments. Change-Id: I05e8b438950ddb908e46c9168ea6ee601e6d674f Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-03-19 12:16:08 -07:00
# restorecon /data/data
allow installd unlabeled:dir relabelfrom;
allow installd unlabeled:notdevfile_class_set relabelfrom;
Label app data directories for system UID apps with a different type. We were using system_data_file for the /data/data directories of system UID apps to match the DAC ownership of system UID shared with other system files. However, we are seeing cases where files created in these directories must be writable by other apps, and we would like to avoid allowing write to system data files outside of these directories. So introduce a separate system_app_data_file type and assign it. This should also help protect against arbitrary writes by system UID apps to other system data directories. This resolves the following denial when cropping or taking a user photo for secondary users: avc: denied { write } for path="/data/data/com.android.settings/cache/TakeEditUserPhoto2.jpg" dev="mmcblk0p28" ino=82120 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:system_data_file:s0 tclass=file avc: denied { write } for path="/data/data/com.android.settings/cache/CropEditUserPhoto.jpg" dev="mmcblk0p30" ino=602905 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:system_data_file:s0 tclass=file Bug: 14604553 Change-Id: Ifa10e3283b07f6bd6ecc16eceeb663edfd756cea Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-05-07 10:10:02 -07:00
allow installd system_data_file:dir relabelfrom;
allow installd system_data_file:notdevfile_class_set relabelfrom;
allow installd system_app_data_file:dir { relabelfrom relabelto };
allow installd system_app_data_file:notdevfile_class_set { relabelfrom relabelto };
Allow installd to restorecon /data/data. Ability to relabel from/to any of the types that can be assigned to /data/data directories as per seapp_contexts type= assignments. Change-Id: I05e8b438950ddb908e46c9168ea6ee601e6d674f Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-03-19 12:16:08 -07:00
allow installd bluetooth_data_file:dir { relabelfrom relabelto };
allow installd bluetooth_data_file:notdevfile_class_set { relabelfrom relabelto };
allow installd nfc_data_file:dir { relabelfrom relabelto };
allow installd nfc_data_file:notdevfile_class_set { relabelfrom relabelto };
allow installd radio_data_file:dir { relabelfrom relabelto };
allow installd radio_data_file:notdevfile_class_set { relabelfrom relabelto };
allow installd app_data_file:dir { relabelfrom relabelto };
allow installd app_data_file:notdevfile_class_set { relabelfrom relabelto };
allow installd shell_data_file:dir { relabelfrom relabelto };
allow installd shell_data_file:notdevfile_class_set { relabelfrom relabelto };
Reference in New Issue Copy Permalink