android_system_sepolicy/logd.te

# android user-space log manager
type logd, domain, domain_deprecated, mlstrustedsubject;
type logd_exec, exec_type, file_type;

init_daemon_domain(logd)

# Read access to pseudo filesystems.
r_dir_file(logd, proc)
r_dir_file(logd, proc_net)

allow logd self:capability { setuid setgid sys_nice audit_control };
allow logd self:capability2 syslog;
allow logd self:netlink_audit_socket { create_socket_perms nlmsg_write };
allow logd kernel:system syslog_read;
allow logd kmsg_device:chr_file w_file_perms;
allow logd system_data_file:file r_file_perms;
# logpersist is only allowed on userdebug and eng builds
userdebug_or_eng(`
  allow logd misc_logd_file:file create_file_perms;
  allow logd misc_logd_file:dir rw_dir_perms;
')
allow logd pstorefs:dir search;
allow logd pstorefs:file r_file_perms;

# Set persist.sys. and sys.powerctl
set_prop(logd, safemode_prop)
set_prop(logd, powerctl_prop)

# Access device logging gating property
get_prop(logd, device_logging_prop)

r_dir_file(logd, domain)

allow logd kernel:system syslog_mod;

control_logd(logd)

# case where logpersistd is actually logcat -f in logd context (nee: logcatd)
userdebug_or_eng(`
  unix_socket_connect(logd, logdr, logd)
')

###
### Neverallow rules
###
### logd should NEVER do any of this

# Block device access.
neverallow logd dev_type:blk_file { read write };

# ptrace any other app
neverallow logd domain:process ptrace;

# Write to /system.
neverallow logd system_file:dir_file_class_set write;

# Write to files in /data/data or system files on /data
neverallow logd { app_data_file system_data_file }:dir_file_class_set write;

# logd is not allowed to write anywhere other than /data/misc/logd, and then
# only on userdebug or eng builds
neverallow logd { file_type -logd_tmpfs userdebug_or_eng(` -misc_logd_file -coredump_file ') }:file { create write append };

# logpersist is only allowed on userdebug/eng builds
neverallow { domain userdebug_or_eng(`-logd -shell -dumpstate') } misc_logd_file:file no_rw_file_perms;
neverallow { domain userdebug_or_eng(`-logd') } misc_logd_file:dir { add_name link relabelfrom remove_name rename reparent rmdir write };
neverallow { domain -init } misc_logd_file:dir create;
sepolicy: Add write_logd, read_logd & control_logd - Add write_logd, read_logd and control_logd macros added along with contexts for user space logd. - Specify above on domain wide, or service-by-service basis - Add logd rules. - deprecate access_logcat as unused. - 'allow <domain> zygote:unix_dgram_socket write;' rule added to deal with fd inheritance. ToDo: investigate means to allow references to close, and reopen in context of application or call setsockcreatecon() to label them in child context. Change-Id: I35dbb9d5122c5ed9b8c8f128abf24a871d6b26d8 2013-11-12 15:34:52 -08:00			`# android user-space log manager`
Create attribute for moving perms out of domain Motivation: Domain is overly permissive. Start removing permissions from domain and assign them to the domain_deprecated attribute. Domain_deprecated and domain can initially be assigned to all domains. The goal is to not assign domain_deprecated to new domains and to start removing domain_deprecated where it is not required or reassigning the appropriate permissions to the inheriting domain when necessary. Bug: 25433265 Change-Id: I8b11cb137df7bdd382629c98d916a73fe276413c 2015-11-03 09:54:39 -08:00			`type logd, domain, domain_deprecated, mlstrustedsubject;`
sepolicy: Add write_logd, read_logd & control_logd - Add write_logd, read_logd and control_logd macros added along with contexts for user space logd. - Specify above on domain wide, or service-by-service basis - Add logd rules. - deprecate access_logcat as unused. - 'allow <domain> zygote:unix_dgram_socket write;' rule added to deal with fd inheritance. ToDo: investigate means to allow references to close, and reopen in context of application or call setsockcreatecon() to label them in child context. Change-Id: I35dbb9d5122c5ed9b8c8f128abf24a871d6b26d8 2013-11-12 15:34:52 -08:00			`type logd_exec, exec_type, file_type;`

			`init_daemon_domain(logd)`

logd: grant perms from domain_deprecated In preparation of removing permissions from domain_deprecated. Addresses: avc: denied { read } for name="psched" dev="proc" ino=4026536519 scontext=u:r:logd:s0 tcontext=u:object_r:proc_net:s0 tclass=file permissive=1 avc: denied { open } for path="/proc/147/net/psched" dev="proc" ino=4026536519 scontext=u:r:logd:s0 tcontext=u:object_r:proc_net:s0 tclass=file permissive=1 avc: denied { getattr } for path="/proc/147/net/psched" dev="proc" ino=4026536519 scontext=u:r:logd:s0 tcontext=u:object_r:proc_net:s0 tclass=file permissive=1 avc: denied { read } for name="kmsg" dev="proc" ino=4026536603 scontext=u:r:logd:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 avc: denied { open } for path="/proc/kmsg" dev="proc" ino=4026536603 scontext=u:r:logd:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 avc: denied { getattr } for path="/proc/meminfo" dev="proc" ino=4026536598 scontext=u:r:logd:s0 tcontext=u:object_r:proc:s0 tclass=file permissive=1 Change-Id: Iaa67a6b8369c0449b09b64b807bc5819d6d68f02 2016-01-27 19:23:10 -08:00			`# Read access to pseudo filesystems.`
			`r_dir_file(logd, proc)`
			`r_dir_file(logd, proc_net)`

logd: add auditd Change-Id: Iec4bfc08ced20c0d4c74e07baca6cff812c9ba00 2014-04-01 11:02:57 -07:00			`allow logd self:capability { setuid setgid sys_nice audit_control };`
			`allow logd self:capability2 syslog;`
			`allow logd self:netlink_audit_socket { create_socket_perms nlmsg_write };`
			`allow logd kernel:system syslog_read;`
logd: auditd: add permissions to access /dev/kmsg Change-Id: I3c16a8e1104352d3d71cd3cd0298f4c31de56f5d 2014-04-07 14:04:30 -07:00			`allow logd kmsg_device:chr_file w_file_perms;`
logd: allow access to system files - allow access for /data/system/packages.xml. - deprecate access to /dev/logd_debug (can use /dev/kmsg for debugging) - allow access to /dev/socket/logd for 'logd --reinit' Bug: 19681572 Change-Id: Iac57fff1aabc3b061ad2cc27969017797f8bef54 2015-03-10 13:46:37 -07:00			`allow logd system_data_file:file r_file_perms;`
Enforce no persistent logging on user builds For userdebug and eng builds enforce that: - only logd and shell domains may access logd files - logd is only allowed to write to /data/misc/logd Change-Id: Ie909cf701fc57109257aa13bbf05236d1777669a 2015-09-21 16:22:21 -07:00			`# logpersist is only allowed on userdebug and eng builds`
			userdebug_or_eng(`
			`allow logd misc_logd_file:file create_file_perms;`
			`allow logd misc_logd_file:dir rw_dir_perms;`
			`')`
logd: logpersistd - Enable logpersistd to write to /data/misc/logd - Enable logpersistd to read from pstore to help complete any content lost by reboot disruption - Enable shell readonly ability logpersistd files in /data/misc/logd - Enable logcat -f when placed into logd context to act as a logpersistd (nee logcatd) agent, restrict access to run only in userdebug or eng Bug: 19608716 Change-Id: I3209582bc796a1093c325c90068a48bf268e5ab5 2015-05-26 15:12:45 -07:00			`allow logd pstorefs:dir search;`
			`allow logd pstorefs:file r_file_perms;`
sepolicy: Add write_logd, read_logd & control_logd - Add write_logd, read_logd and control_logd macros added along with contexts for user space logd. - Specify above on domain wide, or service-by-service basis - Add logd rules. - deprecate access_logcat as unused. - 'allow <domain> zygote:unix_dgram_socket write;' rule added to deal with fd inheritance. ToDo: investigate means to allow references to close, and reopen in context of application or call setsockcreatecon() to label them in child context. Change-Id: I35dbb9d5122c5ed9b8c8f128abf24a871d6b26d8 2013-11-12 15:34:52 -08:00
Allow logd.auditd to reboot to safe mode Bug: 26902605 Change-Id: Ica825cf2af74f5624cf4091544bd24bb5482dbe7 2016-02-05 15:42:32 -08:00			`# Set persist.sys. and sys.powerctl`
			`set_prop(logd, safemode_prop)`
			`set_prop(logd, powerctl_prop)`

SELinux rule for ro.device_owner and persist.logd.security They are introduced for the device owner process logging feature. That is, for enterprise-owned devices with device owner app provisioned, the device owner may choose to turn on additional device-wide logging for auditing and intrusion detection purposes. Logging includes histories of app process startup, commands issued over ADB and lockscreen unlocking attempts. These logs will available to the device owner for analysis, potentially shipped to a remote server if it chooses to. ro.device_owner will be a master switch to turn off logging, if the device has no device owner provisioned. persist.logd.security is a switch that device owner can toggle (via DevicePoliyManager) to enable/disable logging. Writing to both properties should be only allowed by the system server. Bug: 22860162 Change-Id: Iabfe2347b094914813b9d6e0c808877c25ccd038 2016-01-04 07:20:45 -08:00			`# Access device logging gating property`
			`get_prop(logd, device_logging_prop)`

sepolicy: Add write_logd, read_logd & control_logd - Add write_logd, read_logd and control_logd macros added along with contexts for user space logd. - Specify above on domain wide, or service-by-service basis - Add logd rules. - deprecate access_logcat as unused. - 'allow <domain> zygote:unix_dgram_socket write;' rule added to deal with fd inheritance. ToDo: investigate means to allow references to close, and reopen in context of application or call setsockcreatecon() to label them in child context. Change-Id: I35dbb9d5122c5ed9b8c8f128abf24a871d6b26d8 2013-11-12 15:34:52 -08:00			`r_dir_file(logd, domain)`

logd: Add klogd Change-Id: Ib9bc89b05771a12c6bb9a25cf59ea51afd22ae15 2014-10-15 15:49:37 -07:00			`allow logd kernel:system syslog_mod;`

logd: allow access to system files - allow access for /data/system/packages.xml. - deprecate access to /dev/logd_debug (can use /dev/kmsg for debugging) - allow access to /dev/socket/logd for 'logd --reinit' Bug: 19681572 Change-Id: Iac57fff1aabc3b061ad2cc27969017797f8bef54 2015-03-10 13:46:37 -07:00			`control_logd(logd)`

logd: logpersistd - Enable logpersistd to write to /data/misc/logd - Enable logpersistd to read from pstore to help complete any content lost by reboot disruption - Enable shell readonly ability logpersistd files in /data/misc/logd - Enable logcat -f when placed into logd context to act as a logpersistd (nee logcatd) agent, restrict access to run only in userdebug or eng Bug: 19608716 Change-Id: I3209582bc796a1093c325c90068a48bf268e5ab5 2015-05-26 15:12:45 -07:00			`# case where logpersistd is actually logcat -f in logd context (nee: logcatd)`
			userdebug_or_eng(`
			`unix_socket_connect(logd, logdr, logd)`
			`')`

sepolicy: Add write_logd, read_logd & control_logd - Add write_logd, read_logd and control_logd macros added along with contexts for user space logd. - Specify above on domain wide, or service-by-service basis - Add logd rules. - deprecate access_logcat as unused. - 'allow <domain> zygote:unix_dgram_socket write;' rule added to deal with fd inheritance. ToDo: investigate means to allow references to close, and reopen in context of application or call setsockcreatecon() to label them in child context. Change-Id: I35dbb9d5122c5ed9b8c8f128abf24a871d6b26d8 2013-11-12 15:34:52 -08:00			`###`
			`### Neverallow rules`
			`###`
			`### logd should NEVER do any of this`

			`# Block device access.`
			`neverallow logd dev_type:blk_file { read write };`

			`# ptrace any other app`
			`neverallow logd domain:process ptrace;`

			`# Write to /system.`
			`neverallow logd system_file:dir_file_class_set write;`

			`# Write to files in /data/data or system files on /data`
			`neverallow logd { app_data_file system_data_file }:dir_file_class_set write;`
Enforce no persistent logging on user builds For userdebug and eng builds enforce that: - only logd and shell domains may access logd files - logd is only allowed to write to /data/misc/logd Change-Id: Ie909cf701fc57109257aa13bbf05236d1777669a 2015-09-21 16:22:21 -07:00
refine /data/misc/logd rules Followup to 121f5bfd80298266d293fa5c0a30fed66f4facfa. Move misc_logd_file neverallow rule from domain.te to logd.te, since the goal of the neverallow rule is to protect logd / logpersist files from other processes. Switch the misc_logd_file neverallow rule from using "rw_file_perms" to "no_rw_file_perms". The latter covers more cases of file modifications. Add more neverallow rules covering misc_logd_file directories. Instead of using not_userdebug_nor_eng(), modify the rules to be consistent with other highly constrained file types such as keystore_data_file or vold_data_file. See, for example, https://android-review.googlesource.com/144768 To see the net effect of this change, you can use the following command line: sesearch --allow -t misc_logd_file -c file,dir,lnk_file \ out/target/product/bullhead/root/sepolicy Before this change: # userdebug builds allow init misc_logd_file:dir { search setattr read create getattr write relabelfrom ioctl rmdir remove_name relabelto open add_name }; allow init misc_logd_file:file { setattr read create write relabelfrom getattr relabelto unlink open }; allow init misc_logd_file:lnk_file { setattr relabelfrom create getattr relabelto unlink }; allow logd misc_logd_file:dir { search read lock getattr write ioctl remove_name open add_name }; allow logd misc_logd_file:file { rename setattr read lock create getattr write ioctl unlink open append }; allow shell misc_logd_file:dir { search read lock getattr ioctl open }; allow shell misc_logd_file:file { read lock ioctl open getattr }; # user builds allow init misc_logd_file:dir { search setattr read create getattr write relabelfrom ioctl rmdir remove_name relabelto open add_name }; allow init misc_logd_file:file relabelto; allow init misc_logd_file:lnk_file { setattr relabelfrom create getattr relabelto unlink }; After this change: # userdebug builds allow init misc_logd_file:dir { search setattr read create getattr ioctl relabelto open }; allow init misc_logd_file:file { relabelto getattr }; allow init misc_logd_file:lnk_file relabelto; allow logd misc_logd_file:dir { search read lock getattr write ioctl remove_name open add_name }; allow logd misc_logd_file:file { rename setattr read lock create getattr write ioctl unlink open append }; allow shell misc_logd_file:dir { search read lock getattr ioctl open }; allow shell misc_logd_file:file { read lock ioctl open getattr }; # user builds allow init misc_logd_file:dir { search setattr read create getattr ioctl relabelto open }; allow init misc_logd_file:file { relabelto getattr }; allow init misc_logd_file:lnk_file relabelto; Change-Id: I0b00215049ad83182f458b4b9e258289c5144479 2016-03-26 07:43:38 -07:00			`# logd is not allowed to write anywhere other than /data/misc/logd, and then`
Enforce no persistent logging on user builds For userdebug and eng builds enforce that: - only logd and shell domains may access logd files - logd is only allowed to write to /data/misc/logd Change-Id: Ie909cf701fc57109257aa13bbf05236d1777669a 2015-09-21 16:22:21 -07:00			`# only on userdebug or eng builds`
refine /data/misc/logd rules Followup to 121f5bfd80298266d293fa5c0a30fed66f4facfa. Move misc_logd_file neverallow rule from domain.te to logd.te, since the goal of the neverallow rule is to protect logd / logpersist files from other processes. Switch the misc_logd_file neverallow rule from using "rw_file_perms" to "no_rw_file_perms". The latter covers more cases of file modifications. Add more neverallow rules covering misc_logd_file directories. Instead of using not_userdebug_nor_eng(), modify the rules to be consistent with other highly constrained file types such as keystore_data_file or vold_data_file. See, for example, https://android-review.googlesource.com/144768 To see the net effect of this change, you can use the following command line: sesearch --allow -t misc_logd_file -c file,dir,lnk_file \ out/target/product/bullhead/root/sepolicy Before this change: # userdebug builds allow init misc_logd_file:dir { search setattr read create getattr write relabelfrom ioctl rmdir remove_name relabelto open add_name }; allow init misc_logd_file:file { setattr read create write relabelfrom getattr relabelto unlink open }; allow init misc_logd_file:lnk_file { setattr relabelfrom create getattr relabelto unlink }; allow logd misc_logd_file:dir { search read lock getattr write ioctl remove_name open add_name }; allow logd misc_logd_file:file { rename setattr read lock create getattr write ioctl unlink open append }; allow shell misc_logd_file:dir { search read lock getattr ioctl open }; allow shell misc_logd_file:file { read lock ioctl open getattr }; # user builds allow init misc_logd_file:dir { search setattr read create getattr write relabelfrom ioctl rmdir remove_name relabelto open add_name }; allow init misc_logd_file:file relabelto; allow init misc_logd_file:lnk_file { setattr relabelfrom create getattr relabelto unlink }; After this change: # userdebug builds allow init misc_logd_file:dir { search setattr read create getattr ioctl relabelto open }; allow init misc_logd_file:file { relabelto getattr }; allow init misc_logd_file:lnk_file relabelto; allow logd misc_logd_file:dir { search read lock getattr write ioctl remove_name open add_name }; allow logd misc_logd_file:file { rename setattr read lock create getattr write ioctl unlink open append }; allow shell misc_logd_file:dir { search read lock getattr ioctl open }; allow shell misc_logd_file:file { read lock ioctl open getattr }; # user builds allow init misc_logd_file:dir { search setattr read create getattr ioctl relabelto open }; allow init misc_logd_file:file { relabelto getattr }; allow init misc_logd_file:lnk_file relabelto; Change-Id: I0b00215049ad83182f458b4b9e258289c5144479 2016-03-26 07:43:38 -07:00			neverallow logd { file_type -logd_tmpfs userdebug_or_eng(` -misc_logd_file -coredump_file ') }:file { create write append };

			`# logpersist is only allowed on userdebug/eng builds`
dumpstate: access /data/misc/logd Bug: 27965066 Change-Id: Ia0690c544876e209e4c080b0e959f763b731c48a 2016-04-01 09:58:39 -07:00			neverallow { domain userdebug_or_eng(`-logd -shell -dumpstate') } misc_logd_file:file no_rw_file_perms;
refine /data/misc/logd rules Followup to 121f5bfd80298266d293fa5c0a30fed66f4facfa. Move misc_logd_file neverallow rule from domain.te to logd.te, since the goal of the neverallow rule is to protect logd / logpersist files from other processes. Switch the misc_logd_file neverallow rule from using "rw_file_perms" to "no_rw_file_perms". The latter covers more cases of file modifications. Add more neverallow rules covering misc_logd_file directories. Instead of using not_userdebug_nor_eng(), modify the rules to be consistent with other highly constrained file types such as keystore_data_file or vold_data_file. See, for example, https://android-review.googlesource.com/144768 To see the net effect of this change, you can use the following command line: sesearch --allow -t misc_logd_file -c file,dir,lnk_file \ out/target/product/bullhead/root/sepolicy Before this change: # userdebug builds allow init misc_logd_file:dir { search setattr read create getattr write relabelfrom ioctl rmdir remove_name relabelto open add_name }; allow init misc_logd_file:file { setattr read create write relabelfrom getattr relabelto unlink open }; allow init misc_logd_file:lnk_file { setattr relabelfrom create getattr relabelto unlink }; allow logd misc_logd_file:dir { search read lock getattr write ioctl remove_name open add_name }; allow logd misc_logd_file:file { rename setattr read lock create getattr write ioctl unlink open append }; allow shell misc_logd_file:dir { search read lock getattr ioctl open }; allow shell misc_logd_file:file { read lock ioctl open getattr }; # user builds allow init misc_logd_file:dir { search setattr read create getattr write relabelfrom ioctl rmdir remove_name relabelto open add_name }; allow init misc_logd_file:file relabelto; allow init misc_logd_file:lnk_file { setattr relabelfrom create getattr relabelto unlink }; After this change: # userdebug builds allow init misc_logd_file:dir { search setattr read create getattr ioctl relabelto open }; allow init misc_logd_file:file { relabelto getattr }; allow init misc_logd_file:lnk_file relabelto; allow logd misc_logd_file:dir { search read lock getattr write ioctl remove_name open add_name }; allow logd misc_logd_file:file { rename setattr read lock create getattr write ioctl unlink open append }; allow shell misc_logd_file:dir { search read lock getattr ioctl open }; allow shell misc_logd_file:file { read lock ioctl open getattr }; # user builds allow init misc_logd_file:dir { search setattr read create getattr ioctl relabelto open }; allow init misc_logd_file:file { relabelto getattr }; allow init misc_logd_file:lnk_file relabelto; Change-Id: I0b00215049ad83182f458b4b9e258289c5144479 2016-03-26 07:43:38 -07:00			neverallow { domain userdebug_or_eng(`-logd') } misc_logd_file:dir { add_name link relabelfrom remove_name rename reparent rmdir write };
			`neverallow { domain -init } misc_logd_file:dir create;`