PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7e86e19d58
android_system_sepolicy/device.te

96 lines
2.9 KiB
Plaintext
Raw Normal View History

SE Android policy.
2012-01-04 09:33:27 -08:00
# Device types
type device, dev_type, fs_type;
type alarm_device, dev_type, mlstrustedobject;
type adb_device, dev_type;
type ashmem_device, dev_type, mlstrustedobject;
type audio_device, dev_type;
type binder_device, dev_type, mlstrustedobject;
type block_device, dev_type;
type camera_device, dev_type;
type dm_device, dev_type;
type loop_device, dev_type;
selinux: add pstore Used to record the Android log messages, then on reboot provide a means to triage user-space actitivies leading up to a panic. A companion to the pstore console logs. Change-Id: I9b94ee3d5e94e0c4590ba8453b4ac1ebdfc7603f
2014-12-15 12:01:35 -08:00
type pmsg_device, dev_type, mlstrustedobject;
SE Android policy.
2012-01-04 09:33:27 -08:00
type radio_device, dev_type;
type ram_device, dev_type;
Label /dev/rtc0 as rtc_device. Grant access to system_server, as it is used by AlarmManagerService. Change-Id: I4f099fe30ba206db07d636dd454d43d3df9d3015
2015-05-18 14:01:37 -07:00
type rtc_device, dev_type;
Label block devices created or accessed by vold with specific types. Assign a more specific type than block_device to all block devices created or accessed by vold. Allow vold to set the context on the device nodes it creates. vold can create extra loop devices (/dev/block/loopN) and block devices for volumes it manages (/dev/block/vold/M:N). vold can read/write device mapper block devices (/dev/block/dm-N) created for encrypted volumes. vold can read/write metadata partitions used to store encryption metadata. The metadata_block_device type should be assigned in device-specific policy to the partition specified by the encryptable= mount option for the userata entry in the fstab.<board> file. This change does not remove the ability to create or read/write generic block_device devices by vold, so it should not break anything. It does add an auditallow statement on such accesses so that we can track remaining cases where we need to label such device nodes so that we can ultimately remove this access. Change-Id: Id3bea28f5958086716cd3db055bea309b3b5fa5a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-30 08:37:51 -07:00
type vold_device, dev_type;
SE Android policy.
2012-01-04 09:33:27 -08:00
type console_device, dev_type;
type cpuctl_device, dev_type;
Label /dev/fscklogs and allow system_server access to it. Otherwise you get denials such as: type=1400 audit(1383590310.430:623): avc: denied { getattr } for pid=1629 comm="Thread-78" path="/dev/fscklogs/log" dev="tmpfs" ino=1642 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=file type=1400 audit(1383590310.430:624): avc: denied { open } for pid=1629 comm="Thread-78" name="log" dev="tmpfs" ino=1642 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=file type=1400 audit(1383590310.430:625): avc: denied { write } for pid=1629 comm="Thread-78" name="fscklogs" dev="tmpfs" ino=1628 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=dir type=1400 audit(1383590310.430:625): avc: denied { remove_name } for pid=1629 comm="Thread-78" name="log" dev="tmpfs" ino=1642 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=dir type=1400 audit(1383590310.430:625): avc: denied { unlink } for pid=1629 comm="Thread-78" name="log" dev="tmpfs" ino=1642 scontext=u:r:system_server:s0 tcontext=u:object_r:device:s0 tclass=file Change-Id: Ia7ae06a6d4cc5d2a59b8b85a5fb93cc31074fd37 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-11-04 06:47:29 -08:00
type fscklogs, dev_type;
SE Android policy.
2012-01-04 09:33:27 -08:00
type full_device, dev_type;
Move gpu_device type and rules to core policy. Change-Id: I3ce0b4bd25e078698a1c50242aaed414bf5cb517 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-12 06:09:53 -08:00
# GPU (used by most UI apps)
type gpu_device, dev_type, mlstrustedobject;
SE Android policy.
2012-01-04 09:33:27 -08:00
type graphics_device, dev_type;
Restrict access to /dev/hw_random to system_server and init. /dev/hw_random is accessed only by init and by EntropyMixer (which runs inside system_server). Other domains are denied access because apps/services should be obtaining randomness from the Linux RNG. Change-Id: Ifde851004301ffd41b2189151a64a0c5989c630f
2013-10-03 13:35:56 -07:00
type hw_random_device, dev_type;
SE Android policy.
2012-01-04 09:33:27 -08:00
type input_device, dev_type;
type kmem_device, dev_type;
type log_device, dev_type, mlstrustedobject;
type mtd_device, dev_type;
Further policy for Motorola Xoom.
2012-01-06 07:25:53 -08:00
type mtp_device, dev_type, mlstrustedobject;
SE Android policy.
2012-01-04 09:33:27 -08:00
type nfc_device, dev_type;
type ptmx_device, dev_type, mlstrustedobject;
type kmsg_device, dev_type;
type null_device, dev_type, mlstrustedobject;
More MLS trusted subject/object annotations. dumpstate and lmkd need to act on apps running at any level. Various file types need to be writable by apps running at any level. Change-Id: Idf574d96ba961cc110a48d0a00d30807df6777ba Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-11 12:51:28 -07:00
type random_device, dev_type, mlstrustedobject;
Various policy updates. Assortment of policy changes include: * Bluetooth domain to talk to init and procfs. * New device node domains. * Allow zygote to talk to its executable. * Update system domain access to new device node domains. * Create a post-process sepolicy with dontaudits removed. * Allow rild to use the tty device. Change-Id: Ibb96b590d0035b8f6d1606cd5e4393c174d10ffb Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2013-03-27 03:30:25 -07:00
type sensors_device, dev_type;
SE Android policy.
2012-01-04 09:33:27 -08:00
type serial_device, dev_type;
type socket_device, dev_type;
run-as policy fixes. - Remove dac_read_search as it is no longer required by run-as. - Introduce a separate type for /dev/tty so that we can allow use of own tty for for a run-as shell without allowing access to other /dev/tty[0-9]* nodes. - Allow sigchld notifications for death of run-as and its descendants by adbd. - Drop redundant rules for executing shell or system commands from untrusted_app; now covered by rules in app.te. Change-Id: Ic3bf7bee9eeabf9ad4a20f61fbb142a64bb37c6c
2013-04-05 11:22:27 -07:00
type owntty_device, dev_type, mlstrustedobject;
SE Android policy.
2012-01-04 09:33:27 -08:00
type tty_device, dev_type;
More MLS trusted subject/object annotations. dumpstate and lmkd need to act on apps running at any level. Various file types need to be writable by apps running at any level. Change-Id: Idf574d96ba961cc110a48d0a00d30807df6777ba Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-11 12:51:28 -07:00
type urandom_device, dev_type, mlstrustedobject;
SE Android policy.
2012-01-04 09:33:27 -08:00
type video_device, dev_type;
type vcs_device, dev_type;
More MLS trusted subject/object annotations. dumpstate and lmkd need to act on apps running at any level. Various file types need to be writable by apps running at any level. Change-Id: Idf574d96ba961cc110a48d0a00d30807df6777ba Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-11 12:51:28 -07:00
type zero_device, dev_type, mlstrustedobject;
sdcard policy and fuse device label.
2012-05-31 06:44:51 -07:00
type fuse_device, dev_type;
Introduce security labels for 2 new device nodes. iio: Industrial I/O subsystem usb_accessory: accessory protocol for usb Allow system access in both cases. Change-Id: I02db9775ec2ddaaeda40fae6d5e56e320957b09c Signed-off-by: Robert Craig <rpcraig@tycho.ncsc.mil>
2013-01-30 10:17:14 -08:00
type iio_device, dev_type;
Make ion_device mls trusted. Allow device node access irrespective of MLS restrictions. Third party apps (untrusted_app) domains need access too. Change-Id: I132b8201bccb1ff31dc0c15a735f81f645c9836d
2012-12-07 03:11:14 -08:00
type ion_device, dev_type, mlstrustedobject;
Corrected denials for LocationManager when accessing gps over uart.
2012-07-10 14:36:22 -07:00
type gps_device, dev_type;
Target the denials/policies over qtaguid file and device: 1. Relabel /proc/net/xt_qtaguid/ctrl from "qtaguid" to "qtaguid_proc"; 2. Label /dev/xt_qtaguid with "qtaguid_device"; 3. Allow mediaserver read/[write] to qtaguid_proc and qtaguid_device; 4. Allow media apps read/[write] to qtaguid_proc and qtaguid_device; 5. Allow system read/[write] to qtaguid_proc and qtaguid_device. Actually, some of policies related to qtaguid have been there already, but we refind existing ones and add new ones.
2012-07-19 11:07:04 -07:00
type qtaguid_device, dev_type;
watchdog security policy. Initial policy for software watchdog daemon which is started by init. Change-Id: I042a5b1698bf53ce2e50ea06851c374e5123ee2c Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2012-12-03 03:07:45 -08:00
type watchdog_device, dev_type;
racoon policy. Initial policy for racoon (IKE key management). Signed-off-by: Robert Craig <rpcraig@tycho.ncsc.mil> Change-Id: If1e344f39ea914e42afbaa021b272ba1b7113479
2013-01-07 06:21:18 -08:00
type uhid_device, dev_type;
Label /dev/uio[0-9]* with its own type. Change-Id: Ibeeec6637022ee8bc9868e102b3d55e3b0d4762c Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-03-26 12:37:54 -07:00
type uio_device, dev_type;
racoon policy. Initial policy for racoon (IKE key management). Signed-off-by: Robert Craig <rpcraig@tycho.ncsc.mil> Change-Id: If1e344f39ea914e42afbaa021b272ba1b7113479
2013-01-07 06:21:18 -08:00
type tun_device, dev_type, mlstrustedobject;
More MLS trusted subject/object annotations. dumpstate and lmkd need to act on apps running at any level. Various file types need to be writable by apps running at any level. Change-Id: Idf574d96ba961cc110a48d0a00d30807df6777ba Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-11 12:51:28 -07:00
type usbaccessory_device, dev_type, mlstrustedobject;
type usb_device, dev_type, mlstrustedobject;
SELinux policy for users of libcutils klog_write. klog_write/init create /dev/__kmsg__ backed by a kernel character device, keep the file descriptor, and then immediately unlink the file. Change-Id: I729d224347a003eaca29299d216a53c99cc3197c
2013-05-09 12:39:32 -07:00
type klog_device, dev_type;
Add policy for __properties__ device. Change-Id: Ie9b391283362fb6930f1ae858f0a879835c91e32
2013-02-28 17:33:16 -08:00
type properties_device, dev_type;
Policy for hci_attach service.
2012-05-31 06:40:12 -07:00
# All devices have a uart for the hci
# attach service. The uart dev node
# varies per device. This type
# is used in per device policy
type hci_attach_dev, dev_type;
Correct denies of rpmsg device when accessing to remote processors.
2012-07-11 11:21:05 -07:00
Various policy updates. Assortment of policy changes include: * Bluetooth domain to talk to init and procfs. * New device node domains. * Allow zygote to talk to its executable. * Update system domain access to new device node domains. * Create a post-process sepolicy with dontaudits removed. * Allow rild to use the tty device. Change-Id: Ibb96b590d0035b8f6d1606cd5e4393c174d10ffb Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2013-03-27 03:30:25 -07:00
# All devices have a rpmsg device for
Correct denies of rpmsg device when accessing to remote processors.
2012-07-11 11:21:05 -07:00
# achieving remoteproc and rpmsg modules
type rpmsg_device, dev_type;
Create a label for the root block device. Change-Id: If4de8d3515727c0b2f95c88c1125410d9894a9ba Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
2014-02-19 17:16:13 -08:00
# Partition layout block device
type root_block_device, dev_type;
Typedef+rules for SysSer to access persistent block device Defines new device type persistent_data_block_device This block device will allow storage of data that will live across factory resets. Gives rw and search access to SystemServer. Change-Id: I298eb40f9a04c16e90dcc1ad32d240ca84df3b1e
2014-07-09 15:18:32 -07:00
Add support for factory reset protection. Address the following denials: <12>[ 417.732129] type=1400 audit(365340.189:47): avc: denied { read } for pid=1737 comm="Binder_2" name="mmcblk0p18" dev="tmpfs" ino=12406 scontext=u:r:system_server:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=0 <12>[ 417.882126] type=1400 audit(365340.339:48): avc: denied { read } for pid=1737 comm="Binder_2" name="mmcblk0p18" dev="tmpfs" ino=12406 scontext=u:r:system_server:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=0 (cherrypick of commit 47bd7300a522fb9c7e233b6d040533ad16708a0e) Bug: 16710840 Change-Id: I8cb5b4b17dffe14f0bf05d63eb8f6ab8d5c09f53
2014-09-08 13:11:01 -07:00
# factory reset protection block device
type frp_block_device, dev_type;
Define types for userdata and cache block devices. Introduce separate types for the userdata and cache block devices so that we can assign them and allow access to them in device-specific policy without allowing access to any other block device (e.g. system). These types will only be used if assigned to device node paths in the device-specific file_contexts configuration. Otherwise, this change will have no impact - the userdata and cache block devices will continue to default to block_device type. To avoid breakage when these new types are assigned to the userdata block device, allow access by vold and uncrypt, but auditallow these accesses to confirm that these are required. Change-Id: I99d24f06506f51ebf1d186d9c393b3cad60e98d7 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-11 05:50:04 -07:00
Define specific block device types for system and recovery partitions. Define a specific block device type for system so that we can prevent raw writes to the system partition by anything other than recovery. Define a specific block device type for recovery so that we can prevent raw writes to the recovery partition by anything other than install_recovery or recovery. These types must be assigned to specific block device nodes via device-specific policy. This change merely defines the types, adds allow rules so that nothing will break when the types are assigned, and adds neverallow rules to prevent adding further allow rules on these types. This change does not remove access to the generic block_device type from any domain so nothing should break even on devices without these type assignments. Change-Id: Ie9c1f6d632f6e9e8cbba106f07f6b1979d2a3c4a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-30 09:53:12 -07:00
# System block device mounted on /system.
type system_block_device, dev_type;
# Recovery block device.
type recovery_block_device, dev_type;
Create boot_block_device and allow install_recovery read access The install_recovery script creates a new recovery image based off of the boot image plus a patch on /system. We need to allow read access to the boot image to allow the patching to succeed, otherwise OTAs are broken. Addresses the following denial: type=1400 audit(9109404.519:6): avc: denied { read } for pid=341 comm="applypatch" name="mmcblk0p37" dev="tmpfs" ino=9186 scontext=u:r:install_recovery:s0 tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=0 TODO: Add device specific labels for the boot image. Bug: 19534538 Change-Id: Ic811ec03e235df3b1bfca9b0a65e23307cd968aa
2015-02-27 17:39:09 -08:00
# boot block device.
type boot_block_device, dev_type;
Define types for userdata and cache block devices. Introduce separate types for the userdata and cache block devices so that we can assign them and allow access to them in device-specific policy without allowing access to any other block device (e.g. system). These types will only be used if assigned to device node paths in the device-specific file_contexts configuration. Otherwise, this change will have no impact - the userdata and cache block devices will continue to default to block_device type. To avoid breakage when these new types are assigned to the userdata block device, allow access by vold and uncrypt, but auditallow these accesses to confirm that these are required. Change-Id: I99d24f06506f51ebf1d186d9c393b3cad60e98d7 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-11 05:50:04 -07:00
# Userdata block device mounted on /data.
type userdata_block_device, dev_type;
# Cache block device mounted on /cache.
type cache_block_device, dev_type;
Do not allow init to execute anything without changing domains. Remove the ability of init to execute programs from / or /system without changing domains. This forces all helper programs and services invoked by init to be assigned their own domain. Introduce separate domains for running the helper programs executed from the fs_mgr library by init. This requires a domain for e2fsck (named fsck for generality) and a domain for running mkswap (named toolbox since mkswap is just a symlink to the toolbox binary and the domain transition occurs on executing the binary, not based on the symlink in any way). e2fsck is invoked on any partitions marked with the check mount option in the fstab file, typically userdata and cache but never system. We allow it to read/write the userdata_block_device and cache_block_device types but also allow it to read/write the default block_device type until we can get the more specific types assigned in all of the device-specific policies. mkswap is invoked on any swap partition defined in the fstab file. We introduce a new swap_block_device type for this purpose, to be assigned to any such block devices in the device-specific policies, and only allow it to read/write such block devices. As there seem to be no devices in AOSP with swap partitions in their fstab files, this does not appear to risk any breakage for existing devices. With the introduction of these domains, we can de-privilege init to only having read access to block devices for mounting filesystems; it no longer needs direct write access to such devices AFAICT. To avoid breaking execution of toolbox by system services, apps, or the shell, we allow all domains other than kernel and init the ability to run toolbox in their own domain. This is broader than strictly required; we could alternatively only add it to those domains that already had x_file_perms to system_file but this would require a coordinated change with device-specific policy. Change-Id: Ib05de2d2bc2781dad48b70ba385577cb855708e4 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-23 06:11:30 -07:00
# Block device for any swap partition.
type swap_block_device, dev_type;
Label block devices created or accessed by vold with specific types. Assign a more specific type than block_device to all block devices created or accessed by vold. Allow vold to set the context on the device nodes it creates. vold can create extra loop devices (/dev/block/loopN) and block devices for volumes it manages (/dev/block/vold/M:N). vold can read/write device mapper block devices (/dev/block/dm-N) created for encrypted volumes. vold can read/write metadata partitions used to store encryption metadata. The metadata_block_device type should be assigned in device-specific policy to the partition specified by the encryptable= mount option for the userata entry in the fstab.<board> file. This change does not remove the ability to create or read/write generic block_device devices by vold, so it should not break anything. It does add an auditallow statement on such accesses so that we can track remaining cases where we need to label such device nodes so that we can ultimately remove this access. Change-Id: Id3bea28f5958086716cd3db055bea309b3b5fa5a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2014-09-30 08:37:51 -07:00
# Metadata block device used for encryption metadata.
# Assign this type to the partition specified by the encryptable=
# mount option in your fstab file in the entry for userdata.
type metadata_block_device, dev_type;
Reference in New Issue Copy Permalink