PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7ef01c34ed
android_system_sepolicy/public/healthd.te

57 lines
1.7 KiB
Plaintext
Raw Normal View History

healthd: create SEPolicy for 'charger' and reduce healthd's scope healthd is being split into 'charger' and 'healthd' processes, that will never run together. 'charger' is to be run only in charge-only and recovery, while healthd runs with Android. While they both share much of battery monitoring code, they both now have reduced scope. E.g. 'charger', doesn't need to use binder anymore and healthd doesn't need to do charging ui animation. So, amend the SEPolicy for healthd to reduce it's scope and add a new one for charger. Test: Tested all modes {recovery, charger-only, android} with new policy Change-Id: If7f81875c605f7f07da4d23a313f308b9dde9ce8 Signed-off-by: Sandeep Patil <sspatil@google.com> (cherry picked from commit c73d0022ade4855ab72849e1fe97856c737fdcef)
2016-11-01 13:49:10 -07:00
# healthd - battery/charger monitoring service daemon
type healthd, domain;
Introduce system_file_type system_file_type is a new attribute used to identify files which exist on the /system partition. It's useful for allow rules in init, which are based off of a blacklist of writable files. Additionally, it's useful for constructing neverallow rules to prevent regressions. Additionally, add commented out tests which enforce that all files on the /system partition have the system_file_type attribute. These tests will be uncommented in a future change after all the device-specific policies are cleaned up. Test: Device boots and no obvious problems. Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
2018-09-27 10:21:37 -07:00
type healthd_exec, system_file_type, exec_type, file_type;
healthd: add sepolicy Change-Id: Ic0351c69d67aa3a6f71f505408c53d642626ebb4
2013-06-03 14:09:54 -07:00
Allow /dev/klog access, drop mknod and __null__ access Allow vold, healthd, slideshow, and watchdogd access to /dev/kmsg. These processes log to the kernel dmesg ring buffer, so they need write access to that file. Addresses the following denials: avc: denied { write } for pid=134 comm="watchdogd" name="kmsg" dev="tmpfs" ino=9248 scontext=u:r:watchdogd:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0 avc: denied { write } for pid=166 comm="healthd" name="kmsg" dev="tmpfs" ino=9248 scontext=u:r:healthd:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0 avc: denied { write } for pid=180 comm="vold" name="kmsg" dev="tmpfs" ino=9248 scontext=u:r:vold:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0 These denials were triggered by the change in https://android-review.googlesource.com/151209 . Prior to that change, any code which called klog_init would (unnecessarily) create the device node themselves, rather than using the already existing device node. Drop special /dev/__null__ handling from watchdogd. As of https://android-review.googlesource.com/148288 , watchdogd no longer creates it's own /dev/null device, so it's unnecessary for us to allow for it. Drop mknod from healthd, slideshow, and watchdogd. healthd and slideshow only needed mknod to create /dev/__kmsg__, which is now obsolete. watchdogd only needed mknod to create /dev/__kmsg__ and /dev/__null__, which again is now obsolete. Bug: 21242418 Change-Id: If01c8001084575e7441253f0fa8b4179ae33f534
2015-06-06 07:42:37 -07:00
# Write to /dev/kmsg
allow healthd kmsg_device:chr_file rw_file_perms;
healthd: add sepolicy Change-Id: Ic0351c69d67aa3a6f71f505408c53d642626ebb4
2013-06-03 14:09:54 -07:00
healthd: grant perms from domain_deprecated In preparation of removing permissions from domain_deprecated. Addresses: avc: denied { read } for name="present" dev="sysfs" ino=5003 scontext=u:r:healthd:s0 tcontext=u:object_r:sysfs:s0 tclass=file avc: denied { open } for path="/sys/devices/platform/htc_battery_max17050.8/power_supply/flounder-battery/present" dev="sysfs" ino=5003 scontext=u:r:healthd:s0 tcontext=u:object_r:sysfs:s0 tclass=file Change-Id: Iaee5b79a45aedad98e08c670addbf444c984165e
2016-01-27 11:19:34 -08:00
# Read access to pseudo filesystems.
Remove access to 'sysfs' files from healtd and charger. We rely on vendors to label all dependencies of healthd/charger under /sys/class/power_supply with sysfs_batteryinfo type. Bug: 65643247 Bug: 32659667 Test: boots without denials from healthd, to sysfs_batteryinfo or to sysfs_msm_subsys. Test: charging with device turned off works without /sys denials. Change-Id: I893f309ecad8a0caf7d0b81f5f945725907255c2
2017-10-16 15:54:49 -07:00
allow healthd sysfs_type:dir search;
Fix aosp healthd. We only need this change for aosp devices. Internal sepolicy for healthd domain is different and does not need this. Addresses this denial: avc: denied { open } for path="/sys/class/power_supply" dev="sysfs" ino=25340 scontext=u:r:healthd:s0 tcontext=u:object_r:sysfs:s0 tclass=dir permissive=1 Test: $OUT/vendor/etc/selinux/precompiled_sepolicy contains the new permission. Change-Id: Ie47c231af800026fd9d8a1f752253bb338768c13
2018-03-27 15:05:03 -07:00
# Allow to read /sys/class/power_supply directory.
allow healthd sysfs:dir r_dir_perms;
audit domain_deprecated perms for removal Grant permissions observed. Bug: 28760354 Change-Id: Ie63cda709319bbf635ef7bffbba3477c2cccc11b
2016-09-09 16:27:17 -07:00
r_dir_file(healthd, rootfs)
healthd: create SEPolicy for 'charger' and reduce healthd's scope healthd is being split into 'charger' and 'healthd' processes, that will never run together. 'charger' is to be run only in charge-only and recovery, while healthd runs with Android. While they both share much of battery monitoring code, they both now have reduced scope. E.g. 'charger', doesn't need to use binder anymore and healthd doesn't need to do charging ui animation. So, amend the SEPolicy for healthd to reduce it's scope and add a new one for charger. Test: Tested all modes {recovery, charger-only, android} with new policy Change-Id: If7f81875c605f7f07da4d23a313f308b9dde9ce8 Signed-off-by: Sandeep Patil <sspatil@google.com> (cherry picked from commit c73d0022ade4855ab72849e1fe97856c737fdcef)
2016-11-01 13:49:10 -07:00
r_dir_file(healthd, cgroup)
healthd: grant perms from domain_deprecated In preparation of removing permissions from domain_deprecated. Addresses: avc: denied { read } for name="present" dev="sysfs" ino=5003 scontext=u:r:healthd:s0 tcontext=u:object_r:sysfs:s0 tclass=file avc: denied { open } for path="/sys/devices/platform/htc_battery_max17050.8/power_supply/flounder-battery/present" dev="sysfs" ino=5003 scontext=u:r:healthd:s0 tcontext=u:object_r:sysfs:s0 tclass=file Change-Id: Iaee5b79a45aedad98e08c670addbf444c984165e
2016-01-27 11:19:34 -08:00
sepolicy: Add rules for non-init namespaces In kernel 4.7, the capability and capability2 classes were split apart from cap_userns and cap2_userns (see kernel commit 8e4ff6f228e4722cac74db716e308d1da33d744f). Since then, Android cannot be run in a container with SELinux in enforcing mode. This change applies the existing capability rules to user namespaces as well as the root namespace so that Android running in a container behaves the same on pre- and post-4.7 kernels. This is essentially: 1. New global_capability_class_set and global_capability2_class_set that match capability+cap_userns and capability2+cap2_userns, respectively. 2. s/self:capability/self:global_capability_class_set/g 3. s/self:capability2/self:global_capability2_class_set/g 4. Add cap_userns and cap2_userns to the existing capability_class_set so that it covers all capabilities. This set was used by several neverallow and dontaudit rules, and I confirmed that the new classes are still appropriate. Test: diff new policy against old and confirm that all new rules add only cap_userns or cap2_userns; Boot ARC++ on a device with the 4.12 kernel. Bug: crbug.com/754831 Change-Id: I4007eb3a2ecd01b062c4c78d9afee71c530df95f
2017-11-09 14:51:26 -08:00
allow healthd self:global_capability_class_set { sys_tty_config };
allow healthd self:global_capability_class_set sys_boot;
healthd: create SEPolicy for 'charger' and reduce healthd's scope healthd is being split into 'charger' and 'healthd' processes, that will never run together. 'charger' is to be run only in charge-only and recovery, while healthd runs with Android. While they both share much of battery monitoring code, they both now have reduced scope. E.g. 'charger', doesn't need to use binder anymore and healthd doesn't need to do charging ui animation. So, amend the SEPolicy for healthd to reduce it's scope and add a new one for charger. Test: Tested all modes {recovery, charger-only, android} with new policy Change-Id: If7f81875c605f7f07da4d23a313f308b9dde9ce8 Signed-off-by: Sandeep Patil <sspatil@google.com> (cherry picked from commit c73d0022ade4855ab72849e1fe97856c737fdcef)
2016-11-01 13:49:10 -07:00
Enforce ioctl command whitelisting on all sockets Remove the ioctl permission for most socket types. For others, such as tcp/udp/rawip/unix_dgram/unix_stream set a default unprivileged whitelist that individual domains may extend (except where neverallowed like untrusted_app). Enforce via a neverallowxperm rule. Change-Id: I15548d830f8eff1fd4d64005c5769ca2be8d4ffe
2016-05-16 21:12:17 -07:00
allow healthd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
healthd: create SEPolicy for 'charger' and reduce healthd's scope healthd is being split into 'charger' and 'healthd' processes, that will never run together. 'charger' is to be run only in charge-only and recovery, while healthd runs with Android. While they both share much of battery monitoring code, they both now have reduced scope. E.g. 'charger', doesn't need to use binder anymore and healthd doesn't need to do charging ui animation. So, amend the SEPolicy for healthd to reduce it's scope and add a new one for charger. Test: Tested all modes {recovery, charger-only, android} with new policy Change-Id: If7f81875c605f7f07da4d23a313f308b9dde9ce8 Signed-off-by: Sandeep Patil <sspatil@google.com> (cherry picked from commit c73d0022ade4855ab72849e1fe97856c737fdcef)
2016-11-01 13:49:10 -07:00
healthd: restore healthd sepolicy for charger mode Test: Boot charge-only and android on sailfish Bug: https://b/33672744 Change-Id: I6a25e90a716ec0ca46b5ba5edad860aa0eebafef Signed-off-by: Sandeep Patil <sspatil@google.com> (cherry picked from commit 3b25e384108c20741313fb356ed25e0c515e5b6b)
2016-12-15 12:36:45 -08:00
wakelock_use(healthd)
Annotate most remaining HALs with _client/_server This switches most remaining HALs to the _client/_server approach. To unblock efforts blocked on majority of HALs having to use this model, this change does not remove unnecessary rules from clients of these HALs. That work will be performed in follow-up commits. This commit only adds allow rules and thus does not break existing functionality. The HALs not yet on the _client/_server model after this commit are: * Allocator HAL, because it's non-trivial to declare all apps except isolated apps as clients of this HAL, which they are. * Boot HAL, because it's still on the non-attributized model and I'm waiting for update_engine folks to answer a couple of questions which will let me refactor the policy of this HAL. Test: mmm system/sepolicy Test: Device boots, no new denials Test: Device boots in recovery mode, no new denials Bug: 34170079 Change-Id: I03e6bcec2fa02f14bdf17d11f7367b62c68a14b9
2017-03-16 18:48:40 -07:00
hal_client_domain(healthd, hal_health)
fix healthd charger mode. Healthd has an optional "charger" mode. The device boots into a minimally running mode, and healthd displays the battery indicator. Without this patch, when a manta device boots into charger mode, the screen will never turn off and the battery indicator will not move. From reviewing the healthd code, it looks like this may affect lots of devices, not just manta. I'm adding this change to the generic policy. Steps to reproduce: 1) Make sure the device is unplugged. 2) Boot into a normal system. 3) Shutdown the system normally using the power button. 4) After shutdown, plugin the power cord. 5) Device will boot into charger mode. Battery icon will display. 6) Press the button to reboot into a normal mode. 7) Examine /proc/last_kmsg and look for denials. Addresses the following denials: [ 3.908457] type=1400 audit(1390866386.620:3): avc: denied { read write } for pid=98 comm="charger" name="fb0" dev="tmpfs" ino=4286 scontext=u:r:healthd:s0 tcontext=u:object_r:graphics_device:s0 tclass=chr_file [ 3.909085] type=1400 audit(1390866386.620:4): avc: denied { open } for pid=98 comm="charger" name="fb0" dev="tmpfs" ino=4286 scontext=u:r:healthd:s0 tcontext=u:object_r:graphics_device:s0 tclass=chr_file [ 3.909749] type=1400 audit(1390866386.620:5): avc: denied { ioctl } for pid=98 comm="charger" path="/dev/graphics/fb0" dev="tmpfs" ino=4286 scontext=u:r:healthd:s0 tcontext=u:object_r:graphics_device:s0 tclass=chr_file [ 4.889857] type=1400 audit(1390866387.605:6): avc: denied { read } for pid=98 comm="charger" name="input" dev="tmpfs" ino=4153 scontext=u:r:healthd:s0 tcontext=u:object_r:input_device:s0 tclass=dir [ 4.890873] type=1400 audit(1390866387.605:7): avc: denied { open } for pid=98 comm="charger" name="input" dev="tmpfs" ino=4153 scontext=u:r:healthd:s0 tcontext=u:object_r:input_device:s0 tclass=dir [ 4.891949] type=1400 audit(1390866387.605:8): avc: denied { search } for pid=98 comm="charger" name="input" dev="tmpfs" ino=4153 scontext=u:r:healthd:s0 tcontext=u:object_r:input_device:s0 tclass=dir [ 4.892677] type=1400 audit(1390866387.605:9): avc: denied { read } for pid=98 comm="charger" name="event2" dev="tmpfs" ino=4279 scontext=u:r:healthd:s0 tcontext=u:object_r:input_device:s0 tclass=chr_file [ 4.893576] type=1400 audit(1390866387.605:10): avc: denied { open } for pid=98 comm="charger" name="event2" dev="tmpfs" ino=4279 scontext=u:r:healthd:s0 tcontext=u:object_r:input_device:s0 tclass=chr_file [ 7.288104] type=1400 audit(1390866389.999:12): avc: denied { execmem } for pid=98 comm="charger" scontext=u:r:healthd:s0 tcontext=u:r:healthd:s0 tclass=process [ 7.288574] type=1400 audit(1390866389.999:13): avc: denied { execute } for pid=98 comm="charger" path="/dev/ashmem" dev="tmpfs" ino=4113 scontext=u:r:healthd:s0 tcontext=u:object_r:ashmem_device:s0 tclass=chr_file Change-Id: I0118e08514caa0ad11d2aa7562c9846a96779a21
2014-01-27 16:15:00 -08:00
Remove access to 'sysfs' files from healtd and charger. We rely on vendors to label all dependencies of healthd/charger under /sys/class/power_supply with sysfs_batteryinfo type. Bug: 65643247 Bug: 32659667 Test: boots without denials from healthd, to sysfs_batteryinfo or to sysfs_msm_subsys. Test: charging with device turned off works without /sys denials. Change-Id: I893f309ecad8a0caf7d0b81f5f945725907255c2
2017-10-16 15:54:49 -07:00
# Read/write to /sys/power/state
allow healthd sysfs_power:file rw_file_perms;
healthd: restore healthd sepolicy for charger mode Test: Boot charge-only and android on sailfish Bug: https://b/33672744 Change-Id: I6a25e90a716ec0ca46b5ba5edad860aa0eebafef Signed-off-by: Sandeep Patil <sspatil@google.com> (cherry picked from commit 3b25e384108c20741313fb356ed25e0c515e5b6b)
2016-12-15 12:36:45 -08:00
# TODO: added to match above sysfs rule. Remove me?
allow healthd sysfs_usb:file write;
Remove access to 'sysfs' files from healtd and charger. We rely on vendors to label all dependencies of healthd/charger under /sys/class/power_supply with sysfs_batteryinfo type. Bug: 65643247 Bug: 32659667 Test: boots without denials from healthd, to sysfs_batteryinfo or to sysfs_msm_subsys. Test: charging with device turned off works without /sys denials. Change-Id: I893f309ecad8a0caf7d0b81f5f945725907255c2
2017-10-16 15:54:49 -07:00
r_dir_file(healthd, sysfs_batteryinfo)
healthd: restore healthd sepolicy for charger mode Test: Boot charge-only and android on sailfish Bug: https://b/33672744 Change-Id: I6a25e90a716ec0ca46b5ba5edad860aa0eebafef Signed-off-by: Sandeep Patil <sspatil@google.com> (cherry picked from commit 3b25e384108c20741313fb356ed25e0c515e5b6b)
2016-12-15 12:36:45 -08:00
###
### healthd: charger mode
###
# Read /sys/fs/pstore/console-ramoops
# Don't worry about overly broad permissions for now, as there's
# only one file in /sys/fs/pstore
allow healthd pstorefs:dir r_dir_perms;
allow healthd pstorefs:file r_file_perms;
allow healthd graphics_device:dir r_dir_perms;
allow healthd graphics_device:chr_file rw_file_perms;
allow healthd input_device:dir r_dir_perms;
allow healthd input_device:chr_file r_file_perms;
allow healthd tty_device:chr_file rw_file_perms;
allow healthd ashmem_device:chr_file execute;
allow healthd self:process execmem;
allow healthd proc_sysrq:file rw_file_perms;
# Healthd needs to tell init to continue the boot
# process when running in charger mode.
set_prop(healthd, system_prop)
Whitelist exported platform properties This CL lists all the exported platform properties in private/exported_property_contexts. Additionally accessing core_property_type from vendor components is restricted. Instead public_readable_property_type is used to allow vendor components to read exported platform properties, and accessibility from vendor_init is also specified explicitly. Note that whitelisting would be applied only if PRODUCT_COMPATIBLE_PROPERTY is set on. Bug: 38146102 Test: tested on walleye with PRODUCT_COMPATIBLE_PROPERTY=true Change-Id: I304ba428cc4ca82668fec2ddeb17c971e7ec065e
2017-10-19 00:54:49 -07:00
set_prop(healthd, exported_system_prop)
set_prop(healthd, exported2_system_prop)
set_prop(healthd, exported3_system_prop)
Reference in New Issue Copy Permalink