2014-01-13 06:45:45 -08:00
|
|
|
# recovery console (used in recovery init.rc for /sbin/recovery)
|
2014-05-29 13:40:15 -07:00
|
|
|
|
|
|
|
# Declare the domain unconditionally so we can always reference it
|
|
|
|
# in neverallow rules.
|
2014-01-13 06:45:45 -08:00
|
|
|
type recovery, domain;
|
|
|
|
|
2014-05-29 13:40:15 -07:00
|
|
|
# But the allow rules are only included in the recovery policy.
|
|
|
|
# Otherwise recovery is only allowed the domain rules.
|
|
|
|
recovery_only(`
|
2014-06-19 09:15:22 -07:00
|
|
|
allow recovery self:capability { chown dac_override fowner fsetid setfcap setuid setgid sys_admin sys_tty_config };
|
2014-06-03 16:16:21 -07:00
|
|
|
|
2014-05-29 13:40:15 -07:00
|
|
|
# Set security contexts on files that are not known to the loaded policy.
|
|
|
|
allow recovery self:capability2 mac_admin;
|
2014-01-30 10:23:08 -08:00
|
|
|
|
2014-06-19 06:07:17 -07:00
|
|
|
# Run helpers from / or /system without changing domain.
|
|
|
|
allow recovery rootfs:file execute_no_trans;
|
|
|
|
allow recovery system_file:file execute_no_trans;
|
|
|
|
|
2014-05-29 13:40:15 -07:00
|
|
|
# Mount filesystems.
|
2014-06-03 16:16:21 -07:00
|
|
|
allow recovery rootfs:dir mounton;
|
2014-06-16 10:05:38 -07:00
|
|
|
allow recovery fs_type:filesystem ~relabelto;
|
|
|
|
allow recovery unlabeled:filesystem ~relabelto;
|
|
|
|
allow recovery contextmount_type:filesystem relabelto;
|
2014-01-13 06:45:45 -08:00
|
|
|
|
2014-06-04 23:43:03 -07:00
|
|
|
# Create and relabel files and directories under /system.
|
|
|
|
allow recovery exec_type:{ file lnk_file } { create_file_perms relabelfrom relabelto };
|
|
|
|
allow recovery system_file:{ file lnk_file } { create_file_perms relabelfrom relabelto };
|
|
|
|
allow recovery system_file:dir { create_dir_perms relabelfrom relabelto };
|
|
|
|
|
2014-07-07 13:19:24 -07:00
|
|
|
# We may be asked to set an SELinux label for a type not known to the
|
|
|
|
# currently loaded policy. Allow it.
|
2014-10-23 12:12:58 -07:00
|
|
|
allow recovery unlabeled:{ file lnk_file } { create_file_perms relabelfrom relabelto };
|
2014-07-07 13:19:24 -07:00
|
|
|
allow recovery unlabeled:dir { create_dir_perms relabelfrom relabelto };
|
|
|
|
|
recovery: Allow exec_type on dirs, read for /dev
When applying a file based OTA, the recovery scripts sometimes
transiently label a directory as an exec_type. This occurs on
hammerhead when the OTA generation scripts generate lines of the
form:
set_metadata_recursive("/system/vendor/bin", "uid", 0, "gid", 2000, "dmode", 0755, "fmode", 0755, "capabilities", 0x0, "selabel", "u:object_r:vss_exec:s0");
set_metadata("/system/vendor/bin", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:system_file:s0");
which has the effect of transiently labeling the /system/vendor/bin
directory as vss_exec.
Allow this behavior for now, even though it's obviously a bug.
Also, allow recovery to read through the /dev directory.
Addresses the following denials:
avc: denied { read } for pid=143 comm="recovery" name="/" dev="tmpfs" ino=8252 scontext=u:r:recovery:s0 tcontext=u:object_r:device:s0 tclass=dir
avc: denied { open } for pid=143 comm="recovery" name="/" dev="tmpfs" ino=8252 scontext=u:r:recovery:s0 tcontext=u:object_r:device:s0 tclass=dir
avc: denied { relabelto } for pid=142 comm="update_binary" name="bin" dev="mmcblk0p25" ino=1438 scontext=u:r:recovery:s0 tcontext=u:object_r:vss_exec:s0 tclass=dir
avc: denied { getattr } for pid=142 comm="update_binary" path="/system/vendor/bin" dev="mmcblk0p25" ino=1438 scontext=u:r:recovery:s0 tcontext=u:object_r:vss_exec:s0 tclass=dir
avc: denied { setattr } for pid=142 comm="update_binary" name="bin" dev="mmcblk0p25" ino=1438 scontext=u:r:recovery:s0 tcontext=u:object_r:vss_exec:s0 tclass=dir
avc: denied { relabelfrom } for pid=142 comm="update_binary" name="bin" dev="mmcblk0p25" ino=1438 scontext=u:r:recovery:s0 tcontext=u:object_r:vss_exec:s0 tclass=dir
Bug: 15575013
Change-Id: I743bea356382d3c23c136465dc5b434878370127
2014-06-15 09:40:12 -07:00
|
|
|
# 0eb17d944704b3eb140bb9dded299d3be3aed77e in build/ added SELinux
|
|
|
|
# support to OTAs. However, that code has a bug. When an update occurs,
|
|
|
|
# some directories are inappropriately labeled as exec_type. This is
|
|
|
|
# only transient, and subsequent steps in the OTA script correct this
|
2015-03-05 14:58:30 -08:00
|
|
|
# mistake. New devices are moving to block based OTAs, so this is not
|
|
|
|
# worth fixing. b/15575013
|
recovery: Allow exec_type on dirs, read for /dev
When applying a file based OTA, the recovery scripts sometimes
transiently label a directory as an exec_type. This occurs on
hammerhead when the OTA generation scripts generate lines of the
form:
set_metadata_recursive("/system/vendor/bin", "uid", 0, "gid", 2000, "dmode", 0755, "fmode", 0755, "capabilities", 0x0, "selabel", "u:object_r:vss_exec:s0");
set_metadata("/system/vendor/bin", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:system_file:s0");
which has the effect of transiently labeling the /system/vendor/bin
directory as vss_exec.
Allow this behavior for now, even though it's obviously a bug.
Also, allow recovery to read through the /dev directory.
Addresses the following denials:
avc: denied { read } for pid=143 comm="recovery" name="/" dev="tmpfs" ino=8252 scontext=u:r:recovery:s0 tcontext=u:object_r:device:s0 tclass=dir
avc: denied { open } for pid=143 comm="recovery" name="/" dev="tmpfs" ino=8252 scontext=u:r:recovery:s0 tcontext=u:object_r:device:s0 tclass=dir
avc: denied { relabelto } for pid=142 comm="update_binary" name="bin" dev="mmcblk0p25" ino=1438 scontext=u:r:recovery:s0 tcontext=u:object_r:vss_exec:s0 tclass=dir
avc: denied { getattr } for pid=142 comm="update_binary" path="/system/vendor/bin" dev="mmcblk0p25" ino=1438 scontext=u:r:recovery:s0 tcontext=u:object_r:vss_exec:s0 tclass=dir
avc: denied { setattr } for pid=142 comm="update_binary" name="bin" dev="mmcblk0p25" ino=1438 scontext=u:r:recovery:s0 tcontext=u:object_r:vss_exec:s0 tclass=dir
avc: denied { relabelfrom } for pid=142 comm="update_binary" name="bin" dev="mmcblk0p25" ino=1438 scontext=u:r:recovery:s0 tcontext=u:object_r:vss_exec:s0 tclass=dir
Bug: 15575013
Change-Id: I743bea356382d3c23c136465dc5b434878370127
2014-06-15 09:40:12 -07:00
|
|
|
allow recovery exec_type:dir { create_dir_perms relabelfrom relabelto };
|
|
|
|
|
2014-06-04 23:43:03 -07:00
|
|
|
# Write to /proc/sys/vm/drop_caches
|
|
|
|
# TODO: create more specific label?
|
|
|
|
allow recovery proc:file w_file_perms;
|
2014-05-29 11:35:55 -07:00
|
|
|
|
2014-06-19 09:15:22 -07:00
|
|
|
# Write to /sys/class/android_usb/android0/enable.
|
|
|
|
# TODO: create more specific label?
|
|
|
|
allow recovery sysfs:file w_file_perms;
|
|
|
|
|
2014-12-09 12:43:26 -08:00
|
|
|
access_kmsg(recovery)
|
|
|
|
|
2014-07-10 13:40:25 -07:00
|
|
|
# Access /dev/android_adb or /dev/usb-ffs/adb/ep0
|
2014-06-19 09:15:22 -07:00
|
|
|
allow recovery adb_device:chr_file rw_file_perms;
|
2014-07-10 13:40:25 -07:00
|
|
|
allow recovery functionfs:dir search;
|
|
|
|
allow recovery functionfs:file rw_file_perms;
|
2014-06-19 09:15:22 -07:00
|
|
|
|
2014-05-29 13:40:15 -07:00
|
|
|
# Required to e.g. wipe userdata/cache.
|
recovery: Allow exec_type on dirs, read for /dev
When applying a file based OTA, the recovery scripts sometimes
transiently label a directory as an exec_type. This occurs on
hammerhead when the OTA generation scripts generate lines of the
form:
set_metadata_recursive("/system/vendor/bin", "uid", 0, "gid", 2000, "dmode", 0755, "fmode", 0755, "capabilities", 0x0, "selabel", "u:object_r:vss_exec:s0");
set_metadata("/system/vendor/bin", "uid", 0, "gid", 2000, "mode", 0755, "capabilities", 0x0, "selabel", "u:object_r:system_file:s0");
which has the effect of transiently labeling the /system/vendor/bin
directory as vss_exec.
Allow this behavior for now, even though it's obviously a bug.
Also, allow recovery to read through the /dev directory.
Addresses the following denials:
avc: denied { read } for pid=143 comm="recovery" name="/" dev="tmpfs" ino=8252 scontext=u:r:recovery:s0 tcontext=u:object_r:device:s0 tclass=dir
avc: denied { open } for pid=143 comm="recovery" name="/" dev="tmpfs" ino=8252 scontext=u:r:recovery:s0 tcontext=u:object_r:device:s0 tclass=dir
avc: denied { relabelto } for pid=142 comm="update_binary" name="bin" dev="mmcblk0p25" ino=1438 scontext=u:r:recovery:s0 tcontext=u:object_r:vss_exec:s0 tclass=dir
avc: denied { getattr } for pid=142 comm="update_binary" path="/system/vendor/bin" dev="mmcblk0p25" ino=1438 scontext=u:r:recovery:s0 tcontext=u:object_r:vss_exec:s0 tclass=dir
avc: denied { setattr } for pid=142 comm="update_binary" name="bin" dev="mmcblk0p25" ino=1438 scontext=u:r:recovery:s0 tcontext=u:object_r:vss_exec:s0 tclass=dir
avc: denied { relabelfrom } for pid=142 comm="update_binary" name="bin" dev="mmcblk0p25" ino=1438 scontext=u:r:recovery:s0 tcontext=u:object_r:vss_exec:s0 tclass=dir
Bug: 15575013
Change-Id: I743bea356382d3c23c136465dc5b434878370127
2014-06-15 09:40:12 -07:00
|
|
|
allow recovery device:dir r_dir_perms;
|
2014-06-03 16:16:21 -07:00
|
|
|
allow recovery block_device:dir r_dir_perms;
|
2014-05-29 13:40:15 -07:00
|
|
|
allow recovery dev_type:blk_file rw_file_perms;
|
2014-05-20 11:09:16 -07:00
|
|
|
|
2014-05-29 13:40:15 -07:00
|
|
|
# GUI
|
|
|
|
allow recovery self:process execmem;
|
|
|
|
allow recovery ashmem_device:chr_file execute;
|
2014-06-03 16:16:21 -07:00
|
|
|
allow recovery graphics_device:chr_file rw_file_perms;
|
|
|
|
allow recovery graphics_device:dir r_dir_perms;
|
|
|
|
allow recovery input_device:dir r_dir_perms;
|
|
|
|
allow recovery input_device:chr_file r_file_perms;
|
2014-06-07 11:48:35 -07:00
|
|
|
allow recovery tty_device:chr_file rw_file_perms;
|
2014-06-03 16:16:21 -07:00
|
|
|
|
|
|
|
# Create /tmp/recovery.log and execute /tmp/update_binary.
|
|
|
|
allow recovery tmpfs:file { create_file_perms x_file_perms };
|
|
|
|
allow recovery tmpfs:dir create_dir_perms;
|
2014-02-11 11:40:14 -08:00
|
|
|
|
2014-06-03 16:16:21 -07:00
|
|
|
# Manage files on /cache
|
|
|
|
allow recovery cache_file:dir create_dir_perms;
|
|
|
|
allow recovery cache_file:file create_file_perms;
|
|
|
|
|
|
|
|
# Reboot the device
|
2015-05-04 18:22:45 -07:00
|
|
|
set_prop(recovery, powerctl_prop)
|
2014-05-23 08:26:19 -07:00
|
|
|
|
2014-06-19 07:27:02 -07:00
|
|
|
# Start/stop adbd via ctl.start adbd
|
2015-05-04 18:22:45 -07:00
|
|
|
set_prop(recovery, ctl_default_prop)
|
2014-06-19 07:27:02 -07:00
|
|
|
|
2014-05-29 13:40:15 -07:00
|
|
|
# Use setfscreatecon() to label files for OTA updates.
|
|
|
|
allow recovery self:process setfscreate;
|
2014-06-03 16:16:21 -07:00
|
|
|
|
2014-07-08 11:45:09 -07:00
|
|
|
# Allow recovery to create a fuse filesystem, and read files from it.
|
2014-07-02 10:28:20 -07:00
|
|
|
allow recovery fuse_device:chr_file rw_file_perms;
|
2014-07-08 11:45:09 -07:00
|
|
|
allow recovery fuse:dir r_dir_perms;
|
|
|
|
allow recovery fuse:file r_file_perms;
|
2014-07-02 10:28:20 -07:00
|
|
|
|
2014-06-03 16:16:21 -07:00
|
|
|
wakelock_use(recovery)
|
2014-06-07 11:48:35 -07:00
|
|
|
|
2014-06-09 20:35:51 -07:00
|
|
|
# This line seems suspect, as it should not really need to
|
2014-06-07 11:48:35 -07:00
|
|
|
# set scheduling parameters for a kernel domain task.
|
2014-06-03 16:16:21 -07:00
|
|
|
allow recovery kernel:process setsched;
|
2014-05-29 13:40:15 -07:00
|
|
|
')
|
2014-11-05 15:30:41 -08:00
|
|
|
|
|
|
|
###
|
|
|
|
### neverallow rules
|
|
|
|
###
|
|
|
|
|
|
|
|
# Recovery should never touch /data.
|
|
|
|
#
|
|
|
|
# In particular, if /data is encrypted, it is not accessible
|
|
|
|
# to recovery anyway.
|
|
|
|
#
|
|
|
|
# For now, we only enforce write/execute restrictions, as domain.te
|
|
|
|
# contains a number of read-only rules that apply to all
|
|
|
|
# domains, including recovery.
|
|
|
|
#
|
|
|
|
# TODO: tighten this up further.
|
|
|
|
neverallow recovery data_file_type:file { no_w_file_perms no_x_file_perms };
|
|
|
|
neverallow recovery data_file_type:dir no_w_dir_perms;
|