PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
ff1c765ff2
android_system_sepolicy/public/bootanim.te

43 lines
1.1 KiB
Plaintext
Raw Normal View History

Define a domain for the bootanim service. Leave the domain permissive initially until it gets more testing. Change-Id: I9d88d76d1ffdc79a2eff4545d37a9e615482df50 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-11 12:17:53 -08:00
# bootanimation oneshot service
bootanim: Remove domain_deprecated Remove domain_deprecated from bootanim. This removes some unnecessarily permissive rules. As part of this, re-allow access to cgroups, proc and sysfs, removed as a result of removing domain_deprecated. Bug: 25433265 Change-Id: I58658712666c719c8f5a39fe2076c4f6d166616c
2015-12-02 13:29:20 -08:00
type bootanim, domain;
Define a domain for the bootanim service. Leave the domain permissive initially until it gets more testing. Change-Id: I9d88d76d1ffdc79a2eff4545d37a9e615482df50 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-11 12:17:53 -08:00
type bootanim_exec, exec_type, file_type;
Sync internal master and AOSP sepolicy. Bug: 37916906 Test: Builds 'n' boots. Change-Id: Ia1d86264446ebecc1ca79f32f11354921bc77668 Merged-In: I208ec6a864127a059fb389417a9c6b259d7474cb
2017-09-26 12:58:29 -07:00
hal_client_domain(bootanim, hal_configstore)
Allow hals to read hwservicemanager prop. Test: no relevant denials on marlin while booting Test: no relevant denials on angler while booting Bug: 36278706 Change-Id: Ieba79e1c8fca4f74c63bc63e6dd0bdcf59204ca2
2017-03-22 09:16:49 -07:00
hal_client_domain(bootanim, hal_graphics_allocator)
hal_client_domain(bootanim, hal_graphics_composer)
Define a domain for the bootanim service. Leave the domain permissive initially until it gets more testing. Change-Id: I9d88d76d1ffdc79a2eff4545d37a9e615482df50 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-11 12:17:53 -08:00
binder_use(bootanim)
binder_call(bootanim, surfaceflinger)
Allow audioserver for bootanim. Required for using native audio in BootAnimation Bug: 29055299 Change-Id: Ie75d35219be95a8dc697cc3c0384a4de90ea3478
2016-06-29 14:14:34 -07:00
binder_call(bootanim, audioserver)
Define a domain for the bootanim service. Leave the domain permissive initially until it gets more testing. Change-Id: I9d88d76d1ffdc79a2eff4545d37a9e615482df50 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-11 12:17:53 -08:00
Allow bootanimation to talk to hwservicemanager. Because bootanimation uses the graphics mapper HIDL service (which is always passthrough), it makes a call to hwservicemanager to let it know it has obtained a reference to it. Bug: 35207188 Test: no more denials from bootanim Change-Id: I99ea57a0d7777cb84eeaca26426ea38bf72ee933
2017-02-15 04:38:33 -08:00
hwbinder_use(bootanim)
Define a domain for the bootanim service. Leave the domain permissive initially until it gets more testing. Change-Id: I9d88d76d1ffdc79a2eff4545d37a9e615482df50 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-11 12:17:53 -08:00
allow bootanim gpu_device:chr_file rw_file_perms;
reconcile aosp (3a8c5dc05fb7696dd81b8a7c1b2524224154e8ea) after branching. Please do not merge. Change-Id: Ic8ee83ed6ffef02bddd17e1175416fc2481db7b2
2014-07-14 23:31:31 -07:00
# /oem access
allow bootanim oemfs:dir search;
sepolicy for oem cutomization Added read permissions for bootanimation Bug: 16635599 Change-Id: Ib5d0ba5a6d1144ff831f4f0eda092879f853c376
2014-09-22 13:03:52 -07:00
allow bootanim oemfs:file r_file_perms;
Resync lmp-dev-plus-aosp with master A DO NOT MERGE change merged from lmp-dev to lmp-dev-plus-aosp. This is expected, but it's causing unnecessary merge conflicts when handling AOSP contributions. Resolve those conflicts. This is essentially a revert of bf696327246833c9aba55a645e6c433e9f321e27 for lmp-dev-plus-aosp only. Change-Id: Icc66def7113ab45176ae015f659cb442d53bce5c
2014-07-25 15:19:47 -07:00
Give bootanimation access to /dev/snd files so it can use tinyalsa Bug: 17674304 Change-Id: Ide32833809bca8d3ed8ddc898748e25d7a692319
2014-09-29 06:18:19 -07:00
allow bootanim audio_device:dir r_dir_perms;
allow bootanim audio_device:chr_file rw_file_perms;
resolved conflicts for merge of 0a52df50 to lmp-dev-plus-aosp Change-Id: I3c6af086fc8ca3e9600c2267c439718c9a572dfb
2014-10-06 11:56:31 -07:00
Allow audioserver for bootanim. Required for using native audio in BootAnimation Bug: 29055299 Change-Id: Ie75d35219be95a8dc697cc3c0384a4de90ea3478
2016-06-29 14:14:34 -07:00
allow bootanim audioserver_service:service_manager find;
Restrict service_manager find and list access. All domains are currently granted list and find service_manager permissions, but this is not necessary. Pare the permissions which did not trigger any of the auditallow reporting. Bug: 18106000 Change-Id: Ie0ce8de2af8af2cbe4ce388a2dcf4534694c994a
2014-12-11 16:01:27 -08:00
allow bootanim surfaceflinger_service:service_manager find;
bootanim: Remove domain_deprecated Remove domain_deprecated from bootanim. This removes some unnecessarily permissive rules. As part of this, re-allow access to cgroups, proc and sysfs, removed as a result of removing domain_deprecated. Bug: 25433265 Change-Id: I58658712666c719c8f5a39fe2076c4f6d166616c
2015-12-02 13:29:20 -08:00
# Allow access to ion memory allocation device
allow bootanim ion_device:chr_file rw_file_perms;
resolve merge conflicts of 837a6f2 to master Test: make Change-Id: Icf77940472c7b7776b731c0ce0c1f53ac8bd198c
2016-11-13 18:22:31 -08:00
allow bootanim hal_graphics_allocator:fd use;
bootanim: Remove domain_deprecated Remove domain_deprecated from bootanim. This removes some unnecessarily permissive rules. As part of this, re-allow access to cgroups, proc and sysfs, removed as a result of removing domain_deprecated. Bug: 25433265 Change-Id: I58658712666c719c8f5a39fe2076c4f6d166616c
2015-12-02 13:29:20 -08:00
Add sepolicy for hwcomposer HAL Allow SurfaceFlinger to call into IComposer, and vice versa for IComposerCallback. Specifically, hwbinder_use(...) for avc: denied { call } for scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=1 avc: denied { transfer } for scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:hwservicemanager:s0 tclass=binder permissive=1 binder_call(..., surfaceflinger) for avc: denied { call } for scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:surfaceflinger:s0 tclass=binder permissive=1 allow ... gpu_device:chr_file rw_file_perms for avc: denied { read write } for name="kgsl-3d0" dev="tmpfs" ino=14956 scontext=u:r:hal_graphics_composer:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1 avc: denied { open } for path="/dev/kgsl-3d0" dev="tmpfs" ino=14956 scontext=u:r:hal_graphics_composer:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1 avc: denied { ioctl } for path="/dev/kgsl-3d0" dev="tmpfs" ino=14956 ioctlcmd=940 scontext=u:r:hal_graphics_composer:s0 tcontext=u:object_r:gpu_device:s0 tclass=chr_file permissive=1 allow ... ion_device:chr_file r_file_perms for avc: denied { ioctl } for path="/dev/ion" dev="tmpfs" ino=15014 ioctlcmd=4900 scontext=u:r:hal_graphics_composer:s0 tcontext=u:object_r:ion_device:s0 tclass=chr_file permissive=1 allow ... graphics_device ... for avc: denied { ioctl } for path="/dev/graphics/fb0" dev="tmpfs" ino=15121 ioctlcmd=5380 scontext=u:r:hal_graphics_composer:s0 tcontext=u:object_r:graphics_device:s0 tclass=chr_file permissive=1 allow ... ...:fd use for avc: denied { use } for path="anon_inode:dmabuf" dev="anon_inodefs" ino=12794 scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:hal_graphics_allocator_service:s0 tclass=fd permissive=1 avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=12794 scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:bootanim:s0 tclass=fd permissive=1 avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=12794 scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:surfaceflinger:s0 tclass=fd permissive=1 avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=12794 scontext=u:r:hal_graphics_composer:s0 tcontext=u:r:platform_app:s0:c512,c768 tclass=fd permissive=1 binder_call(surfaceflinger, ...) for avc: denied { call } for scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_composer:s0 tclass=binder permissive=1 avc: denied { transfer } for scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_composer:s0 tclass=binder permissive=1 avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=12794 ioctlcmd=3e02 scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_composer:s0 tclass=fd permissive=1 avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=12794 scontext=u:r:surfaceflinger:s0 tcontext=u:r:hal_graphics_composer:s0 tclass=fd permissive=1 allow bootanim ...:fd use for avc: denied { use } for path="anon_inode:sync_fence" dev="anon_inodefs" ino=11947 scontext=u:r:bootanim:s0 tcontext=u:r:hal_graphics_composer:s0 tclass=fd permissive=1 Bug: 32021609 Test: make bootimage Change-Id: I036cdbebf0c619fef7559f294f1865f381b17588
2016-10-17 19:58:22 -07:00
# Fences
allow bootanim hal_graphics_composer:fd use;
bootanim: Remove domain_deprecated Remove domain_deprecated from bootanim. This removes some unnecessarily permissive rules. As part of this, re-allow access to cgroups, proc and sysfs, removed as a result of removing domain_deprecated. Bug: 25433265 Change-Id: I58658712666c719c8f5a39fe2076c4f6d166616c
2015-12-02 13:29:20 -08:00
# Read access to pseudo filesystems.
bootanim: allow /proc/meminfo read Allow /proc/meminfo to be read by bootanim. Not sure why it's needed, but harmless enough. Modify domain_deprecated so it doesn't use r_dir_file(). /proc/meminfo is neither a symlink nor a directory, so it doesn't make sense to create allow rules for those classes of objects. Addresses the following denial: avc: denied { read } for comm="BootAnimation" name="meminfo" dev="proc" ino=4026536593 scontext=u:r:bootanim:s0 tcontext=u:object_r:proc_meminfo:s0 tclass=file permissive=0 This denial is only showing up on flounder, flounder_lte, or dragon devices. I'm not sure why. Change-Id: I0f808bcae47fc2fda512cd147c3b44593835cac5
2016-03-31 14:11:50 -07:00
allow bootanim proc_meminfo:file r_file_perms;
bootanim: Remove domain_deprecated Remove domain_deprecated from bootanim. This removes some unnecessarily permissive rules. As part of this, re-allow access to cgroups, proc and sysfs, removed as a result of removing domain_deprecated. Bug: 25433265 Change-Id: I58658712666c719c8f5a39fe2076c4f6d166616c
2015-12-02 13:29:20 -08:00
# System file accesses.
allow bootanim system_file:dir r_dir_perms;
Switch /data/misc/reboot/last_reboot_reason to persistent property Switch from /data/misc/reboot/last_reboot_reason to persistent Android property persist.sys.boot.reason for indicating why the device is rebooted or shutdown. Introduce protection for all boot reason properties Protect the following properties with these labels ro.boot.bootreason u:object_r:bootloader_boot_reason_prop:s0 sys.boot.reason u:object_r:sys_boot_reason_prop:s0 persist.sys.boot.reason u:object_r:last_boot_reason_prop:s0 Setup the current as-need access rules for each. ToDo: Remove u:object_r:reboot_data_file after internal fixes. Test: system/core/bootstat/boot_reason_test.sh Bug: 64687998 Change-Id: I3771c73933e8ae2d94aee936c7a38b6282611b80
2017-08-14 14:25:10 -07:00
# Read ro.boot.bootreason b/30654343
get_prop(bootanim, bootloader_boot_reason_prop)
Reference in New Issue Copy Permalink