Prevent vendor_init from using binder or sockets am: a099830e3d
am: 40e15ab342
am: 4f0b721c29
Change-Id: I904afb67ec4c38e5c1d214edfd9f34473e92c6ba
This commit is contained in:
commit
13ad150ceb
@ -389,6 +389,7 @@ neverallow * init:process ptrace;
|
||||
# Init can't do anything with binder calls. If this neverallow rule is being
|
||||
# triggered, it's probably due to a service with no SELinux domain.
|
||||
neverallow * init:binder *;
|
||||
neverallow * vendor_init:binder *;
|
||||
|
||||
# Don't allow raw read/write/open access to block_device
|
||||
# Rather force a relabel to a more specific type
|
||||
|
@ -12,6 +12,7 @@ allow servicemanager self:binder set_context_mgr;
|
||||
allow servicemanager {
|
||||
domain
|
||||
-init
|
||||
-vendor_init
|
||||
-hwservicemanager
|
||||
-vndservicemanager
|
||||
}:binder transfer;
|
||||
|
@ -4,6 +4,9 @@ type vendor_init, domain, mlstrustedsubject;
|
||||
# Communication to the main init process
|
||||
allow vendor_init init:unix_stream_socket { read write };
|
||||
|
||||
# Vendor init shouldn't communicate with any vendor process, nor most system processes.
|
||||
neverallow_establish_socket_comms(vendor_init, { domain -init -logd -su -vendor_init });
|
||||
|
||||
# Logging to kmsg
|
||||
allow vendor_init kmsg_device:chr_file { open write };
|
||||
|
||||
|
2
vendor/vndservicemanager.te
vendored
2
vendor/vndservicemanager.te
vendored
@ -6,7 +6,7 @@ init_daemon_domain(vndservicemanager);
|
||||
allow vndservicemanager self:binder set_context_mgr;
|
||||
|
||||
# transfer binder objects to other processes (TODO b/35870313 limit this to vendor-only)
|
||||
allow vndservicemanager { domain -coredomain -init }:binder transfer;
|
||||
allow vndservicemanager { domain -coredomain -init -vendor_init }:binder transfer;
|
||||
|
||||
allow vndservicemanager vndbinder_device:chr_file rw_file_perms;
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user