From 8a2b4a783e5c9f4a342b7b0923fa1089842566e5 Mon Sep 17 00:00:00 2001 From: Ruchi Kandoi Date: Thu, 4 Jan 2018 10:33:20 -0800 Subject: [PATCH] SE Policy for Secure Element app and Secure Element HAL Test: App startup on boot Change-Id: I7740aafc088aadf676328e3f1bb8db5175d97102 --- private/app_neverallows.te | 1 + private/compat/26.0/26.0.ignore.cil | 4 ++++ private/hwservice_contexts | 1 + private/nfc.te | 1 + private/seapp_contexts | 1 + private/secure_element.te | 14 ++++++++++++++ private/service_contexts | 1 + public/attributes | 1 + public/hal_secure_element.te | 6 ++++++ public/hwservice.te | 1 + public/secure_element.te | 2 ++ public/service.te | 1 + public/su.te | 1 + vendor/file_contexts | 1 + vendor/hal_secure_element_default.te | 5 +++++ 15 files changed, 41 insertions(+) create mode 100644 private/secure_element.te create mode 100644 public/hal_secure_element.te create mode 100644 public/secure_element.te create mode 100644 vendor/hal_secure_element_default.te diff --git a/private/app_neverallows.te b/private/app_neverallows.te index bb9142d0b..df140198c 100644 --- a/private/app_neverallows.te +++ b/private/app_neverallows.te @@ -199,6 +199,7 @@ neverallow all_untrusted_apps { hal_nfc_hwservice hal_oemlock_hwservice hal_power_hwservice + hal_secure_element_hwservice hal_sensors_hwservice hal_telephony_hwservice hal_thermal_hwservice diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil index 2b0a3fb9e..7769b65b6 100644 --- a/private/compat/26.0/26.0.ignore.cil +++ b/private/compat/26.0/26.0.ignore.cil @@ -40,6 +40,7 @@ hal_confirmationui_hwservice hal_lowpan_hwservice hal_neuralnetworks_hwservice + hal_secure_element_hwservice hal_tetheroffload_hwservice hal_usb_gadget_hwservice hal_wifi_offload_hwservice @@ -65,6 +66,9 @@ perfetto_traces_data_file perfprofd_service property_info + secure_element + secure_element_tmpfs + secure_element_service slice_service stats stats_data_file diff --git a/private/hwservice_contexts b/private/hwservice_contexts index 5a6558076..96233fcda 100644 --- a/private/hwservice_contexts +++ b/private/hwservice_contexts @@ -38,6 +38,7 @@ android.hardware.radio.deprecated::IOemHook u:object_r:hal_t android.hardware.radio::IRadio u:object_r:hal_telephony_hwservice:s0 android.hardware.radio::ISap u:object_r:hal_telephony_hwservice:s0 android.hardware.renderscript::IDevice u:object_r:hal_renderscript_hwservice:s0 +android.hardware.secure_element::ISecureElement u:object_r:hal_secure_element_hwservice:s0 android.hardware.sensors::ISensors u:object_r:hal_sensors_hwservice:s0 android.hardware.soundtrigger::ISoundTriggerHw u:object_r:hal_audio_hwservice:s0 android.hardware.thermal::IThermal u:object_r:hal_thermal_hwservice:s0 diff --git a/private/nfc.te b/private/nfc.te index 56446f4f7..5e8567291 100644 --- a/private/nfc.te +++ b/private/nfc.te @@ -24,6 +24,7 @@ allow nfc radio_service:service_manager find; allow nfc app_api_service:service_manager find; allow nfc system_api_service:service_manager find; allow nfc vr_manager_service:service_manager find; +allow nfc secure_element_service:service_manager find; set_prop(nfc, nfc_prop); diff --git a/private/seapp_contexts b/private/seapp_contexts index 76f299866..6efd59f76 100644 --- a/private/seapp_contexts +++ b/private/seapp_contexts @@ -99,6 +99,7 @@ user=_app seinfo=platform name=com.android.traceur domain=traceur_app type=app_d user=system seinfo=platform domain=system_app type=system_app_data_file user=bluetooth seinfo=platform domain=bluetooth type=bluetooth_data_file user=nfc seinfo=platform domain=nfc type=nfc_data_file +user=secure_element seinfo=platform domain=secure_element levelFrom=all user=radio seinfo=platform domain=radio type=radio_data_file user=shared_relro domain=shared_relro user=shell seinfo=platform domain=shell type=shell_data_file diff --git a/private/secure_element.te b/private/secure_element.te new file mode 100644 index 000000000..57f512bbd --- /dev/null +++ b/private/secure_element.te @@ -0,0 +1,14 @@ +# secure element subsystem +typeattribute secure_element coredomain; +app_domain(secure_element) + +binder_service(secure_element) +add_service(secure_element, secure_element_service) + +allow secure_element app_api_service:service_manager find; +hal_client_domain(secure_element, hal_secure_element) + +# already open bugreport file descriptors may be shared with +# the secure element process, from a file in +# /data/data/com.android.shell/files/bugreports/bugreport-*. +allow secure_element shell_data_file:file read; diff --git a/private/service_contexts b/private/service_contexts index 373c7cca0..71d484514 100644 --- a/private/service_contexts +++ b/private/service_contexts @@ -134,6 +134,7 @@ rttmanager u:object_r:rttmanager_service:s0 samplingprofiler u:object_r:samplingprofiler_service:s0 scheduling_policy u:object_r:scheduling_policy_service:s0 search u:object_r:search_service:s0 +secure_element u:object_r:secure_element_service:s0 sec_key_att_app_id_provider u:object_r:sec_key_att_app_id_provider_service:s0 sensorservice u:object_r:sensorservice_service:s0 serial u:object_r:serial_service:s0 diff --git a/public/attributes b/public/attributes index 66ce7d09c..8138a3fa2 100644 --- a/public/attributes +++ b/public/attributes @@ -229,6 +229,7 @@ hal_attribute(neuralnetworks); hal_attribute(nfc); hal_attribute(oemlock); hal_attribute(power); +hal_attribute(secure_element); hal_attribute(sensors); hal_attribute(telephony); hal_attribute(tetheroffload); diff --git a/public/hal_secure_element.te b/public/hal_secure_element.te new file mode 100644 index 000000000..e3046d12e --- /dev/null +++ b/public/hal_secure_element.te @@ -0,0 +1,6 @@ +# HwBinder IPC from client to server, and callbacks +binder_call(hal_secure_element_client, hal_secure_element_server) +binder_call(hal_secure_element_server, hal_secure_element_client) + +add_hwservice(hal_secure_element_server, hal_secure_element_hwservice) +allow hal_secure_element_client hal_secure_element_hwservice:hwservice_manager find; diff --git a/public/hwservice.te b/public/hwservice.te index f6ab621fc..436ec68ac 100644 --- a/public/hwservice.te +++ b/public/hwservice.te @@ -31,6 +31,7 @@ type hal_oemlock_hwservice, hwservice_manager_type; type hal_omx_hwservice, hwservice_manager_type; type hal_power_hwservice, hwservice_manager_type; type hal_renderscript_hwservice, hwservice_manager_type, same_process_hwservice; +type hal_secure_element_hwservice, hwservice_manager_type; type hal_sensors_hwservice, hwservice_manager_type; type hal_telephony_hwservice, hwservice_manager_type; type hal_tetheroffload_hwservice, hwservice_manager_type; diff --git a/public/secure_element.te b/public/secure_element.te new file mode 100644 index 000000000..4ce6714f6 --- /dev/null +++ b/public/secure_element.te @@ -0,0 +1,2 @@ +# secure_element subsystem +type secure_element, domain; diff --git a/public/service.te b/public/service.te index 6f9d47c2b..e13b6d5e7 100644 --- a/public/service.te +++ b/public/service.te @@ -23,6 +23,7 @@ type netd_service, service_manager_type; type nfc_service, service_manager_type; type perfprofd_service, service_manager_type; type radio_service, service_manager_type; +type secure_element_service, service_manager_type; type storaged_service, service_manager_type; type surfaceflinger_service, app_api_service, ephemeral_app_api_service, service_manager_type; type system_app_service, service_manager_type; diff --git a/public/su.te b/public/su.te index edc62c3c1..fd90ebe0e 100644 --- a/public/su.te +++ b/public/su.te @@ -81,6 +81,7 @@ userdebug_or_eng(` typeattribute su hal_nfc_client; typeattribute su hal_oemlock_client; typeattribute su hal_power_client; + typeattribute su hal_secure_element_client; typeattribute su hal_sensors_client; typeattribute su hal_telephony_client; typeattribute su hal_tetheroffload_client; diff --git a/vendor/file_contexts b/vendor/file_contexts index 5be64247d..320a9b18c 100644 --- a/vendor/file_contexts +++ b/vendor/file_contexts @@ -31,6 +31,7 @@ /(vendor|system/vendor)/bin/hw/android\.hardware\.power@1\.0-service u:object_r:hal_power_default_exec:s0 /(vendor|system/vendor)/bin/hw/android\.hardware\.radio\.config@1\.0-service u:object_r:hal_radio_config_default_exec:s0 /(vendor|system/vendor)/bin/hw/android\.hardware\.sensors@1\.0-service u:object_r:hal_sensors_default_exec:s0 +/(vendor|system/vendor)/bin/hw/android\.hardware\.secure_element@1\.0-service u:object_r:hal_secure_element_default_exec:s0 /(vendor|system/vendor)/bin/hw/rild u:object_r:rild_exec:s0 /(vendor|system/vendor)/bin/hw/android\.hardware\.thermal@1\.[01]-service u:object_r:hal_thermal_default_exec:s0 /(vendor|system/vendor)/bin/hw/android\.hardware\.tv\.cec@1\.0-service u:object_r:hal_tv_cec_default_exec:s0 diff --git a/vendor/hal_secure_element_default.te b/vendor/hal_secure_element_default.te new file mode 100644 index 000000000..86fe0b993 --- /dev/null +++ b/vendor/hal_secure_element_default.te @@ -0,0 +1,5 @@ +type hal_secure_element_default, domain; +hal_server_domain(hal_secure_element_default, hal_secure_element) +type hal_secure_element_default_exec, exec_type, vendor_file_type, file_type; + +init_daemon_domain(hal_secure_element_default)