PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove domain init:unix_stream_socket connectto permission.

Browse Source 
We do not want to permit connecting to arbitrary unconfined services
left running in the init domain.  I do not know how this was originally
triggered and thus cannot test that it is fixed.  Possible causes:
- another service was left running in init domain, e.g. dumpstate,
- there was a socket entry for the service in the init.rc file
and the service was launched via logwrapper and therefore init did
not know how to label the socket.

The former should be fixed.  The latter can be solved either by
removing use of logwrapper or by specifying the socket context
explicitly in the init.rc file now.

Change-Id: I09ececaaaea2ccafb7637ca08707566c1155a298
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
This commit is contained in:
Stephen Smalley 2014-01-09 15:45:44 -05:00 committed by Nick Kralevich
parent aef4a469ef
commit 39fd7818b3
1 changed files with 0 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
domain.te
View File

@ -33,9 +33,6 @@ allow domain adbd:unix_stream_socket { getattr getopt read write shutdown };
###
allow domain debuggerd:process sigchld;
allow domain debuggerd:unix_stream_socket connectto;
# b/9858255 - debuggerd sockets are not getting properly labeled.
# TODO: Remove this temporary workaround.
allow domain init:unix_stream_socket connectto;
# Root fs.
allow domain rootfs:dir r_dir_perms;