From 45ba665cfcc5c2fc3242a013e6070c2bed860b0a Mon Sep 17 00:00:00 2001 From: Stephen Smalley Date: Fri, 27 Sep 2013 10:24:49 -0400 Subject: [PATCH] Label and allow access to /data/system/ndebugsocket. Otherwise it defaults to the label of /data/system and cannot be distinguished from any other socket in that directory. Also adds allow rule required for pre-existing wpa_socket transition to function without unconfined_domain. Change-Id: I57179aa18786bd56d247f397347e546cca978e41 Signed-off-by: Stephen Smalley --- debuggerd.te | 3 +++ file.te | 1 + system_server.te | 6 ++++++ 3 files changed, 10 insertions(+) diff --git a/debuggerd.te b/debuggerd.te index 31453c9ce..690e69548 100644 --- a/debuggerd.te +++ b/debuggerd.te @@ -7,3 +7,6 @@ init_daemon_domain(debuggerd) unconfined_domain(debuggerd) relabelto_domain(debuggerd) allow debuggerd tombstone_data_file:dir relabelto; + +# Connect to system_server via /data/system/ndebugsocket. +unix_socket_connect(debuggerd, system_ndebug, system_server) diff --git a/file.te b/file.te index aeea030b2..44b751621 100644 --- a/file.te +++ b/file.te @@ -98,6 +98,7 @@ type racoon_socket, file_type; type rild_socket, file_type; type rild_debug_socket, file_type; type system_wpa_socket, file_type; +type system_ndebug_socket, file_type; type vold_socket, file_type; type wpa_socket, file_type; type zygote_socket, file_type; diff --git a/system_server.te b/system_server.te index d4930ab27..35df21c66 100644 --- a/system_server.te +++ b/system_server.te @@ -25,6 +25,12 @@ allow system_server self:capability { # Create a socket for receiving info from wpa. type_transition system_server wifi_data_file:sock_file system_wpa_socket; +allow system_server system_wpa_socket:sock_file create_file_perms; + +# Create a socket for connections from debuggerd. +type_transition system_server system_data_file:sock_file system_ndebug_socket "ndebugsocket"; +allow system_server system_ndebug_socket:sock_file create_file_perms; + allow system_server self:zygote { specifyids specifyrlimits specifyseinfo }; allow system_server backup_data_file:dir relabelto;