From 7672eac5fb0d0ce3bcb52f11b125b25ac597ea3f Mon Sep 17 00:00:00 2001 From: rpcraig Date: Mon, 22 Oct 2012 13:50:01 -0400 Subject: [PATCH] Add SELinux policy for asec containers. Creates 2 new types: - asec_apk_file : files found under /mnt/asec when the asec images are mounted - asec_image_file : the actual encrypted apks under /data/app-asec Change-Id: I963472add1980ac068d3a6d36a24f27233022832 Signed-off-by: rpcraig --- app.te | 5 +++++ domain.te | 1 + file.te | 5 ++++- file_contexts | 3 ++- installd.te | 4 ++++ vold.te | 13 ++++++++++--- 6 files changed, 26 insertions(+), 5 deletions(-) diff --git a/app.te b/app.te index 1540f08b8..22a393e24 100644 --- a/app.te +++ b/app.te @@ -26,6 +26,9 @@ allow platform_app shell_data_file:lnk_file read; allow platform_app apk_tmp_file:file rw_file_perms; # Read /dev/xt_qtaguid allow platform_app qtaguid_device:chr_file r_file_perms; +# ASEC +allow platform_app asec_apk_file:dir create_dir_perms; +allow platform_app asec_apk_file:file create_file_perms; # Apps signed with the media key. type media_app, domain; @@ -53,6 +56,8 @@ net_domain(shared_app) bluetooth_domain(shared_app) # Read logs. allow shared_app log_device:chr_file read; +# ASEC +r_dir_file(shared_app, asec_apk_file); # Apps signed with the release key (testkey in AOSP). type release_app, domain; diff --git a/domain.te b/domain.te index 47ad05a3a..96f971c84 100644 --- a/domain.te +++ b/domain.te @@ -54,6 +54,7 @@ allow domain urandom_device:chr_file r_file_perms; # Filesystem accesses. allow domain fs_type:filesystem getattr; +allow domain fs_type:dir getattr; # System file accesses. allow domain system_file:dir r_dir_perms; diff --git a/file.te b/file.te index 451ad1dad..70100a955 100644 --- a/file.te +++ b/file.te @@ -32,7 +32,6 @@ type anr_data_file, file_type, data_file_type, mlstrustedobject; type tombstone_data_file, file_type, data_file_type; # /data/app - user-installed apps type apk_data_file, file_type, data_file_type; -type asec_data_file, file_type, data_file_type; type apk_tmp_file, file_type, data_file_type, mlstrustedobject; # /data/dalvik-cache type dalvikcache_data_file, file_type, data_file_type; @@ -59,6 +58,10 @@ type cache_file, file_type, mlstrustedobject; type efs_file, file_type; # Type for wallpaper file. type wallpaper_file, file_type, mlstrustedobject; +# /mnt/asec +type asec_apk_file, file_type, data_file_type; +# /data/app-asec +type asec_image_file, file_type, data_file_type; # All devices have bluetooth efs files. But they # vary per device, so this type is used in per diff --git a/file_contexts b/file_contexts index 8876bfe96..713da7991 100644 --- a/file_contexts +++ b/file_contexts @@ -152,4 +152,5 @@ /sys/devices/platform/nfc-power/nfc_power -- u:object_r:sysfs_nfc_power_writable:s0 ############################# # asec containers -/mnt/asec(/.*)? u:object_r:asec_data_file:s0 +/mnt/asec(/.*)? u:object_r:asec_apk_file:s0 +/data/app-asec(/.*)? u:object_r:asec_image_file:s0 diff --git a/installd.te b/installd.te index 2a87eb7b1..553127c00 100644 --- a/installd.te +++ b/installd.te @@ -20,3 +20,7 @@ dontaudit installd self:capability sys_admin; selinux_check_context(installd) # Read /seapp_contexts, presently on the rootfs. allow installd rootfs:file r_file_perms; +# ASEC +allow installd platform_app_data_file:lnk_file { create setattr }; +allow installd app_data_file:lnk_file { create setattr }; +allow installd asec_apk_file:file r_file_perms; diff --git a/vold.te b/vold.te index 86dbbb7a7..60d6a3729 100644 --- a/vold.te +++ b/vold.te @@ -16,7 +16,7 @@ allow vold sdcard:dir create_dir_perms; allow vold tmpfs:filesystem { mount unmount }; allow vold tmpfs:dir create_dir_perms; allow vold tmpfs:dir mounton; -allow vold self:capability { net_admin dac_override mknod sys_admin }; +allow vold self:capability { net_admin dac_override mknod sys_admin chown fowner fsetid }; allow vold self:netlink_kobject_uevent_socket *; allow vold app_data_file:dir search; allow vold app_data_file:file rw_file_perms; @@ -39,7 +39,7 @@ allow vold sysfs:file rw_file_perms; unix_socket_connect(vold, property, init) # Unmount and mount the fs. -allow vold labeledfs:filesystem { mount unmount }; +allow vold labeledfs:filesystem { mount unmount remount }; # Access /efs/userdata_footer. # XXX Split into a separate type? @@ -53,7 +53,14 @@ allow vold kernel:system module_request; allow vold proc:file write; # Create and mount on /data/tmp_mnt. -allow vold system_data_file:dir { open read write create add_name mounton }; +allow vold system_data_file:dir { rw_dir_perms mounton }; # Property Service allow vold vold_prop:property_service set; + +# ASEC +allow vold asec_image_file:file create_file_perms; +allow vold asec_image_file:dir rw_dir_perms; +allow vold rootfs:file r_file_perms; +allow vold asec_apk_file:dir { rw_dir_perms setattr }; +allow vold asec_apk_file:file { r_file_perms setattr };