PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove coredomain /dev access no longer needed after Treble

Browse Source 
According to go/sedenials (internal dogfooding), coredomain access to
following types is not exercised and can be removed:
iio_device
radio_device
tee_device

Access to audio_device is still needed since some ALSA interfaces
(/dev/snd/*) are directly used by system_server.

Bug: 110962171
Test: m selinux_policy
Change-Id: I740b99813e1f93136bfcaec087b74f0e03b259ad
This commit is contained in:
Tri Vo 2018-11-28 13:47:44 -08:00
parent 0096e7af57
commit 8a6cc52ed7
5 changed files with 9 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
private/coredomain.te
View File

@ -169,13 +169,12 @@ full_treble_only(`
}{ usbfs binfmt_miscfs }:file no_rw_file_perms;
')
# Audit coredomain access to /dev nodes that might no longer be needed after
# Treble.
userdebug_or_eng(`
auditallow coredomain {
audio_device
iio_device
radio_device
tee_device
}:chr_file { open read append write ioctl };
# Following /dev nodes must not be directly accessed by coredomain after Treble,
# but should instead be wrapped by HALs.
full_treble_only(`
neverallow coredomain {
iio_device
radio_device
tee_device
}:chr_file { open read append write ioctl };
')

4
private/surfaceflinger.te
View File

@ -71,10 +71,6 @@ binder_call(surfaceflinger, dumpstate)
binder_call(surfaceflinger, shell)
r_dir_file(surfaceflinger, dumpstate)
# Needed on some devices for playing DRM protected content,
# but seems expected and appropriate for all devices.
allow surfaceflinger tee_device:chr_file rw_file_perms;
# media.player service
# do not use add_service() as hal_graphics_composer_default may be the

4
private/system_server.te
View File

@ -326,10 +326,8 @@ allow system_server device:dir r_dir_perms;
allow system_server mdns_socket:sock_file rw_file_perms;
allow system_server alarm_device:chr_file rw_file_perms;
allow system_server gpu_device:chr_file rw_file_perms;
allow system_server iio_device:chr_file rw_file_perms;
allow system_server input_device:dir r_dir_perms;
allow system_server input_device:chr_file rw_file_perms;
allow system_server radio_device:chr_file r_file_perms;
allow system_server tty_device:chr_file rw_file_perms;
allow system_server usbaccessory_device:chr_file rw_file_perms;
allow system_server video_device:dir r_dir_perms;
@ -338,7 +336,7 @@ allow system_server adbd_socket:sock_file rw_file_perms;
allow system_server rtc_device:chr_file rw_file_perms;
allow system_server audio_device:dir r_dir_perms;
# write access needed for MIDI
# write access to ALSA interfaces (/dev/snd/*) needed for MIDI
allow system_server audio_device:chr_file rw_file_perms;
# tun device used for 3rd party vpn apps

1
public/drmserver.te
View File

@ -20,7 +20,6 @@ binder_call(drmserver, mediaserver)
allow drmserver sdcard_type:dir search;
allow drmserver drm_data_file:dir create_dir_perms;
allow drmserver drm_data_file:file create_file_perms;
allow drmserver tee_device:chr_file rw_file_perms;
allow drmserver { app_data_file privapp_data_file }:file { read write getattr map };
allow drmserver sdcard_type:file { read write getattr map };
r_dir_file(drmserver, efs_file)

1
public/gatekeeperd.te
View File

@ -7,7 +7,6 @@ binder_use(gatekeeperd)
### Rules needed when Gatekeeper HAL runs inside gatekeeperd process.
### These rules should eventually be granted only when needed.
allow gatekeeperd tee_device:chr_file rw_file_perms;
allow gatekeeperd ion_device:chr_file r_file_perms;
# Load HAL implementation
allow gatekeeperd system_file:dir r_dir_perms;