PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "binder_use: Allow servicemanager callbacks"

Browse Source
This commit is contained in:
Jon Spivack 2019-12-23 20:04:33 +00:00 committed by Gerrit Code Review
commit a2f0fdfddd
4 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
private/lpdumpd.te
View File

@ -38,4 +38,5 @@ neverallow {
-dumpstate
-lpdumpd
-shell
-servicemanager
} lpdumpd:binder call;

2
public/apexd.te
View File

@ -7,7 +7,7 @@ add_service(apexd, apex_service)
set_prop(apexd, apexd_prop)
neverallow { domain -init -apexd -system_server } apex_service:service_manager find;
neverallow { domain -init -apexd -system_server } apexd:binder call;
neverallow { domain -init -apexd -system_server -servicemanager } apexd:binder call;
neverallow { domain userdebug_or_eng(`-crash_dump') } apexd:process ptrace;

4
public/installd.te
View File

@ -173,9 +173,9 @@ allow installd preloads_media_file:dir { r_dir_perms write remove_name rmdir };
### Neverallow rules
###
# only system_server, installd and dumpstate may interact with installd over binder
# only system_server, installd, dumpstate, and servicemanager may interact with installd over binder
neverallow { domain -system_server -dumpstate -installd } installd_service:service_manager find;
neverallow { domain -system_server -dumpstate } installd:binder call;
neverallow { domain -system_server -dumpstate -servicemanager } installd:binder call;
neverallow installd {
domain
-system_server

2
public/te_macros
View File

@ -337,6 +337,8 @@ allow $1 $3:unix_dgram_socket sendto;
define(`binder_use', `
# Call the servicemanager and transfer references to it.
allow $1 servicemanager:binder { call transfer };
# Allow servicemanager to send out callbacks
allow servicemanager $1:binder { call transfer };
# servicemanager performs getpidcon on clients.
allow servicemanager $1:dir search;
allow servicemanager $1:file { read open };