PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Give system_server / system_app ability to write some properties

Browse Source 
Allow writing to persist.sys and debug.

This addresses the following denials (which are actually being enforced):

<4>[  131.700473] avc:  denied  { set } for property=debug.force_rtl scontext=u:r:system_server:s0 tcontext=u:object_r:shell_prop:s0 tclass=property_service
<3>[  131.700625] init: sys_prop: permission denied uid:1000  name:debug.force_rtl
<4>[  132.630062] avc:  denied  { set } for property=persist.sys.dalvik.vm.lib scontext=u:r:system_app:s0 tcontext=u:object_r:system_prop:s0 tclass=property_service
<3>[  132.630184] init: sys_prop: permission denied uid:1000  name:persist.sys.dalvik.vm.lib

Change-Id: I5d114c0d963bf393f49f1bf13d1ed84137fbcca6
This commit is contained in:
Nick Kralevich 2013-11-01 10:45:03 -07:00
parent 58da198a90
commit dd1ec6d557
4 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
property.te
View File

@ -1,5 +1,6 @@
type default_prop, property_type;
type shell_prop, property_type;
type debug_prop, property_type;
type radio_prop, property_type;
type system_prop, property_type;
type vold_prop, property_type;

2
property_contexts
View File

@ -26,7 +26,7 @@ wlan. u:object_r:system_prop:s0
dhcp. u:object_r:system_prop:s0
bluetooth. u:object_r:bluetooth_prop:s0
debug. u:object_r:shell_prop:s0
debug. u:object_r:debug_prop:s0
log. u:object_r:shell_prop:s0
service.adb.root u:object_r:shell_prop:s0
service.adb.tcp.port u:object_r:shell_prop:s0

3
system_app.te
View File

@ -33,3 +33,6 @@ allow system_app sdcard_type:dir r_dir_perms;
# Allow settings app to read from asec
allow system_app asec_apk_file:dir search;
allow system_app asec_apk_file:file r_file_perms;
# Write to properties
allow system_app system_prop:property_service set;

1
system_server.te
View File

@ -147,6 +147,7 @@ allow system_server anr_data_file:dir relabelto;
# Property Service write
allow system_server system_prop:property_service set;
allow system_server radio_prop:property_service set;
allow system_server debug_prop:property_service set;
# ctl interface
allow system_server ctl_default_prop:property_service set;