PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

allow init to communicate with lmkd and lmkd to kill native processes

Browse Source 
init should register native services with lmkd so that they can be killed
when necessary. Allow init to communicate with lmkd over dedicated socket
the same way AMS does. Allow lmkd to kill and manipulate native processes
that were registered with lmkd.

Bug: 129011369
Test: boot and verify native service registration
Test: verify lmkd can kill registered native processes using lmkd_unit_test
Change-Id: Idfc814bd08115c548e97f11a6bdb006790cbb4ed
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
This commit is contained in:
Suren Baghdasaryan 2019-10-18 11:29:44 -07:00
parent 426f2e77c0
commit ee57f177d8
2 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
public/init.te
View File

@ -28,6 +28,8 @@ allow init device:file relabelfrom;
allow init runtime_event_log_tags_file:file { open write setattr relabelto create }; allow init runtime_event_log_tags_file:file { open write setattr relabelto create };
# /dev/socket # /dev/socket
allow init { device socket_device }:dir relabelto; allow init { device socket_device }:dir relabelto;
# allow init to establish connection and communicate with lmkd
unix_socket_connect(init, lmkd, lmkd)
# Relabel /dev nodes created in first stage init, /dev/null, /dev/ptmx, /dev/random, /dev/urandom # Relabel /dev nodes created in first stage init, /dev/null, /dev/ptmx, /dev/random, /dev/urandom
allow init { null_device ptmx_device random_device } : chr_file relabelto; allow init { null_device ptmx_device random_device } : chr_file relabelto;
# /dev/device-mapper, /dev/block(/.*)? # /dev/device-mapper, /dev/block(/.*)?

13
public/lmkd.te
View File

@ -10,19 +10,17 @@ allow lmkd self:global_capability_class_set { dac_override dac_read_search sys_r
# b/16236289 # b/16236289
allow lmkd self:global_capability_class_set ipc_lock; allow lmkd self:global_capability_class_set ipc_lock;
## Open and write to /proc/PID/oom_score_adj ## Open and write to /proc/PID/oom_score_adj and /proc/PID/timerslack_ns
## TODO: maybe scope this down? ## TODO: maybe scope this down?
r_dir_file(lmkd, appdomain) r_dir_file(lmkd, domain)
allow lmkd appdomain:file write; allow lmkd domain:file write;
r_dir_file(lmkd, system_server)
allow lmkd system_server:file write;
## Writes to /sys/module/lowmemorykiller/parameters/minfree ## Writes to /sys/module/lowmemorykiller/parameters/minfree
r_dir_file(lmkd, sysfs_lowmemorykiller) r_dir_file(lmkd, sysfs_lowmemorykiller)
allow lmkd sysfs_lowmemorykiller:file w_file_perms; allow lmkd sysfs_lowmemorykiller:file w_file_perms;
# setsched and send kill signals # setsched and send kill signals to any registered process
allow lmkd appdomain:process { setsched sigkill }; allow lmkd domain:process { setsched sigkill };
# TODO: delete this line b/131761776 # TODO: delete this line b/131761776
allow lmkd kernel:process { setsched }; allow lmkd kernel:process { setsched };
@ -69,3 +67,4 @@ unix_socket_send(lmkd, statsdw, statsd)
# never honor LD_PRELOAD # never honor LD_PRELOAD
neverallow * lmkd:process noatsecure; neverallow * lmkd:process noatsecure;
neverallow lmkd self:global_capability_class_set sys_ptrace;