PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
7ef01c34ed
android_system_sepolicy/public
History
Nick Kralevich fefc887eda vold: allow ioctls BLKDISCARD and BLKGETSIZE 
BLKDISCARD is used by vold while wiping block devices
b2455747a9/Utils.cpp (619)

BLKGETSIZE is used to determine the size of the block device. Ideally
code should not be using this ioctl, as it fails for devices >= 2T in
size. Vold indirectly uses this when executing /system/bin/newfs_msdos.
Arguably this is a bug in newfs_msdos, as BLKGETSIZE64 should be used
instead.
Code: 0c7e133c7f/mkfs_msdos.c (845)

Addresses the following denials:

audit(0.0:24): avc: denied { ioctl } for comm="Binder:588_2" path="/dev/block/vold/public:7,9" dev="tmpfs" ino=106407 ioctlcmd=1277 scontext=u:r:vold:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file permissive=0
audit(0.0:25): avc: denied { ioctl } for comm="newfs_msdos" path="/dev/block/vold/public:7,9" dev="tmpfs" ino=106407 ioctlcmd=1260 scontext=u:r:vold:s0 tcontext=u:object_r:vold_device:s0 tclass=blk_file permissive=0

Test: policy compiles.
Bug: 119562530
Change-Id: Ib7198daf150d6f2578545a6a402e0313069ea2b4
2018-11-14 13:01:00 -08:00
..
adbd.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
apexd.te apexd exports its status via sysprop 2018-11-02 12:23:42 +09:00
app.te SELinux changes for AppFuse 2018-11-13 22:45:51 +00:00
asan_extract.te
attributes Sepolicy for bufferhub hwservice 2018-10-25 10:08:05 -07:00
audioserver.te
blkid_untrusted.te
blkid.te
bluetooth.te
bootanim.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
bootstat.te Allow zygote to write to statsd and refactor 2018-10-08 13:48:28 -07:00
bufferhubd.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
cameraserver.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
charger.te
clatd.te Clatd: allow clatd use ioctl 2018-11-06 14:22:56 +09:00
cppreopts.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
crash_dump.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
device.te Remove mtd_device type. 2018-11-12 23:11:03 +00:00
dex2oat.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
dhcp.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
display_service_server.te
dnsmasq.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
domain.te Add userdebug selinux config for heapprofd. 2018-11-14 09:22:07 +00:00
drmserver.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
dumpstate.te Allow dumpstate to call mediaswcodec over binder 2018-10-22 12:39:28 -07:00
e2fs.te start enforcing ioctl restrictions on blk_file 2018-10-18 15:24:32 -07:00
ephemeral_app.te
fastbootd.te fastboot: /mnt/scratch refined access on userdebug 2018-11-01 14:57:01 +00:00
file.te Sepolicies for server configural flags reset 2018-11-09 18:55:55 +00:00
fingerprintd.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
flags_heatlh_check.te Sepolicies for server configural flags reset 2018-11-09 18:55:55 +00:00
fsck_untrusted.te
fsck.te start enforcing ioctl restrictions on blk_file 2018-10-18 15:24:32 -07:00
fwk_bufferhub.te Sepolicy for bufferhub hwservice 2018-10-25 10:08:05 -07:00
gatekeeperd.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
global_macros Update access_vectors 2018-11-01 19:53:50 -07:00
hal_allocator.te same_process_hal_file: access to individual coredomains 2018-10-26 18:03:01 +00:00
hal_atrace.te Add atrace HAL 1.0 sepolicy 2018-09-27 23:18:29 +00:00
hal_audio.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_audiocontrol.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_authsecret.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_bluetooth.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_bootctl.te sepolicy: Fix references to self:capability 2018-08-21 15:55:23 +00:00
hal_broadcastradio.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_camera.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_cas.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_configstore.te Make hal_configstore consistent. 2018-06-06 13:01:17 -07:00
hal_confirmationui.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_contexthub.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_drm.te More granular vendor access to /system files. 2018-09-20 03:07:50 +00:00
hal_dumpstate.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_evs.te Move automotive HALs sepolicy to system/ 2018-05-04 21:36:48 +00:00
hal_fingerprint.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_gatekeeper.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_gnss.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_graphics_allocator.te same_process_hal_file: access to individual coredomains 2018-10-26 18:03:01 +00:00
hal_graphics_composer.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_health_storage.te health.filesystem HAL renamed to health.storage 2018-09-20 04:12:45 +00:00
hal_health.te More granular vendor access to /system files. 2018-09-20 03:07:50 +00:00
hal_ir.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_keymaster.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_light.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_lowpan.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_memtrack.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_neuralnetworks.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_neverallows.te Allow to use sockets from hal server for auto 2018-05-15 14:38:00 -07:00
hal_nfc.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_oemlock.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_omx.te add mediaswcodec service 2018-10-11 15:10:17 -07:00
hal_power.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_secure_element.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_sensors.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_system_suspend.te Sepolicy for system suspend HAL. 2018-08-13 17:26:34 -07:00
hal_telephony.te Remove mtd_device type. 2018-11-12 23:11:03 +00:00
hal_tetheroffload.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_thermal.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_tv_cec.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_tv_input.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_usb_gadget.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_usb.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_vehicle.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_vibrator.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_vr.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_weaver.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_wifi_hostapd.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_wifi_offload.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_wifi_supplicant.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
hal_wifi.te hal_attribute_hwservice_client drop '_client' 2018-06-06 09:30:18 -07:00
healthd.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
heapprofd.te Add userdebug selinux config for heapprofd. 2018-11-14 09:22:07 +00:00
hwservice.te Sepolicy for bufferhub hwservice 2018-10-25 10:08:05 -07:00
hwservicemanager.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
idmap.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
incident_helper.te
incident.te
incidentd.te
init.te init: access to /dev based on audit results 2018-10-19 01:08:54 +00:00
inputflinger.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
install_recovery.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
installd.te installd: add fsverity ioctls 2018-10-12 08:56:48 -07:00
ioctl_defines Allow apexd more ioctl cmds for loop devices 2018-10-26 21:33:29 +09:00
ioctl_macros more ioctl work 2018-10-17 11:12:18 -07:00
iorapd.te iorapd: Add new binder service iorapd. 2018-10-08 15:00:34 -07:00
isolated_app.te
kernel.te Allow the kernel to access apexd file descriptors. 2018-11-08 11:22:48 +01:00
keystore.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
llkd.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
lmkd.te Allow zygote to write to statsd and refactor 2018-10-08 13:48:28 -07:00
logd.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
logpersist.te Start partitioning off privapp_data_file from app_data_file 2018-08-02 16:29:02 -07:00
mdnsd.te
mediadrmserver.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
mediaextractor.te add media.codec.update service 2018-10-15 21:06:53 +00:00
mediametrics.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
mediaprovider.te
mediaserver.te Allow mediaserver domain have getatrr perm on vendor_app_file 2018-10-18 03:10:52 +00:00
mediaswcodec.te add media.codec.update service 2018-10-15 21:06:53 +00:00
modprobe.te modprobe: shouldn't load kernel modules from /system 2018-03-23 14:16:25 -07:00
mtp.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
net.te
netd.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
netutils_wrapper.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
neverallow_macros
nfc.te
otapreopt_chroot.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
otapreopt_slot.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
performanced.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
perfprofd.te same_process_hal_file: access to individual coredomains 2018-10-26 18:03:01 +00:00
platform_app.te
postinstall_dexopt.te sepolicy: grant dac_read_search to domains with dac_override 2018-09-19 15:54:37 -06:00
postinstall.te
ppp.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
preopt2cachename.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
priv_app.te
profman.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
property_contexts Added system property (dumpstate.unroot) to run dumpstate as shell. 2018-11-08 08:25:32 -08:00
property.te Sepolicies for server configural flags reset 2018-11-09 18:55:55 +00:00
racoon.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
radio.te sepolicy entries for time zone detector service 2018-06-19 21:13:57 +01:00
recovery_persist.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
recovery_refresh.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
recovery.te sepolicy: grant dac_read_search to domains with dac_override 2018-09-19 15:54:37 -06:00
roles
runas.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
sdcardd.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
secure_element.te
service.te Add SELinux service for RoleManagerService 2018-11-12 17:10:59 +00:00
servicemanager.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
sgdisk.te sgdisk: allow BLKRRPART 2018-11-02 14:26:23 -07:00
shared_relro.te Allow shared_relro to access PackageManager. 2018-09-11 16:26:56 -04:00
shell.te iorapd: Add new binder service iorapd. 2018-10-08 15:00:34 -07:00
slideshow.te
statsd.te Allow zygote to write to statsd and refactor 2018-10-08 13:48:28 -07:00
su.te Add atrace HAL 1.0 sepolicy 2018-09-27 23:18:29 +00:00
surfaceflinger.te
swcodec_service_server.te add mediaswcodec service 2018-10-11 15:10:17 -07:00
system_app.te
system_server.te
te_macros Add userdebug selinux config for heapprofd. 2018-11-14 09:22:07 +00:00
tee.te Fingerprint data is now stored in one of two ways depending on the 2018-05-16 14:22:14 -07:00
thermalserviced.te Introduce system_file_type 2018-09-27 15:28:16 -07:00
tombstoned.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
toolbox.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
traced_probes.te Make traced_probes mlstrustedsubject. 2018-04-17 18:12:28 +00:00
traceur_app.te iorapd: Add new binder service iorapd. 2018-10-08 15:00:34 -07:00
tzdatacheck.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
ueventd.te sepolicy: grant dac_read_search to domains with dac_override 2018-09-19 15:54:37 -06:00
uncrypt.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
untrusted_app.te Add untrusted_app_27 2018-04-03 12:25:51 -07:00
update_engine_common.te update_engine_common: expand default allowed ioctl list 2018-10-23 12:28:40 -07:00
update_engine.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
update_verifier.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
usbd.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
vdc.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
vendor_init.te Sepolicies for server configural flags reset 2018-11-09 18:55:55 +00:00
vendor_shell.te
vendor_toolbox.te
virtual_touchpad.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
vndservice.te
vndservicemanager.te
vold_prepare_subdirs.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
vold.te vold: allow ioctls BLKDISCARD and BLKGETSIZE 2018-11-14 13:01:00 -08:00
vr_hwc.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
watchdogd.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
webview_zygote.te
wificond.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
wpantund.te Introduce system_file_type 2018-09-27 12:52:09 -07:00
zygote.te Introduce system_file_type 2018-09-27 12:52:09 -07:00