95e0842e34
Remove init, ueventd, watchdogd, healthd and adbd from the set of domains traceable by debuggerd. bionic/linker/debugger.cpp sets up handlers for all dynamically linked programs in Android but this should not apply for statically linked programs. Exclude ptrace access from unconfineddomain. Prohibit ptrace access to init via neverallow. Change-Id: I70d742233fbe40cb4d1772a4e6cd9f8f767f2c3a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
44 lines
2.2 KiB
Plaintext
44 lines
2.2 KiB
Plaintext
#######################################################
|
|
#
|
|
# This is the unconfined template. This template is the base policy
|
|
# which is used by daemons and other privileged components of
|
|
# Android.
|
|
#
|
|
# Historically, this template was called "unconfined" because it
|
|
# allowed the domain to do anything it wanted. Over time,
|
|
# this has changed, and will continue to change in the future.
|
|
# The rules in this file will be removed when no remaining
|
|
# unconfined domains require it, or when the rules contradict
|
|
# Android security best practices. Domains which need rules not
|
|
# provided by the unconfined template should add them directly to
|
|
# the relevant policy.
|
|
#
|
|
# The use of this template is discouraged.
|
|
######################################################
|
|
|
|
allow unconfineddomain self:capability_class_set *;
|
|
allow unconfineddomain kernel:security ~{ load_policy setenforce };
|
|
allow unconfineddomain kernel:system *;
|
|
allow unconfineddomain self:memprotect *;
|
|
allow unconfineddomain domain:process ~ptrace;
|
|
allow unconfineddomain domain:fd *;
|
|
allow unconfineddomain domain:dir r_dir_perms;
|
|
allow unconfineddomain domain:lnk_file r_file_perms;
|
|
allow unconfineddomain domain:{ fifo_file file } rw_file_perms;
|
|
allow unconfineddomain domain:socket_class_set *;
|
|
allow unconfineddomain domain:ipc_class_set *;
|
|
allow unconfineddomain domain:key *;
|
|
allow unconfineddomain fs_type:filesystem *;
|
|
allow unconfineddomain {fs_type dev_type file_type}:{ dir blk_file lnk_file sock_file fifo_file } ~relabelto;
|
|
allow unconfineddomain {fs_type -usermodehelper -proc_security}:{ chr_file file } ~{entrypoint relabelto};
|
|
allow unconfineddomain {dev_type -kmem_device}:{ chr_file file } ~{entrypoint relabelto};
|
|
allow unconfineddomain file_type:{ chr_file file } ~{entrypoint relabelto};
|
|
allow unconfineddomain node_type:node *;
|
|
allow unconfineddomain node_type:{ tcp_socket udp_socket rawip_socket } node_bind;
|
|
allow unconfineddomain netif_type:netif *;
|
|
allow unconfineddomain port_type:socket_class_set name_bind;
|
|
allow unconfineddomain port_type:{ tcp_socket dccp_socket } name_connect;
|
|
allow unconfineddomain domain:peer recv;
|
|
allow unconfineddomain domain:binder { call transfer set_context_mgr };
|
|
allow unconfineddomain property_type:property_service set;
|