Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sysserv sepolicy changes #2

Open
wants to merge 3 commits into
base: o-mr1
Choose a base branch
from
+54 −1
Open

Sysserv sepolicy changes #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
2c6a6e8
Introduce sepolicy exceptions for theme assets
Surge1223 Jan 4, 2017
7ee0c40
Initial sepolicy rules for substratum service
ivaniskandar Jul 31, 2017
371bdaf
SELinux: added to the policies without entries into the compatibility…
Surge1223 Dec 27, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions private/app.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -540,3 +540,7 @@ neverallow {
-bluetooth
-system_app
} bluetooth_prop:file create_file_perms;

# Themed resources (i.e. composed icons)
allow appdomain theme_data_file:dir r_dir_perms;
allow appdomain theme_data_file:file r_file_perms;
5 changes: 4 additions & 1 deletion private/compat/26.0/26.0.ignore.cil
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,10 @@
thermalserviced_exec
thermalserviced_tmpfs
timezone_service
tombstoned_java_trace_socket))
tombstoned_java_trace_socket
substratum_service
theme_data_file
theme_prop))

;; private_objects - a collection of types that were labeled differently in
;; older policy, but that should not remain accessible to vendor policy.
Expand Down
3 changes: 3 additions & 0 deletions private/file_contexts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -401,6 +401,9 @@
# Bootchart data
/data/bootchart(/.*)? u:object_r:bootchart_data_file:s0

# Themes data
/data/system/theme(/.*)? u:object_r:theme_data_file:s0

#############################
# Expanded data files
#
Expand Down
1 change: 1 addition & 0 deletions private/property_contexts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ ro.hw. u:object_r:system_prop:s0
sys. u:object_r:system_prop:s0
sys.cppreopt u:object_r:cppreopt_prop:s0
sys.powerctl u:object_r:powerctl_prop:s0
sys.refresh_theme u:object_r:theme_prop:s0
sys.usb.ffs. u:object_r:ffs_prop:s0
service. u:object_r:system_prop:s0
dhcp. u:object_r:dhcp_prop:s0
Expand Down
1 change: 1 addition & 0 deletions private/service_contexts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,6 +143,7 @@ soundtrigger u:object_r:voiceinteraction_service:s0
statusbar u:object_r:statusbar_service:s0
storaged u:object_r:storaged_service:s0
storagestats u:object_r:storagestats_service:s0
substratum u:object_r:substratum_service:s0
SurfaceFlinger u:object_r:surfaceflinger_service:s0
task u:object_r:task_service:s0
telecom u:object_r:telecom_service:s0
Expand Down
7 changes: 7 additions & 0 deletions private/system_app.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,13 @@ allow system_app keystore:keystore_key {
# /sys access
r_dir_file(system_app, sysfs_type)

# /data/system access
allow system_app system_data_file:file r_file_perms;

# Allow access theme data files
allow system_app theme_data_file:dir create_dir_perms;
allow system_app theme_data_file:file create_file_perms;

control_logd(system_app)
read_runtime_log_tags(system_app)

Expand Down
12 changes: 12 additions & 0 deletions private/system_server.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -483,6 +483,10 @@ set_prop(system_server, cppreopt_prop)
# Collect metrics on boot time created by init
get_prop(system_server, boottime_prop)

# theme property
get_prop(system_server, theme_prop)
set_prop(system_server, theme_prop)

# Read device's serial number from system properties
get_prop(system_server, serialno_prop)

Expand Down Expand Up @@ -571,6 +575,7 @@ allow system_server mediadrmserver_service:service_manager find;
allow system_server netd_service:service_manager find;
allow system_server nfc_service:service_manager find;
allow system_server radio_service:service_manager find;
allow system_server substratum_service:service_manager find;
allow system_server surfaceflinger_service:service_manager find;
allow system_server wificond_service:service_manager find;

Expand Down Expand Up @@ -653,6 +658,10 @@ allow system_server adbd:unix_stream_socket { getattr getopt ioctl read write sh
# Allow invoking tools like "timeout"
allow system_server toolbox_exec:file rx_file_perms;

# Allow access theme data files
allow system_server theme_data_file:dir { create_dir_perms relabelto rw_dir_perms };
allow system_server theme_data_file:file { create_file_perms relabelto rw_file_perms };

# Postinstall
#
# For OTA dexopt, allow calls coming from postinstall.
Expand Down Expand Up @@ -697,6 +706,9 @@ with_asan(`
allow system_server zygote_exec:file rx_file_perms;
')

# allow system_server to look into theme resources
allow system_server theme_data_file:dir search;

###
### Neverallow rules
###
Expand Down
4 changes: 4 additions & 0 deletions private/zygote.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -112,6 +112,10 @@ allow zygote tmpfs:dir r_dir_perms;
# Let the zygote access overlays so it can initialize the AssetManager.
get_prop(zygote, overlay_prop)

# Themes
allow zygote theme_data_file:file r_file_perms;
allow zygote theme_data_file:dir r_dir_perms;

###
### neverallow rules
###
Expand Down
5 changes: 5 additions & 0 deletions public/bootanim.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,3 +39,8 @@ r_dir_file(bootanim, cgroup)

# System file accesses.
allow bootanim system_file:dir r_dir_perms;

# Themed resources (bootanimation)
allow bootanim theme_data_file:dir search;
allow bootanim theme_data_file:file r_file_perms;
allow bootanim system_data_file:file open;
4 changes: 4 additions & 0 deletions public/drmserver.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,3 +56,7 @@ selinux_check_access(drmserver)

r_dir_file(drmserver, cgroup)
r_dir_file(drmserver, system_file)

# Themed resources (i.e. composed icons)
allow drmserver theme_data_file:dir r_dir_perms;
allow drmserver theme_data_file:file r_file_perms;
3 changes: 3 additions & 0 deletions public/file.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -345,3 +345,6 @@ with_asan(`type asanwrapper_exec, exec_type, file_type;')
# Should be:
# type apk_data_file, file_type, data_file_type;
neverallow fs_type file_type:filesystem associate;

# Themes
type theme_data_file, file_type, data_file_type;
4 changes: 4 additions & 0 deletions public/mediaserver.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,3 +148,7 @@ neverallow mediaserver { file_type fs_type }:file execute_no_trans;

# do not allow privileged socket ioctl commands
neverallowxperm mediaserver domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;

# Themed resources (i.e. composed icons)
allow mediaserver theme_data_file:dir r_dir_perms;
allow mediaserver theme_data_file:file r_file_perms;
1 change: 1 addition & 0 deletions public/property.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@ type serialno_prop, property_type;
type shell_prop, property_type, core_property_type;
type system_prop, property_type, core_property_type;
type system_radio_prop, property_type, core_property_type;
type theme_prop, property_type;
type vold_prop, property_type, core_property_type;
type wifi_log_prop, property_type, log_property_type;
type wifi_prop, property_type;
Expand Down
1 change: 1 addition & 0 deletions public/service.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -125,6 +125,7 @@ type settings_service, app_api_service, ephemeral_app_api_service, system_server
type shortcut_service, app_api_service, system_server_service, service_manager_type;
type statusbar_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type storagestats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type substratum_service, app_api_service, system_server_service, service_manager_type;
type task_service, system_server_service, service_manager_type;
type textclassification_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
type textservices_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type;
Expand Down