Skip to content
Snippets Groups Projects
  • Nick Kralevich's avatar
    6d0e9c8f
    init.te: delete kernel load policy support · 6d0e9c8f
    Nick Kralevich authored
    Remove the ability to dynamically update SELinux policy on the
    device.
    
    1) This functionality has never been used, so we have no idea if
    it works or not.
    
    2) If system_server is compromised, this functionality allows a
    complete bypass of the SELinux policy on the device. In particular,
    an attacker can force a regression of the following patch
      * https://android-review.googlesource.com/138510
    see also https://code.google.com/p/android/issues/detail?id=181826
    
    3) Dynamic policy update can be used to bypass neverallow protections
    enforced in CTS, by pushing a policy to the device after certification.
    Such an updated policy could bring the device out of compliance or
    deliberately introduce security weaknesses.
    
    (cherrypicked from commit e827a8ab)
    
    Bug: 22885422
    Bug: 8949824
    Change-Id: I802cb61fd18a452a2bb71c02fe57cfce5b7e9dc8
    6d0e9c8f
    History
    init.te: delete kernel load policy support
    Nick Kralevich authored
    Remove the ability to dynamically update SELinux policy on the
    device.
    
    1) This functionality has never been used, so we have no idea if
    it works or not.
    
    2) If system_server is compromised, this functionality allows a
    complete bypass of the SELinux policy on the device. In particular,
    an attacker can force a regression of the following patch
      * https://android-review.googlesource.com/138510
    see also https://code.google.com/p/android/issues/detail?id=181826
    
    3) Dynamic policy update can be used to bypass neverallow protections
    enforced in CTS, by pushing a policy to the device after certification.
    Such an updated policy could bring the device out of compliance or
    deliberately introduce security weaknesses.
    
    (cherrypicked from commit e827a8ab)
    
    Bug: 22885422
    Bug: 8949824
    Change-Id: I802cb61fd18a452a2bb71c02fe57cfce5b7e9dc8