Skip to content
Snippets Groups Projects
  • Nick Kralevich's avatar
    da17402c
    Do not allow new additions to core_property_type · da17402c
    Nick Kralevich authored
    core_property_type is an attribute which was given to all existing
    properties known to core SELinux policy. Any property with this label is
    readable to all SELinux domains, which is overly broad. The long term
    goal is to remove the core_property_type attribute entirely.
    
    Add a neverallow rule prohibiting the introduction of new properties
    with the core_property_type attribute. Device specific properties, or
    new properties in core SELinux policy, should not have this attribute.
    
    (cherry picked from commit d310df20)
    
    Test: policy compiles
    Bug: 33620117
    Change-Id: I61d18c126bca722002f41a5cc4728318878f46c6
    da17402c
    History
    Do not allow new additions to core_property_type
    Nick Kralevich authored
    core_property_type is an attribute which was given to all existing
    properties known to core SELinux policy. Any property with this label is
    readable to all SELinux domains, which is overly broad. The long term
    goal is to remove the core_property_type attribute entirely.
    
    Add a neverallow rule prohibiting the introduction of new properties
    with the core_property_type attribute. Device specific properties, or
    new properties in core SELinux policy, should not have this attribute.
    
    (cherry picked from commit d310df20)
    
    Test: policy compiles
    Bug: 33620117
    Change-Id: I61d18c126bca722002f41a5cc4728318878f46c6
property.te 2.81 KiB