From 06486796a4e818d782ea1f2f20cfc8ddf6bf724c Mon Sep 17 00:00:00 2001
From: Bartosz Fabianowski <bartfab@google.com>
Date: Thu, 8 Jun 2017 10:57:55 +0000
Subject: [PATCH] Revert "SELinux policy for secure persistent netd storage"
This broke the build on master. See b/17613910#comment17
for details.
This reverts commit ef1fd98b6a1eaea04720ca80bc113ae149e736a2.
Change-Id: I11f7d463061a9b6340c11827135586266e26f016
---
private/property_contexts | 1 -
public/netd.te | 9 ---------
public/property.te | 1 -
3 files changed, 11 deletions(-)
diff --git a/private/property_contexts b/private/property_contexts
index 74497c9f1..23150343f 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -50,7 +50,6 @@ persist.logd.logpersistd u:object_r:logpersistd_logging_prop:s0
logd.logpersistd u:object_r:logpersistd_logging_prop:s0
persist.log.tag u:object_r:log_tag_prop:s0
persist.mmc. u:object_r:mmc_prop:s0
-persist.netd. u:object_r:netd_prop:s0
persist.sys. u:object_r:system_prop:s0
persist.sys.safemode u:object_r:safemode_prop:s0
ro.sys.safemode u:object_r:safemode_prop:s0
diff --git a/public/netd.te b/public/netd.te
index e09f05367..35d9b7cee 100644
--- a/public/netd.te
+++ b/public/netd.te
@@ -58,7 +58,6 @@ allow netd dnsmasq:process signal;
allow netd clatd:process signal;
set_prop(netd, ctl_mdnsd_prop)
-set_prop(netd, netd_prop)
# Allow netd to publish a binder service and make binder calls.
binder_use(netd)
@@ -105,11 +104,3 @@ neverallow netd { app_data_file system_data_file }:dir_file_class_set write;
neverallow { domain -system_server -dumpstate -netd } netd_service:service_manager find;
neverallow { domain -system_server -dumpstate } netd:binder call;
neverallow netd { domain -system_server -servicemanager userdebug_or_eng(`-su') }:binder call;
-
-# persist.netd.stable_secret contains RFC 7217 secret key which should never be
-# leaked to other processes. Make sure it never leaks.
-neverallow { domain -netd -init } netd_prop:file r_file_perms;
-
-# We want to ensure that no other process ever tries tampering with persist.netd.stable_secret,
-# the RFC 7217 secret key managed by netd. Doing so could compromise user privacy.
-neverallow { domain -netd -init } netd_prop:property_service set;
diff --git a/public/property.te b/public/property.te
index 4a74cecf7..daac0fb5c 100644
--- a/public/property.te
+++ b/public/property.te
@@ -30,7 +30,6 @@ type log_tag_prop, property_type, log_property_type;
type mmc_prop, property_type;
type net_dns_prop, property_type;
type net_radio_prop, property_type, core_property_type;
-type netd_prop, property_type;
type nfc_prop, property_type, core_property_type;
type overlay_prop, property_type;
type pan_result_prop, property_type, core_property_type;
--
GitLab