Skip to content
Snippets Groups Projects
Commit 0671abc3 authored by Nick Kralevich's avatar Nick Kralevich Committed by android-build-merger
Browse files

Merge "relax fuse_device neverallow rules" into oc-dev am: c78db706

am: 7acd1517

Change-Id: Ib7b56576f037048614998e655b0b6a9ca5f71a02
parents 621f439f 7acd1517
No related branches found
No related tags found
No related merge requests found
......@@ -91,6 +91,9 @@ neverallow { all_untrusted_apps -mediaprovider } {
')
}:dir_file_class_set { create unlink };
# No untrusted component should be touching /dev/fuse
neverallow all_untrusted_apps fuse_device:chr_file *;
# Do not allow untrusted apps to directly open tun_device
neverallow all_untrusted_apps tun_device:chr_file open;
......
......@@ -61,3 +61,10 @@ allow platform_app preloads_media_file:file r_file_perms;
allow platform_app preloads_media_file:dir r_dir_perms;
read_runtime_log_tags(platform_app)
###
### Neverallow rules
###
# app domains which access /dev/fuse should not run as platform_app
neverallow platform_app fuse_device:chr_file *;
......@@ -83,3 +83,10 @@ r_dir_file(system_app, sysfs_type)
control_logd(system_app)
read_runtime_log_tags(system_app)
###
### Neverallow rules
###
# app domains which access /dev/fuse should not run as system_app
neverallow system_app fuse_device:chr_file *;
......@@ -991,26 +991,6 @@ neverallow * domain:file { execute execute_no_trans entrypoint };
# TODO: fix system_server and dumpstate
neverallow { domain -init -system_server -dumpstate } debugfs:file no_rw_file_perms;
neverallow {
domain
-init
-recovery
-sdcardd
-vold
} fuse_device:chr_file open;
neverallow {
domain
-dumpstate
-init
-priv_app
-recovery
-sdcardd
-shell # Restricted by shell.te to only getattr
-system_server
-ueventd
-vold
} fuse_device:chr_file *;
# Profiles contain untrusted data and profman parses that. We should only run
# in from installd forked processes.
neverallow {
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment