From 1bcff87c59f510e27687c35af112f3b68f1b5439 Mon Sep 17 00:00:00 2001
From: Stephen Smalley <sds@tycho.nsa.gov>
Date: Tue, 16 Jun 2015 09:12:54 -0400
Subject: [PATCH] neverallow write access to /data/dalvik-cache directories.
Prohibit all but a specific set of whitelisted domains
from writing to /data/dalvik-cache. This is to prevent
code injection into apps, zygote, or system_server.
Inspired by:
https://www.nowsecure.com/blog/2015/06/16/remote-code-execution-as-system-user-on-samsung-phones/
which depended on system UID apps having write access to
/data/dalvik-cache (not allowed in AOSP policy but evidently
in those device policies). Prevent this from recurring.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
(cherry picked from commit d9bf7b3fc008533a6552887a3451a311c3a2607a)
Change-Id: I9219ddc3af44c909af90ba694e96565f99d8190c
---
domain.te | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/domain.te b/domain.te
index a67e77abe..8fb020b98 100644
--- a/domain.te
+++ b/domain.te
@@ -358,6 +358,14 @@ neverallow {
-dex2oat
} dalvikcache_data_file:file no_w_file_perms;
+neverallow {
+ domain
+ -init
+ -installd
+ -dex2oat
+ -zygote
+} dalvikcache_data_file:dir no_w_dir_perms;
+
# Only system_server should be able to send commands via the zygote socket
neverallow { domain -zygote -system_server } zygote:unix_stream_socket connectto;
neverallow { domain -system_server } zygote_socket:sock_file write;
--
GitLab