Skip to content
Snippets Groups Projects
Commit 346a913c authored by Martijn Coenen's avatar Martijn Coenen Committed by Android (Google) Code Review
Browse files

Merge "Prevent access to nonplat_service_contexts on full_treble." into oc-mr1-dev

parents 12d1c4f7 431a03bb
No related branches found
No related tags found
No related merge requests found
Hide whitespace changes
Inline Side-by-side
prebuilts/api/26.0/26.0.cil
+ 1
− 1
View file @ 346a913c
...@@ -538,7 +538,7 @@ ...@@ -538,7 +538,7 @@
(typeattributeset serial_device_26_0 (serial_device)) (typeattributeset serial_device_26_0 (serial_device))
(typeattributeset serialno_prop_26_0 (serialno_prop)) (typeattributeset serialno_prop_26_0 (serialno_prop))
(typeattributeset serial_service_26_0 (serial_service)) (typeattributeset serial_service_26_0 (serial_service))
(typeattributeset service_contexts_file_26_0 (service_contexts_file)) (typeattributeset service_contexts_file_26_0 (service_contexts_file nonplat_service_contexts_file))
(typeattributeset servicediscovery_service_26_0 (servicediscovery_service)) (typeattributeset servicediscovery_service_26_0 (servicediscovery_service))
(typeattributeset servicemanager_26_0 (servicemanager)) (typeattributeset servicemanager_26_0 (servicemanager))
(typeattributeset servicemanager_exec_26_0 (servicemanager_exec)) (typeattributeset servicemanager_exec_26_0 (servicemanager_exec))
......
private/file_contexts
+ 2
− 2
View file @ 346a913c
...@@ -51,7 +51,7 @@ ...@@ -51,7 +51,7 @@
/sepolicy u:object_r:sepolicy_file:s0 /sepolicy u:object_r:sepolicy_file:s0
/plat_service_contexts u:object_r:service_contexts_file:s0 /plat_service_contexts u:object_r:service_contexts_file:s0
/plat_hwservice_contexts u:object_r:hwservice_contexts_file:s0 /plat_hwservice_contexts u:object_r:hwservice_contexts_file:s0
/nonplat_service_contexts u:object_r:service_contexts_file:s0 /nonplat_service_contexts u:object_r:nonplat_service_contexts_file:s0
/nonplat_hwservice_contexts u:object_r:hwservice_contexts_file:s0 /nonplat_hwservice_contexts u:object_r:hwservice_contexts_file:s0
/vndservice_contexts u:object_r:vndservice_contexts_file:s0 /vndservice_contexts u:object_r:vndservice_contexts_file:s0
...@@ -298,7 +298,7 @@ ...@@ -298,7 +298,7 @@
/vendor/etc/selinux/nonplat_mac_permissions.xml u:object_r:mac_perms_file:s0 /vendor/etc/selinux/nonplat_mac_permissions.xml u:object_r:mac_perms_file:s0
/vendor/etc/selinux/nonplat_property_contexts u:object_r:property_contexts_file:s0 /vendor/etc/selinux/nonplat_property_contexts u:object_r:property_contexts_file:s0
/vendor/etc/selinux/nonplat_service_contexts u:object_r:service_contexts_file:s0 /vendor/etc/selinux/nonplat_service_contexts u:object_r:nonplat_service_contexts_file:s0
/vendor/etc/selinux/nonplat_hwservice_contexts u:object_r:hwservice_contexts_file:s0 /vendor/etc/selinux/nonplat_hwservice_contexts u:object_r:hwservice_contexts_file:s0
/vendor/etc/selinux/nonplat_file_contexts u:object_r:file_contexts_file:s0 /vendor/etc/selinux/nonplat_file_contexts u:object_r:file_contexts_file:s0
/vendor/etc/selinux/nonplat_seapp_contexts u:object_r:seapp_contexts_file:s0 /vendor/etc/selinux/nonplat_seapp_contexts u:object_r:seapp_contexts_file:s0
......
public/file.te
+ 3
− 0
View file @ 346a913c
...@@ -313,6 +313,9 @@ type sepolicy_file, file_type; ...@@ -313,6 +313,9 @@ type sepolicy_file, file_type;
# service_contexts file # service_contexts file
type service_contexts_file, file_type; type service_contexts_file, file_type;
# nonplat service_contexts file (only accessible on non full-treble devices)
type nonplat_service_contexts_file, file_type;
# hwservice_contexts file # hwservice_contexts file
type hwservice_contexts_file, file_type; type hwservice_contexts_file, file_type;
......
public/servicemanager.te
+ 2
− 3
View file @ 346a913c
...@@ -16,10 +16,9 @@ allow servicemanager { ...@@ -16,10 +16,9 @@ allow servicemanager {
-vndservicemanager -vndservicemanager
}:binder transfer; }:binder transfer;
# Access to all (system and vendor) service_contexts
# TODO(b/36866029) access to nonplat_service_contexts
# should not be allowed on full treble devices
allow servicemanager service_contexts_file:file r_file_perms; allow servicemanager service_contexts_file:file r_file_perms;
# nonplat_service_contexts only accessible on non full-treble devices
not_full_treble('allow servicemanager nonplat_service_contexts_file:file r_file_perms;')
# Check SELinux permissions. # Check SELinux permissions.
selinux_check_access(servicemanager) selinux_check_access(servicemanager)
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment