Skip to content
GitLab
Explore
Sign in
Primary navigation
Search or go to…
Project
A
AndroidSystemSEPolicy
Manage
Activity
Members
Code
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Deploy
Releases
Container registry
Model registry
Analyze
Contributor analytics
Repository analytics
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
Community forum
Contribute to GitLab
Provide feedback
Terms and privacy
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
Werner Sembach
AndroidSystemSEPolicy
Commits
39f92a83
Commit
39f92a83
authored
10 years ago
by
Nick Kralevich
Committed by
Android Git Automerger
10 years ago
Browse files
Options
Downloads
Plain Diff
am
f7e98fe2
: Merge "recovery.te: add /data neverallow rules"
* commit '
f7e98fe2
': recovery.te: add /data neverallow rules
parents
57df7115
f7e98fe2
Branches
Branches containing commit
Tags
Tags containing commit
No related merge requests found
Changes
4
Hide whitespace changes
Inline
Side-by-side
Showing
4 changed files
Android.mk
+1
-0
1 addition, 0 deletions
Android.mk
domain.te
+2
-2
2 additions, 2 deletions
domain.te
neverallow_macros
+5
-0
5 additions, 0 deletions
neverallow_macros
recovery.te
+17
-0
17 additions, 0 deletions
recovery.te
with
25 additions
and
2 deletions
Android.mk
+
1
−
0
View file @
39f92a83
...
@@ -83,6 +83,7 @@ sepolicy_build_files := security_classes \
...
@@ -83,6 +83,7 @@ sepolicy_build_files := security_classes \
initial_sids
\
initial_sids
\
access_vectors
\
access_vectors
\
global_macros
\
global_macros
\
neverallow_macros
\
mls_macros
\
mls_macros
\
mls
\
mls
\
policy_capabilities
\
policy_capabilities
\
...
...
This diff is collapsed.
Click to expand it.
domain.te
+
2
−
2
View file @
39f92a83
...
@@ -291,8 +291,8 @@ neverallow {
...
@@ -291,8 +291,8 @@ neverallow {
} { fs_type -rootfs }:file execute;
} { fs_type -rootfs }:file execute;
# Only the init property service should write to /data/property.
# Only the init property service should write to /data/property.
neverallow { domain -init } property_data_file:dir
{ create setattr relabelfrom rename write add_name remove_name rmdir }
;
neverallow { domain -init } property_data_file:dir
no_w_dir_perms
;
neverallow { domain -init } property_data_file:file
{ create setattr relabelfrom write append unlink link rename }
;
neverallow { domain -init } property_data_file:file
no_w_file_perms
;
# Only recovery should be doing writes to /system
# Only recovery should be doing writes to /system
neverallow { domain -recovery } { system_file exec_type }:dir_file_class_set
neverallow { domain -recovery } { system_file exec_type }:dir_file_class_set
...
...
This diff is collapsed.
Click to expand it.
neverallow_macros
0 → 100644
+
5
−
0
View file @
39f92a83
#
# Common neverallow permissions
define(`no_w_file_perms', `{ append create link unlink relabelfrom rename setattr write }')
define(`no_x_file_perms', `{ execute execute_no_trans }')
define(`no_w_dir_perms', `{ add_name create link relabelfrom remove_name rename reparent rmdir setattr write }')
This diff is collapsed.
Click to expand it.
recovery.te
+
17
−
0
View file @
39f92a83
...
@@ -98,3 +98,20 @@ recovery_only(`
...
@@ -98,3 +98,20 @@ recovery_only(`
# set scheduling parameters for a kernel domain task.
# set scheduling parameters for a kernel domain task.
allow recovery kernel:process setsched;
allow recovery kernel:process setsched;
')
')
###
### neverallow rules
###
# Recovery should never touch /data.
#
# In particular, if /data is encrypted, it is not accessible
# to recovery anyway.
#
# For now, we only enforce write/execute restrictions, as domain.te
# contains a number of read-only rules that apply to all
# domains, including recovery.
#
# TODO: tighten this up further.
neverallow recovery data_file_type:file { no_w_file_perms no_x_file_perms };
neverallow recovery data_file_type:dir no_w_dir_perms;
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment