From 45ba665cfcc5c2fc3242a013e6070c2bed860b0a Mon Sep 17 00:00:00 2001
From: Stephen Smalley <sds@tycho.nsa.gov>
Date: Fri, 27 Sep 2013 10:24:49 -0400
Subject: [PATCH] Label and allow access to /data/system/ndebugsocket.
Otherwise it defaults to the label of /data/system and
cannot be distinguished from any other socket in that directory.
Also adds allow rule required for pre-existing wpa_socket transition
to function without unconfined_domain.
Change-Id: I57179aa18786bd56d247f397347e546cca978e41
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
debuggerd.te | 3 +++
file.te | 1 +
system_server.te | 6 ++++++
3 files changed, 10 insertions(+)
diff --git a/debuggerd.te b/debuggerd.te
index 31453c9ce..690e69548 100644
--- a/debuggerd.te
+++ b/debuggerd.te
@@ -7,3 +7,6 @@ init_daemon_domain(debuggerd)
unconfined_domain(debuggerd)
relabelto_domain(debuggerd)
allow debuggerd tombstone_data_file:dir relabelto;
+
+# Connect to system_server via /data/system/ndebugsocket.
+unix_socket_connect(debuggerd, system_ndebug, system_server)
diff --git a/file.te b/file.te
index aeea030b2..44b751621 100644
--- a/file.te
+++ b/file.te
@@ -98,6 +98,7 @@ type racoon_socket, file_type;
type rild_socket, file_type;
type rild_debug_socket, file_type;
type system_wpa_socket, file_type;
+type system_ndebug_socket, file_type;
type vold_socket, file_type;
type wpa_socket, file_type;
type zygote_socket, file_type;
diff --git a/system_server.te b/system_server.te
index d4930ab27..35df21c66 100644
--- a/system_server.te
+++ b/system_server.te
@@ -25,6 +25,12 @@ allow system_server self:capability {
# Create a socket for receiving info from wpa.
type_transition system_server wifi_data_file:sock_file system_wpa_socket;
+allow system_server system_wpa_socket:sock_file create_file_perms;
+
+# Create a socket for connections from debuggerd.
+type_transition system_server system_data_file:sock_file system_ndebug_socket "ndebugsocket";
+allow system_server system_ndebug_socket:sock_file create_file_perms;
+
allow system_server self:zygote { specifyids specifyrlimits specifyseinfo };
allow system_server backup_data_file:dir relabelto;
--
GitLab