diff --git a/domain.te b/domain.te index f7eb3bce90d7a0057f1eece8122df894b99b19d6..bb8badd98e51e73cb0e9e705d223a639e4b7e644 100644 --- a/domain.te +++ b/domain.te @@ -339,7 +339,13 @@ neverallow * default_android_service:service_manager add; neverallow { domain -init } default_prop:property_service set; neverallow { domain -init } mmc_prop:property_service set; -neverallow { domain -init -recovery -system_server } frp_block_device:blk_file rw_file_perms; +neverallow { + domain + -init + -recovery + -system_server + -shell # Shell is further restricted in shell.te +} frp_block_device:blk_file rw_file_perms; # No domain other than recovery and update_engine can write to system partition(s). neverallow { domain -recovery -update_engine } system_block_device:blk_file write; diff --git a/shell.te b/shell.te index 182e5bc9308e2e8bf6edd07c555810037799429e..991a3371a86ea676be2478609f41f5e94fbd113e 100644 --- a/shell.te +++ b/shell.te @@ -141,6 +141,11 @@ allow shell dev_type:chr_file getattr; # /dev/fd is a symlink allow shell proc:lnk_file getattr; +# +# filesystem test for insucre blk_file's is done +# via hostside test +# +allow shell dev_type:blk_file getattr; ### ### Neverallow rules @@ -164,3 +169,6 @@ neverallow shell { hw_random_device kmem_device }:chr_file ~getattr; + +# Limit shell to only getattr on blk devices for host side tests. +neverallow shell dev_type:blk_file ~getattr;