Introduce asec_public_file type.

This new type will allow us to write finer-grained
policy concerning asec containers. Some files of
these containers need to be world readable.

Change-Id: Iefee74214d664acd262edecbb4f981d633ff96ce
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>

domain.te

@@ -132,6 +132,10 @@ selinux_getenforce(domain)
 allow domain security_file:dir { search getattr };
 allow domain security_file:file getattr;
 
+# World readable asec image contents
+allow domain asec_public_file:file r_file_perms;
+allow domain { asec_public_file asec_apk_file }:dir r_dir_perms;
+
 ######## Backwards compatibility - Unlabeled files ############
 
 # Revert to DAC rules when looking at unlabeled files. Over time, the number

drmserver.te

@@ -21,7 +21,7 @@ allow drmserver self:{ tcp_socket udp_socket } *;
 allow drmserver port:tcp_socket name_connect;
 allow drmserver tee_device:chr_file rw_file_perms;
 allow drmserver platform_app_data_file:file { read write getattr };
-allow drmserver { app_data_file asec_apk_file }:file { read write getattr };
+allow drmserver app_data_file:file { read write getattr };
 allow drmserver sdcard_type:file { read write getattr };
 r_dir_file(drmserver, efs_file)
 

file.te

@@ -85,6 +85,8 @@ type efs_file, file_type;
 type wallpaper_file, file_type, mlstrustedobject;
 # /mnt/asec
 type asec_apk_file, file_type, data_file_type;
+# Elements of asec files (/mnt/asec) that are world readable
+type asec_public_file, file_type, data_file_type;
 # /data/app-asec
 type asec_image_file, file_type, data_file_type;
 # /data/backup and /data/secure/backup

file_contexts

@@ -224,5 +224,7 @@
 /sys/kernel/uevent_helper --	u:object_r:usermodehelper:s0
 #############################
 # asec containers
-/mnt/asec(/.*)?         u:object_r:asec_apk_file:s0
-/data/app-asec(/.*)?    u:object_r:asec_image_file:s0
+/mnt/asec(/.*)?           u:object_r:asec_apk_file:s0
+/mnt/asec/[^/]+/res.zip   u:object_r:asec_public_file:s0
+/mnt/asec/[^/]+/lib(/.*)? u:object_r:asec_public_file:s0
+/data/app-asec(/.*)?      u:object_r:asec_image_file:s0

mediaserver.te

@@ -39,7 +39,7 @@ allow mediaserver audio_device:chr_file rw_file_perms;
 allow mediaserver sysfs:file rw_file_perms;
 
 # XXX Why?
-allow mediaserver { apk_data_file asec_apk_file }:file { read getattr };
+allow mediaserver apk_data_file:file { read getattr };
 
 # Access camera device.
 allow mediaserver camera_device:chr_file rw_file_perms;

shared_app.te

@@ -10,5 +10,3 @@ platform_app_domain(shared_app)
 net_domain(shared_app)
 # Access bluetooth.
 bluetooth_domain(shared_app)
-# ASEC
-r_dir_file(shared_app, asec_apk_file)

system_app.te

@@ -31,10 +31,6 @@ selinux_getenforce(system_app)
 # Settings app reads sdcard for storage stats
 allow system_app sdcard_type:dir r_dir_perms;
 
-# Allow settings app to read from asec
-allow system_app asec_apk_file:dir search;
-allow system_app asec_apk_file:file r_file_perms;
-
 # Write to properties
 unix_socket_connect(system_app, property, init)
 allow system_app debug_prop:property_service set;

untrusted_app.te

@@ -32,6 +32,8 @@ allow untrusted_app sdcard_external:file create_file_perms;
 # ASEC
 allow untrusted_app asec_apk_file:dir { getattr };
 allow untrusted_app asec_apk_file:file r_file_perms;
+# Execute libs in asec containers.
+allow untrusted_app asec_public_file:file execute;
 
 # Create tcp/udp sockets
 allow untrusted_app node_type:{ tcp_socket udp_socket } node_bind;

vold.te

@@ -71,8 +71,11 @@ allow vold ctl_default_prop:property_service set;
 allow vold asec_image_file:file create_file_perms;
 allow vold asec_image_file:dir rw_dir_perms;
 security_access_policy(vold)
-allow vold asec_apk_file:dir { rw_dir_perms setattr };
-allow vold asec_apk_file:file { r_file_perms setattr };
+relabelto_domain(vold)
+allow vold asec_apk_file:dir { rw_dir_perms setattr relabelfrom };
+allow vold asec_public_file:dir { relabelto setattr };
+allow vold asec_apk_file:file { r_file_perms setattr relabelfrom };
+allow vold asec_public_file:file { relabelto setattr };
 
 # Handle wake locks (used for device encryption)
 allow vold sysfs_wake_lock:file rw_file_perms;