diff --git a/domain.te b/domain.te index 8c66e1bce923b242d25ecb95763f2aba2ea585e3..9ecb1371dbbbc2e4447c476f1329ae5c22e4626c 100644 --- a/domain.te +++ b/domain.te @@ -132,6 +132,10 @@ selinux_getenforce(domain) allow domain security_file:dir { search getattr }; allow domain security_file:file getattr; +# World readable asec image contents +allow domain asec_public_file:file r_file_perms; +allow domain { asec_public_file asec_apk_file }:dir r_dir_perms; + ######## Backwards compatibility - Unlabeled files ############ # Revert to DAC rules when looking at unlabeled files. Over time, the number diff --git a/drmserver.te b/drmserver.te index 2fbb6613ef69f3483947aca6e9f56741d263d5eb..eb050a2cd1ec5db4240d2f41c1592efdbd80f85e 100644 --- a/drmserver.te +++ b/drmserver.te @@ -21,7 +21,7 @@ allow drmserver self:{ tcp_socket udp_socket } *; allow drmserver port:tcp_socket name_connect; allow drmserver tee_device:chr_file rw_file_perms; allow drmserver platform_app_data_file:file { read write getattr }; -allow drmserver { app_data_file asec_apk_file }:file { read write getattr }; +allow drmserver app_data_file:file { read write getattr }; allow drmserver sdcard_type:file { read write getattr }; r_dir_file(drmserver, efs_file) diff --git a/file.te b/file.te index ef6c55c2262f301e3a4145efe6ce7bba020d186e..bde3a53270144d4005ec21f38d7434b9089f3901 100644 --- a/file.te +++ b/file.te @@ -85,6 +85,8 @@ type efs_file, file_type; type wallpaper_file, file_type, mlstrustedobject; # /mnt/asec type asec_apk_file, file_type, data_file_type; +# Elements of asec files (/mnt/asec) that are world readable +type asec_public_file, file_type, data_file_type; # /data/app-asec type asec_image_file, file_type, data_file_type; # /data/backup and /data/secure/backup diff --git a/file_contexts b/file_contexts index 35dee30a14980f1578d869e9c3de77c7e48e9d5c..1763a7b0a3732d95118e8509453a079dbfc15bb2 100644 --- a/file_contexts +++ b/file_contexts @@ -224,5 +224,7 @@ /sys/kernel/uevent_helper -- u:object_r:usermodehelper:s0 ############################# # asec containers -/mnt/asec(/.*)? u:object_r:asec_apk_file:s0 -/data/app-asec(/.*)? u:object_r:asec_image_file:s0 +/mnt/asec(/.*)? u:object_r:asec_apk_file:s0 +/mnt/asec/[^/]+/res.zip u:object_r:asec_public_file:s0 +/mnt/asec/[^/]+/lib(/.*)? u:object_r:asec_public_file:s0 +/data/app-asec(/.*)? u:object_r:asec_image_file:s0 diff --git a/mediaserver.te b/mediaserver.te index ad7cdcb467da9ca2a49579540363c22bf0e4261b..31b4818862de6a25df068072bd5a278c5e819246 100644 --- a/mediaserver.te +++ b/mediaserver.te @@ -39,7 +39,7 @@ allow mediaserver audio_device:chr_file rw_file_perms; allow mediaserver sysfs:file rw_file_perms; # XXX Why? -allow mediaserver { apk_data_file asec_apk_file }:file { read getattr }; +allow mediaserver apk_data_file:file { read getattr }; # Access camera device. allow mediaserver camera_device:chr_file rw_file_perms; diff --git a/shared_app.te b/shared_app.te index 4ab90fe26ff2a1f8e689898598991ef117dc790d..22238824e599fa6843f0bedb9b3961109dcdaf2c 100644 --- a/shared_app.te +++ b/shared_app.te @@ -10,5 +10,3 @@ platform_app_domain(shared_app) net_domain(shared_app) # Access bluetooth. bluetooth_domain(shared_app) -# ASEC -r_dir_file(shared_app, asec_apk_file) diff --git a/system_app.te b/system_app.te index a80cc4548ee083cb83e8103aa8d6a09c52ac7157..4f5492cff54331d4f832f7b05a4fe59ab71bf496 100644 --- a/system_app.te +++ b/system_app.te @@ -31,10 +31,6 @@ selinux_getenforce(system_app) # Settings app reads sdcard for storage stats allow system_app sdcard_type:dir r_dir_perms; -# Allow settings app to read from asec -allow system_app asec_apk_file:dir search; -allow system_app asec_apk_file:file r_file_perms; - # Write to properties unix_socket_connect(system_app, property, init) allow system_app debug_prop:property_service set; diff --git a/untrusted_app.te b/untrusted_app.te index 1904249999acc5f5e85aaeae718918a1e6cd0967..96c7009749f9c1063670e0d6059bae9765d03821 100644 --- a/untrusted_app.te +++ b/untrusted_app.te @@ -32,6 +32,8 @@ allow untrusted_app sdcard_external:file create_file_perms; # ASEC allow untrusted_app asec_apk_file:dir { getattr }; allow untrusted_app asec_apk_file:file r_file_perms; +# Execute libs in asec containers. +allow untrusted_app asec_public_file:file execute; # Create tcp/udp sockets allow untrusted_app node_type:{ tcp_socket udp_socket } node_bind; diff --git a/vold.te b/vold.te index 22198fdc9da1b2c1b141aab0a04c2c4428d96c07..18c909de650d3aa2fcf1c1f80c85a8dbe1bf5740 100644 --- a/vold.te +++ b/vold.te @@ -71,8 +71,11 @@ allow vold ctl_default_prop:property_service set; allow vold asec_image_file:file create_file_perms; allow vold asec_image_file:dir rw_dir_perms; security_access_policy(vold) -allow vold asec_apk_file:dir { rw_dir_perms setattr }; -allow vold asec_apk_file:file { r_file_perms setattr }; +relabelto_domain(vold) +allow vold asec_apk_file:dir { rw_dir_perms setattr relabelfrom }; +allow vold asec_public_file:dir { relabelto setattr }; +allow vold asec_apk_file:file { r_file_perms setattr relabelfrom }; +allow vold asec_public_file:file { relabelto setattr }; # Handle wake locks (used for device encryption) allow vold sysfs_wake_lock:file rw_file_perms;