From 55540755bc2f95ec3e0fb941a9e98dbf8aa24e7f Mon Sep 17 00:00:00 2001 From: Stephen Smalley <sds@tycho.nsa.gov> Date: Mon, 30 Sep 2013 13:54:09 -0400 Subject: [PATCH] Label adb keys file and allow access to it. The /adb_keys entry will only take effect if a restorecon is applied by init.rc on a kernel that includes the rootfs labeling support, but does no harm otherwise. The /data/misc/adb labeling ensures correct labeling of the adb_keys file created if the device has ro.adb.secure=1 set. Allow adbd to read the file. Change-Id: I97b3d86a69681330bba549491a2fb39df6cf20ef Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> --- adbd.te | 8 ++++++++ file.te | 1 + file_contexts | 3 ++- 3 files changed, 11 insertions(+), 1 deletion(-) diff --git a/adbd.te b/adbd.te index 8f2ac302c..4f332b357 100644 --- a/adbd.te +++ b/adbd.te @@ -6,3 +6,11 @@ unconfined_domain(adbd) domain_auto_trans(adbd, shell_exec, shell) # this is an entrypoint allow adbd rootfs:file entrypoint; + +# Read /data/misc/adb/adb_keys. +allow adbd adb_keys_file:dir search; +allow adbd adb_keys_file:file r_file_perms; + +# Allow access in case /data/misc/adb still has the old type. +allow adbd system_data_file:dir search; +allow adbd system_data_file:file r_file_perms; diff --git a/file.te b/file.te index 44b751621..a6868bf0c 100644 --- a/file.te +++ b/file.te @@ -54,6 +54,7 @@ type wifi_data_file, file_type, data_file_type; type radio_data_file, file_type, data_file_type; type nfc_data_file, file_type, data_file_type; type camera_calibration_file, file_type, data_file_type; +type adb_keys_file, file_type, data_file_type; # /data/data subdirectories - app sandboxes type app_data_file, file_type, data_file_type; type platform_app_data_file, file_type, data_file_type, mlstrustedobject; diff --git a/file_contexts b/file_contexts index 1e4b5a666..c4c4a094e 100644 --- a/file_contexts +++ b/file_contexts @@ -3,7 +3,7 @@ / u:object_r:rootfs:s0 # Data files -/adb_keys u:object_r:rootfs:s0 +/adb_keys u:object_r:adb_keys_file:s0 /default.prop u:object_r:rootfs:s0 /fstab\..* u:object_r:rootfs:s0 /init\..* u:object_r:rootfs:s0 @@ -175,6 +175,7 @@ /data/misc/wifi(/.*)? u:object_r:wifi_data_file:s0 /data/misc/camera(/.*)? u:object_r:camera_calibration_file:s0 /data/misc/dhcp(/.*)? u:object_r:dhcp_data_file:s0 +/data/misc/adb(/.*)? u:object_r:adb_keys_file:s0 # App sandboxes /data/data/.* u:object_r:app_data_file:s0 # Wallpaper file. -- GitLab