diff --git a/private/property_contexts b/private/property_contexts index 39e8a8db894aa4e2826e7527e592fcde38bb6723..80476cc25061df0e94cecdd4218a8ecca886bb29 100644 --- a/private/property_contexts +++ b/private/property_contexts @@ -61,7 +61,9 @@ persist.vendor.overlay. u:object_r:overlay_prop:s0 ro.boot.vendor.overlay. u:object_r:overlay_prop:s0 ro.boottime. u:object_r:boottime_prop:s0 ro.serialno u:object_r:serialno_prop:s0 +ro.boot.btmacaddr u:object_r:bluetooth_prop:s0 ro.boot.serialno u:object_r:serialno_prop:s0 +ro.bt. u:object_r:bluetooth_prop:s0 # Boolean property set by system server upon boot indicating # if device owner is provisioned. diff --git a/public/app.te b/public/app.te index 77af57c8cc972fdc191f6f835d270520c66de489..370f5394ba9fc9fd8da8a1ee69e5b82eece081c2 100644 --- a/public/app.te +++ b/public/app.te @@ -468,3 +468,11 @@ neverallow { appdomain -shell # bugreport } input_device:chr_file ~getattr; + +# Do not allow access to Bluetooth-related system properties except for a few whitelisted domains. +# neverallow rules for access to Bluetooth-related data files are above. +neverallow { + appdomain + -bluetooth + -system_app +} bluetooth_prop:file create_file_perms; diff --git a/public/property.te b/public/property.te index ce5ce2f9b711c241c123009e903db88b7a9b91c1..1bde35c4d80817018cfd28718999fcd4acc08b19 100644 --- a/public/property.te +++ b/public/property.te @@ -1,6 +1,6 @@ type audio_prop, property_type, core_property_type; type boottime_prop, property_type; -type bluetooth_prop, property_type, core_property_type; +type bluetooth_prop, property_type; type config_prop, property_type, core_property_type; type cppreopt_prop, property_type, core_property_type; type ctl_bootanim_prop, property_type; @@ -61,7 +61,6 @@ allow property_type tmpfs:filesystem associate; neverallow * { core_property_type -audio_prop - -bluetooth_prop -config_prop -cppreopt_prop -dalvik_prop diff --git a/public/webview_zygote.te b/public/webview_zygote.te index 71f3f9a3c2515ffccb3e061c181160643b64e6cd..93bbbb1ef87c2f63ffce8aaf0c62861414723c28 100644 --- a/public/webview_zygote.te +++ b/public/webview_zygote.te @@ -102,3 +102,7 @@ neverallow webview_zygote domain:{ netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket } *; + +# Do not allow access to Bluetooth-related system properties. +# neverallow rules for Bluetooth-related data files are listed above. +neverallow webview_zygote bluetooth_prop:file create_file_perms; diff --git a/public/zygote.te b/public/zygote.te index aabf12fd484b3861bc72455ab99de1df04c71ec6..385be94a3477675804dac2d20a5e2d696a3196e7 100644 --- a/public/zygote.te +++ b/public/zygote.te @@ -123,3 +123,6 @@ neverallow zygote { data_file_type -dalvikcache_data_file # map PROT_EXEC }:file no_x_file_perms; + +# Do not allow access to Bluetooth-related system properties and files +neverallow zygote bluetooth_prop:file create_file_perms;