From 7c065a9f138e5e552b087a307d15c870b6a58553 Mon Sep 17 00:00:00 2001
From: William Roberts <william.c.roberts@linux.intel.com>
Date: Tue, 12 May 2015 20:32:29 -0700
Subject: [PATCH] neverallow "write ops" on system_data_file from "others"
Only a few system level components should be creating and writing
these files, force a type transition for shared files.
Signed-off-by: William Roberts <william.c.roberts@linux.intel.com>
(cherry picked from commit 529a8634e1d31967db2600ba27e55fc35b7d0195)
Change-Id: I9c4df4e332426e253dd6fcd4f8ea0348dc3a5f54
Bug: 21924438
---
domain.te | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/domain.te b/domain.te
index 8fb020b98..3775c95da 100644
--- a/domain.te
+++ b/domain.te
@@ -424,3 +424,22 @@ neverallow { domain -init } proc:{ file dir } mounton;
# from a domain to a non-domain type and vice versa.
neverallow domain ~domain:process { transition dyntransition };
neverallow ~domain domain:process { transition dyntransition };
+
+#
+# Only system_app and system_server should be creating or writing
+# their files. The proper way to share files is to setup
+# type transitions to a more specific type or assigning a type
+# to its parent directory via a file_contexts entry.
+# Example type transition:
+# mydomain.te:file_type_auto_trans(mydomain, system_data_file, new_file_type)
+#
+neverallow {
+ domain
+ -system_server
+ -system_app
+ -init
+ -installd # for relabelfrom and unlink, check for this in explicit neverallow
+} system_data_file:file no_w_file_perms;
+# do not grant anything greater than r_file_perms and relabelfrom unlink
+# to installd
+neverallow installd system_data_file:file ~{ r_file_perms relabelfrom unlink };
--
GitLab