diff --git a/private/compat/26.0/26.0.cil b/private/compat/26.0/26.0.cil index fb4a9e6c8f842197d65c97f37bc4034b01445471..261fc6de2b9b065bad7edd516f58c5630a1f9e86 100644 --- a/private/compat/26.0/26.0.cil +++ b/private/compat/26.0/26.0.cil @@ -10,6 +10,7 @@ (type reboot_data_file) (type tracing_shell_writable) (type tracing_shell_writable_debug) +(type webview_zygote_socket) (typeattributeset accessibility_service_26_0 (accessibility_service)) (typeattributeset account_service_26_0 (account_service)) diff --git a/private/file_contexts b/private/file_contexts index 10a8a71b3652d03f387aba96bdf30d6534cc0ca5..f05d005796c5cddcef1ee168afc3e6be124eef85 100644 --- a/private/file_contexts +++ b/private/file_contexts @@ -157,7 +157,6 @@ /dev/socket/traced_consumer u:object_r:traced_consumer_socket:s0 /dev/socket/uncrypt u:object_r:uncrypt_socket:s0 /dev/socket/vold u:object_r:vold_socket:s0 -/dev/socket/webview_zygote u:object_r:webview_zygote_socket:s0 /dev/socket/wpa_eth[0-9] u:object_r:wpa_socket:s0 /dev/socket/wpa_wlan[0-9] u:object_r:wpa_socket:s0 /dev/socket/zygote u:object_r:zygote_socket:s0 @@ -276,8 +275,6 @@ /system/bin/bspatch u:object_r:update_engine_exec:s0 /system/bin/storaged u:object_r:storaged_exec:s0 /system/bin/thermalserviced u:object_r:thermalserviced_exec:s0 -/system/bin/webview_zygote32 u:object_r:webview_zygote_exec:s0 -/system/bin/webview_zygote64 u:object_r:webview_zygote_exec:s0 /system/bin/wpantund u:object_r:wpantund_exec:s0 /system/bin/virtual_touchpad u:object_r:virtual_touchpad_exec:s0 /system/bin/hw/android\.hidl\.allocator@1\.0-service u:object_r:hal_allocator_default_exec:s0 diff --git a/private/isolated_app.te b/private/isolated_app.te index 06ed2c82cf4e71ccc3c7b4b80ace561c2835cc21..a6276b38c68f906236b017cd61770017e3e0083f 100644 --- a/private/isolated_app.te +++ b/private/isolated_app.te @@ -108,7 +108,7 @@ neverallow isolated_app sdcard_type:file ~{ read write append getattr lock }; neverallow isolated_app { usb_device usbaccessory_device }:chr_file *; # Restrict the webview_zygote control socket. -neverallow isolated_app webview_zygote_socket:sock_file write; +neverallow isolated_app webview_zygote:sock_file write; # Limit the /sys files which isolated_app can access. This is important # for controlling isolated_app attack surface. diff --git a/private/system_server.te b/private/system_server.te index 6e6212ebc8fc6ecd5fba52e694993dbf456ace76..a52c5c73765fa3ed54daa61a6366f1edb12b31c9 100644 --- a/private/system_server.te +++ b/private/system_server.te @@ -153,7 +153,6 @@ unix_socket_connect(system_server, lmkd, lmkd) unix_socket_connect(system_server, mtpd, mtp) unix_socket_connect(system_server, netd, netd) unix_socket_connect(system_server, vold, vold) -unix_socket_connect(system_server, webview_zygote, webview_zygote) unix_socket_connect(system_server, zygote, zygote) unix_socket_connect(system_server, racoon, racoon) unix_socket_connect(system_server, uncrypt, uncrypt) @@ -161,6 +160,9 @@ unix_socket_connect(system_server, uncrypt, uncrypt) # Communicate over a socket created by surfaceflinger. allow system_server surfaceflinger:unix_stream_socket { read write setopt }; +# Communicate over a socket created by webview_zygote. +allow system_server webview_zygote:unix_stream_socket { read write connectto setopt }; + # Perform Binder IPC. binder_use(system_server) binder_call(system_server, appdomain) diff --git a/private/webview_zygote.te b/private/webview_zygote.te index e0921127b0a6232c606134f0a3e747678f393320..c9a401a77a40c8b93ddb5be36f1f50cc7877a3a2 100644 --- a/private/webview_zygote.te +++ b/private/webview_zygote.te @@ -6,9 +6,7 @@ typeattribute webview_zygote coredomain; # The webview_zygote needs to be able to transition domains. typeattribute webview_zygote mlstrustedsubject; -# When init launches the WebView zygote's executable, transition the -# resulting process into webview_zygote domain. -init_daemon_domain(webview_zygote) +tmpfs_domain(webview_zygote); # Allow reading/executing installed binaries to enable preloading the # installed WebView implementation. @@ -84,9 +82,8 @@ neverallow webview_zygote { domain -crash_dump }:process transition; # Having said that, exec() above is not allowed. neverallow webview_zygote *:file execute_no_trans; -# The only way to enter this domain is for init to exec() us or the zygote -# to fork a new webview_zygote child. -neverallow { domain -init } webview_zygote:process transition; +# The only way to enter this domain is for the zygote to fork a new +# webview_zygote child. neverallow { domain -zygote } webview_zygote:process dyntransition; # Disallow write access to properties. diff --git a/public/domain.te b/public/domain.te index dc967f3dfcc9a5bcfaabf3f4d9f35915118e4b31..eb66b30f5815638d811f3c87eb79c413ee3a2424 100644 --- a/public/domain.te +++ b/public/domain.te @@ -1022,7 +1022,7 @@ neverallow { domain -zygote -system_server } zygote:unix_stream_socket connectto neverallow { domain -system_server } zygote_socket:sock_file write; neverallow { domain -system_server -webview_zygote } webview_zygote:unix_stream_socket connectto; -neverallow { domain -system_server } webview_zygote_socket:sock_file write; +neverallow { domain -system_server } webview_zygote:sock_file write; neverallow { domain diff --git a/public/file.te b/public/file.te index 27ee0dcaa741839b40cfe9a627fcad45f17f3946..c6b4ba86c106991f7510ebcb54e793b1f5f0dcfd 100644 --- a/public/file.te +++ b/public/file.te @@ -331,7 +331,6 @@ type traced_producer_socket, file_type, coredomain_socket, mlstrustedobject; type traced_consumer_socket, file_type, coredomain_socket; type uncrypt_socket, file_type, coredomain_socket; type vold_socket, file_type, coredomain_socket; -type webview_zygote_socket, file_type, coredomain_socket; type wpa_socket, file_type, data_file_type, core_data_file_type; type zygote_socket, file_type, coredomain_socket; # UART (for GPS) control proc file