From 8aa754c9bef003d9429a44e86043661979b75e7b Mon Sep 17 00:00:00 2001
From: Nick Kralevich <nnk@google.com>
Date: Mon, 19 May 2014 21:49:50 -0700
Subject: [PATCH] Don't allow ptrace on keystore

keystore may hold sensitive information in it's memory. Don't
allow anyone to ptrace keystore.

Change-Id: I4e3717e482b9fd128d38ce687c03122d41678b6f
---
 debuggerd.te | 2 +-
 keystore.te  | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/debuggerd.te b/debuggerd.te
index 30204f20e..6bbeac4a6 100644
--- a/debuggerd.te
+++ b/debuggerd.te
@@ -9,7 +9,7 @@ allow debuggerd self:capability2 { syslog };
 allow debuggerd domain:dir r_dir_perms;
 allow debuggerd domain:file r_file_perms;
 allow debuggerd domain:lnk_file read;
-allow debuggerd { domain -init -ueventd -watchdogd -healthd -adbd }:process ptrace;
+allow debuggerd { domain -init -ueventd -watchdogd -healthd -adbd -keystore }:process ptrace;
 security_access_policy(debuggerd)
 allow debuggerd system_data_file:dir create_dir_perms;
 allow debuggerd system_data_file:dir relabelfrom;
diff --git a/keystore.te b/keystore.te
index e92efaa4f..8aa1d7d4a 100644
--- a/keystore.te
+++ b/keystore.te
@@ -15,7 +15,7 @@ allow keystore tee:unix_stream_socket connectto;
 ###
 ### Neverallow rules
 ###
-### Protect our files from others
+### Protect ourself from others
 ###
 
 neverallow { domain -keystore } keystore_data_file:dir ~{ open create read getattr setattr search relabelto };
@@ -23,3 +23,5 @@ neverallow { domain -keystore } keystore_data_file:notdevfile_class_set ~{ relab
 
 neverallow { domain -keystore -init -kernel -recovery } keystore_data_file:dir *;
 neverallow { domain -keystore -init -kernel -recovery } keystore_data_file:notdevfile_class_set *;
+
+neverallow domain keystore:process ptrace;
-- 
GitLab