Merge \\\\"ueventd: allow getattr on blk and chr types.\\\\" am: c7927b8d...

Merge \\\\"ueventd: allow getattr on blk and chr types.\\\\" am: c7927b8d am: a7f70ac0 am: 2b165b1e
am: 1ff54eb2

Change-Id: Idd3dc1ea795c953a4c602669fdefba509484df8c

domain.te

@@ -230,7 +230,7 @@ neverallow {
   -init
   -kernel
   -shell # For CTS and is restricted to getattr in shell.te
-  -ueventd
+  -ueventd # Further restricted in ueventd.te
 } kmem_device:chr_file *;
 neverallow * kmem_device:chr_file ~{ create relabelto unlink setattr getattr };
 
@@ -345,6 +345,7 @@ neverallow {
   -recovery
   -system_server
   -shell # Shell is further restricted in shell.te
+  -ueventd # Further restricted in ueventd.te
 } frp_block_device:blk_file rw_file_perms;
 
 # No domain other than recovery and update_engine can write to system partition(s).

ueventd.te

@@ -22,8 +22,8 @@ allow ueventd sysfs_devices_system_cpu:file rw_file_perms;
 allow ueventd tmpfs:chr_file rw_file_perms;
 allow ueventd dev_type:dir create_dir_perms;
 allow ueventd dev_type:lnk_file { create unlink };
-allow ueventd dev_type:chr_file { create setattr unlink };
-allow ueventd dev_type:blk_file { relabelfrom relabelto create setattr unlink };
+allow ueventd dev_type:chr_file { getattr create setattr unlink };
+allow ueventd dev_type:blk_file { getattr relabelfrom relabelto create setattr unlink };
 allow ueventd self:netlink_kobject_uevent_socket create_socket_perms;
 allow ueventd efs_file:dir search;
 allow ueventd efs_file:file r_file_perms;
@@ -44,3 +44,9 @@ allow ueventd self:process setfscreate;
 neverallow ueventd property_socket:sock_file write;
 neverallow ueventd init:unix_stream_socket connectto;
 neverallow ueventd property_type:property_service set;
+
+# Restrict ueventd access on block devices to maintenence operations.
+neverallow ueventd dev_type:blk_file ~{ getattr relabelfrom relabelto create setattr unlink };
+
+# Only relabelto as we would never want to relabelfrom kmem_device
+neverallow ueventd kmem_device:chr_file ~{ getattr create setattr unlink relabelto };