diff --git a/private/property_contexts b/private/property_contexts index 23150343f13181084f4aec044fc5befb89bda66f..8eb2f28b268205519818a351f70e8735d1307748 100644 --- a/private/property_contexts +++ b/private/property_contexts @@ -50,6 +50,7 @@ persist.logd.logpersistd u:object_r:logpersistd_logging_prop:s0 logd.logpersistd u:object_r:logpersistd_logging_prop:s0 persist.log.tag u:object_r:log_tag_prop:s0 persist.mmc. u:object_r:mmc_prop:s0 +persist.netd.stable_secret u:object_r:netd_stable_secret_prop:s0 persist.sys. u:object_r:system_prop:s0 persist.sys.safemode u:object_r:safemode_prop:s0 ro.sys.safemode u:object_r:safemode_prop:s0 diff --git a/public/netd.te b/public/netd.te index 691887fcd39e56743135d50fb66b5d054e3c6850..77974bf40fb0647f0fe9b189af0063c6cbefc12e 100644 --- a/public/netd.te +++ b/public/netd.te @@ -62,6 +62,7 @@ allow netd dnsmasq:process signal; allow netd clatd:process signal; set_prop(netd, ctl_mdnsd_prop) +set_prop(netd, netd_stable_secret_prop) # Allow netd to publish a binder service and make binder calls. binder_use(netd) @@ -108,3 +109,11 @@ neverallow netd { app_data_file system_data_file }:dir_file_class_set write; neverallow { domain -system_server -dumpstate -netd } netd_service:service_manager find; neverallow { domain -system_server -dumpstate } netd:binder call; neverallow netd { domain -system_server -servicemanager userdebug_or_eng(`-su') }:binder call; + +# persist.netd.stable_secret contains RFC 7217 secret key which should never be +# leaked to other processes. Make sure it never leaks. +neverallow { domain -netd -init } netd_stable_secret_prop:file r_file_perms; + +# We want to ensure that no other process ever tries tampering with persist.netd.stable_secret, +# the RFC 7217 secret key managed by netd. Doing so could compromise user privacy. +neverallow { domain -netd -init } netd_stable_secret_prop:property_service set; diff --git a/public/property.te b/public/property.te index c633dabe2fca4f086c1d44839088cb2c8426ce9e..4cc2701315a34dd4f7a31b7b794d4abe53e25fda 100644 --- a/public/property.te +++ b/public/property.te @@ -31,6 +31,7 @@ type log_tag_prop, property_type, log_property_type; type mmc_prop, property_type; type net_dns_prop, property_type; type net_radio_prop, property_type, core_property_type; +type netd_stable_secret_prop, property_type; type nfc_prop, property_type, core_property_type; type overlay_prop, property_type; type pan_result_prop, property_type, core_property_type;