From d065f0483c89d18aa92f60646b3e0867072bc8ff Mon Sep 17 00:00:00 2001
From: Nick Kralevich <nnk@google.com>
Date: Fri, 25 Jul 2014 15:19:47 -0700
Subject: [PATCH] Resync lmp-dev-plus-aosp with master
A DO NOT MERGE change merged from lmp-dev to lmp-dev-plus-aosp.
This is expected, but it's causing unnecessary merge conflicts
when handling AOSP contributions.
Resolve those conflicts.
This is essentially a revert of bf696327246833c9aba55a645e6c433e9f321e27
for lmp-dev-plus-aosp only.
Change-Id: Icc66def7113ab45176ae015f659cb442d53bce5c
---
adbd.te | 6 ++++++
attributes | 3 +++
bluetooth.te | 9 +++++++++
bootanim.te | 4 ++++
domain.te | 2 ++
drmserver.te | 8 ++++++++
dumpstate.te | 15 +++++++++++++++
healthd.te | 4 ++++
inputflinger.te | 4 ++++
isolated_app.te | 9 +++++++++
keystore.te | 4 ++++
mediaserver.te | 10 ++++++++++
nfc.te | 9 +++++++++
platform_app.te | 10 ++++++++++
radio.te | 10 ++++++++++
surfaceflinger.te | 8 ++++++++
system_app.te | 11 +++++++++++
system_server.te | 3 +++
te_macros | 8 ++++++++
untrusted_app.te | 13 +++++++++++++
20 files changed, 150 insertions(+)
diff --git a/adbd.te b/adbd.te
index 58fdead68..3b654a152 100644
--- a/adbd.te
+++ b/adbd.te
@@ -68,3 +68,9 @@ allow adbd appdomain:unix_stream_socket connectto;
# ndk-gdb invokes adb pull of app_process, linker, and libc.so.
allow adbd zygote_exec:file r_file_perms;
allow adbd system_file:file r_file_perms;
+
+service_manager_local_audit_domain(adbd)
+auditallow adbd {
+ service_manager_type
+ -surfaceflinger_service
+}:service_manager find;
diff --git a/attributes b/attributes
index 613ed8f35..d40217aed 100644
--- a/attributes
+++ b/attributes
@@ -67,3 +67,6 @@ attribute bluetoothdomain;
# All domains used for binder service domains.
attribute binderservicedomain;
+
+# All domains that are excluded from the domain.te auditallow.
+attribute service_manager_local_audit;
diff --git a/bluetooth.te b/bluetooth.te
index 2b108a9e8..56fe17058 100644
--- a/bluetooth.te
+++ b/bluetooth.te
@@ -49,6 +49,15 @@ allow bluetooth bluetooth_prop:property_service set;
allow bluetooth pan_result_prop:property_service set;
allow bluetooth ctl_dhcp_pan_prop:property_service set;
+# Audited locally.
+service_manager_local_audit_domain(bluetooth)
+auditallow bluetooth {
+ service_manager_type
+ -bluetooth_service
+ -radio_service
+ -system_server_service
+}:service_manager find;
+
###
### Neverallow rules
###
diff --git a/bootanim.te b/bootanim.te
index 3a0a76f0f..759229553 100644
--- a/bootanim.te
+++ b/bootanim.te
@@ -11,3 +11,7 @@ allow bootanim gpu_device:chr_file rw_file_perms;
# /oem access
allow bootanim oemfs:dir search;
+
+# Audited locally.
+service_manager_local_audit_domain(bootanim)
+auditallow bootanim { service_manager_type -surfaceflinger_service }:service_manager find;
diff --git a/domain.te b/domain.te
index ba4c65ac0..015274bf0 100644
--- a/domain.te
+++ b/domain.te
@@ -159,7 +159,9 @@ allow domain asec_public_file:file r_file_perms;
allow domain { asec_public_file asec_apk_file }:dir r_dir_perms;
allow domain servicemanager:service_manager list;
+auditallow domain servicemanager:service_manager list;
allow domain service_manager_type:service_manager find;
+auditallow { domain -service_manager_local_audit } service_manager_type:service_manager find;
###
### neverallow rules
diff --git a/drmserver.te b/drmserver.te
index 1d6b07552..2a146b6bb 100644
--- a/drmserver.te
+++ b/drmserver.te
@@ -47,4 +47,12 @@ allow drmserver radio_data_file:file { read getattr };
allow drmserver drmserver_service:service_manager add;
+# Audited locally.
+service_manager_local_audit_domain(drmserver)
+auditallow drmserver {
+ service_manager_type
+ -drmserver_service
+ -system_server_service
+}:service_manager find;
+
selinux_check_access(drmserver)
diff --git a/dumpstate.te b/dumpstate.te
index b2870bcc0..481febad2 100644
--- a/dumpstate.te
+++ b/dumpstate.te
@@ -100,3 +100,18 @@ allow dumpstate net_data_file:file r_file_perms;
# Access /data/tombstones.
allow dumpstate tombstone_data_file:dir r_dir_perms;
allow dumpstate tombstone_data_file:file r_file_perms;
+
+service_manager_local_audit_domain(dumpstate)
+auditallow dumpstate {
+ service_manager_type
+ -drmserver_service
+ -healthd_service
+ -inputflinger_service
+ -keystore_service
+ -mediaserver_service
+ -nfc_service
+ -radio_service
+ -surfaceflinger_service
+ -system_app_service
+ -system_server_service
+}:service_manager find;
diff --git a/healthd.te b/healthd.te
index e7e165a84..3cb69bf8e 100644
--- a/healthd.te
+++ b/healthd.te
@@ -40,6 +40,10 @@ allow healthd self:capability sys_boot;
allow healthd healthd_service:service_manager add;
+# Audited locally.
+service_manager_local_audit_domain(healthd)
+auditallow healthd { service_manager_type -healthd_service }:service_manager find;
+
# Healthd needs to tell init to continue the boot
# process when running in charger mode.
unix_socket_connect(healthd, property, init)
diff --git a/inputflinger.te b/inputflinger.te
index 283bbbaf3..4377a104f 100644
--- a/inputflinger.te
+++ b/inputflinger.te
@@ -9,3 +9,7 @@ binder_service(inputflinger)
binder_call(inputflinger, system_server)
allow inputflinger inputflinger_service:service_manager add;
+
+# Audited locally.
+service_manager_local_audit_domain(inputflinger)
+auditallow inputflinger { service_manager_type -inputflinger_service }:service_manager find;
diff --git a/isolated_app.te b/isolated_app.te
index a156838bb..5929b2593 100644
--- a/isolated_app.te
+++ b/isolated_app.te
@@ -18,3 +18,12 @@ net_domain(isolated_app)
# Needed to allow dlopen() from Chrome renderer processes.
# See b/15902433 for details.
allow isolated_app app_data_file:file execute;
+
+# Audited locally.
+service_manager_local_audit_domain(isolated_app)
+auditallow isolated_app {
+ service_manager_type
+ -radio_service
+ -surfaceflinger_service
+ -system_server_service
+}:service_manager find;
diff --git a/keystore.te b/keystore.te
index afa701c7e..f2c5039b0 100644
--- a/keystore.te
+++ b/keystore.te
@@ -28,5 +28,9 @@ neverallow domain keystore:process ptrace;
allow keystore keystore_service:service_manager add;
+# Audited locally.
+service_manager_local_audit_domain(keystore)
+auditallow keystore { service_manager_type -keystore_service }:service_manager find;
+
# Check SELinux permissions.
selinux_check_access(keystore)
diff --git a/mediaserver.te b/mediaserver.te
index ce3dc0d55..3eb078d4b 100644
--- a/mediaserver.te
+++ b/mediaserver.te
@@ -80,6 +80,16 @@ allow mediaserver tee:unix_stream_socket connectto;
allow mediaserver mediaserver_service:service_manager add;
+# Audited locally.
+service_manager_local_audit_domain(mediaserver)
+auditallow mediaserver {
+ service_manager_type
+ -drmserver_service
+ -mediaserver_service
+ -system_server_service
+ -surfaceflinger_service
+}:service_manager find;
+
use_drmservice(mediaserver)
allow mediaserver drmserver:drmservice {
consumeRights
diff --git a/nfc.te b/nfc.te
index 65aaef76c..2b851a276 100644
--- a/nfc.te
+++ b/nfc.te
@@ -15,3 +15,12 @@ allow nfc sysfs_nfc_power_writable:file rw_file_perms;
allow nfc sysfs:file write;
allow nfc nfc_service:service_manager add;
+
+# Audited locally.
+service_manager_local_audit_domain(nfc)
+auditallow nfc {
+ service_manager_type
+ -mediaserver_service
+ -surfaceflinger_service
+ -system_server_service
+}:service_manager find;
diff --git a/platform_app.te b/platform_app.te
index 7ff8d62e2..a44e35d8a 100644
--- a/platform_app.te
+++ b/platform_app.te
@@ -27,3 +27,13 @@ allow platform_app media_rw_data_file:file create_file_perms;
# Write to /cache.
allow platform_app cache_file:dir create_dir_perms;
allow platform_app cache_file:file create_file_perms;
+
+# Audited locally.
+service_manager_local_audit_domain(platform_app)
+auditallow platform_app {
+ service_manager_type
+ -mediaserver_service
+ -radio_service
+ -surfaceflinger_service
+ -system_server_service
+}:service_manager find;
diff --git a/radio.te b/radio.te
index d0018eac2..5f45df33c 100644
--- a/radio.te
+++ b/radio.te
@@ -28,3 +28,13 @@ auditallow radio system_radio_prop:property_service set;
allow radio ctl_rildaemon_prop:property_service set;
allow radio radio_service:service_manager add;
+
+# Audited locally.
+service_manager_local_audit_domain(radio)
+auditallow radio {
+ service_manager_type
+ -mediaserver_service
+ -radio_service
+ -surfaceflinger_service
+ -system_server_service
+}:service_manager find;
diff --git a/surfaceflinger.te b/surfaceflinger.te
index c50861209..ff91993ec 100644
--- a/surfaceflinger.te
+++ b/surfaceflinger.te
@@ -59,6 +59,14 @@ allow surfaceflinger tee_device:chr_file rw_file_perms;
allow surfaceflinger surfaceflinger_service:service_manager add;
+# Audited locally.
+service_manager_local_audit_domain(surfaceflinger)
+auditallow surfaceflinger {
+ service_manager_type
+ -surfaceflinger_service
+ -system_server_service
+}:service_manager find;
+
###
### Neverallow rules
###
diff --git a/system_app.te b/system_app.te
index 2a7421b39..5a5888f2f 100644
--- a/system_app.te
+++ b/system_app.te
@@ -64,3 +64,14 @@ allow system_app keystore:keystore_key {
};
control_logd(system_app)
+
+# Audited locally.
+service_manager_local_audit_domain(system_app)
+auditallow system_app {
+ service_manager_type
+ -keystore_service
+ -nfc_service
+ -radio_service
+ -surfaceflinger_service
+ -system_server_service
+}:service_manager find;
diff --git a/system_server.te b/system_server.te
index c5e7b58f3..8ecfe5277 100644
--- a/system_server.te
+++ b/system_server.te
@@ -364,6 +364,9 @@ allow system_server pstorefs:file r_file_perms;
allow system_server system_server_service:service_manager add;
+# Audited locally.
+service_manager_local_audit_domain(system_server)
+
allow system_server keystore:keystore_key {
test
get
diff --git a/te_macros b/te_macros
index fdcfe87db..f18cd36d5 100644
--- a/te_macros
+++ b/te_macros
@@ -109,6 +109,7 @@ typeattribute $1 appdomain;
tmpfs_domain($1)
# Map with PROT_EXEC.
allow $1 $1_tmpfs:file execute;
+service_manager_local_audit_domain($1)
')
#####################################
@@ -360,6 +361,13 @@ define(`use_keystore', `
')
###########################################
+# service_manager_local_audit_domain(domain)
+# Has its own auditallow rule on service_manager
+# and should be excluded from the domain.te auditallow.
+define(`service_manager_local_audit_domain', `
+ typeattribute $1 service_manager_local_audit;
+')
+
# use_drmservice(domain)
# Ability to use DrmService which requires
# DrmService to call getpidcon.
diff --git a/untrusted_app.te b/untrusted_app.te
index f29149e3d..c97b4513b 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -64,6 +64,19 @@ allow untrusted_app media_rw_data_file:file create_file_perms;
allow untrusted_app cache_file:dir create_dir_perms;
allow untrusted_app cache_file:file create_file_perms;
+# Audited locally.
+service_manager_local_audit_domain(untrusted_app)
+auditallow untrusted_app {
+ service_manager_type
+ -drmserver_service
+ -keystore_service
+ -mediaserver_service
+ -nfc_service
+ -radio_service
+ -surfaceflinger_service
+ -system_server_service
+}:service_manager find;
+
###
### neverallow rules
###
--
GitLab