From df125b90b456748f834df06e69d9e8aa05054c69 Mon Sep 17 00:00:00 2001
From: Mark Salyzyn <salyzyn@google.com>
Date: Tue, 6 Dec 2016 08:57:23 -0800
Subject: [PATCH] init: only allowed to transition to logpersist or logd
Generate a compile time error if someone unexpectedly tries to
transition into logpersist or logd domain.
Test: compile
Bug: 30566487
Change-Id: Ib55f301f104ad63de5ac513cdc9dc9937e3ba48d
---
public/logd.te | 4 ++++
public/logpersist.te | 4 ++++
2 files changed, 8 insertions(+)
diff --git a/public/logd.te b/public/logd.te
index e8d38618f..6478123f0 100644
--- a/public/logd.te
+++ b/public/logd.te
@@ -43,3 +43,7 @@ neverallow logd system_file:dir_file_class_set write;
# Write to files in /data/data or system files on /data
neverallow logd { app_data_file system_data_file }:dir_file_class_set write;
+
+# Only init is allowed to enter the logd domain via exec()
+neverallow { domain -init } logd:process transition;
+neverallow * logd:process dyntransition;
diff --git a/public/logpersist.te b/public/logpersist.te
index 86eb0d3be..ab7d04b77 100644
--- a/public/logpersist.te
+++ b/public/logpersist.te
@@ -14,3 +14,7 @@ neverallow logpersist domain:process ptrace;
# Write to files in /data/data or system files on /data except misc_logd_file
neverallow logpersist { app_data_file system_data_file }:dir_file_class_set write;
+
+# Only init is allowed to enter the logpersist domain via exec()
+neverallow { domain -init } logpersist:process transition;
+neverallow * logpersist:process dyntransition;
--
GitLab