From eb1bbf2632dc20e836f3d340feab548ee496e291 Mon Sep 17 00:00:00 2001
From: Stephen Smalley <sds@tycho.nsa.gov>
Date: Thu, 29 May 2014 14:35:55 -0400
Subject: [PATCH] Clean up kernel, init, and recovery domains.
Narrow the relabelto rules to a more specific type set
for each domain.
Drop mount permissions from the kernel domain since mounting
occurs after switching to the init domain. This was likely
a residual of when all processes were left in the kernel domain
on a recovery boot due to the missing setcon statement in the
recovery init.rc.
Be consistent with unlabeled filesystems (i.e. filesystems
without any matching fs_use or genfs_contexts entry) so
that we can also unmount them.
Add comments to note the reason for various rules.
Change-Id: I269a1744ed7bf8c6be899494c5dc97847e5a994d
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
init.te | 19 ++++++++++++++++---
kernel.te | 12 ++++++++----
recovery.te | 7 ++++---
3 files changed, 28 insertions(+), 10 deletions(-)
diff --git a/init.te b/init.te
index f0e11f639..5cb947199 100644
--- a/init.te
+++ b/init.te
@@ -3,17 +3,30 @@ type init, domain;
# init is unconfined.
unconfined_domain(init)
tmpfs_domain(init)
-# add a rule to handle unlabelled mounts
-allow init unlabeled:filesystem mount;
allow init self:capability { sys_rawio mknod };
+# Running e2fsck or mkswap via fs_mgr.
allow init dev_type:blk_file rw_file_perms;
+
+# Mounting filesystems.
allow init fs_type:filesystem *;
-allow init {fs_type dev_type}:dir_file_class_set relabelto;
+allow init unlabeled:filesystem *;
+
+# restorecon and restorecon_recursive calls from init.rc files.
+# system/core/init.rc requires at least cache_file and data_file_type.
+# init.<board>.rc files often include device-specific types, so
+# we just allow all file types except /system files here.
allow init {file_type -system_file -exec_type}:dir_file_class_set relabelto;
+
+# Reload policy upon setprop selinux.reload_policy 1.
allow init kernel:security load_policy;
+
+# Any operation that can modify the kernel ring buffer, e.g. clear
+# or a read that consumes the messages that were read.
allow init kernel:system syslog_mod;
+
+# Set usermodehelpers and /proc security settings.
allow init usermodehelper:file rw_file_perms;
allow init proc_security:file rw_file_perms;
diff --git a/kernel.te b/kernel.te
index b09c10648..96b57407e 100644
--- a/kernel.te
+++ b/kernel.te
@@ -8,10 +8,14 @@ allow kernel init:process dyntransition;
# The kernel is unconfined.
unconfined_domain(kernel)
-allow kernel {fs_type dev_type}:dir_file_class_set relabelto;
-allow kernel {file_type -system_file -exec_type}:dir_file_class_set relabelto;
-allow kernel unlabeled:filesystem mount;
-allow kernel fs_type:filesystem *;
+# init direct restorecon calls prior to switching to init domain
+# /dev and /dev/socket
+allow kernel { device socket_device }:dir relabelto;
+# /dev/__properties__
+allow kernel properties_device:file relabelto;
+# /sys
+allow kernel sysfs:{ dir file lnk_file } relabelfrom;
+allow kernel sysfs_type:{ dir file lnk_file } relabelto;
# Initial setenforce by init prior to switching to init domain.
# We use dontaudit instead of allow to prevent a kernel spawned userspace
diff --git a/recovery.te b/recovery.te
index 811623e62..669c1da37 100644
--- a/recovery.te
+++ b/recovery.te
@@ -5,11 +5,12 @@ unconfined_domain(recovery)
allow recovery self:capability2 mac_admin;
-allow recovery {dev_type -kmem_device}:dir_file_class_set relabelto;
-allow recovery {fs_type file_type}:dir_file_class_set relabelto;
-allow recovery unlabeled:filesystem mount;
+# Mount filesystems.
allow recovery fs_type:filesystem *;
+allow recovery unlabeled:filesystem *;
+
+# Create and relabel files under /system.
allow recovery exec_type:{ file dir lnk_file } { create write setattr relabelfrom relabelto append unlink link rename };
allow recovery system_file:{ file dir lnk_file } { create write setattr relabelfrom relabelto append unlink link rename };
--
GitLab