diff --git a/domain.te b/domain.te index 04c98408d36e37b585199b5b129eb8e971ee0061..085b319243fa32cda9ca763c4bc79d5b15c95c04 100644 --- a/domain.te +++ b/domain.te @@ -495,6 +495,42 @@ neverallow { -installd } shell_data_file:lnk_file read; +# In addition to the symlink reading restrictions above, restrict +# write access to shell owned directories. The /data/local/tmp +# directory is untrustworthy, and non-whitelisted domains should +# not be trusting any content in those directories. +neverallow { + domain + -adbd + -dumpstate + -installd + -init + -shell + -vold +} shell_data_file:dir no_w_dir_perms; + +neverallow { + domain + -adbd + -appdomain + -dumpstate + -init + -installd + -system_server # why? + userdebug_or_eng(`-uncrypt') +} shell_data_file:dir { open search }; + +# Same as above for /data/local/tmp files. We allow shell files +# to be passed around by file descriptor, but not directly opened. +neverallow { + domain + -adbd + -appdomain + -dumpstate + -installd + userdebug_or_eng(`-uncrypt -procrank') +} shell_data_file:file open; + # servicemanager is the only process which handles list request neverallow domain ~servicemanager:service_manager list; diff --git a/init.te b/init.te index a3a37b6f142f8f36386a929b1d53cc21240458ac..6b57098357429f35ebe5c3a75f0df1b17aea7248 100644 --- a/init.te +++ b/init.te @@ -288,3 +288,6 @@ neverallow init { file_type fs_type }:file execute_no_trans; # Init never adds or uses services via service_manager. neverallow init service_manager_type:service_manager { add find }; neverallow init servicemanager:service_manager list; + +# Init should not be creating subdirectories in /data/local/tmp +neverallow init shell_data_file:dir { write add_name remove_name };