CTS test luni/src/test/java/libcore/java/nio/BufferTest.java function
testDevZeroMapRW() requires us to be able to open /dev/zero in read-write
mode. Allow it.

Change-Id: I2be266875b1d190188376fd84c0996039d3c1524

As far as I know, this is never used. Get rid of it.

Change-Id: Iee0fb4e3f3952a0c4cc28d0aa96ca6c462ba5211

keystore may hold sensitive information in it's memory. Don't
allow anyone to ptrace keystore.

Change-Id: I4e3717e482b9fd128d38ce687c03122d41678b6f

installd is expected to be handling unlabeled apps. Don't
emit an audit rule when it occurs.

Change-Id: Ia173914ff4d1b8368a18f326494eda8173d30192

On an upgrade from 4.2 to tip-of-tree master, there are still a
number of files which aren't properly labeled. Restore the
unlabeled compat rules until we can get everything properly
labeled. It's not ideal, but it works around the immediate
problem.

After applying https://android-review.googlesource.com/94966 ,
I'm still seeing the following denials.

<4>[   12.040639] type=1400 audit(1400289656.430:4): avc:  denied  { read } for  pid=143 comm="installd" name="0" dev=mmcblk0p9 ino=32194 scontext=u:r:installd:s0 tcontext=u:object_r:unlabeled:s0 tclass=lnk_file
<4>[  168.289170] type=1400 audit(1400289812.680:5): avc:  denied  { getattr } for  pid=1079 comm="system_server" path="/data/data/com.android.backupconfirm" dev=mmcblk0p9 ino=112676 scontext=u:r:system_server:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir
<4>[  169.088406] type=1400 audit(1400289813.480:6): avc:  denied  { read } for  pid=143 comm="installd" name="com.android.location.fused" dev=mmcblk0p9 ino=112720 scontext=u:r:installd:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir
<4>[  169.088790] type=1400 audit(1400289813.480:7): avc:  denied  { open } for  pid=143 comm="installd" name="com.android.location.fused" dev=mmcblk0p9 ino=112720 scontext=u:r:installd:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir
<4>[  169.089205] type=1400 audit(1400289813.480:8): avc:  denied  { write } for  pid=143 comm="installd" name="com.android.location.fused" dev=mmcblk0p9 ino=112720 scontext=u:r:installd:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir
<4>[  169.089615] type=1400 audit(1400289813.480:9): avc:  denied  { remove_name } for  pid=143 comm="installd" name="lib" dev=mmcblk0p9 ino=112721 scontext=u:r:installd:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir
<4>[  169.090024] type=1400 audit(1400289813.480:10): avc:  denied  { unlink } for  pid=143 comm="installd" name="lib" dev=mmcblk0p9 ino=112721 scontext=u:r:installd:s0 tcontext=u:object_r:unlabeled:s0 tclass=lnk_file
<4>[  169.090350] type=1400 audit(1400289813.480:11): avc:  denied  { rmdir } for  pid=143 comm="installd" name="com.android.renderscript.cache" dev=mmcblk0p9 ino=112902 scontext=u:r:installd:s0 tcontext=u:object_r:unlabeled:s0 tclass=dir
<4>[  171.875822] type=1400 audit(1400289816.260:12): avc:  denied  { unlink } for  pid=143 comm="installd" name="8882B60ADE91B9E4.toc" dev=mmcblk0p9 ino=112903 scontext=u:r:installd:s0 tcontext=u:object_r:unlabeled:s0 tclass=file
<4>[  180.615263] type=1400 audit(1400289825.000:13): avc:  denied  { rename } for  pid=143 comm="installd" name="BackupTransport.backupScheduler.xml" dev=mmcblk0p9 ino=112852 scontext=u:r:installd:s0 tcontext=u:object_r:unlabeled:s0 tclass=file
<4>[  180.615578] type=1400 audit(1400289825.000:14): avc:  denied  { setattr } for  pid=143 comm="installd" name="BackupTransport.backupScheduler.xml" dev=mmcblk0p9 ino=112852 scontext=u:r:installd:s0 tcontext=u:object_r:unlabeled:s0 tclass=file
<4>[  393.934310] type=1400 audit(1400290038.320:15): avc:  denied  { read } for  pid=2410 comm="d.process.acore" name="0" dev=mmcblk0p9 ino=32194 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:unlabeled:s0 tclass=lnk_file
<4>[  399.370936] type=1400 audit(1400290043.760:16): avc:  denied  { read } for  pid=2998 comm="SharedPreferenc" name="BackupTransport.backupScheduler.xml" dev=mmcblk0p9 ino=112852 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:unlabeled:s0 tclass=file
<4>[  399.371792] type=1400 audit(1400290043.760:17): avc:  denied  { getattr } for  pid=2998 comm="SharedPreferenc" path="/data/data/com.google.android.backuptransport/shared_prefs/BackupTransport.backupScheduler.xml" dev=mmcblk0p9 ino=112852 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:unlabeled:s0 tclass=file
<4>[  399.372219] type=1400 audit(1400290043.760:18): avc:  denied  { open } for  pid=2998 comm="SharedPreferenc" name="BackupTransport.backupScheduler.xml" dev=mmcblk0p9 ino=112852 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:unlabeled:s0 tclass=file

Change-Id: I65dcfa8e77a63cb61551a1010358f0e45956dbbf

Bug: 15021938
Change-Id: Id815640302efde3ae089da33ff8e2cb7daee8bfd

Change-Id: Id6d9a7cabc2fe9c18de10c6e9bc0080cdcd7033d
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

app_process is now a symlink to app_process32 or
app_process64, so we have to update the selinux
rules to explicitly refer to them.

See change 5a7ee9ad63d for context.

Change-Id: I7f7a107d79a8f7a3c193f97809e1e737540258f1

Commit: 7ffb9972 added protection against low
memory mapping for all domains, a superset of appdomain.  Remove the same,
redundant neverallow rule from appdomain.

Change-Id: Ia41c02763f6b5a260c56d10adfbab649d9f3f97c

Neither mediaserver nor system_server appear to require
direct access to graphics_device, i.e. the framebuffer
device.  Drop it.

Change-Id: Ie9d1be3f9071584155cddf248ea85e174b7e50a6
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Address denials such as:
 avc:  denied  { read } for  name="tombstones" dev="dm-0" ino=765537 scontext=u:r:system_server:s0 tcontext=u:object_r:tombstone_data_file:s0 tclass=dir
 avc:  denied  { open } for  name="tombstones" dev="dm-0" ino=765537 scontext=u:r:system_server:s0 tcontext=u:object_r:tombstone_data_file:s0 tclass=dir
 avc:  denied  { getattr } for  path="/data/tombstones/tombstone_00" dev="dm-0" ino=765538 scontext=u:r:system_server:s0 tcontext=u:object_r:tombstone_data_file:s0 tclass=file
 avc:  denied  { read } for  name="tombstone_00" dev="dm-0" ino=765538 scontext=u:r:system_server:s0 tcontext=u:object_r:tombstone_data_file:s0 tclass=file
 avc:  denied  { open } for  name="tombstone_00" dev="dm-0" ino=765538 scontext=u:r:system_server:s0 tcontext=u:object_r:tombstone_data_file:s0 tclass=file

Change-Id: Iae5a10bed9483589660b84a88b6b9f8f8e9a8f5c
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

(cherry picked from commit 7d51096d4106a441a15741592d9ccdd0bfaca907)

Change-Id: Ib6198e19dbc306521a26fcecfdf6e8424d163fc9

This just adds a neverallow rule to ensure we never
add an allow rule permitting such mappings.

Change-Id: Id20463b26e0eac5b7629326f68b3b94713108cc2
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

We added these rules to the recovery domain when we removed them
from unconfined to ensure that we did not break anything. But we
have seen no uses of these rules by the recovery domain.  Tested
wiping userdata and cache from the recovery and performing an
adb sideload of an ota zip file.

Change-Id: I261cb1124130f73e98b87f3e5a31d6d7f521ff11
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

We added these rules to the kernel domain when we removed them
from unconfined to ensure that we did not break anything.  But
we have seen no uses of these rules and this matches our expectation
that any actual operations that require these permissions occurs
after switching to the init domain.

Change-Id: I6f3556a26b0f6f4e6effcb874bfc9498e7dfaa47
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

These rules seem to be a legacy of old Android or perhaps old policy
before we began splitting types on /data.  I have not been able to
trigger the auditallow rules on AOSP master.  Reduce the rules to
only read access to system data.  If we need write access to some
specific directory under /data, we should introduce a type for it.

Change-Id: I780835950cc366c97b7d0901fc73527d9ea479b1
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Address recent installd denials resulting from the recent
tightening of installd access to /data file types, including:
 avc:  denied  { unlink } for  name="._playmusicid" dev="mmcblk0p30" ino=1038393 scontext=u:r:installd:s0 tcontext=u:object_r:media_rw_data_file:s0 tclass=file
 avc:  denied  { search } for  pid=195 comm="installd" name="app-asec" dev="mmcblk0p28" ino=578225 scontext=u:r:installd:s0 tcontext=u:object_r:asec_image_file:s0 tclass=dir

Change-Id: I957738139678699949da9ad09d3bddb91605f8cf
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Too many leaky files in that directory. It's a security best practice
to not mount this filesystem, however, we need it mounted for
tracing support. Even though it's mounted, make sure the files aren't
readable.

Bug: 11635985
Change-Id: I6f116c0a03a567a8107a8e07135ce025e51458dd

Change-Id: If6b85fbb2332f7a03b603f2d46bd2f73c778ecf9
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Resolves denials such as:
avc:  denied  { read write } for  path="socket:[33571]" dev="sockfs" ino=33571 scontext=u:r:ppp:s0 tcontext=u:r:mtp:s0 tclass=unix_dgram_socket

Change-Id: Icb1ee00d8513179039bfb738647f49480e836f25
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Resolves denials such as:
 avc:  denied  { getattr } for  path="pipe:[167684]" dev="pipefs" ino=167684 scontext=u:r:mediaserver:s0 tcontext=u:r:untrusted_app:s0 tclass=fifo_file

Change-Id: I1120c8b130a592e40992c5233650345640a23a87
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Drop rules on data_file_type attribute and replace with rules
on specific types under /data.

Change-Id: I5cbfef64cdd71b8e93478d9ef377689bf6dda192
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>