android_external_sepolicy, branch cm-13.0 Unnamed repository; edit this file 'description' to name the repository. system_server: replace sys_resource with sys_ptrace 2017-07-17T21:16:46+00:00 Nick Kralevich nnk@google.com 2017-02-15T23:04:43+00:00 ae28752d5bc428d65ff5e0d26c83626e7a744b6d Commit https://android.googlesource.com/kernel/common/+/f0ce0eee added CAP_SYS_RESOURCE as a capability check which would allow access to sensitive /proc/PID files. However, in an SELinux based world, allowing this access causes CAP_SYS_RESOURCE to duplicate what CAP_SYS_PTRACE (without :process ptrace) already provides. Use CAP_SYS_PTRACE instead of CAP_SYS_RESOURCE. Test: Device boots, functionality remains identical, no sys_resource denials from system_server. Bug: 34951864 Bug: 38496951 Change-Id: I04d745b436ad75ee1ebecf0a61c6891858022e34 (cherry picked from commit 448669540c0b7c22ee8b8293217818f8f92238b6) (cherry picked from commit c15810c527ffa6953108f68365cf2df9e0868096) 
Commit https://android.googlesource.com/kernel/common/+/f0ce0eee added
CAP_SYS_RESOURCE as a capability check which would allow access to
sensitive /proc/PID files. However, in an SELinux based world, allowing
this access causes CAP_SYS_RESOURCE to duplicate what CAP_SYS_PTRACE
(without :process ptrace) already provides.

Use CAP_SYS_PTRACE instead of CAP_SYS_RESOURCE.

Test: Device boots, functionality remains identical, no sys_resource
denials from system_server.
Bug: 34951864
Bug: 38496951
Change-Id: I04d745b436ad75ee1ebecf0a61c6891858022e34
(cherry picked from commit 448669540c0b7c22ee8b8293217818f8f92238b6)
(cherry picked from commit c15810c527ffa6953108f68365cf2df9e0868096)
Merge tag 'android-6.0.1_r74' into HEAD 2016-11-09T19:58:42+00:00 Jessica Wagantall jwagantall@cyngn.com 2016-11-08T23:12:45+00:00 e7cd3302ee34a21ebc434089a80e0c3e5f75f7c4 CYNGNOS-3303 Android 6.0.1 release 74 Change-Id: Icf0638b4bfa8716f8b4b1b63481755cf3420e613 
CYNGNOS-3303

Android 6.0.1 release 74

Change-Id: Icf0638b4bfa8716f8b4b1b63481755cf3420e613
Allow the zygote to stat all files it opens. 2016-09-27T22:56:25+00:00 Narayan Kamath narayan@google.com 2016-08-23T16:02:57+00:00 21658af93cc6f83902a6d883957a353ed4700b13 bug: 30963384 Change-Id: I62b5ffd43469dbb0bba67e1bb1d3416e7354f9e5 (cherry picked from commit 3ff0b0282688c3776904b8e5409a4dfb7f231e73) 
bug: 30963384
Change-Id: I62b5ffd43469dbb0bba67e1bb1d3416e7354f9e5
(cherry picked from commit 3ff0b0282688c3776904b8e5409a4dfb7f231e73)
Merge tag 'android-6.0.1_r61' into HEAD 2016-08-02T18:37:40+00:00 Jessica Wagantall jwagantall@cyngn.com 2016-08-02T18:02:17+00:00 c6c90b3a7188a8ee30c446bda1e0e5ee3ff52b85 Android 6.0.1 Release 61 (MOB30Z) Change-Id: If4ef759eb48ed270f658c2412cea5f7edd9b3d97 
Android 6.0.1 Release 61 (MOB30Z)

Change-Id: If4ef759eb48ed270f658c2412cea5f7edd9b3d97
sepolicy: Add policy for sdcardfs and configfs 2016-07-27T01:41:44+00:00 Steve Kondik steve@cyngn.com 2016-07-27T01:41:44+00:00 908ba0035b1003aaa2acef9ee6392485f6c8055e Change-Id: I4c318efba76e61b6ab0be9491c352f281b1c2bff Bug: 19160983 
Change-Id: I4c318efba76e61b6ab0be9491c352f281b1c2bff
Bug: 19160983
Merge remote-tracking branch 'remotes/android-6.0.1_r52' into HEAD 2016-07-07T21:15:15+00:00 Jessica Wagantall jwagantall@cyngn.com 2016-07-07T18:51:08+00:00 0d2bc4350ad290c0f5bdf69dbbc5baa716889b0b Ticket: CYNGNOS-3020 Change-Id: Ia88a540cb0a5d2bf379d03053095a64cc4c73276 
Ticket: CYNGNOS-3020

Change-Id: Ia88a540cb0a5d2bf379d03053095a64cc4c73276
expose control over unpriv perf access to shell 2016-06-23T22:05:11+00:00 Daniel Micay danielmicay@gmail.com 2016-05-31T20:01:08+00:00 f2b123a5a31ac9ee7abfe1ebb4fffe1c846120bc This allows the shell user to control whether unprivileged access to perf events is allowed. To enable unprivileged access to perf: adb shell setprop security.perf_harden 0 To disable it again: adb shell setprop security.perf_harden 1 This allows Android to disable this kernel attack surface by default, while still allowing profiling tools to work automatically. It can also be manually toggled, but most developers won't ever need to do that if tools end up incorporating this. (Cherry picked from commit 38ac77e4c2b3c3212446de2f5ccc42a4311e65fc) Bug: 29054680 Change-Id: Idcf6a2f6cbb35b405587deced7da1f6749b16a5f 
This allows the shell user to control whether unprivileged access to
perf events is allowed.

To enable unprivileged access to perf:

    adb shell setprop security.perf_harden 0

To disable it again:

    adb shell setprop security.perf_harden 1

This allows Android to disable this kernel attack surface by default,
while still allowing profiling tools to work automatically. It can also
be manually toggled, but most developers won't ever need to do that if
tools end up incorporating this.

(Cherry picked from commit 38ac77e4c2b3c3212446de2f5ccc42a4311e65fc)

Bug: 29054680

Change-Id: Idcf6a2f6cbb35b405587deced7da1f6749b16a5f
Remove generic socket access from untrusted processes 2016-05-27T18:30:05+00:00 Nick Kralevich nnk@google.com 2016-05-05T20:37:55+00:00 abf0663ed884af7bc880a05e9529e6671eb58f39 SELinux defines various classes for various socket types, including tcp_socket, udp_socket, rawip_socket, netlink_socket, etc. Socket classes not known to the SELinux kernel code get lumped into the generic "socket" class. In particular, this includes the AF_MSM_IPC socket class. Bluetooth using apps were granted access to this generic socket class at one point in 2012. In 1601132086b054adc70e7f8f38ed24574c90bc37, a TODO was added indicating that this access was likely unnecessary. In cb835a2852997dde0be2941173f8c879ebbef157, an auditallow was added to test to see if this rule was actually used, and in master branch d0113ae0aed1a455834f26ec847b6ca8610e3b16, this rule was completely deleted. Revoke access to the generic socket class for isolated_app, untrusted_app, and shell for older Android releases. This is conceptually a backport of d0113ae0aed1a455834f26ec847b6ca8610e3b16, but affecting fewer domains to avoid potential breakage. Add a neverallow rule asserting that this rule isn't present for the untrusted domains. Contrary to our usual conventions, the neverallow rule is placed in bluetooth.te, to avoid merge conflicts and simplify patching. Bug: 28612709 Bug: 25768265 Change-Id: Ibfbb67777e448784bb334163038436f3c4dc1b51 
SELinux defines various classes for various socket types, including
tcp_socket, udp_socket, rawip_socket, netlink_socket, etc. Socket
classes not known to the SELinux kernel code get lumped into the generic
"socket" class. In particular, this includes the AF_MSM_IPC socket
class.

Bluetooth using apps were granted access to this generic socket class at
one point in 2012. In 1601132086b054adc70e7f8f38ed24574c90bc37,
a TODO was added indicating that this access was likely unnecessary. In
cb835a2852997dde0be2941173f8c879ebbef157, an auditallow was added to
test to see if this rule was actually used, and in master branch
d0113ae0aed1a455834f26ec847b6ca8610e3b16, this rule was completely
deleted.

Revoke access to the generic socket class for isolated_app,
untrusted_app, and shell for older Android releases. This is
conceptually a backport of d0113ae0aed1a455834f26ec847b6ca8610e3b16, but
affecting fewer domains to avoid potential breakage.

Add a neverallow rule asserting that this rule isn't present for the
untrusted domains. Contrary to our usual conventions, the neverallow
rule is placed in bluetooth.te, to avoid merge conflicts and simplify
patching.

Bug: 28612709
Bug: 25768265
Change-Id: Ibfbb67777e448784bb334163038436f3c4dc1b51
Further restrict socket ioctls available to apps 2016-05-27T18:30:05+00:00 Jeff Vander Stoep jeffv@google.com 2016-04-26T18:29:14+00:00 556bb0f55324e8839d7b735a0de9bc31028e839e Restrict unix_dgram_socket and unix_stream_socket to a whitelist for all domains. Remove ioctl permission for netlink_selinux_socket and netlink_route_socket for netdomain. Bug: 28171804 Bug: 27424603 Change-Id: I650639115b8179964ae690a39e4766ead0032d2e 
Restrict unix_dgram_socket and unix_stream_socket to a whitelist
for all domains. Remove ioctl permission for netlink_selinux_socket and
netlink_route_socket for netdomain.

Bug: 28171804
Bug: 27424603
Change-Id: I650639115b8179964ae690a39e4766ead0032d2e
Merge tag 'android-6.0.1_r30' into HEAD 2016-04-18T18:14:06+00:00 Jessica Wagantall jwagantall@cyngn.com 2016-04-18T18:14:06+00:00 f00429df5685a46aa4f4694dab8f68d6d5645cd0 Ticket: RM-234 Android 6.0.1 release 30 
Ticket: RM-234
Android 6.0.1 release 30