diff options
| author | Stephen Smalley <sds@tycho.nsa.gov> | 2014-02-10 16:31:04 -0500 |
|---|---|---|
| committer | Stephen Smalley <sds@tycho.nsa.gov> | 2014-02-12 11:14:16 -0500 |
| commit | 5487ca00d4788de367a9d099714f6df4d86ef261 (patch) | |
| tree | df70addd5d6e49779734f0562823d0fc6920bbd1 /domain.te | |
| parent | 3db328fd2c7d6b396a4a2f6204841a26d7783939 (diff) | |
| download | android_external_sepolicy-5487ca00d4788de367a9d099714f6df4d86ef261.tar.gz android_external_sepolicy-5487ca00d4788de367a9d099714f6df4d86ef261.tar.bz2 android_external_sepolicy-5487ca00d4788de367a9d099714f6df4d86ef261.zip | |
Remove several superuser capabilities from unconfined domains.
Remove sys_ptrace and add a neverallow for it.
Remove sys_rawio and mknod, explicitly allow to kernel, init, and recovery,
and add a neverallow for them.
Remove sys_module. It can be added back where appropriate in device
policy if using a modular kernel. No neverallow since it is device
specific.
Change-Id: I1a7971db8d247fd53a8f9392de9e46250e91f89b
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Diffstat (limited to 'domain.te')
| -rw-r--r-- | domain.te | 10 |
1 files changed, 10 insertions, 0 deletions
@@ -154,7 +154,17 @@ neverallow { domain -relabeltodomain } *:dir_file_class_set relabelto; ### neverallow rules ### +# Limit ability to ptrace or read sensitive /proc/pid files of processes +# with other UIDs to these whitelisted domains. +neverallow { domain -debuggerd -vold -dumpstate -system_server } self:capability sys_ptrace; + +# Limit device node creation and raw I/O to these whitelisted domains. +neverallow { domain -kernel -init -recovery -ueventd -watchdogd -healthd -vold } self:capability { sys_rawio mknod }; + +# No domain needs mac_override as it is unused by SELinux. neverallow domain self:capability2 mac_override; + +# Only recovery needs mac_admin to set contexts not defined in current policy. neverallow { domain -recovery } self:capability2 mac_admin; # Only init should be able to load SELinux policies. |