aboutsummaryrefslogtreecommitdiffstats
path: root/system_app.te
Commit message (Collapse)AuthorAgeFilesLines
* Let Settings measure transient free space.Jeff Sharkey2015-07-301-0/+3
| | | | | | | | | | | | Transient volumes like USB drives are only mounted at /mnt/media_rw, but they still appear in Settings > Storage. To show stats like free/used space, give Settings the permissions it needs to access devices mounted there. avc: denied { search } for name="media_rw" dev="tmpfs" ino=8358 scontext=u:r:system_app:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir permissive=0 Bug: 22545248 Change-Id: I273a1729e417873184ad04ba9dd0fec95fd54f97
* Allow system_app to find all system services.dcashman2015-05-281-7/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | SystemPropPoker in settings app lists and communicates with every service on the system on property change, which is not currently allowed for all services. This occurs, for instance, when toggling Developer options -> Monitoring -> Profile GPU Rendering -> On scren as bars. Addresses the following denials: SELinux : avc: denied { find } for service=samplingprofiler scontext=u:r:system_app:s0 tcontext=u:object_r:samplingprofiler_service:s0 tclass=service_manager SELinux : avc: denied { find } for service=DockObserver scontext=u:r:system_app:s0 tcontext=u:object_r:DockObserver_service:s0 tclass=service_manager SELinux : avc: denied { find } for service=devicestoragemonitor scontext=u:r:system_app:s0 tcontext=u:object_r:devicestoragemonitor_service:s0 tclass=service_manager SELinux : avc: denied { find } for service=media.camera.proxy scontext=u:r:system_app:s0 tcontext=u:object_r:cameraproxy_service:s0 tclass=service_manager SELinux : avc: denied { find } for service=scheduling_policy scontext=u:r:system_app:s0 tcontext=u:object_r:scheduling_policy_service:s0 tclass=service_manager SELinux : avc: denied { find } for service=battery scontext=u:r:system_app:s0 tcontext=u:object_r:battery_service:s0 tclass=service_manager SELinux : avc: denied { find } for service=processinfo scontext=u:r:system_app:s0 tcontext=u:object_r:processinfo_service:s0 tclass=service_manager SELinux : avc: denied { find } for service=batteryproperties scontext=u:r:system_app:s0 tcontext=u:object_r:healthd_service:s0 tclass=service_manager SELinux : avc: denied { find } for service=drm.drmManager scontext=u:r:system_app:s0 tcontext=u:object_r:drmserver_service:s0 tclass=service_manager SELinux : avc: denied { find } for service=commontime_management scontext=u:r:system_app:s0 tcontext=u:object_r:commontime_management_service:s0 tclass=service_manager (cherry-pick of commit: bf0c34d59bd47f9f286c9b5cd97196c1b075b7b1) Bug: 20762975 Bug: 21446739 Change-Id: I655d39c6d6ff0b8bd333a99d17abc08af8001be8
* Rename keystore methods and delete unused permissionsChad Brubaker2015-05-181-3/+3
| | | | | | | | | Keystore is going through an API cleanup to make names more clear and remove unclear methods. (cherry-picked from commit cbc8f796551151c0d9651500d5d9f116177a07dc) Change-Id: I06354ccd0a9a73fd20168bfce9350c451cfaced3
* Add keystore user_changed permissionChad Brubaker2015-05-181-0/+1
| | | | | | | | | user_changed will be used for state change methods around android user creation/deletion. (cherry-picked from commit 520bb816b86fe36440767db6e2f05fb4e8a08f3e) Change-Id: I295ca9adfc4907b5d7bcf0555f6e5a9a3379635b
* Replace unix_socket_connect() and explicit property sets with macroWilliam Roberts2015-05-071-7/+6
| | | | | | | | | | | | | | | | | | | | | | | | A common source of mistakes when authoring sepolicy is properly setting up property sets. This is a 3 part step of: 1. Allowing the unix domain connection to the init/property service 2. Allowing write on the property_socket file 3. Allowing the set on class property_service The macro unix_socket_connect() handled 1 and 2, but could be confusing for first time policy authors. 3 had to be explicitly added. To correct this, we introduce a new macros: set_prop(sourcedomain, targetprop) This macro handles steps 1, 2 and 3. No difference in sediff is expected. (cherrypicked from commit 625a3526f1ebaaa014bb563239cc33829f616232) Change-Id: I630ba0178439c935d08062892990d43a3cc1239e Signed-off-by: William Roberts <william.c.roberts@linux.intel.com>
* Allow system_app to list all services.dcashman2015-05-041-0/+1
| | | | | | | | | | | | | The Settings app contains a SystemPropPoker class which notifies every service on the system that a property has changed. Address the following denial: avc: denied { list } for service=NULL scontext=u:r:system_app:s0 tcontext=u:r:servicemanager:s0 tclass=service_manager Cherry-pick of Change-Id: I81926e8833c1abcb17a4d49687fc89619b416d6c Bug: 20762975 Change-Id: I665a460f30a1ef57b513da9166aad60097dd4886
* Enforce more specific service access.dcashman2015-04-091-16/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Move the remaining services from tmp_system_server_service to appropriate attributes and remove tmp_system_server and associated logging: registry restrictions rttmanager scheduling_policy search sensorservice serial servicediscovery statusbar task textservices telecom_service trust_service uimode updatelock usagestats usb user vibrator voiceinteraction wallpaper webviewupdate wifip2p wifi window Bug: 18106000 Change-Id: Ia0a6d47099d82c53ba403af394537db6fbc71ca0
* Enforce more specific service access.dcashman2015-04-081-5/+0
| | | | | | | | | | | | | | | | | | | Move the following services from tmp_system_server_service to appropriate attributes: network_management network_score notification package permission persistent power print processinfo procstats Bug: 18106000 Change-Id: I9dfb41fa41cde72ef0059668410a2e9eb1af491c
* Enforce more specific service access.dcashman2015-04-071-4/+0
| | | | | | | | | | | | | | | | | | | Move the following services from tmp_system_server_service to appropriate attributes: jobscheduler launcherapps location lock_settings media_projection media_router media_session mount netpolicy netstats Bug: 18106000 Change-Id: Ia82d475ec41f658851f945173c968f4abf57e7e1
* Enforce more specific service access.dcashman2015-04-071-7/+0
| | | | | | | | | | | | | | | | | | | | Move the following services from tmp_system_server_service to appropriate attributes: diskstats display dreams dropbox ethernet fingerprint graphicstats hardware hdmi_control input_method input_service Bug: 18106000 Change-Id: Iadd8aab9e78d9d39fb00cf0b5a95fa1927d02095
* Enforce more specific service access.dcashman2015-04-071-4/+0
| | | | | | | | | | | | | | | | | | Move the following services from tmp_system_server_service to appropriate attributes: battery bluetooth_manager clipboard commontime_management connectivity content country_detector device_policy deviceidle Bug: 18106000 Change-Id: I0d0f2a075c0509a783631d88ba453ac13399cdf2
* Assign app_api_service attribute to services.dcashman2015-04-061-4/+0
| | | | | | | | Assign the alarm, appwidget, assetatlas, audio, backup and batterystats services the appropriate service access levels and move into enforcing. Bug: 18106000 Change-Id: If3210bb25f3076edfdb6eec36ef6521ace1bd8d7
* Assign app_api_service attribute to services.dcashman2015-04-031-4/+0
| | | | | | | | | Move accessibility, account, appops and activity services into enforcing with app_api_service level of access, with additional grants to mediaserver and isolated app. Bug: 18106000 Change-Id: I1d5a79b9223026415f1690e8e9325ec4c270e3dd
* Add system_api_service and app_api_service attributes.dcashman2015-04-031-1/+2
| | | | | | | | | | | System services differ in designed access level. Add attributes reflecting this distinction and label services appropriately. Begin moving access to the newly labeled services by removing them from tmp_system_server_service into the newly made system_server_service attribute. Reflect the move of system_server_service from a type to an attribute by removing access to system_server_service where appropriate. Change-Id: I7fd06823328daaea6d6f96e4d6bd00332382230b
* Record observed service accesses.dcashman2015-04-011-0/+8
| | | | | | | Get ready to switch system_server service lookups into enforcing. Bug: 18106000 Change-Id: Iefd4b2eee6cdd680f5ab423d15cc72a2a30e27cf
* Add graphicsstats serviceJohn Reck2015-03-271-0/+1
| | | | Change-Id: I156b139b57f46c695ece35b7b26a3087d87b25df
* Record observed system_server servicemanager service requests.dcashman2015-03-031-0/+21
| | | | | | | | | | | Also formally allow dumpstate access to all services and grant system_server access to address the following non-system_server_service entries: avc: granted { find } for service=drm.drmManager scontext=u:r:system_server:s0 tcontext=u:object_r:drmserver_service:s0 tclass=service_manager avc: granted { find } for service=nfc scontext=u:r:system_server:s0 tcontext=u:object_r:nfc_service:s0 tclass=service_manager Bug: 18106000 Change-Id: Iad16b36acf44bce52c4824f8b53c0e7731c25602
* Allow platform_app access to keystore.dcashman2015-03-021-1/+0
| | | | | | | | | | | Encountered when certinstaller tries to talk to keystore: ComponentInfo{com.android.certinstaller/com.android.certinstaller.CertInstaller}: java.lang.NullPointerException: Attempt to invoke interface method 'int android.security.IKeystoreService.test()' on a null object reference Address the following denial: avc: denied { find } for service=android.security.keystore scontext=u:r:platform_app:s0:c512,c768 tcontext=u:object_r:keystore_service:s0 tclass=service_manager Bug: 19347232 Change-Id: I35b46da3c78b384cf04216be937c6b5bfa86452d
* Allow system_app to access /data/data link filesSharif Inamdar2015-01-211-1/+1
| | | | | | | | system_app tries to access files in /data/data (lnk_files). But due to permission issue it is not able to access the link files. Change-Id: I2959d899f5e3ab9caa219d684541d36587a6c059
* Record service accesses.dcashman2015-01-161-8/+4
| | | | | | | Reduce logspam and record further observed service connections. Bug: 18106000 Change-Id: I9a57e4bb8f1c8e066861719fb208c691498842a8
* Remove known system_server service accesses from auditing.dcashman2015-01-151-0/+17
| | | | | | | | | | Address observed audit logs of the form: granted { find } for service=XXX scontext=u:r:YYY:s0:c512,c768 tcontext=u:object_r:XXX_service:s0 tclass=service_manager in order to record existing relationships with services. Bug: 18106000 Change-Id: I99a68f329c17ba67ebf3b87729b8405bdc925ef4
* Make system_server_service an attribute.dcashman2015-01-141-0/+1
| | | | | | | | Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef
* Allow system_app to locate mediaserver_service.dcashman2015-01-071-0/+1
| | | | | | | Address the following denial: SELinux : avc: denied { find } for service=media.audio_flinger scontext=u:r:system_app:s0 tcontext=u:object_r:mediaserver_service:s0 tclass=service_manager Change-Id: I6bd5d2490c7d4aa06a645c1ee293f2b3db21968b
* Restrict service_manager find and list access.dcashman2014-12-151-11/+5
| | | | | | | | | All domains are currently granted list and find service_manager permissions, but this is not necessary. Pare the permissions which did not trigger any of the auditallow reporting. Bug: 18106000 Change-Id: Ie0ce8de2af8af2cbe4ce388a2dcf4534694c994a
* sepolicy: allow system apps to access ASECPawit Pornkitprasan2014-12-121-0/+3
| | | | | | | | | Required for Settings to show name/icon of apps on sd card (permission copied from untrusted_app) Also removed duplicate permission (from domain) in untrusted_app Change-Id: Ib2b3bee4dfb54ad5e45b392fd9bfd65add4a00bf
* resolved conflicts for merge of 51bfecf4 to lmp-dev-plus-aospRobin Lee2014-10-151-1/+7
|\ | | | | | | Change-Id: I8ea400354e33a01d3223b4efced6db76ba00aed6
| * Pull keychain-data policy out of system-dataRobin Lee2014-10-151-1/+7
| | | | | | | | | | | | | | | | | | | | | | Migrators should be allowed to write to /data/misc/keychain in order to remove it. Similarly /data/misc/user should be writable by system apps. TODO: Revoke zygote's rights to read from /data/misc/keychain on behalf of some preloaded security classes. Bug: 17811821 Change-Id: I9e9c6883cff1dca3755732225404909c16a0e547
| * Remove system_server create access from /data/dalvik-cacheBrian Carlstrom2014-08-281-3/+0
| | | | | | | | | | Bug: 16875245 Change-Id: I2487a80896a4a923fb1fa606f537df9f6ad4220a
| * DO NOT MERGE: Remove service_manager audit_allows.Riley Spahn2014-07-181-11/+0
| | | | | | | | | | | | | | Remove the audit_allow rules from lmp-dev because we will not be tightening any further so these logs will not be useful. Change-Id: Ibd0e4bf4e8f4f5438c3dbb9114addaadac9ef8c9
| * Refine service_manager find auditallow statements.Riley Spahn2014-07-171-0/+2
| | | | | | | | | | | | | | | | | | | | Add adbd as a service_manager_local_audit_domain and negate surfaceflinger_service in its auditallow. Negate keystore_service and radio_service in the system_app auditallow. (cherry picked from commit 88157ea34779aa66a7d43a322d10a0eda9fe39a0) Change-Id: I25354db2add3135335c80be2c2d350e526137572
| * Add access control for each service_manager action.Riley Spahn2014-07-151-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | Add SELinux MAC for the service manager actions list and find. Add the list and find verbs to the service_manager class. Add policy requirements for service_manager to enforce policies to binder_use macro. (cherry picked from commit b8511e0d98880a683c276589ab7d8d7666b7f8c1) Change-Id: I980d4a8acf6a0c6e99a3a7905961eb5564b1be15
* | Remove system_server create access from /data/dalvik-cacheBrian Carlstrom2014-08-281-3/+0
| | | | | | | | | | | | | | | | Bug: 16875245 (cherry picked from commit 372d0df796389e2f6295a394492585ed64f0ceca) Change-Id: I38fa14226ab94df2029ca60d3c8898f46c1824c7
* | Refine service_manager find auditallow statements.Riley Spahn2014-07-171-0/+2
| | | | | | | | | | | | | | Add adbd as a service_manager_local_audit_domain and negate surfaceflinger_service in its auditallow. Negate keystore_service and radio_service in the system_app auditallow. Change-Id: I05ea2a3e853b692f151182202f1b30786b44f1fb
* | Add access control for each service_manager action.Riley Spahn2014-07-141-0/+9
|/ | | | | | | | | | Add SELinux MAC for the service manager actions list and find. Add the list and find verbs to the service_manager class. Add policy requirements for service_manager to enforce policies to binder_use macro. Change-Id: I224b1c6a6e21e3cdeb23badfc35c82a37558f964
* Remove keystore auditallow statements from system.Riley Spahn2014-07-011-17/+0
| | | | | | Remove the auditallow statements related to keystore in system_app and system_server. Change-Id: I1fc25ff475299ee020ea19f9b6b5811f8fd17c28
* Add imms service and system_app_service type.Riley Spahn2014-07-011-0/+2
| | | | | | | | Map imms to system_app_service in service_contexts and add the system_app_service type and allow system_app to add the system_app_service. Bug: 16005467 Change-Id: I06ca75e2602f083297ed44960767df2e78991140
* Adding policies for KeyStore MAC.Riley Spahn2014-06-261-0/+36
| | | | | | | | | | Add keystore_key class and an action for each action supported by keystore. Add policies that replicate the access control that already exists in keystore. Add auditallow rules for actions not known to be used frequently. Add macro for those domains wishing to access keystore. Change-Id: Iddd8672b9e9b72b45ee208e6eda608cc9dc61edc
* Align SELinux property policy with init property_perms.Stephen Smalley2014-06-231-1/+4
| | | | | | | | | | | | | | | | | | Introduce a net_radio_prop type for net. properties that can be set by radio or system. Introduce a system_radio_prop type for sys. properties that can be set by radio or system. Introduce a dhcp_prop type for properties that can be set by dhcp or system. Drop the rild_prop vs radio_prop distinction; this was an early experiment to see if we could separate properties settable by rild versus other radio UID processes but it did not pan out. Remove the ability to set properties from unconfineddomain. Allow init to set any property. Allow recovery to set ctl_default_prop to restart adbd. Change-Id: I5ccafcb31ec4004dfefcec8718907f6b6f3e0dfd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* selinux: logd Development settingsMark Salyzyn2014-06-121-0/+1
| | | | | | - logd Development Settings failed to access persist.logd.size Change-Id: I0732b44fcbffbf3c187bcb23df2db807fa3e8fde
* Make system_app enforcing.Stephen Smalley2014-06-091-1/+0
| | | | | Change-Id: I9c3ff0a79d947a14084638772451d06298c43e47 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* Restore system_app access to system-owned /data directories.Stephen Smalley2014-05-271-0/+9
| | | | | | | | | | | | | | | System UID apps want to be able to create/write to system-owned /data directories outside of their own /data/data package directory, such as /data/system/cache and /data/misc/keychain. Restore access (which was removed by Ifa10e3283b07f6bd6ecc16eceeb663edfd756cea when system_app_data_file was introduced for the /data/data package directories of system UID apps), but audit writes to system_data_file so we can look at introducing separate types for these directories in the future and ultimately remove access to the rest of the system-owned data. Change-Id: I573f120f23f2dd2d228aa738b31ad2cb3044ec6e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* Allow Developer settings to change runtime size of logdMark Salyzyn2014-05-121-0/+2
| | | | | | | - permit logd control from system_app Bug: 14563261 Change-Id: Id5992cca70647a0e4b913a793c6ba8334dc57963
* Label app data directories for system UID apps with a different type.Stephen Smalley2014-05-071-4/+3
| | | | | | | | | | | | | | | | | | | | We were using system_data_file for the /data/data directories of system UID apps to match the DAC ownership of system UID shared with other system files. However, we are seeing cases where files created in these directories must be writable by other apps, and we would like to avoid allowing write to system data files outside of these directories. So introduce a separate system_app_data_file type and assign it. This should also help protect against arbitrary writes by system UID apps to other system data directories. This resolves the following denial when cropping or taking a user photo for secondary users: avc: denied { write } for path="/data/data/com.android.settings/cache/TakeEditUserPhoto2.jpg" dev="mmcblk0p28" ino=82120 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:system_data_file:s0 tclass=file avc: denied { write } for path="/data/data/com.android.settings/cache/CropEditUserPhoto.jpg" dev="mmcblk0p30" ino=602905 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:system_data_file:s0 tclass=file Bug: 14604553 Change-Id: Ifa10e3283b07f6bd6ecc16eceeb663edfd756cea Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* Allow system_app to start bugreport and to create /data/anr/traces.txt.Stephen Smalley2014-03-111-0/+5
| | | | | | | | | | | | | | | Resolves denials such as: avc: denied { set } for property =ctl.bugreport scontext=u:r:system_app:s0 tcontext=u:object_r:ctl_default_prop:s0 tclass=property_service avc: denied { write } for pid=4415 comm=5369676E616C2043617463686572 name="anr" dev="dm-0" ino=358337 scontext=u:r:system_app:s0 tcontext=u:object_r:anr_data_file:s0 tclass=dir avc: denied { add_name } for pid=4415 comm=5369676E616C2043617463686572 name="traces.txt" scontext=u:r:system_app:s0 tcontext=u:object_r:anr_data_file:s0 tclass=dir avc: denied { create } for pid=4415 comm=5369676E616C2043617463686572 name="traces.txt" scontext=u:r:system_app:s0 tcontext=u:object_r:anr_data_file:s0 tclass=file Change-Id: I71d0ede049136d72f28bdc85d52fcefa2f7d128f Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* Clean up, unify, and deduplicate app domain rules.Stephen Smalley2014-03-071-6/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Coalesce a number of allow rules replicated among multiple app domains. Get rid of duplicated rules already covered by domain, appdomain, or platformappdomain rules. Split the platformappdomain rules to their own platformappdomain.te file, document them more fully, and note the inheritance in each of the relevant *_app.te files. Generalize isolated app unix_stream_socket rules to all app domains to resolve denials such as: avc: denied { read write } for pid=11897 comm="Binder_2" path="socket:[203881]" dev="sockfs" ino=203881 scontext=u:r:release_app:s0 tcontext=u:r:untrusted_app:s0 tclass=unix_stream_socket avc: denied { getattr } for pid=11990 comm=4173796E635461736B202334 path="socket:[203881]" dev="sockfs" ino=203881 scontext=u:r:release_app:s0 tcontext=u:r:untrusted_app:s0 tclass=unix_stream_socket avc: denied { getopt } for pid=11990 comm=4173796E635461736B202334 scontext=u:r:release_app:s0 tcontext=u:r:untrusted_app:s0 tclass=unix_stream_socket avc: denied { read write } for pid=6890 comm="Binder_10" path="socket:[205010]" dev="sockfs" ino=205010 scontext=u:r:release_app:s0 tcontext=u:r:media_app:s0 tclass=unix_stream_socket avc: denied { getattr } for pid=11990 comm=4173796E635461736B202334 path="socket:[205010]" dev="sockfs" ino=205010 scontext=u:r:release_app:s0 tcontext=u:r:media_app:s0 tclass=unix_stream_socket avc: denied { getopt } for pid=11990 comm=4173796E635461736B202334 scontext=u:r:release_app:s0 tcontext=u:r:media_app:s0 tclass=unix_stream_socket Change-Id: I770d7d51d498b15447219083739153265d951fe5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* Deduplicate binder_call rules.Stephen Smalley2014-03-031-3/+0
| | | | | | | | | | | | A number of binder_call rules are duplicated by other rules written in terms of attributes/sets (e.g. appdomain, binderservicedomain). Get rid of the duplicates. Also use binder_use() in racoon.te rather than manually writing the base rule for communicating with the servicemanager. Change-Id: I5a459cc2154b1466bcde6eccef253dfcdcb44e0a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* Drop obsolete keystore_socket type and rules.Stephen Smalley2014-02-251-3/+0
| | | | | | | | | | | | Change I6dacdc43bcc1a56e47655e37e825ee6a205eb56b switched the keystore to using binder instead of a socket, so this socket type and rules have been unused for a while. The type was only ever assigned to a /dev/socket socket file (tmpfs) so there is no issue with removing the type (no persistent files will have this xattr value). Change-Id: Id584233c58f6276774c3432ea76878aca28d6280 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* Resolve overlapping rules between app.te and net.te.Stephen Smalley2014-02-251-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | There is some overlap between socket rules in app.te and the net.te rules, but they aren't quite identical since not all app domains presently include the net_domain() macro and because the rules in app.te allow more permissions for netlink_route_socket and allow rawip_socket permissions for ping. The current app.te rules prevent one from ever creating a non-networked app domain. Resolve this overlap by: 1) Adding the missing permissions allowed by app.te to net.te for netlink_route_socket and rawip_socket. 2) Adding net_domain() calls to all existing app domains that do not already have it. 3) Deleting the redundant socket rules from app.te. Then we'll have no effective change in what is allowed for apps but allow one to define app domains in the future that are not allowed network access. Also cleanup net.te to use the create_socket_perms macro rather than * and add macros for stream socket permissions. Change-Id: I6e80d65b0ccbd48bd2b7272c083a4473e2b588a9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
* Introduce asec_public_file type.Robert Craig2014-02-111-4/+0
| | | | | | | | | This new type will allow us to write finer-grained policy concerning asec containers. Some files of these containers need to be world readable. Change-Id: Iefee74214d664acd262edecbb4f981d633ff96ce Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
* Address bug report denials.Nick Kralevich2014-01-211-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Triggering a bug report via Settings > Developer Options > Take bug report generates a number of denials. Two bugs here: 1) According to the "allowed" list in frameworks/native/cmds/servicemanager/service_manager.c , media apps, nfc, radio, and apps with system/root UIDs can register as a binder service. However, they were not placed into the binder_service domain. Fix them. 2) The bugreport mechanism queries all the services and java programs and asks them to write to a shell owned file. Grant the corresponding SELinux capability. Addresses the following denials: <5>[ 149.342181] type=1400 audit(1389419775.872:17): avc: denied { write } for pid=4023 comm="dumpsys" path="/data/data/com.android.shell/files/bugreports/bugreport-2014-01-10-21-55-46.txt.tmp" dev="mmcblk0p28" ino=82094 scontext=u:r:keystore:s0 tcontext=u:object_r:shell_data_file:s0 tclass=file <5>[ 149.371844] type=1400 audit(1389419775.902:18): avc: denied { write } for pid=4023 comm="dumpsys" path="/data/data/com.android.shell/files/bugreports/bugreport-2014-01-10-21-55-46.txt.tmp" dev="mmcblk0p28" ino=82094 scontext=u:r:healthd:s0 tcontext=u:object_r:shell_data_file:s0 tclass=file <5>[ 149.980161] type=1400 audit(1389419776.512:22): avc: denied { write } for pid=4023 comm="dumpsys" path="/data/data/com.android.shell/files/bugreports/bugreport-2014-01-10-21-55-46.txt.tmp" dev="mmcblk0p28" ino=82094 scontext=u:r:drmserver:s0 tcontext=u:object_r:shell_data_file:s0 tclass=file <5>[ 150.095066] type=1400 audit(1389419776.622:23): avc: denied { write } for pid=1514 comm="Binder_C" path="/data/data/com.android.shell/files/bugreports/bugreport-2014-01-10-21-55-46.txt.tmp" dev="mmcblk0p28" ino=82094 scontext=u:r:system_app:s0 tcontext=u:object_r:shell_data_file:s0 tclass=file <5>[ 150.096748] type=1400 audit(1389419776.632:24): avc: denied { getattr } for pid=3178 comm="Binder_3" path="/data/data/com.android.shell/files/bugreports/bugreport-2014-01-10-21-55-46.txt.tmp" dev="mmcblk0p28" ino=82094 scontext=u:r:system_app:s0 tcontext=u:object_r:shell_data_file:s0 tclass=file <5>[ 150.097090] type=1400 audit(1389419776.632:25): avc: denied { write } for pid=1514 comm="Binder_C" path="/data/data/com.android.shell/files/bugreports/bugreport-2014-01-10-21-55-46.txt.tmp" dev="mmcblk0p28" ino=82094 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:shell_data_file:s0 tclass=file <5>[ 154.545583] type=1400 audit(1389419781.072:43): avc: denied { write } for pid=1423 comm="Binder_A" path="/data/data/com.android.shell/files/bugreports/bugreport-2014-01-10-21-55-46.txt.tmp" dev="mmcblk0p28" ino=82094 scontext=u:r:media_app:s0 tcontext=u:object_r:shell_data_file:s0 tclass=file <5>[ 156.000877] type=1400 audit(1389419782.532:44): avc: denied { write } for pid=1423 comm="Binder_A" path="/data/data/com.android.shell/files/bugreports/bugreport-2014-01-10-21-55-46.txt.tmp" dev="mmcblk0p28" ino=82094 scontext=u:r:radio:s0 tcontext=u:object_r:shell_data_file:s0 tclass=file <5>[ 156.022567] type=1400 audit(1389419782.552:45): avc: denied { write } for pid=1423 comm="Binder_A" path="/data/data/com.android.shell/files/bugreports/bugreport-2014-01-10-21-55-46.txt.tmp" dev="mmcblk0p28" ino=82094 scontext=u:r:radio:s0 tcontext=u:object_r:shell_data_file:s0 tclass=file <5>[ 156.043463] type=1400 audit(1389419782.572:46): avc: denied { write } for pid=1423 comm="Binder_A" path="/data/data/com.android.shell/files/bugreports/bugreport-2014-01-10-21-55-46.txt.tmp" dev="mmcblk0p28" ino=82094 scontext=u:r:nfc:s0 tcontext=u:object_r:shell_data_file:s0 tclass=file <5>[ 156.062550] type=1400 audit(1389419782.592:47): avc: denied { write } for pid=1423 comm="Binder_A" path="/data/data/com.android.shell/files/bugreports/bugreport-2014-01-10-21-55-46.txt.tmp" dev="mmcblk0p28" ino=82094 scontext=u:r:radio:s0 tcontext=u:object_r:shell_data_file:s0 tclass=file Change-Id: I365d530c38ce176617e48b620c05c4aae01324d3
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-02 18:05:54 +0000