Skip to content
GitLab
Explore
Sign in
Primary navigation
Search or go to…
Project
S
sepolicy
Manage
Activity
Members
Plan
Wiki
Code
Repository
Branches
Commits
Tags
Repository graph
Compare revisions
Snippets
Deploy
Releases
Package Registry
Model registry
Operate
Terraform modules
Analyze
Contributor analytics
Repository analytics
Model experiments
Help
Help
Support
GitLab documentation
Compare GitLab plans
Community forum
Contribute to GitLab
Provide feedback
Keyboard shortcuts
?
Snippets
Groups
Projects
Show more breadcrumbs
CodeLinaro
public-release-test
platform
system
sepolicy
Commits
13e4eb8c
Commit
13e4eb8c
authored
6 years ago
by
Treehugger Robot
Committed by
Gerrit Code Review
6 years ago
Browse files
Options
Downloads
Plain Diff
Merge "Add a script to check for ways to cleanup SELinux policy."
parents
7826a787
c4327316
No related branches found
Branches containing commit
No related tags found
No related merge requests found
Changes
1
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
tools/sepolicy_cleanup_check.sh
+114
-0
114 additions, 0 deletions
tools/sepolicy_cleanup_check.sh
with
114 additions
and
0 deletions
tools/sepolicy_cleanup_check.sh
0 → 100755
+
114
−
0
View file @
13e4eb8c
#!/bin/bash
# This script uses some heuristics to suggest potential ways to clean up SELinux policy.
# As these are heuristics, not everything it outputs is an error.
# It is better to run this on device-specific policy rather than core policy.
# It requires a device connected to adb.
# Usage:
# ./sepolicy_cleanup_check.sh <sepolicy source path> [serial]
if
[[
$#
-lt
1
]]
;
then
echo
"Usage:
$0
<sepolicy source path> [serial]"
exit
fi
sedir
=
$1
shift
adb_cmd
=
"adb"
if
[[
$#
-eq
1
]]
;
then
adb_cmd
=
"
$adb_cmd
-s
$1
"
shift
fi
$adb_cmd
shell
id
&>/dev/null
if
[[
$?
-ne
0
]]
;
then
echo
"Please plug in a device and/or specify a serial"
adb devices
exit
fi
echo
"Warning: this file uses heuristics, so all of its outputs are not necessarily errors."
echo
"For example, when run on core policy, it will likely find many things that do not exist on a given device but might exist on others."
echo
echo
"Scanning for labels that are not assigned to any files."
# Find all types.
grep
-r
"^type "
--exclude
=
\*
.go
$sedir
--exclude
=
\*
_macros |
sed
's/^.*:.*type \([^,]*\)*.*$/\1/'
|
sort
|
uniq
|
while
read
-r
type
;
do
# Find types that are not referenced in *_contexts.
if
[[
`
find
$sedir
-name
"*_contexts"
-not
-path
"*prebuilts*"
-exec
grep
$type
'{}'
\;
|wc
-l
`
-eq
0
]]
;
then
echo
"None for
$type
"
grep
-r
$type
--exclude-dir
=
prebuilts
--exclude
=
\*
.cil
$sedir
fi
done
echo
echo
"Scanning for executables that don't exist."
# Find executable types.
grep
-r
"^type .*exec_type"
--exclude
=
\*
.go
$sedir
|
sed
's/^.*:.*type \([^,]*\)*.*$/\1/'
|
sort
|
uniq
|
while
read
-r
type
;
do
path_line
=
`
grep
-r
$type
--include
=
\*
_contexts
$sedir
`
# Note that this only examines one entry, even if multiple executables have the same label.
# But the file_contexts scan below covers that case.
path
=
`
echo
$path_line
|
sed
's/^.*:[^\/]*\([^ ]*\) .*$/\1/'
`
# Replace character classes and + with *.
path
=
`
echo
$path
|
sed
's/\[[^]]*\]/*/'
|
sed
's/+/*/'
`
# Check whether the file exists.
if
[
-n
"
`
$adb_cmd
shell
ls
-lZ
$path
< /dev/null |&
grep
"No such file or directory"
`
"
]
;
then
echo
"
$path
does not exist"
fi
done
echo
echo
"Scanning genfs_contexts for files that don't exist."
# Find files in genfs_contexts.
find
$sedir
-name
genfs_contexts
-exec
grep
"^genfscon "
'{}'
\;
|
cut
-d
' '
-f2
,3 |
sort
|
uniq
|
while
read
-r
file_line
;
do
# Extract the full path.
path
=
`
echo
$file_line
|
sed
's/rootfs //'
|
sed
's/sysfs /\/sys/'
|
sed
's/proc /\/proc/'
|
sed
's/debugfs /\/sys\/kernel\/debug/'
|
sed
's/tracefs /\/sys\/kernel\/debug\/tracing/'
`
# Skip things whose prefix we don't recognize.
if
[[
$path
=
*
" "
*
]]
;
then
continue
fi
# Check whether the file exists.
if
[
-n
"
`
$adb_cmd
shell
ls
-lZ
$path
< /dev/null |&
grep
"No such file or directory"
`
"
]
;
then
echo
"
$path
does not exist"
fi
done
echo
echo
"Scanning file_contexts for files that don't exist."
# Find files in file_contexts.
find
$sedir
-name
file_contexts
-not
-path
"*prebuilts*"
-exec
grep
"^/"
'{}'
\;
|
cut
-d
' '
-f1
|
cut
-f1
|
sort
|
uniq
|
while
read
-r
path
;
do
# Replace (/.*)? with *
# Replace (64)? with ??
# Replace (vendor|system/vendor) with /vendor
# Replace character classes and + with *.
# Replace captures.
# Replace \. with .
# Replace .* with *
# Replace ** with *
path
=
`
echo
"
$path
"
|
sed
's/(\/\.\*)?$//'
|
sed
's/(64)?/??/'
|
sed
's/\(vendor|system\/vendor\)/vendor/'
|
sed
's/\[[^]]*\]/*/'
|
sed
's/+/*/'
|
sed
's/(\([^)]*\))/\1/'
|
sed
's/\\\././g'
|
sed
's/\.\*/\*/g'
|
sed
's/\*\*/\*/g'
`
# Check whether the file exists.
if
[
-n
"
`
$adb_cmd
shell
ls
-lZ
"
$path
"
< /dev/null |&
grep
"No such file or directory"
`
"
]
;
then
echo
"
$path
does not exist"
fi
done
echo
echo
"Scanning for rules that are defined in the wrong file."
echo
"That is, rules that do not contain the name of the file."
# Find .te files.
find
$sedir
-name
"*.te"
-not
-path
"*prebuilts*"
|
while
read
-r
file
;
do
filename
=
`
basename
$file
`
filename
=
"
${
filename
%.*
}
"
# Look for lines that don't have the filename in them.
lines
=
$(
grep
"^[^# }']"
$file
|
grep
-v
$filename
|
grep
-v
"^userdebug_or_eng(
\`
$"
|
grep
-v
"^type "
|
grep
"[,)]"
|
grep
-v
"^define("
)
if
[[
-n
"
$lines
"
]]
;
then
echo
"
$file
:"
echo
"
$lines
"
fi
done
echo
echo
"Scanning for rules that use the wrong file/dir macros."
grep
-r
":file.*_dir_perms"
--exclude
=
\*
_macros
$sedir
grep
-r
":dir.*_file_perms"
--exclude
=
\*
_macros
$sedir
This diff is collapsed.
Click to expand it.
Preview
0%
Loading
Try again
or
attach a new file
.
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Save comment
Cancel
Please
register
or
sign in
to comment