From 65d4f44c1fd999d9cf9c4ef4dc65deb71bafcd8e Mon Sep 17 00:00:00 2001
From: Robert Craig <rpcraig@tycho.ncsc.mil>
Date: Wed, 27 Mar 2013 06:30:25 -0400
Subject: [PATCH] Various policy updates.
Assortment of policy changes include:
* Bluetooth domain to talk to init and procfs.
* New device node domains.
* Allow zygote to talk to its executable.
* Update system domain access to new device node domains.
* Create a post-process sepolicy with dontaudits removed.
* Allow rild to use the tty device.
Change-Id: Ibb96b590d0035b8f6d1606cd5e4393c174d10ffb
Signed-off-by: rpcraig <rpcraig@tycho.ncsc.mil>
---
Android.mk | 2 ++
bluetooth.te | 6 ++++++
device.te | 5 ++++-
file.te | 1 +
file_contexts | 1 +
mediaserver.te | 2 +-
rild.te | 2 ++
system.te | 7 +++++++
zygote.te | 3 +++
9 files changed, 27 insertions(+), 2 deletions(-)
diff --git a/Android.mk b/Android.mk
index 2a6751eec..47b17a94f 100644
--- a/Android.mk
+++ b/Android.mk
@@ -77,10 +77,12 @@ $(sepolicy_policy.conf): PRIVATE_MLS_CATS := $(MLS_CATS)
$(sepolicy_policy.conf) : $(call build_policy, security_classes initial_sids access_vectors global_macros mls_macros mls policy_capabilities te_macros attributes *.te roles users initial_sid_contexts fs_use genfs_contexts port_contexts)
@mkdir -p $(dir $@)
$(hide) m4 -D mls_num_sens=$(PRIVATE_MLS_SENS) -D mls_num_cats=$(PRIVATE_MLS_CATS) -s $^ > $@
+ $(hide) sed '/dontaudit/d' $@ > $@.dontaudit
$(LOCAL_BUILT_MODULE) : $(sepolicy_policy.conf) $(HOST_OUT_EXECUTABLES)/checkpolicy
@mkdir -p $(dir $@)
$(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $@ $<
+ $(hide) $(HOST_OUT_EXECUTABLES)/checkpolicy -M -c $(POLICYVERS) -o $(dir $<)/$(notdir $@).dontaudit $<.dontaudit
built_sepolicy := $(LOCAL_BUILT_MODULE)
sepolicy_policy.conf :=
diff --git a/bluetooth.te b/bluetooth.te
index cd1796741..31ea06479 100644
--- a/bluetooth.te
+++ b/bluetooth.te
@@ -26,3 +26,9 @@ allow bluetoothdomain bluetooth:unix_stream_socket { read write shutdown };
# tethering
allow bluetooth self:{ tun_socket udp_socket } { ioctl create };
allow bluetooth efs_file:dir search;
+
+# Talk to init over the property socket.
+unix_socket_connect(bluetooth, property, init)
+
+# proc access.
+allow bluetooth proc_bluetooth_writable:file rw_file_perms;
diff --git a/device.te b/device.te
index 628d803cc..2aeeb16d0 100644
--- a/device.te
+++ b/device.te
@@ -30,8 +30,10 @@ type qemu_device, dev_type;
type kmsg_device, dev_type;
type null_device, dev_type, mlstrustedobject;
type random_device, dev_type;
+type sensors_device, dev_type;
type serial_device, dev_type;
type socket_device, dev_type;
+type timerirq_device, dev_type;
type tty_device, dev_type;
type urandom_device, dev_type;
type video_device, dev_type;
@@ -46,6 +48,7 @@ type watchdog_device, dev_type;
type uhid_device, dev_type;
type tun_device, dev_type, mlstrustedobject;
type usbaccessory_device, dev_type;
+type usb_device, dev_type;
# All devices have a uart for the hci
# attach service. The uart dev node
@@ -53,6 +56,6 @@ type usbaccessory_device, dev_type;
# is used in per device policy
type hci_attach_dev, dev_type;
-# All devices have a rpmsg device for
+# All devices have a rpmsg device for
# achieving remoteproc and rpmsg modules
type rpmsg_device, dev_type;
diff --git a/file.te b/file.te
index cc196a3e4..a82945a5f 100644
--- a/file.te
+++ b/file.te
@@ -5,6 +5,7 @@ type sockfs, fs_type;
type rootfs, fs_type;
type proc, fs_type;
type qtaguid_proc, fs_type, mlstrustedobject;
+type proc_bluetooth_writable, fs_type;
type selinuxfs, fs_type;
type cgroup, fs_type, mlstrustedobject;
type sysfs, fs_type, mlstrustedobject;
diff --git a/file_contexts b/file_contexts
index 6501dfd83..6e05edb13 100644
--- a/file_contexts
+++ b/file_contexts
@@ -41,6 +41,7 @@
/dev/block/loop[0-9]* u:object_r:loop_device:s0
/dev/block/ram[0-9]* u:object_r:ram_device:s0
/dev/block/mtdblock5 u:object_r:radio_device:s0
+/dev/bus/usb(.*)? u:object_r:usb_device:s0
/dev/cam u:object_r:camera_device:s0
/dev/console u:object_r:console_device:s0
/dev/cpuctl(/.*)? u:object_r:cpuctl_device:s0
diff --git a/mediaserver.te b/mediaserver.te
index 0696331cd..85be2d5de 100644
--- a/mediaserver.te
+++ b/mediaserver.te
@@ -49,4 +49,4 @@ allow mediaserver qtaguid_proc:file rw_file_perms;
allow mediaserver qtaguid_device:chr_file r_file_perms;
# Allow abstract socket connection
-allow mediaserver rild:unix_stream_socket connectto;
+allow mediaserver rild:unix_stream_socket { connectto read write setopt };
diff --git a/rild.te b/rild.te
index c331bb327..e8069bff6 100644
--- a/rild.te
+++ b/rild.te
@@ -37,3 +37,5 @@ allow rild radio_prop:property_service set;
# Read/Write to uart driver (for GPS)
allow rild gps_device:chr_file rw_file_perms;
+
+allow rild tty_device:chr_file rw_file_perms;
diff --git a/system.te b/system.te
index eacd5fb55..cf92bca9f 100644
--- a/system.te
+++ b/system.te
@@ -221,3 +221,10 @@ allow system backup_data_file:dir { relabelto relabelfrom };
allow system cache_backup_file:file { relabelto relabelfrom };
# LocalTransport creates and relabels /cache/backup
allow system cache_backup_file:dir { relabelto relabelfrom create_dir_perms };
+
+# Allow system to talk to usb device
+allow system usb_device:chr_file rw_file_perms;
+allow system usb_device:dir r_dir_perms;
+
+# Allow system to talk to sensors and timer irq
+allow system { sensors_device timerirq_device }:chr_file rw_file_perms;
diff --git a/zygote.te b/zygote.te
index 9707082c3..33e8fe80a 100644
--- a/zygote.te
+++ b/zygote.te
@@ -37,3 +37,6 @@ allow zygote sdcard_type:dir { write search setattr create add_name mounton };
dontaudit zygote self:capability fsetid;
allow zygote tmpfs:dir { write create add_name setattr mounton search };
allow zygote tmpfs:filesystem mount;
+
+# Handle --invoke-with command when launching Zygote with a wrapper command.
+allow zygote zygote_exec:file { execute_no_trans open };
--
GitLab