Skip to content
Snippets Groups Projects
Commit 7acd1517 authored by Nick Kralevich's avatar Nick Kralevich Committed by android-build-merger
Browse files

Merge "relax fuse_device neverallow rules" into oc-dev

am: c78db706

Change-Id: I7b866f588980ebb068629e326155976629bf2223
parents 8784e1e7 c78db706
No related branches found
No related tags found
No related merge requests found
...@@ -91,6 +91,9 @@ neverallow { all_untrusted_apps -mediaprovider } { ...@@ -91,6 +91,9 @@ neverallow { all_untrusted_apps -mediaprovider } {
') ')
}:dir_file_class_set { create unlink }; }:dir_file_class_set { create unlink };
# No untrusted component should be touching /dev/fuse
neverallow all_untrusted_apps fuse_device:chr_file *;
# Do not allow untrusted apps to directly open tun_device # Do not allow untrusted apps to directly open tun_device
neverallow all_untrusted_apps tun_device:chr_file open; neverallow all_untrusted_apps tun_device:chr_file open;
......
...@@ -61,3 +61,10 @@ allow platform_app preloads_media_file:file r_file_perms; ...@@ -61,3 +61,10 @@ allow platform_app preloads_media_file:file r_file_perms;
allow platform_app preloads_media_file:dir r_dir_perms; allow platform_app preloads_media_file:dir r_dir_perms;
read_runtime_log_tags(platform_app) read_runtime_log_tags(platform_app)
###
### Neverallow rules
###
# app domains which access /dev/fuse should not run as platform_app
neverallow platform_app fuse_device:chr_file *;
...@@ -83,3 +83,10 @@ r_dir_file(system_app, sysfs_type) ...@@ -83,3 +83,10 @@ r_dir_file(system_app, sysfs_type)
control_logd(system_app) control_logd(system_app)
read_runtime_log_tags(system_app) read_runtime_log_tags(system_app)
###
### Neverallow rules
###
# app domains which access /dev/fuse should not run as system_app
neverallow system_app fuse_device:chr_file *;
...@@ -988,26 +988,6 @@ neverallow * domain:file { execute execute_no_trans entrypoint }; ...@@ -988,26 +988,6 @@ neverallow * domain:file { execute execute_no_trans entrypoint };
# TODO: fix system_server and dumpstate # TODO: fix system_server and dumpstate
neverallow { domain -init -system_server -dumpstate } debugfs:file no_rw_file_perms; neverallow { domain -init -system_server -dumpstate } debugfs:file no_rw_file_perms;
neverallow {
domain
-init
-recovery
-sdcardd
-vold
} fuse_device:chr_file open;
neverallow {
domain
-dumpstate
-init
-priv_app
-recovery
-sdcardd
-shell # Restricted by shell.te to only getattr
-system_server
-ueventd
-vold
} fuse_device:chr_file *;
# Profiles contain untrusted data and profman parses that. We should only run # Profiles contain untrusted data and profman parses that. We should only run
# in from installd forked processes. # in from installd forked processes.
neverallow { neverallow {
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment