From 8a6cc52ed7480eb522537aa7c954c227e10e1aaa Mon Sep 17 00:00:00 2001
From: Tri Vo <trong@google.com>
Date: Wed, 28 Nov 2018 13:47:44 -0800
Subject: [PATCH] Remove coredomain /dev access no longer needed after Treble
According to go/sedenials (internal dogfooding), coredomain access to
following types is not exercised and can be removed:
iio_device
radio_device
tee_device
Access to audio_device is still needed since some ALSA interfaces
(/dev/snd/*) are directly used by system_server.
Bug: 110962171
Test: m selinux_policy
Change-Id: I740b99813e1f93136bfcaec087b74f0e03b259ad
---
private/coredomain.te | 17 ++++++++---------
private/surfaceflinger.te | 4 ----
private/system_server.te | 4 +---
public/drmserver.te | 1 -
public/gatekeeperd.te | 1 -
5 files changed, 9 insertions(+), 18 deletions(-)
diff --git a/private/coredomain.te b/private/coredomain.te
index 78ffb27df..56502472a 100644
--- a/private/coredomain.te
+++ b/private/coredomain.te
@@ -169,13 +169,12 @@ full_treble_only(`
}{ usbfs binfmt_miscfs }:file no_rw_file_perms;
')
-# Audit coredomain access to /dev nodes that might no longer be needed after
-# Treble.
-userdebug_or_eng(`
- auditallow coredomain {
- audio_device
- iio_device
- radio_device
- tee_device
- }:chr_file { open read append write ioctl };
+# Following /dev nodes must not be directly accessed by coredomain after Treble,
+# but should instead be wrapped by HALs.
+full_treble_only(`
+ neverallow coredomain {
+ iio_device
+ radio_device
+ tee_device
+ }:chr_file { open read append write ioctl };
')
diff --git a/private/surfaceflinger.te b/private/surfaceflinger.te
index c50faef31..36e784f92 100644
--- a/private/surfaceflinger.te
+++ b/private/surfaceflinger.te
@@ -71,10 +71,6 @@ binder_call(surfaceflinger, dumpstate)
binder_call(surfaceflinger, shell)
r_dir_file(surfaceflinger, dumpstate)
-# Needed on some devices for playing DRM protected content,
-# but seems expected and appropriate for all devices.
-allow surfaceflinger tee_device:chr_file rw_file_perms;
-
# media.player service
# do not use add_service() as hal_graphics_composer_default may be the
diff --git a/private/system_server.te b/private/system_server.te
index 4cf8ae02b..1466e6cca 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -326,10 +326,8 @@ allow system_server device:dir r_dir_perms;
allow system_server mdns_socket:sock_file rw_file_perms;
allow system_server alarm_device:chr_file rw_file_perms;
allow system_server gpu_device:chr_file rw_file_perms;
-allow system_server iio_device:chr_file rw_file_perms;
allow system_server input_device:dir r_dir_perms;
allow system_server input_device:chr_file rw_file_perms;
-allow system_server radio_device:chr_file r_file_perms;
allow system_server tty_device:chr_file rw_file_perms;
allow system_server usbaccessory_device:chr_file rw_file_perms;
allow system_server video_device:dir r_dir_perms;
@@ -338,7 +336,7 @@ allow system_server adbd_socket:sock_file rw_file_perms;
allow system_server rtc_device:chr_file rw_file_perms;
allow system_server audio_device:dir r_dir_perms;
-# write access needed for MIDI
+# write access to ALSA interfaces (/dev/snd/*) needed for MIDI
allow system_server audio_device:chr_file rw_file_perms;
# tun device used for 3rd party vpn apps
diff --git a/public/drmserver.te b/public/drmserver.te
index 4a101478a..b7b641c18 100644
--- a/public/drmserver.te
+++ b/public/drmserver.te
@@ -20,7 +20,6 @@ binder_call(drmserver, mediaserver)
allow drmserver sdcard_type:dir search;
allow drmserver drm_data_file:dir create_dir_perms;
allow drmserver drm_data_file:file create_file_perms;
-allow drmserver tee_device:chr_file rw_file_perms;
allow drmserver { app_data_file privapp_data_file }:file { read write getattr map };
allow drmserver sdcard_type:file { read write getattr map };
r_dir_file(drmserver, efs_file)
diff --git a/public/gatekeeperd.te b/public/gatekeeperd.te
index 40c9a075b..e1739c273 100644
--- a/public/gatekeeperd.te
+++ b/public/gatekeeperd.te
@@ -7,7 +7,6 @@ binder_use(gatekeeperd)
### Rules needed when Gatekeeper HAL runs inside gatekeeperd process.
### These rules should eventually be granted only when needed.
-allow gatekeeperd tee_device:chr_file rw_file_perms;
allow gatekeeperd ion_device:chr_file r_file_perms;
# Load HAL implementation
allow gatekeeperd system_file:dir r_dir_perms;
--
GitLab