From 971aeeda2138b27e3f8850f2fd7c95f60508154c Mon Sep 17 00:00:00 2001
From: dcashman <dcashman@google.com>
Date: Tue, 23 Feb 2016 17:09:48 -0800
Subject: [PATCH] Label /proc/meminfo.
Address the following denial:
m.chrome.canary: type=1400 audit(0.0:15): avc: granted { read open } for path="/proc/meminfo" dev="proc" ino=4026544360 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:proc:s0 tclass=file
Bug: 22032619
Chromium Bug: 586021
Change-Id: I584345c84d870c313da69ec97a0b1e54c0eb9ee1
---
domain_deprecated.te | 1 +
file.te | 1 +
genfs_contexts | 1 +
untrusted_app.te | 7 ++++---
4 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/domain_deprecated.te b/domain_deprecated.te
index ed88cca99..4da7a3190 100644
--- a/domain_deprecated.te
+++ b/domain_deprecated.te
@@ -57,6 +57,7 @@ r_dir_file(domain_deprecated, proc)
r_dir_file(domain_deprecated, sysfs)
r_dir_file(domain_deprecated, inotify)
r_dir_file(domain_deprecated, cgroup)
+r_dir_file(domain_deprecated, proc_meminfo)
r_dir_file(domain_deprecated, proc_net)
# Get SELinux enforcing status.
diff --git a/file.te b/file.te
index ff60c0435..7d090f446 100644
--- a/file.te
+++ b/file.te
@@ -14,6 +14,7 @@ type qtaguid_proc, fs_type, mlstrustedobject;
type proc_bluetooth_writable, fs_type;
type proc_cpuinfo, fs_type;
type proc_iomem, fs_type;
+type proc_meminfo, fs_type;
type proc_net, fs_type;
type proc_sysrq, fs_type;
type proc_uid_cputime_showstat, fs_type;
diff --git a/genfs_contexts b/genfs_contexts
index 3f865c4e4..2700a9458 100644
--- a/genfs_contexts
+++ b/genfs_contexts
@@ -3,6 +3,7 @@ genfscon rootfs / u:object_r:rootfs:s0
# proc labeling can be further refined (longest matching prefix).
genfscon proc / u:object_r:proc:s0
genfscon proc /iomem u:object_r:proc_iomem:s0
+genfscon proc /meminfo u:object_r:proc_meminfo:s0
genfscon proc /net u:object_r:proc_net:s0
genfscon proc /net/xt_qtaguid/ctrl u:object_r:qtaguid_proc:s0
genfscon proc /cpuinfo u:object_r:proc_cpuinfo:s0
diff --git a/untrusted_app.te b/untrusted_app.te
index 189f3c509..d5abe17e5 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -94,10 +94,11 @@ allow untrusted_app self:process ptrace;
# for files. Suppress the denials when they occur.
dontaudit untrusted_app exec_type:file getattr;
-# TODO: access of /proc/meminfo, give specific label or switch to
-# using meminfo service
-allow untrusted_app proc:file r_file_perms;
+# TODO: switch to meminfo service
+allow untrusted_app proc_meminfo:file r_file_perms;
+
# https://code.google.com/p/chromium/issues/detail?id=586021
+allow untrusted_app proc:file r_file_perms;
auditallow untrusted_app proc:file r_file_perms;
# access /proc/net/xt_qtguid/stats
r_dir_file(untrusted_app, proc_net)
--
GitLab