From 9899568f6c4dd740ef2b6c213726ca5945514e77 Mon Sep 17 00:00:00 2001
From: Tri Vo <trong@google.com>
Date: Mon, 14 May 2018 16:57:37 -0700
Subject: [PATCH] Constrain cgroups access.
What changed:
- Removed cgroup access from untrusted and priv apps.
- Settings app writes to /dev/stune/foreground/tasks, so system_app domain
retains access to cgroup.
- libcutils exports API to /dev/{cpuset, stune}/*. This API seems to be used
abundantly in native code. So added a blanket allow rule for (coredomain - apps)
to access cgroups.
- For now, only audit cgroup access from vendor domains. Ultimately, we want to
either constrain vendor access to individual domains or, even better, remove
vendor access and have platform manage cgroups exclusively.
Bug: 110043362
Test: adb shell setprop ro.config.per_app_memcg true, device correctly populates
/dev/memcg on a per app basis on a device that supports that.
Test: aosp_sailfish, wahoo boot without cgroup denials
Change-Id: I9e441b26792f1edb1663c660bcff422ec7a6332b
---
private/app_neverallows.te | 3 +++
private/priv_app.te | 3 +++
private/system_app.te | 3 +++
public/app.te | 4 ----
public/domain.te | 14 +++++++++++---
public/init.te | 2 +-
public/vendor_init.te | 1 +
7 files changed, 22 insertions(+), 8 deletions(-)
diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 344ecd544..1e824046b 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -274,3 +274,6 @@ neverallow all_untrusted_apps mediaextractor_update_service:service_manager find
# This will go away in a future Android release
neverallow { all_untrusted_apps -untrusted_app_25 } proc_tty_drivers:file r_file_perms;
neverallow all_untrusted_apps proc_tty_drivers:file ~r_file_perms;
+
+# Untrusted apps are not allowed to use cgroups.
+neverallow all_untrusted_apps cgroup:file *;
diff --git a/private/priv_app.te b/private/priv_app.te
index e12cce765..192221db0 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -218,3 +218,6 @@ neverallow priv_app file_type:file link;
# upon traceur to pass a file descriptor which they can then read
neverallow priv_app trace_data_file:dir *;
neverallow priv_app trace_data_file:file { no_w_file_perms open };
+
+# Do not allow priv_app access to cgroups.
+neverallow priv_app cgroup:file *;
diff --git a/private/system_app.te b/private/system_app.te
index 40fec6acf..4bfcc18f4 100644
--- a/private/system_app.te
+++ b/private/system_app.te
@@ -122,6 +122,9 @@ allow system_app {
proc_version
}:file r_file_perms;
+# Settings app writes to /dev/stune/foreground/tasks.
+allow system_app cgroup:file w_file_perms;
+
control_logd(system_app)
read_runtime_log_tags(system_app)
get_prop(system_app, device_logging_prop)
diff --git a/public/app.te b/public/app.te
index 5a8215211..800e891b4 100644
--- a/public/app.te
+++ b/public/app.te
@@ -22,10 +22,6 @@ allow appdomain zygote_exec:file rx_file_perms;
# Notify zygote of death;
allow appdomain zygote:process sigchld;
-# Place process into foreground / background
-allow appdomain cgroup:dir { search write };
-allow appdomain cgroup:file rw_file_perms;
-
# Read /data/dalvik-cache.
allow appdomain dalvikcache_data_file:dir { search getattr };
allow appdomain dalvikcache_data_file:file r_file_perms;
diff --git a/public/domain.te b/public/domain.te
index 16cc09884..2eb2e15a8 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -258,9 +258,17 @@ allow domain selinuxfs:file getattr;
allow domain sysfs:dir search;
allow domain selinuxfs:filesystem getattr;
-# For /acct/uid/*/tasks.
-allow domain cgroup:dir { search write };
-allow domain cgroup:file w_file_perms;
+# Path resolution access in cgroups.
+allow domain cgroup:dir search;
+allow { coredomain -appdomain } cgroup:dir w_dir_perms;
+allow { coredomain -appdomain } cgroup:file w_file_perms;
+# TODO(b/110043362): Clean up cgroup access from non-system domains.
+allow { domain -coredomain } cgroup:file w_file_perms;
+auditallow {
+ domain
+ -coredomain
+ -vendor_init
+} cgroup:file w_file_perms;
# Almost all processes log tracing information to
# /sys/kernel/debug/tracing/trace_marker
diff --git a/public/init.te b/public/init.te
index 18d11b6c6..31fa79733 100644
--- a/public/init.te
+++ b/public/init.te
@@ -93,7 +93,7 @@ allow init sysfs:dir mounton;
allow init tmpfs:dir create_dir_perms;
allow init tmpfs:dir mounton;
allow init cgroup:dir create_dir_perms;
-r_dir_file(init, cgroup)
+allow init cgroup:file rw_file_perms;
allow init cpuctl_device:dir { create mounton };
# /config
diff --git a/public/vendor_init.te b/public/vendor_init.te
index dfd4d8fa8..b6502d234 100644
--- a/public/vendor_init.te
+++ b/public/vendor_init.te
@@ -15,6 +15,7 @@ allow vendor_init rootfs:lnk_file { create unlink };
# Create cgroups mount points in tmpfs and mount cgroups on them.
allow vendor_init cgroup:dir create_dir_perms;
+allow vendor_init cgroup:file w_file_perms;
# /config
allow vendor_init configfs:dir mounton;
--
GitLab