From bf696327246833c9aba55a645e6c433e9f321e27 Mon Sep 17 00:00:00 2001
From: Riley Spahn <rileyspahn@google.com>
Date: Fri, 18 Jul 2014 11:21:34 -0700
Subject: [PATCH] DO NOT MERGE: Remove service_manager audit_allows.
Remove the audit_allow rules from lmp-dev because
we will not be tightening any further so these logs
will not be useful.
Change-Id: Ibd0e4bf4e8f4f5438c3dbb9114addaadac9ef8c9
---
adbd.te | 6 ------
attributes | 3 ---
bluetooth.te | 9 ---------
bootanim.te | 4 ----
domain.te | 2 --
drmserver.te | 8 --------
dumpstate.te | 15 ---------------
healthd.te | 4 ----
inputflinger.te | 4 ----
isolated_app.te | 9 ---------
keystore.te | 4 ----
mediaserver.te | 10 ----------
nfc.te | 9 ---------
platform_app.te | 10 ----------
radio.te | 10 ----------
surfaceflinger.te | 8 --------
system_app.te | 11 -----------
system_server.te | 3 ---
te_macros | 9 ---------
untrusted_app.te | 13 -------------
20 files changed, 151 deletions(-)
diff --git a/adbd.te b/adbd.te
index 3b654a152..58fdead68 100644
--- a/adbd.te
+++ b/adbd.te
@@ -68,9 +68,3 @@ allow adbd appdomain:unix_stream_socket connectto;
# ndk-gdb invokes adb pull of app_process, linker, and libc.so.
allow adbd zygote_exec:file r_file_perms;
allow adbd system_file:file r_file_perms;
-
-service_manager_local_audit_domain(adbd)
-auditallow adbd {
- service_manager_type
- -surfaceflinger_service
-}:service_manager find;
diff --git a/attributes b/attributes
index d40217aed..613ed8f35 100644
--- a/attributes
+++ b/attributes
@@ -67,6 +67,3 @@ attribute bluetoothdomain;
# All domains used for binder service domains.
attribute binderservicedomain;
-
-# All domains that are excluded from the domain.te auditallow.
-attribute service_manager_local_audit;
diff --git a/bluetooth.te b/bluetooth.te
index 56fe17058..2b108a9e8 100644
--- a/bluetooth.te
+++ b/bluetooth.te
@@ -49,15 +49,6 @@ allow bluetooth bluetooth_prop:property_service set;
allow bluetooth pan_result_prop:property_service set;
allow bluetooth ctl_dhcp_pan_prop:property_service set;
-# Audited locally.
-service_manager_local_audit_domain(bluetooth)
-auditallow bluetooth {
- service_manager_type
- -bluetooth_service
- -radio_service
- -system_server_service
-}:service_manager find;
-
###
### Neverallow rules
###
diff --git a/bootanim.te b/bootanim.te
index 759229553..3a0a76f0f 100644
--- a/bootanim.te
+++ b/bootanim.te
@@ -11,7 +11,3 @@ allow bootanim gpu_device:chr_file rw_file_perms;
# /oem access
allow bootanim oemfs:dir search;
-
-# Audited locally.
-service_manager_local_audit_domain(bootanim)
-auditallow bootanim { service_manager_type -surfaceflinger_service }:service_manager find;
diff --git a/domain.te b/domain.te
index 091345398..2ed20bb50 100644
--- a/domain.te
+++ b/domain.te
@@ -159,9 +159,7 @@ allow domain asec_public_file:file r_file_perms;
allow domain { asec_public_file asec_apk_file }:dir r_dir_perms;
allow domain servicemanager:service_manager list;
-auditallow domain servicemanager:service_manager list;
allow domain service_manager_type:service_manager find;
-auditallow { domain -service_manager_local_audit } service_manager_type:service_manager find;
###
### neverallow rules
diff --git a/drmserver.te b/drmserver.te
index 14b2f4936..19931766e 100644
--- a/drmserver.te
+++ b/drmserver.te
@@ -46,11 +46,3 @@ allow drmserver asec_apk_file:file { read getattr };
allow drmserver radio_data_file:file { read getattr };
allow drmserver drmserver_service:service_manager add;
-
-# Audited locally.
-service_manager_local_audit_domain(drmserver)
-auditallow drmserver {
- service_manager_type
- -drmserver_service
- -system_server_service
-}:service_manager find;
diff --git a/dumpstate.te b/dumpstate.te
index 242cb9326..279fd98fb 100644
--- a/dumpstate.te
+++ b/dumpstate.te
@@ -96,18 +96,3 @@ control_logd(dumpstate)
# Read network state info files.
allow dumpstate net_data_file:dir search;
allow dumpstate net_data_file:file r_file_perms;
-
-service_manager_local_audit_domain(dumpstate)
-auditallow dumpstate {
- service_manager_type
- -drmserver_service
- -healthd_service
- -inputflinger_service
- -keystore_service
- -mediaserver_service
- -nfc_service
- -radio_service
- -surfaceflinger_service
- -system_app_service
- -system_server_service
-}:service_manager find;
diff --git a/healthd.te b/healthd.te
index 940f7c413..a788236cf 100644
--- a/healthd.te
+++ b/healthd.te
@@ -34,10 +34,6 @@ allow healthd self:capability sys_boot;
allow healthd healthd_service:service_manager add;
-# Audited locally.
-service_manager_local_audit_domain(healthd)
-auditallow healthd { service_manager_type -healthd_service }:service_manager find;
-
# Healthd needs to tell init to continue the boot
# process when running in charger mode.
unix_socket_connect(healthd, property, init)
diff --git a/inputflinger.te b/inputflinger.te
index 4377a104f..283bbbaf3 100644
--- a/inputflinger.te
+++ b/inputflinger.te
@@ -9,7 +9,3 @@ binder_service(inputflinger)
binder_call(inputflinger, system_server)
allow inputflinger inputflinger_service:service_manager add;
-
-# Audited locally.
-service_manager_local_audit_domain(inputflinger)
-auditallow inputflinger { service_manager_type -inputflinger_service }:service_manager find;
diff --git a/isolated_app.te b/isolated_app.te
index 5929b2593..a156838bb 100644
--- a/isolated_app.te
+++ b/isolated_app.te
@@ -18,12 +18,3 @@ net_domain(isolated_app)
# Needed to allow dlopen() from Chrome renderer processes.
# See b/15902433 for details.
allow isolated_app app_data_file:file execute;
-
-# Audited locally.
-service_manager_local_audit_domain(isolated_app)
-auditallow isolated_app {
- service_manager_type
- -radio_service
- -surfaceflinger_service
- -system_server_service
-}:service_manager find;
diff --git a/keystore.te b/keystore.te
index f2c5039b0..afa701c7e 100644
--- a/keystore.te
+++ b/keystore.te
@@ -28,9 +28,5 @@ neverallow domain keystore:process ptrace;
allow keystore keystore_service:service_manager add;
-# Audited locally.
-service_manager_local_audit_domain(keystore)
-auditallow keystore { service_manager_type -keystore_service }:service_manager find;
-
# Check SELinux permissions.
selinux_check_access(keystore)
diff --git a/mediaserver.te b/mediaserver.te
index 52c593e6e..55d1f2053 100644
--- a/mediaserver.te
+++ b/mediaserver.te
@@ -79,13 +79,3 @@ unix_socket_connect(mediaserver, bluetooth, bluetooth)
allow mediaserver tee:unix_stream_socket connectto;
allow mediaserver mediaserver_service:service_manager add;
-
-# Audited locally.
-service_manager_local_audit_domain(mediaserver)
-auditallow mediaserver {
- service_manager_type
- -drmserver_service
- -mediaserver_service
- -system_server_service
- -surfaceflinger_service
-}:service_manager find;
diff --git a/nfc.te b/nfc.te
index 2b851a276..65aaef76c 100644
--- a/nfc.te
+++ b/nfc.te
@@ -15,12 +15,3 @@ allow nfc sysfs_nfc_power_writable:file rw_file_perms;
allow nfc sysfs:file write;
allow nfc nfc_service:service_manager add;
-
-# Audited locally.
-service_manager_local_audit_domain(nfc)
-auditallow nfc {
- service_manager_type
- -mediaserver_service
- -surfaceflinger_service
- -system_server_service
-}:service_manager find;
diff --git a/platform_app.te b/platform_app.te
index a44e35d8a..7ff8d62e2 100644
--- a/platform_app.te
+++ b/platform_app.te
@@ -27,13 +27,3 @@ allow platform_app media_rw_data_file:file create_file_perms;
# Write to /cache.
allow platform_app cache_file:dir create_dir_perms;
allow platform_app cache_file:file create_file_perms;
-
-# Audited locally.
-service_manager_local_audit_domain(platform_app)
-auditallow platform_app {
- service_manager_type
- -mediaserver_service
- -radio_service
- -surfaceflinger_service
- -system_server_service
-}:service_manager find;
diff --git a/radio.te b/radio.te
index 5f45df33c..d0018eac2 100644
--- a/radio.te
+++ b/radio.te
@@ -28,13 +28,3 @@ auditallow radio system_radio_prop:property_service set;
allow radio ctl_rildaemon_prop:property_service set;
allow radio radio_service:service_manager add;
-
-# Audited locally.
-service_manager_local_audit_domain(radio)
-auditallow radio {
- service_manager_type
- -mediaserver_service
- -radio_service
- -surfaceflinger_service
- -system_server_service
-}:service_manager find;
diff --git a/surfaceflinger.te b/surfaceflinger.te
index ff91993ec..c50861209 100644
--- a/surfaceflinger.te
+++ b/surfaceflinger.te
@@ -59,14 +59,6 @@ allow surfaceflinger tee_device:chr_file rw_file_perms;
allow surfaceflinger surfaceflinger_service:service_manager add;
-# Audited locally.
-service_manager_local_audit_domain(surfaceflinger)
-auditallow surfaceflinger {
- service_manager_type
- -surfaceflinger_service
- -system_server_service
-}:service_manager find;
-
###
### Neverallow rules
###
diff --git a/system_app.te b/system_app.te
index 5a5888f2f..2a7421b39 100644
--- a/system_app.te
+++ b/system_app.te
@@ -64,14 +64,3 @@ allow system_app keystore:keystore_key {
};
control_logd(system_app)
-
-# Audited locally.
-service_manager_local_audit_domain(system_app)
-auditallow system_app {
- service_manager_type
- -keystore_service
- -nfc_service
- -radio_service
- -surfaceflinger_service
- -system_server_service
-}:service_manager find;
diff --git a/system_server.te b/system_server.te
index 9d973dbbc..9afd8afb8 100644
--- a/system_server.te
+++ b/system_server.te
@@ -362,9 +362,6 @@ allow system_server pstorefs:file r_file_perms;
allow system_server system_server_service:service_manager add;
-# Audited locally.
-service_manager_local_audit_domain(system_server)
-
allow system_server keystore:keystore_key {
test
get
diff --git a/te_macros b/te_macros
index b2913f3cd..7c1f6e5d8 100644
--- a/te_macros
+++ b/te_macros
@@ -109,7 +109,6 @@ typeattribute $1 appdomain;
tmpfs_domain($1)
# Map with PROT_EXEC.
allow $1 $1_tmpfs:file execute;
-service_manager_local_audit_domain($1)
')
#####################################
@@ -359,11 +358,3 @@ define(`use_keystore', `
allow keystore $1:process getattr;
binder_call($1, keystore)
')
-
-###########################################
-# service_manager_local_audit_domain(domain)
-# Has its own auditallow rule on service_manager
-# and should be excluded from the domain.te auditallow.
-define(`service_manager_local_audit_domain', `
- typeattribute $1 service_manager_local_audit;
-')
diff --git a/untrusted_app.te b/untrusted_app.te
index c97b4513b..f29149e3d 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -64,19 +64,6 @@ allow untrusted_app media_rw_data_file:file create_file_perms;
allow untrusted_app cache_file:dir create_dir_perms;
allow untrusted_app cache_file:file create_file_perms;
-# Audited locally.
-service_manager_local_audit_domain(untrusted_app)
-auditallow untrusted_app {
- service_manager_type
- -drmserver_service
- -keystore_service
- -mediaserver_service
- -nfc_service
- -radio_service
- -surfaceflinger_service
- -system_server_service
-}:service_manager find;
-
###
### neverallow rules
###
--
GitLab