From c96bb1ed8ca3eae2d8a681428c3a828cf8865028 Mon Sep 17 00:00:00 2001
From: Sandeep Patil <sspatil@google.com>
Date: Thu, 13 Apr 2017 13:06:00 -0700
Subject: [PATCH] vendor_shell: add sepolicy for vendor shell
Bug: 36463595
Test: Boot sailfish and make sure all vendor services that are shell scripts
work. (Checke exited status)
Change-Id: I3d1d564114a914dec8179fb93a9e94493c2808da
Signed-off-by: Sandeep Patil <sspatil@google.com>
---
private/file_contexts | 1 +
public/domain.te | 7 +++++++
public/init.te | 2 ++
public/vendor_shell.te | 4 ++++
4 files changed, 14 insertions(+)
create mode 100644 public/vendor_shell.te
diff --git a/private/file_contexts b/private/file_contexts
index 1bc17162e..e61ef2984 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -265,6 +265,7 @@
# Vendor files
#
/(vendor|system/vendor)(/.*)? u:object_r:vendor_file:s0
+/(vendor|system/vendor)/bin/sh u:object_r:vendor_shell_exec:s0
/(vendor|system/vendor)/bin/toybox_vendor u:object_r:vendor_toolbox_exec:s0
/(vendor|system/vendor)/etc(/.*)? u:object_r:vendor_configs_file:s0
diff --git a/public/domain.te b/public/domain.te
index 9c591db59..513e6e144 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -728,6 +728,13 @@ full_treble_only(`
-system_server
-zygote
} vendor_overlay_file:{ file lnk_file } r_file_perms;
+
+ # Non-vendor domains are not allowed to file execute shell
+ # from vendor
+ neverallow {
+ coredomain
+ -init
+ } vendor_shell_exec:file { execute execute_no_trans };
')
# Only authorized processes should be writing to files in /data/dalvik-cache
diff --git a/public/init.te b/public/init.te
index 0deb8cdc9..e997e1338 100644
--- a/public/init.te
+++ b/public/init.te
@@ -395,6 +395,8 @@ allow init proc_meminfo:file r_file_perms;
allow init system_data_file:file { getattr read };
allow init system_data_file:lnk_file r_file_perms;
+# For init to be able to run shell scripts from vendor
+allow init vendor_shell_exec:file execute;
###
### neverallow rules
diff --git a/public/vendor_shell.te b/public/vendor_shell.te
new file mode 100644
index 000000000..b33054290
--- /dev/null
+++ b/public/vendor_shell.te
@@ -0,0 +1,4 @@
+# vendor shell MUST never run as interactive or login shell.
+# vendor shell CAN never be traisitioned to by any process, so it is
+# only intended by shell script interpreter.
+type vendor_shell_exec, exec_type, vendor_file_type, file_type;
--
GitLab