We have a bunch of magic that mounts the correct view of storage
access based on the runtime permissions of an app, but we forgot to
protect the real underlying data sources; oops.

This series of changes just bumps the directory heirarchy one level
to give us /mnt/runtime which we can mask off as 0700 to prevent
people from jumping to the exposed internals.

Also add CTS tests to verify that we're protecting access to
internal mount points like this.

Bug: 22964288
Change-Id: Ic585c4d4381fe51bd764902ef28c38db63b7f2cc

Revert the neverallow change portion of
356df327, in case others need to
do dynamic policy updates.

Bug: 22885422
Bug: 8949824
Change-Id: If2c13d112b346db5c011a6a61bc4486b43d46d61

Remove the ability to dynamically update SELinux policy on the
device.

1) This functionality has never been used, so we have no idea if
it works or not.

2) If system_server is compromised, this functionality allows a
complete bypass of the SELinux policy on the device. In particular,
an attacker can force a regression of the following patch
  * https://android-review.googlesource.com/138510
see also https://code.google.com/p/android/issues/detail?id=181826

3) Dynamic policy update can be used to bypass neverallow protections
enforced in CTS, by pushing a policy to the device after certification.
Such an updated policy could bring the device out of compliance or
deliberately introduce security weaknesses.

Bug: 22885422
Bug: 8949824
Change-Id: Id98b5e09d79254816d920b92003efe8dcbe6cd2e

Transient volumes like USB drives are only mounted at /mnt/media_rw,
but they still appear in Settings > Storage.  To show stats like
free/used space, give Settings the permissions it needs to access
devices mounted there.

avc: denied { search } for name="media_rw" dev="tmpfs" ino=8358 scontext=u:r:system_app:s0 tcontext=u:object_r:mnt_media_rw_file:s0 tclass=dir permissive=0

Bug: 22545248
Change-Id: I273a1729e417873184ad04ba9dd0fec95fd54f97

Domains have the ability to read normal tmpfs files but not symlinks.
Grant this ability.  In particular, allow domains to read /mnt/sdcard.

Addresses the following denial:
type=1400 audit(0.0:19):avc: denied { read } for comm=4173796E635461736B202333 name="sdcard" dev="tmpfs" ino=7475 scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:object_r:tmpfs:s0 tclass=lnk_file permissive=0

(cherry-pick of commit: 2b0b8299)

Bug: 20755029
Change-Id: Iaa5dc278b34faf33473d3e49f92d8766ae5563c0

avc: denied { write } for pid=14742 comm="procrank" path="/data/data/com.android.shell/files/bugreports/bugreport-2015-07-02-22-17-43.txt.tmp" dev="dm-2" ino=44479 scontext=u:r:procrank:s0 tcontext=u:object_r:shell_data_file:s0 tclass=file permissive=0

(cherry picked from af16c40c)

Bug: 22400298
Change-Id: Ibf5dcf9f7edf416e977577afc32bbbef62e50974

For example, when launching into an isolated process, we need to drop
all mounts inherited from the root namespace.

avc: denied { unmount } for scontext=u:r:zygote:s0 tcontext=u:object_r:fuse:s0 tclass=filesystem permissive=1

Bug: 22192518
Change-Id: Iafbea2c365c1080bdf20d7fa066c304901e582ba

Now that we're treating storage as a runtime permission, we need to
grant read/write access without killing the app.  This is really
tricky, since we had been using GIDs for access control, and they're
set in stone once Zygote drops privileges.

The only thing left that can change dynamically is the filesystem
itself, so let's do that.  This means changing the FUSE daemon to
present itself as three different views:

/mnt/runtime_default/foo - view for apps with no access
/mnt/runtime_read/foo - view for apps with read access
/mnt/runtime_write/foo - view for apps with write access

There is still a single location for all the backing files, and
filesystem permissions are derived the same way for each view, but
the file modes are masked off differently for each mountpoint.

During Zygote fork, it wires up the appropriate storage access into
an isolated mount namespace based on the current app permissions.  When
the app is granted permissions dynamically at runtime, the system
asks vold to jump into the existing mount namespace and bind mount
the newly granted access model into place.

avc: denied { sys_chroot } for capability=18 scontext=u:r:vold:s0 tcontext=u:r:vold:s0 tclass=capability permissive=1
avc: denied { mounton } for path="/storage" dev="tmpfs" ino=4155 scontext=u:r:vold:s0 tcontext=u:object_r:storage_file:s0 tclass=dir permissive=1
avc: denied { unmount } for scontext=u:r:zygote:s0 tcontext=u:object_r:tmpfs:s0 tclass=filesystem permissive=0

Bug: 21858077
Change-Id: Ie481d190c5e7a774fbf80fee6e39a980f382967e

Mako is dead. Long live mako.

Bug: 21924438
Change-Id: I5413566df8f2744df7822eb1715f40958b8ad43e

To reduce the likelihood of malicious symlink attacks, neverallow
read access to shell- and app-writable symlinks.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
(cherry picked from commit 9d439d3d)

Bug: 21924438
Change-Id: Icf1ccca71ef4395de8be8503359f76f89cc9e1a5

Only a few daemons need transition to shell. Prevent
misuse and over-privileging of shell domain.

Signed-off-by: William Roberts <william.c.roberts@linux.intel.com>
(cherry picked from commit d1fa4d3d)

Bug: 21924438
Change-Id: I013143cc5ab1e95bf3f7388ce51619e0e3b18425

Only a few system level components should be creating and writing
these files, force a type transition for shared files.

Signed-off-by: William Roberts <william.c.roberts@linux.intel.com>
(cherry picked from commit 529a8634)

Change-Id: I9c4df4e332426e253dd6fcd4f8ea0348dc3a5f54
Bug: 21924438

* commit 'b23b49f9':
  fs_use: Enabled loading security xattrs for squashfs

* commit '0abf74eb':
  fs_use: Enabled loading security xattrs for squashfs

Change-Id: Icfa4b2cac6a960ef47e928308e4c6c9bd797d180
Signed-off-by: Mohamad Ayyash <mkayyash@google.com>

Prohibit all but a specific set of whitelisted domains
from writing to /data/dalvik-cache.  This is to prevent
code injection into apps, zygote, or system_server.

Inspired by:
https://www.nowsecure.com/blog/2015/06/16/remote-code-execution-as-system-user-on-samsung-phones/


which depended on system UID apps having write access to
/data/dalvik-cache (not allowed in AOSP policy but evidently
in those device policies).  Prevent this from recurring.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
(cherry picked from commit d9bf7b3f)

Change-Id: I9219ddc3af44c909af90ba694e96565f99d8190c

clatd's environment may not have a sufficiently large memlock
ulimit; it needs >=1MB but values much lower can be encountered.

The mmap() is performed while clatd is still root, before dropping
privileges; allow this to succeed.

Bug: 21736319
Change-Id: I8171e077046566924c769e855144ae5fac634d4c

avc: denied { getattr } for path="/mnt/expand" dev="tmpfs" ino=3146 scontext=u:r:installd:s0 tcontext=u:object_r:mnt_expand_file:s0 tclass=dir permissive=0

Bug: 21856349
Change-Id: Ib9984182a71408d5cb803d453f148856b68569e3

Only vold should execute the sdcard daemon. Remove old code which
allows this, and add a neverallow rule to ensure that nobody tries
running with this old configuration.

Change-Id: I6d0133e65948ae69e3c48f7b5f21fc7956fe8168

avc: denied { sys_nice } for capability=23 scontext=u:r:vold:s0 tcontext=u:r:vold:s0 tclass=capability permissive=0

Bug: 21711477
Change-Id: I78e7a6667e06a4b1a2b0c4d26ddae4797231e553

Bug: http://b/19483574

(cherry picked from commit beadf17a)

Change-Id: Ibd2898efb29209d55df1335147d9b0bb6cba77c4

The recovery and update_binary need to access the /oem partition for
devices like sprout.

Bug: 19764039
Change-Id: Ie6cbcae899ad664c6a1809c0d5478031091b6eda

Point to external/selinux/libsepol instead of external/libsepol.

(cherry picked from commit 96136d84)

Change-Id: I09c33a4cbd7b4cd3ef2341c042259b96c0b59372

Point to external/selinux/libsepol instead of external/libsepol

(cherry picked from commit 53b48013)

Change-Id: If6dc1e9261f397d801ba2376ab60c5dc5b5d86e4

This new property is used as a control verb for running a recursive
restorecon at the path contained in the property value.

Defines a new label and grants access to vold, which invokes it when
mounting private adopted volumes.

Bug: 21121357
Change-Id: I8ff12a146e54a505aa5b43a542578891563d647a

* changes:
  Allow installd to link apk_data_file and dalvikcache_data_file.
  Revert "Allow system_server to link,relabel and create_dir dalvikcache_data_file."

service_manager_local_audit_domain was used to fine tune the service_manager
auditallow rules when introducing the service_manager SELinux rules.  This is no
longer needed.

(cherry-pick of commit: eab26faa)

Bug: 21656807
Change-Id: Ia042a887e7bf9eb2a2b08b8d831e68dfe6395f75

Allow vold, healthd, slideshow, and watchdogd access to /dev/kmsg.
These processes log to the kernel dmesg ring buffer, so they need
write access to that file.

Addresses the following denials:

    avc: denied { write } for pid=134 comm="watchdogd" name="kmsg" dev="tmpfs" ino=9248 scontext=u:r:watchdogd:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0
    avc: denied { write } for pid=166 comm="healthd" name="kmsg" dev="tmpfs" ino=9248 scontext=u:r:healthd:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0
    avc: denied { write } for pid=180 comm="vold" name="kmsg" dev="tmpfs" ino=9248 scontext=u:r:vold:s0 tcontext=u:object_r:kmsg_device:s0 tclass=chr_file permissive=0

These denials were triggered by the change in
https://android-review.googlesource.com/151209 . Prior to that change,
any code which called klog_init would (unnecessarily) create the
device node themselves, rather than using the already existing device
node.

Drop special /dev/__null__ handling from watchdogd. As of
https://android-review.googlesource.com/148288 , watchdogd no longer
creates it's own /dev/null device, so it's unnecessary for us
to allow for it.

Drop mknod from healthd, slideshow, and watchdogd. healthd and slideshow
only needed mknod to create /dev/__kmsg__, which is now obsolete.
watchdogd only needed mknod to create /dev/__kmsg__ and /dev/__null__,
which again is now obsolete.

Bug: 21242418
Change-Id: If01c8001084575e7441253f0fa8b4179ae33f534

Create a macro of unprivileged ioctls including
- All common socket ioctls except MAC address
- All wireless extensions ioctls except get/set ESSID
- Some commonly used tty ioctls

Bug: 21657002
Change-Id: Ib08be9cb70d08c1fa2c8bddbae519e7c2df5293c

Needed for split app installs, where we link existing apks and
compiled output to the stage location.

bug: 20889739

Change-Id: I610dc5b12cb46b03894002d60db7c06412d12cab

This reverts commit e929ad8b524a7e444008b657adaafff97b5dea79.

bug: 20889739
Change-Id: I6729f4e26041b481f2442a2d8c3dfb42e2d4144a

Required by the installation flow for split APKs.

bug: 20889739

Change-Id: I3e14335f3bcfe76d1d24d233f53a728a6d90e8a1