Skip to content
Snippets Groups Projects
Select Git revision
  • test default
1 result
Search by author
  • Any Author
  • Admin, Lime Admin, Lime lime_admin
  • CodeLinaro CodeLinaro codelinaro
  • CodeLinaro Hoperun CodeLinaro Hoperun hoperun
  • Joshua S. (Stage) Joshua S. (Stage) joshua.sickmeyer
  • Park, Jae Woo Park, Jae Woo jaewpark
5 authors
  1. Oct 16, 2018
    • Nick Kralevich's avatar
      add map permission to rw_socket_perms am: 9c22895c am: 2e7ac24b · ab7be501
      Nick Kralevich authored 
      am: 86881bd3

Change-Id: I892a1dce285c2af14dea4b5fd180bc573f9aa959
      ab7be501
    • Nick Kralevich's avatar
      add map permission to rw_socket_perms am: 9c22895c · 86881bd3
      Nick Kralevich authored 
      am: 2e7ac24b

Change-Id: Id5b3e10d776575cf578d5ae2d31023169adf18d0
      86881bd3
    • Nick Kralevich's avatar
      add map permission to rw_socket_perms · 2e7ac24b
      Nick Kralevich authored 
      am: 9c22895c

Change-Id: Icf1b28c653ed40e827ad087dec13bcd02b9ba484
      2e7ac24b
    • Nick Kralevich's avatar
      add map permission to rw_socket_perms · 9c22895c
      Nick Kralevich authored 
      Kernel commit 3ba4bf5f1e2c ("selinux: add a map permission check for
mmap") added a map permission check on mmap so that we can
distinguish memory mapped access (since it has different implications
for revocation).  The purpose of a separate map permission check on
mmap(2) is to permit policy to prohibit memory mapping of specific
files for which we need to ensure that every access is revalidated,
particularly useful for scenarios where we expect the file to be
relabeled at runtime in order to reflect state changes (e.g.
cross-domain solution, assured pipeline without data copying).

system/sepolicy commit 4397f082 added
the map permission to common file macros, to ensure that file access
would continue working even in the presence of a newer kernel. However,
that change did not affect socket access.

Certain socket classes, such as AF_NETLINK and AF_PACKET, also support
mmap operations. This change adds the map permission to rw_socket_perms,
to ensure continued support for newer kernels.

This technically allows mmap even in cases where the socket family
doesn't support it (such as TCP and UDP sockets), but granting it
is harmless in those cases.

In particular, this fixes a bug in clatd, where the following error
would occur:

  10-01 13:59:03.182 7129 7129 I clatd : Starting clat version 1.4 on rmnet0 netid=100 mark=0xf0064
  10-01 13:59:03.195 7129 7129 I auditd : type=1400 audit(0.0:18): avc: denied { map } for comm="clatd" path="socket:[52802]" dev="sockfs" ino=52802 scontext=u:r:clatd:s0 tcontext=u:r:clatd:s0 tclass=packet_socket permissive=0
  10-01 13:59:03.195 7129 7129 W clatd : type=1400 audit(0.0:18): avc: denied { map } for path="socket:[52802]" dev="sockfs" ino=52802 scontext=u:r:clatd:s0 tcontext=u:r:clatd:s0 tclass=packet_socket permissive=0
  10-01 13:59:03.199 7129 7129 F clatd : mmap 1048576 failed: Permission denied

Test: policy compiles
Bug: 117791876
Change-Id: I39f286d577b4a2160037ef271517ae8a3839b49b
      9c22895c
    • Chong Zhang's avatar
      add media.codec.update service am: 52fb3edb am: c601d9e5 · 2e4cfcee
      Chong Zhang authored 
      am: 31ef820c

Change-Id: I7d03e88e6a9c19c483ecb90867b997feaa8b207e
      2e4cfcee
    • Chong Zhang's avatar
      add media.codec.update service am: 52fb3edb · 31ef820c
      Chong Zhang authored 
      am: c601d9e5

Change-Id: Ib6a0d41c614857d385645ad870599b5ef6f6a2fb
      31ef820c
    • Chong Zhang's avatar
      add media.codec.update service · c601d9e5
      Chong Zhang authored 
      am: 52fb3edb

Change-Id: I106c471e9251ec7a4f43b13103c429c3b4fc2476
      c601d9e5
  3. Oct 15, 2018
  5. Oct 13, 2018