diff options
| -rw-r--r-- | domain.te | 3 | ||||
| -rw-r--r-- | init.te | 13 | ||||
| -rw-r--r-- | logd.te | 9 | ||||
| -rw-r--r-- | te_macros | 1 |
4 files changed, 16 insertions, 10 deletions
@@ -490,9 +490,6 @@ neverallow * ~servicemanager:service_manager list; # only service_manager_types can be added to service_manager neverallow * ~service_manager_type:service_manager { add find }; -# logpersist is only allowed on userdebug/eng builds -neverallow { domain userdebug_or_eng(`-logd -shell -init') } misc_logd_file:file rw_file_perms; - # Prevent assigning non property types to properties neverallow * ~property_type:property_service set; @@ -99,10 +99,10 @@ allow init rootfs:{ dir file } relabelfrom; # we just allow all file types except /system files here. allow init self:capability { chown fowner fsetid }; allow init {file_type -system_file -exec_type -app_data_file}:dir { create search getattr open read setattr ioctl }; -allow init {file_type -system_file -exec_type -keystore_data_file -app_data_file -shell_data_file -vold_data_file}:dir { write add_name remove_name rmdir relabelfrom }; -allow init {file_type -system_file -exec_type -keystore_data_file -app_data_file -shell_data_file -vold_data_file not_userdebug_nor_eng(`-misc_logd_file') }:file { create getattr open read write setattr relabelfrom unlink }; -allow init {file_type -system_file -exec_type -keystore_data_file -app_data_file -shell_data_file -vold_data_file}:{ sock_file fifo_file } { create getattr open read setattr relabelfrom unlink }; -allow init {file_type -system_file -exec_type -keystore_data_file -app_data_file -shell_data_file -vold_data_file}:lnk_file { create getattr setattr relabelfrom unlink }; +allow init {file_type -system_file -exec_type -keystore_data_file -app_data_file -shell_data_file -vold_data_file -misc_logd_file }:dir { write add_name remove_name rmdir relabelfrom }; +allow init {file_type -system_file -exec_type -keystore_data_file -app_data_file -shell_data_file -vold_data_file -misc_logd_file }:file { create getattr open read write setattr relabelfrom unlink }; +allow init {file_type -system_file -exec_type -keystore_data_file -app_data_file -shell_data_file -vold_data_file -misc_logd_file }:{ sock_file fifo_file } { create getattr open read setattr relabelfrom unlink }; +allow init {file_type -system_file -exec_type -keystore_data_file -app_data_file -shell_data_file -vold_data_file -misc_logd_file }:lnk_file { create getattr setattr relabelfrom unlink }; allow init {file_type -system_file -exec_type}:dir_file_class_set relabelto; allow init { sysfs debugfs }:{ dir file lnk_file } { getattr relabelfrom }; allow init { sysfs_type debugfs_type }:{ dir file lnk_file } relabelto; @@ -167,6 +167,11 @@ userdebug_or_eng(` domain_auto_trans(init, logcat_exec, logd) ') +# Init will create /data/misc/logd when the property persist.logd.logpersistd is "logcatd". +# Init will also walk through the directory as part of a recursive restorecon. +allow init misc_logd_file:dir { open create read getattr setattr search }; +allow init misc_logd_file:file { getattr }; + # Support "adb shell stop" allow init self:capability kill; allow init domain:process { sigkill signal }; @@ -57,6 +57,11 @@ neverallow logd system_file:dir_file_class_set write; # Write to files in /data/data or system files on /data neverallow logd { app_data_file system_data_file }:dir_file_class_set write; -# logd is not allowed to write anywhere other than /misc/data/logd, and then +# logd is not allowed to write anywhere other than /data/misc/logd, and then # only on userdebug or eng builds -neverallow logd { file_type -logd_tmpfs userdebug_or_eng(` -misc_logd_file -coredump_file ') }:file write; +neverallow logd { file_type -logd_tmpfs userdebug_or_eng(` -misc_logd_file -coredump_file ') }:file { create write append }; + +# logpersist is only allowed on userdebug/eng builds +neverallow { domain userdebug_or_eng(`-logd -shell') } misc_logd_file:file no_rw_file_perms; +neverallow { domain userdebug_or_eng(`-logd') } misc_logd_file:dir { add_name link relabelfrom remove_name rename reparent rmdir write }; +neverallow { domain -init } misc_logd_file:dir create; @@ -278,7 +278,6 @@ define(`recovery_only', ifelse(target_recovery, `true', $1, )) # SELinux rules which apply only to userdebug or eng builds # define(`userdebug_or_eng', ifelse(target_build_variant, `eng', $1, ifelse(target_build_variant, `userdebug', $1))) -define(`not_userdebug_nor_eng', ifelse(target_build_variant, `eng', , ifelse(target_build_variant, `userdebug', , $1))) define(`eng', ifelse(target_build_variant, `eng', $1)) ##################################### |