aboutsummaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2013-12-10Merge "Support run-as and ndk-gdb functionality."idea133Nick Kralevich
2013-12-09Restrict mapping low memory.Stephen Smalley
Label /proc/sys/vm/mmap_min_addr with proc_security to prevent writing it by any domain other than init. Also remove memprotect mmap_zero permission from unconfineddomain so that it cannot pass the SELinux check over mapping low memory. Change-Id: Idc189feeb325a4aea26c93396fd0fa7225e79586 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-09Support run-as and ndk-gdb functionality.Stephen Smalley
Confine run-as (but leave permissive for now) and add other allow rules required for the use of run-as and ndk-gdb functionality. Change-Id: Ifae38233c091cd34013e98830d72aac4c4adcae0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-09Restrict ptrace access by debuggerd and unconfineddomain.Stephen Smalley
Remove init, ueventd, watchdogd, healthd and adbd from the set of domains traceable by debuggerd. bionic/linker/debugger.cpp sets up handlers for all dynamically linked programs in Android but this should not apply for statically linked programs. Exclude ptrace access from unconfineddomain. Prohibit ptrace access to init via neverallow. Change-Id: I70d742233fbe40cb4d1772a4e6cd9f8f767f2c3a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06Allow app-app communication via pipesNick Kralevich
Allow apps to communicate with each other via pipes. In particular, this fixes a bug where printing from Chrome wasn't working. STEPS TO REPRODUCE: 1. Launch Chrome 2. From menu tap print and observe OR 1. Launch Drive, Select any file (*.txt, *.doc. *.pdf.........) 2. Select print Addresses the following denials: <5>[ 122.352797] type=1400 audit(1386363998.374:18): avc: denied { write } for pid=3786 comm=4173796E635461736B202332 path="pipe:[19164]" dev="pipefs" ino=19164 scontext=u:r:untrusted_app:s0 tcontext=u:r:release_app:s0 tclass=fifo_file <5>[ 123.248363] type=1400 audit(1386363999.264:19): avc: denied { getattr } for pid=2677 comm=".android.chrome" path="pipe:[19164]" dev="pipefs" ino=19164 scontext=u:r:untrusted_app:s0 tcontext=u:r:release_app:s0 tclass=fifo_file <5>[ 123.248620] type=1400 audit(1386363999.264:20): avc: denied { write } for pid=3308 comm="ChildProcessMai" path="pipe:[19164]" dev="pipefs" ino=19164 scontext=u:r:isolated_app:s0 tcontext=u:r:release_app:s0 tclass=fifo_file Bug: 12032455 Change-Id: Ic1cb5c1d42596f5a8fc3fe82fcbfe47aa43a7d6c
2013-12-06Merge "Make debuggerd enforcing."Nick Kralevich
2013-12-06am fea6e66f: Allow kernel domain, not init domain, to set SELinux enforcing ↵Stephen Smalley
mode. * commit 'fea6e66fad0dd87e66d4df8255733b6840752316': Allow kernel domain, not init domain, to set SELinux enforcing mode.
2013-12-06Allow kernel domain, not init domain, to set SELinux enforcing mode.Stephen Smalley
As per the discussion in: https://android-review.googlesource.com/#/c/71184/ init sets the enforcing mode in its code prior to switching to the init domain via a setcon command in the init.rc file. Hence, the setenforce permission is checked while still running in the kernel domain. Further, as init has no reason to ever set the enforcing mode again, we do not need to allow setenforce to the init domain and this prevents reverting to permissive mode via an errant write by init later. We could technically dontaudit the kernel setenforce access instead since the first call to setenforce happens while still permissive (and thus we never need to allow it in policy) but we allow it to more accurately represent what is possible. Change-Id: I70b5e6d8c99e0566145b9c8df863cc8a34019284 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06am 9e8b8d9f: Revert "Allow kernel domain, not init domain, to set SELinux ↵Nick Kralevich
enforcing mode." * commit '9e8b8d9fdfcdb6b3e8af3349df186c2ab81a9733': Revert "Allow kernel domain, not init domain, to set SELinux enforcing mode."
2013-12-06Revert "Allow kernel domain, not init domain, to set SELinux enforcing mode."Nick Kralevich
The build is broken. Reverting temporarily to fix breakage. libsepol.check_assertion_helper: neverallow on line 4758 violated by allow init kernel:security { setenforce }; Error while expanding policy make: *** [out/target/product/mako/obj/ETC/sepolicy_intermediates/sepolicy] Error 1 make: *** Waiting for unfinished jobs.... This reverts commit bf12e2251422cc8470de21dd882872b7b6f960f6. Change-Id: I78a05756d8ce3c7d06e1d9d27e6135f4b352bb85
2013-12-06am bf12e225: Allow kernel domain, not init domain, to set SELinux enforcing ↵Stephen Smalley
mode. * commit 'bf12e2251422cc8470de21dd882872b7b6f960f6': Allow kernel domain, not init domain, to set SELinux enforcing mode.
2013-12-06Allow kernel domain, not init domain, to set SELinux enforcing mode.Stephen Smalley
As per the discussion in: https://android-review.googlesource.com/#/c/71184/ init sets the enforcing mode in its code prior to switching to the init domain via a setcon command in the init.rc file. Hence, the setenforce permission is checked while still running in the kernel domain. Further, as init has no reason to ever set the enforcing mode again, we do not need to allow setenforce to the init domain and this prevents reverting to permissive mode via an errant write by init later. We could technically dontaudit the kernel setenforce access instead since the first call to setenforce happens while still permissive (and thus we never need to allow it in policy) but we allow it to more accurately represent what is possible. Change-Id: I617876c479666a03167b8fce270c82a8d45c7cc6 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06am 2b392fcc: Move lmkd into it\'s own domain.Nick Kralevich
* commit '2b392fccf35c790bdc55bdce51a196f4953644ce': Move lmkd into it's own domain.
2013-12-06am 7adb999e: Restrict the ability to set usermodehelpers and proc security ↵Stephen Smalley
settings. * commit '7adb999e701ee96356c506ffa93fce190791e8b7': Restrict the ability to set usermodehelpers and proc security settings.
2013-12-06Move lmkd into it's own domain.Nick Kralevich
lmkd low memory killer daemon The kernel low memory killer logic has been moved to a new daemon called lmkd. ActivityManager communicates with this daemon over a named socket. This is just a placeholder policy, starting off in unconfined_domain. Change-Id: Ia3f9a18432c2ae37d4f5526850e11432fd633e10
2013-12-06Make debuggerd enforcing.Stephen Smalley
Change-Id: If5b7206192cf93d9989b734304db0374429c04d5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-06Restrict the ability to set usermodehelpers and proc security settings.Stephen Smalley
Limit the ability to write to the files that configure kernel usermodehelpers and security-sensitive proc settings to the init domain. Permissive domains can also continue to set these values. The current list is not exhaustive, just an initial set. Not all of these files will exist on all kernels/devices. Controlling access to certain kernel usermodehelpers, e.g. cgroup release_agent, will require kernel changes to support and cannot be addressed here. Expected output on e.g. flo after the change: ls -Z /sys/kernel/uevent_helper /proc/sys/fs/suid_dumpable /proc/sys/kernel/core_pattern /proc/sys/kernel/dmesg_restrict /proc/sys/kernel/hotplug /proc/sys/kernel/kptr_restrict /proc/sys/kernel/poweroff_cmd /proc/sys/kernel/randomize_va_space /proc/sys/kernel/usermodehelper -rw-r--r-- root root u:object_r:usermodehelper:s0 uevent_helper -rw-r--r-- root root u:object_r:proc_security:s0 suid_dumpable -rw-r--r-- root root u:object_r:usermodehelper:s0 core_pattern -rw-r--r-- root root u:object_r:proc_security:s0 dmesg_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 hotplug -rw-r--r-- root root u:object_r:proc_security:s0 kptr_restrict -rw-r--r-- root root u:object_r:usermodehelper:s0 poweroff_cmd -rw-r--r-- root root u:object_r:proc_security:s0 randomize_va_space -rw------- root root u:object_r:usermodehelper:s0 bset -rw------- root root u:object_r:usermodehelper:s0 inheritable Change-Id: I3f24b4bb90f0916ead863be6afd66d15ac5e8de0 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-05Merge commit '4ab298359613736281e10accaed3a6ffe1fe590a' into HEADThe Android Open Source Project
2013-12-05Fix new rild denials.Robert Craig
Denials seen on hammerhead but seem appropriate for general policy. <5>[ 8.339347] type=1400 audit(3731546.390:17): avc: denied { ioctl } for pid=314 comm="rild" path="socket:[7996]" dev="sockfs" ino=7996 scontext=u:r:rild:s0 tcontext=u:r:rild:s0 tclass=socket <5>[ 8.339065] type=1400 audit(3731546.390:16): avc: denied { create } for pid=314 comm="rild" scontext=u:r:rild:s0 tcontext=u:r:rild:s0 tclass=socket <5>[ 11.232121] type=1400 audit(3731549.289:22): avc: denied { read } for pid=620 comm="rild" scontext=u:r:rild:s0 tcontext=u:r:rild:s0 tclass=socket Change-Id: Ieaca5360afbb44d5da21c7c24bdd5e7c5758f0a2
2013-12-05Drop tegra specific label from policy.Robert Craig
This label was originally used for Motorola Xoom devices. nvmap is the tegra gpu memory manager and the various nvhost drivers are for tegra graphics related functionality, i.e. display serial interface, image signal processor, or media processing stuff. Only grouper and tilapia presently need this policy. Change-Id: I2a7000f69abf3185724d88d428e8237e0ca436ec
2013-12-05Merge "Allow SELinuxPolicyInstallReceiver to work."Nick Kralevich
2013-12-02Restrict the ability to set SELinux enforcing mode to init.Stephen Smalley
Also make su and shell permissive in non-user builds to allow use of setenforce without violating the neverallow rule. Change-Id: Ie76ee04e90d5a76dfaa5f56e9e3eb7e283328a3f Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-02Allow SELinuxPolicyInstallReceiver to work.Stephen Smalley
Change-Id: I10006f43c142f07168e2ea0f4f5f7af68d03e504 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-02Merge "Make the isolated_app domain enforcing."Nick Kralevich
2013-12-02Default to socket_device for anything under /dev/socket.Stephen Smalley
Otherwise sockets that have no specific entry match the /dev(/.*) entry instead, leaving them in device type rather than socket_device type. Every socket should get its own entry regardless, but this at least puts it into a more specific type by default. Change-Id: I97f7999af7f9f83484d3a51440dda791d3726f1a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-12-02Make the isolated_app domain enforcing.Stephen Smalley
Change-Id: I11be7d1713dd7cb35b8046503a09e42567e53d86 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-11-27Allow write access to ashmem allocated regionsNick Kralevich
Allow tmpfs_domains the ability to write to ashmem allocated regions. At least one Google internal app does this, and switching untrusted_app into enforcing causes the following denial: <5>[ 291.791423] type=1400 audit(1385587240.320:79): avc: denied { write } for pid=3774 comm="XXXXXXXXXXXX" path=2F6465762F6173686D656D202864656C6574656429 dev="tmpfs" ino=16937 scontext=u:r:untrusted_app:s0 tcontext=u:object_r:untrusted_app_tmpfs:s0 tclass=file path=/dev/ashmem (deleted) Bug: 11891764 Change-Id: I64d414c055cd02481ebf69994fad65d777d8381d
2013-11-22am 043b9027: Confine watchdogd, but leave it permissive for now.Stephen Smalley
* commit '043b9027b3cc1c055e4ec5917f5d0d9bdc69005f': Confine watchdogd, but leave it permissive for now.
2013-11-22Merge commit '060f6fa67e1d9779d2d8357659ae530d65171faa' into HEADThe Android Open Source Project
2013-11-21Confine watchdogd, but leave it permissive for now.Stephen Smalley
Change-Id: If2285e927cb886956b3314dd18384145a1ebeaa9 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-11-19am 1ed3caf7: Merge "Add support for duplicate allow rule detection (-D / ↵Nick Kralevich
--dups)." * commit '1ed3caf736d59f11d6c39edb3de2e0d0cd5ca71f': Add support for duplicate allow rule detection (-D / --dups).
2013-11-19Merge "Add support for duplicate allow rule detection (-D / --dups)."Nick Kralevich
2013-11-18Add support for duplicate allow rule detection (-D / --dups).Stephen Smalley
Usage: sepolicy-analyze -D -P out/target/product/<board>/root/sepolicy Displays duplicate allow rules, i.e. pairs of allow rules that grant the same permissions where one allow rule is written directly in terms of individual types and the other is written in terms of attributes associated with those same types. The rule with individual types is a candidate for removal. The rule with individual types may be directly represented in the source policy or may be a result of expansion of a type negation (e.g. domain -foo -bar is expanded to individual allow rules by the policy compiler). Domains with unconfineddomain will typically have such duplicate rules as a natural side effect and can be ignored. Also add a tools/README with a description of all of the tools. Change-Id: I07838dbd22c5cc8a4a65b57003ccae38129050f5 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-11-18am 006260e5: Merge "Confine hostapd, but leave it permissive for now."Nick Kralevich
* commit '006260e528f4bcd6fa7db6e1acc5d38224eb401b': Confine hostapd, but leave it permissive for now.
2013-11-18Merge "Confine hostapd, but leave it permissive for now."Nick Kralevich
2013-11-18am 2b939e8c: Merge "Confine ping, but leave it permissive for now."Nick Kralevich
* commit '2b939e8cabab28db2d7e2015ecab59e1cbdbc442': Confine ping, but leave it permissive for now.
2013-11-18Merge "Confine ping, but leave it permissive for now."Nick Kralevich
2013-11-18Confine hostapd, but leave it permissive for now.Stephen Smalley
Change-Id: I23a2c568e9fdd51c6c09c6c80a7ce9f2b5bd4966 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2013-11-14am 35e8dcc9: Merge "Let vold mount OBB files on external storage." into klp-devJeff Sharkey
* commit '35e8dcc9ba40c6419f63d0a516c0995d3064f96e': Let vold mount OBB files on external storage.
2013-11-15Merge "Let vold mount OBB files on external storage." into klp-devandroid-sdk-4.4.2_r1.0.1android-sdk-4.4.2_r1android-4.4.2_r2.0.1android-4.4.2_r2android-4.4.2_r1.0.1android-4.4.2_r1android-4.4.1_r1.0.1android-4.4.1_r1kitkat-mr1.1-releasekitkat-mr1-releaseJeff Sharkey
2013-11-14Let vold mount OBB files on external storage.Jeff Sharkey
Fixes this specific violation: type=1400 audit(1384468728.202:16): avc: denied { read write } for pid=271 comm="vold" name="test1.obb" dev="fuse" ino=3100664872 scontext=u:r:vold:s0 tcontext=u:object_r:sdcard_internal:s0 tclass=file Bug: 11693888 Change-Id: I45d30ecabdf0bc8871f3dd67b5695ac909109d9a
2013-11-14am 24fb24f7: am ae49e7a3: Merge "Confine tee, but leave it permissive for now."Nick Kralevich
* commit '24fb24f7ea1bf74bc1234394b81955e0aab6943f': Confine tee, but leave it permissive for now.
2013-11-14am ae49e7a3: Merge "Confine tee, but leave it permissive for now."Nick Kralevich
* commit 'ae49e7a3691137b5276254074b2c282bcdfee523': Confine tee, but leave it permissive for now.
2013-11-14Merge "Confine tee, but leave it permissive for now."Nick Kralevich
2013-11-14am 678420e0: am 6ce3d60c: Merge "Confine rild, but leave it permissive for now."Nick Kralevich
* commit '678420e023c6f143fb99cfed031397e732960410': Confine rild, but leave it permissive for now.
2013-11-14am 67a53232: am b1cb3205: Confine wpa_supplicant, but leave it permissive ↵Stephen Smalley
for now. * commit '67a53232cec967ca53e6f7284fd582a5bdd3eb69': Confine wpa_supplicant, but leave it permissive for now.
2013-11-14am 6ce3d60c: Merge "Confine rild, but leave it permissive for now."Nick Kralevich
* commit '6ce3d60ca39dd37f0de4bcd81620b3611cd28e14': Confine rild, but leave it permissive for now.
2013-11-14am b1cb3205: Confine wpa_supplicant, but leave it permissive for now.Stephen Smalley
* commit 'b1cb3205cad978399fa7c9dcafed607fe5d07de6': Confine wpa_supplicant, but leave it permissive for now.
2013-11-14Merge "Confine rild, but leave it permissive for now."Nick Kralevich
2013-11-13Confine rild, but leave it permissive for now.Stephen Smalley
Change-Id: I6df9981b2af0150c6379a0ebdbe0a8597c994f4a Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-03 00:01:39 +0000