diff options
author | Jeff Sharkey | 2018-03-30 13:22:54 -0500 |
---|---|---|
committer | Jeff Sharkey | 2018-04-13 15:08:10 -0500 |
commit | 000cafc70120e26a1c0918d5cedff1a646521c11 (patch) | |
tree | fc04629382cb5f866c1d88fdd9f2d1af46cd2406 | |
parent | db465285cfe5724d83021888c42ba93f0e8ee415 (diff) | |
download | system-sepolicy-000cafc70120e26a1c0918d5cedff1a646521c11.tar.gz system-sepolicy-000cafc70120e26a1c0918d5cedff1a646521c11.tar.xz system-sepolicy-000cafc70120e26a1c0918d5cedff1a646521c11.zip |
Add exFAT support; unify behind "sdcard_type".
We're adding support for OEMs to ship exFAT, which behaves identical
to vfat. Some rules have been manually enumerating labels related
to these "public" volumes, so unify them all behind "sdcard_type".
Test: atest
Bug: 67822822
Change-Id: I09157fd1fc666ec5d98082c6e2cefce7c8d3ae56
-rw-r--r-- | private/app_neverallows.te | 4 | ||||
-rw-r--r-- | private/compat/26.0/26.0.ignore.cil | 1 | ||||
-rw-r--r-- | private/compat/27.0/27.0.ignore.cil | 1 | ||||
-rw-r--r-- | private/genfs_contexts | 1 | ||||
-rw-r--r-- | private/platform_app.te | 4 | ||||
-rw-r--r-- | public/app.te | 15 | ||||
-rw-r--r-- | public/file.te | 1 | ||||
-rw-r--r-- | public/hal_configstore.te | 9 | ||||
-rw-r--r-- | public/hal_telephony.te | 1 |
9 files changed, 19 insertions, 18 deletions
diff --git a/private/app_neverallows.te b/private/app_neverallows.te index 4b79060e..3bdbfb18 100644 --- a/private/app_neverallows.te +++ b/private/app_neverallows.te | |||
@@ -93,9 +93,7 @@ neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_fil | |||
93 | # application un-installation. | 93 | # application un-installation. |
94 | neverallow { all_untrusted_apps -mediaprovider } { | 94 | neverallow { all_untrusted_apps -mediaprovider } { |
95 | fs_type | 95 | fs_type |
96 | -fuse # sdcard | 96 | -sdcard_type |
97 | -sdcardfs # sdcard | ||
98 | -vfat | ||
99 | file_type | 97 | file_type |
100 | -app_data_file # The apps sandbox itself | 98 | -app_data_file # The apps sandbox itself |
101 | -media_rw_data_file # Internal storage. Known that apps can | 99 | -media_rw_data_file # Internal storage. Known that apps can |
diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil index ab58ddaa..68d6b409 100644 --- a/private/compat/26.0/26.0.ignore.cil +++ b/private/compat/26.0/26.0.ignore.cil | |||
@@ -19,6 +19,7 @@ | |||
19 | crossprofileapps_service | 19 | crossprofileapps_service |
20 | e2fs | 20 | e2fs |
21 | e2fs_exec | 21 | e2fs_exec |
22 | exfat | ||
22 | exported_bluetooth_prop | 23 | exported_bluetooth_prop |
23 | exported_config_prop | 24 | exported_config_prop |
24 | exported_dalvik_prop | 25 | exported_dalvik_prop |
diff --git a/private/compat/27.0/27.0.ignore.cil b/private/compat/27.0/27.0.ignore.cil index 493ac312..1eaf22a7 100644 --- a/private/compat/27.0/27.0.ignore.cil +++ b/private/compat/27.0/27.0.ignore.cil | |||
@@ -15,6 +15,7 @@ | |||
15 | bpfloader_exec | 15 | bpfloader_exec |
16 | cgroup_bpf | 16 | cgroup_bpf |
17 | crossprofileapps_service | 17 | crossprofileapps_service |
18 | exfat | ||
18 | exported2_config_prop | 19 | exported2_config_prop |
19 | exported2_default_prop | 20 | exported2_default_prop |
20 | exported2_radio_prop | 21 | exported2_radio_prop |
diff --git a/private/genfs_contexts b/private/genfs_contexts index f2b96990..1d321d81 100644 --- a/private/genfs_contexts +++ b/private/genfs_contexts | |||
@@ -238,6 +238,7 @@ genfscon debugfs /tracing/events/lowmemorykiller/ | |||
238 | 238 | ||
239 | genfscon inotifyfs / u:object_r:inotify:s0 | 239 | genfscon inotifyfs / u:object_r:inotify:s0 |
240 | genfscon vfat / u:object_r:vfat:s0 | 240 | genfscon vfat / u:object_r:vfat:s0 |
241 | genfscon exfat / u:object_r:exfat:s0 | ||
241 | genfscon debugfs / u:object_r:debugfs:s0 | 242 | genfscon debugfs / u:object_r:debugfs:s0 |
242 | genfscon fuse / u:object_r:fuse:s0 | 243 | genfscon fuse / u:object_r:fuse:s0 |
243 | genfscon configfs / u:object_r:configfs:s0 | 244 | genfscon configfs / u:object_r:configfs:s0 |
diff --git a/private/platform_app.te b/private/platform_app.te index 80b20e14..f60597a7 100644 --- a/private/platform_app.te +++ b/private/platform_app.te | |||
@@ -34,8 +34,8 @@ allow platform_app cache_file:file create_file_perms; | |||
34 | # Direct access to vold-mounted storage under /mnt/media_rw | 34 | # Direct access to vold-mounted storage under /mnt/media_rw |
35 | # This is a performance optimization that allows platform apps to bypass the FUSE layer | 35 | # This is a performance optimization that allows platform apps to bypass the FUSE layer |
36 | allow platform_app mnt_media_rw_file:dir r_dir_perms; | 36 | allow platform_app mnt_media_rw_file:dir r_dir_perms; |
37 | allow platform_app vfat:dir create_dir_perms; | 37 | allow platform_app sdcard_type:dir create_dir_perms; |
38 | allow platform_app vfat:file create_file_perms; | 38 | allow platform_app sdcard_type:file create_file_perms; |
39 | 39 | ||
40 | # com.android.systemui | 40 | # com.android.systemui |
41 | allow platform_app rootfs:dir getattr; | 41 | allow platform_app rootfs:dir getattr; |
diff --git a/public/app.te b/public/app.te index cc4d285f..b5e77c15 100644 --- a/public/app.te +++ b/public/app.te | |||
@@ -250,19 +250,12 @@ allow { appdomain -isolated_app -ephemeral_app } mnt_user_file:dir r_dir_perms; | |||
250 | allow { appdomain -isolated_app -ephemeral_app } mnt_user_file:lnk_file r_file_perms; | 250 | allow { appdomain -isolated_app -ephemeral_app } mnt_user_file:lnk_file r_file_perms; |
251 | 251 | ||
252 | # Read/write visible storage | 252 | # Read/write visible storage |
253 | allow { appdomain -isolated_app -ephemeral_app } fuse:dir create_dir_perms; | 253 | allow { appdomain -isolated_app -ephemeral_app } sdcard_type:dir create_dir_perms; |
254 | allow { appdomain -isolated_app -ephemeral_app } fuse:file create_file_perms; | 254 | allow { appdomain -isolated_app -ephemeral_app } sdcard_type:file create_file_perms; |
255 | allow { appdomain -isolated_app -ephemeral_app } sdcardfs:dir create_dir_perms; | ||
256 | allow { appdomain -isolated_app -ephemeral_app } sdcardfs:file create_file_perms; | ||
257 | # This should be removed if sdcardfs is modified to alter the secontext for its | 255 | # This should be removed if sdcardfs is modified to alter the secontext for its |
258 | # accesses to the underlying FS. | 256 | # accesses to the underlying FS. |
259 | allow { appdomain -isolated_app -ephemeral_app } { media_rw_data_file vfat }:dir create_dir_perms; | 257 | allow { appdomain -isolated_app -ephemeral_app } media_rw_data_file:dir create_dir_perms; |
260 | allow { appdomain -isolated_app -ephemeral_app } { media_rw_data_file vfat }:file create_file_perms; | 258 | allow { appdomain -isolated_app -ephemeral_app } media_rw_data_file:file create_file_perms; |
261 | |||
262 | # Access OBBs (vfat images) mounted by vold (b/17633509) | ||
263 | # File write access allowed for FDs returned through Storage Access Framework | ||
264 | allow { appdomain -isolated_app -ephemeral_app } vfat:dir r_dir_perms; | ||
265 | allow { appdomain -isolated_app -ephemeral_app } vfat:file rw_file_perms; | ||
266 | 259 | ||
267 | # Allow apps to use the USB Accessory interface. | 260 | # Allow apps to use the USB Accessory interface. |
268 | # http://developer.android.com/guide/topics/connectivity/usb/accessory.html | 261 | # http://developer.android.com/guide/topics/connectivity/usb/accessory.html |
diff --git a/public/file.te b/public/file.te index c10058ea..5a5ee80b 100644 --- a/public/file.te +++ b/public/file.te | |||
@@ -108,6 +108,7 @@ type mqueue, fs_type; | |||
108 | type fuse, sdcard_type, fs_type, mlstrustedobject; | 108 | type fuse, sdcard_type, fs_type, mlstrustedobject; |
109 | type sdcardfs, sdcard_type, fs_type, mlstrustedobject; | 109 | type sdcardfs, sdcard_type, fs_type, mlstrustedobject; |
110 | type vfat, sdcard_type, fs_type, mlstrustedobject; | 110 | type vfat, sdcard_type, fs_type, mlstrustedobject; |
111 | type exfat, sdcard_type, fs_type, mlstrustedobject; | ||
111 | type debugfs, fs_type, debugfs_type; | 112 | type debugfs, fs_type, debugfs_type; |
112 | type debugfs_mmc, fs_type, debugfs_type; | 113 | type debugfs_mmc, fs_type, debugfs_type; |
113 | type debugfs_trace_marker, fs_type, debugfs_type, mlstrustedobject; | 114 | type debugfs_trace_marker, fs_type, debugfs_type, mlstrustedobject; |
diff --git a/public/hal_configstore.te b/public/hal_configstore.te index d5f2ef6f..c8051e14 100644 --- a/public/hal_configstore.te +++ b/public/hal_configstore.te | |||
@@ -49,7 +49,14 @@ neverallow hal_configstore_server { | |||
49 | }:{ file fifo_file sock_file } *; | 49 | }:{ file fifo_file sock_file } *; |
50 | 50 | ||
51 | # Should never need sdcard access | 51 | # Should never need sdcard access |
52 | neverallow hal_configstore_server { fuse sdcardfs vfat }:file *; | 52 | neverallow hal_configstore_server { |
53 | sdcard_type | ||
54 | fuse sdcardfs vfat exfat # manual expansion for completeness | ||
55 | }:dir ~getattr; | ||
56 | neverallow hal_configstore_server { | ||
57 | sdcard_type | ||
58 | fuse sdcardfs vfat exfat # manual expansion for completeness | ||
59 | }:file *; | ||
53 | 60 | ||
54 | # Do not permit access to service_manager and vndservice_manager | 61 | # Do not permit access to service_manager and vndservice_manager |
55 | neverallow hal_configstore_server *:service_manager *; | 62 | neverallow hal_configstore_server *:service_manager *; |
diff --git a/public/hal_telephony.te b/public/hal_telephony.te index 31859aa5..5f8cc41c 100644 --- a/public/hal_telephony.te +++ b/public/hal_telephony.te | |||
@@ -21,7 +21,6 @@ allow hal_telephony_server efs_file:file create_file_perms; | |||
21 | allow hal_telephony_server vendor_shell_exec:file rx_file_perms; | 21 | allow hal_telephony_server vendor_shell_exec:file rx_file_perms; |
22 | allow hal_telephony_server bluetooth_efs_file:file r_file_perms; | 22 | allow hal_telephony_server bluetooth_efs_file:file r_file_perms; |
23 | allow hal_telephony_server bluetooth_efs_file:dir r_dir_perms; | 23 | allow hal_telephony_server bluetooth_efs_file:dir r_dir_perms; |
24 | allow hal_telephony_server sdcard_type:dir r_dir_perms; | ||
25 | 24 | ||
26 | # property service | 25 | # property service |
27 | set_prop(hal_telephony_server, radio_prop) | 26 | set_prop(hal_telephony_server, radio_prop) |