aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJoel Galenson2018-04-16 16:50:38 -0500
committerJoel Galenson2018-04-16 18:39:43 -0500
commit254a872cab855b01433cdd5a30239ef888452003 (patch)
tree04d780d8244ba7695b70e19a0a3c3abf9ef1a474
parente96766dc42dd1889c5ccfdb37acac20ed75200cc (diff)
downloadsystem-sepolicy-254a872cab855b01433cdd5a30239ef888452003.tar.gz
system-sepolicy-254a872cab855b01433cdd5a30239ef888452003.tar.xz
system-sepolicy-254a872cab855b01433cdd5a30239ef888452003.zip
Let vold_prepare_subdirs completely clean deleted user data.
After adding a new user, deleting it, and rebooting, some of the user's data still remained. This adds the SELinux permissions necessary to remove all of the data. It fixes the followign denials: avc: denied { rmdir } for scontext=u:r:vold_prepare_subdirs:s0 tcontext=u:object_r:system_data_file:s0 tclass=dir avc: denied { unlink } for scontext=u:r:vold_prepare_subdirs:s0 tcontext=u:object_r:system_data_file:s0 tclass=file Bug: 74866238 Test: Create user, delete user, reboot user, see no denials or leftover data. Change-Id: Ibc43bd2552b388a9708bf781b5ad206f21df62dc
-rw-r--r--private/vold_prepare_subdirs.te4
-rw-r--r--public/domain.te1
2 files changed, 3 insertions, 2 deletions
diff --git a/private/vold_prepare_subdirs.te b/private/vold_prepare_subdirs.te
index badbb71f..89b15280 100644
--- a/private/vold_prepare_subdirs.te
+++ b/private/vold_prepare_subdirs.te
@@ -12,8 +12,8 @@ allow vold_prepare_subdirs self:process setfscreate;
12allow vold_prepare_subdirs { 12allow vold_prepare_subdirs {
13 system_data_file 13 system_data_file
14 vendor_data_file 14 vendor_data_file
15}:dir { open read write add_name remove_name relabelfrom }; 15}:dir { open read write add_name remove_name rmdir relabelfrom };
16allow vold_prepare_subdirs system_data_file:file getattr; 16allow vold_prepare_subdirs system_data_file:file { getattr unlink };
17allow vold_prepare_subdirs vold_data_file:dir { create open read write search getattr setattr remove_name rmdir relabelto }; 17allow vold_prepare_subdirs vold_data_file:dir { create open read write search getattr setattr remove_name rmdir relabelto };
18allow vold_prepare_subdirs vold_data_file:file { getattr unlink }; 18allow vold_prepare_subdirs vold_data_file:file { getattr unlink };
19allow vold_prepare_subdirs storaged_data_file:dir { create_dir_perms relabelto }; 19allow vold_prepare_subdirs storaged_data_file:dir { create_dir_perms relabelto };
diff --git a/public/domain.te b/public/domain.te
index 41e09033..2856f2c6 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -1120,6 +1120,7 @@ neverallow {
1120 -system_app 1120 -system_app
1121 -init 1121 -init
1122 -installd # for relabelfrom and unlink, check for this in explicit neverallow 1122 -installd # for relabelfrom and unlink, check for this in explicit neverallow
1123 -vold_prepare_subdirs # For unlink
1123 with_asan(`-asan_extract') 1124 with_asan(`-asan_extract')
1124} system_data_file:file no_w_file_perms; 1125} system_data_file:file no_w_file_perms;
1125# do not grant anything greater than r_file_perms and relabelfrom unlink 1126# do not grant anything greater than r_file_perms and relabelfrom unlink