aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJeff Sharkey2018-04-13 18:47:54 -0500
committerGerrit Code Review2018-04-13 18:47:54 -0500
commitba890071786e90500a67711fc4379f7afc02addb (patch)
treed12ee810fbb297cffcacf0220619b649268434f4
parent6b1ce73e1ff9df5d457c5003f093905f3e6263eb (diff)
parent000cafc70120e26a1c0918d5cedff1a646521c11 (diff)
downloadsystem-sepolicy-ba890071786e90500a67711fc4379f7afc02addb.tar.gz
system-sepolicy-ba890071786e90500a67711fc4379f7afc02addb.tar.xz
system-sepolicy-ba890071786e90500a67711fc4379f7afc02addb.zip
Merge "Add exFAT support; unify behind "sdcard_type"."
-rw-r--r--private/app_neverallows.te4
-rw-r--r--private/compat/26.0/26.0.ignore.cil1
-rw-r--r--private/compat/27.0/27.0.ignore.cil1
-rw-r--r--private/genfs_contexts1
-rw-r--r--private/platform_app.te4
-rw-r--r--public/app.te15
-rw-r--r--public/file.te1
-rw-r--r--public/hal_configstore.te9
-rw-r--r--public/hal_telephony.te1
9 files changed, 19 insertions, 18 deletions
diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 4b79060e..3bdbfb18 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -93,9 +93,7 @@ neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_fil
93# application un-installation. 93# application un-installation.
94neverallow { all_untrusted_apps -mediaprovider } { 94neverallow { all_untrusted_apps -mediaprovider } {
95 fs_type 95 fs_type
96 -fuse # sdcard 96 -sdcard_type
97 -sdcardfs # sdcard
98 -vfat
99 file_type 97 file_type
100 -app_data_file # The apps sandbox itself 98 -app_data_file # The apps sandbox itself
101 -media_rw_data_file # Internal storage. Known that apps can 99 -media_rw_data_file # Internal storage. Known that apps can
diff --git a/private/compat/26.0/26.0.ignore.cil b/private/compat/26.0/26.0.ignore.cil
index ab58ddaa..68d6b409 100644
--- a/private/compat/26.0/26.0.ignore.cil
+++ b/private/compat/26.0/26.0.ignore.cil
@@ -19,6 +19,7 @@
19 crossprofileapps_service 19 crossprofileapps_service
20 e2fs 20 e2fs
21 e2fs_exec 21 e2fs_exec
22 exfat
22 exported_bluetooth_prop 23 exported_bluetooth_prop
23 exported_config_prop 24 exported_config_prop
24 exported_dalvik_prop 25 exported_dalvik_prop
diff --git a/private/compat/27.0/27.0.ignore.cil b/private/compat/27.0/27.0.ignore.cil
index 493ac312..1eaf22a7 100644
--- a/private/compat/27.0/27.0.ignore.cil
+++ b/private/compat/27.0/27.0.ignore.cil
@@ -15,6 +15,7 @@
15 bpfloader_exec 15 bpfloader_exec
16 cgroup_bpf 16 cgroup_bpf
17 crossprofileapps_service 17 crossprofileapps_service
18 exfat
18 exported2_config_prop 19 exported2_config_prop
19 exported2_default_prop 20 exported2_default_prop
20 exported2_radio_prop 21 exported2_radio_prop
diff --git a/private/genfs_contexts b/private/genfs_contexts
index f2b96990..1d321d81 100644
--- a/private/genfs_contexts
+++ b/private/genfs_contexts
@@ -238,6 +238,7 @@ genfscon debugfs /tracing/events/lowmemorykiller/
238 238
239genfscon inotifyfs / u:object_r:inotify:s0 239genfscon inotifyfs / u:object_r:inotify:s0
240genfscon vfat / u:object_r:vfat:s0 240genfscon vfat / u:object_r:vfat:s0
241genfscon exfat / u:object_r:exfat:s0
241genfscon debugfs / u:object_r:debugfs:s0 242genfscon debugfs / u:object_r:debugfs:s0
242genfscon fuse / u:object_r:fuse:s0 243genfscon fuse / u:object_r:fuse:s0
243genfscon configfs / u:object_r:configfs:s0 244genfscon configfs / u:object_r:configfs:s0
diff --git a/private/platform_app.te b/private/platform_app.te
index 80b20e14..f60597a7 100644
--- a/private/platform_app.te
+++ b/private/platform_app.te
@@ -34,8 +34,8 @@ allow platform_app cache_file:file create_file_perms;
34# Direct access to vold-mounted storage under /mnt/media_rw 34# Direct access to vold-mounted storage under /mnt/media_rw
35# This is a performance optimization that allows platform apps to bypass the FUSE layer 35# This is a performance optimization that allows platform apps to bypass the FUSE layer
36allow platform_app mnt_media_rw_file:dir r_dir_perms; 36allow platform_app mnt_media_rw_file:dir r_dir_perms;
37allow platform_app vfat:dir create_dir_perms; 37allow platform_app sdcard_type:dir create_dir_perms;
38allow platform_app vfat:file create_file_perms; 38allow platform_app sdcard_type:file create_file_perms;
39 39
40# com.android.systemui 40# com.android.systemui
41allow platform_app rootfs:dir getattr; 41allow platform_app rootfs:dir getattr;
diff --git a/public/app.te b/public/app.te
index cc4d285f..b5e77c15 100644
--- a/public/app.te
+++ b/public/app.te
@@ -250,19 +250,12 @@ allow { appdomain -isolated_app -ephemeral_app } mnt_user_file:dir r_dir_perms;
250allow { appdomain -isolated_app -ephemeral_app } mnt_user_file:lnk_file r_file_perms; 250allow { appdomain -isolated_app -ephemeral_app } mnt_user_file:lnk_file r_file_perms;
251 251
252# Read/write visible storage 252# Read/write visible storage
253allow { appdomain -isolated_app -ephemeral_app } fuse:dir create_dir_perms; 253allow { appdomain -isolated_app -ephemeral_app } sdcard_type:dir create_dir_perms;
254allow { appdomain -isolated_app -ephemeral_app } fuse:file create_file_perms; 254allow { appdomain -isolated_app -ephemeral_app } sdcard_type:file create_file_perms;
255allow { appdomain -isolated_app -ephemeral_app } sdcardfs:dir create_dir_perms;
256allow { appdomain -isolated_app -ephemeral_app } sdcardfs:file create_file_perms;
257# This should be removed if sdcardfs is modified to alter the secontext for its 255# This should be removed if sdcardfs is modified to alter the secontext for its
258# accesses to the underlying FS. 256# accesses to the underlying FS.
259allow { appdomain -isolated_app -ephemeral_app } { media_rw_data_file vfat }:dir create_dir_perms; 257allow { appdomain -isolated_app -ephemeral_app } media_rw_data_file:dir create_dir_perms;
260allow { appdomain -isolated_app -ephemeral_app } { media_rw_data_file vfat }:file create_file_perms; 258allow { appdomain -isolated_app -ephemeral_app } media_rw_data_file:file create_file_perms;
261
262# Access OBBs (vfat images) mounted by vold (b/17633509)
263# File write access allowed for FDs returned through Storage Access Framework
264allow { appdomain -isolated_app -ephemeral_app } vfat:dir r_dir_perms;
265allow { appdomain -isolated_app -ephemeral_app } vfat:file rw_file_perms;
266 259
267# Allow apps to use the USB Accessory interface. 260# Allow apps to use the USB Accessory interface.
268# http://developer.android.com/guide/topics/connectivity/usb/accessory.html 261# http://developer.android.com/guide/topics/connectivity/usb/accessory.html
diff --git a/public/file.te b/public/file.te
index c10058ea..5a5ee80b 100644
--- a/public/file.te
+++ b/public/file.te
@@ -108,6 +108,7 @@ type mqueue, fs_type;
108type fuse, sdcard_type, fs_type, mlstrustedobject; 108type fuse, sdcard_type, fs_type, mlstrustedobject;
109type sdcardfs, sdcard_type, fs_type, mlstrustedobject; 109type sdcardfs, sdcard_type, fs_type, mlstrustedobject;
110type vfat, sdcard_type, fs_type, mlstrustedobject; 110type vfat, sdcard_type, fs_type, mlstrustedobject;
111type exfat, sdcard_type, fs_type, mlstrustedobject;
111type debugfs, fs_type, debugfs_type; 112type debugfs, fs_type, debugfs_type;
112type debugfs_mmc, fs_type, debugfs_type; 113type debugfs_mmc, fs_type, debugfs_type;
113type debugfs_trace_marker, fs_type, debugfs_type, mlstrustedobject; 114type debugfs_trace_marker, fs_type, debugfs_type, mlstrustedobject;
diff --git a/public/hal_configstore.te b/public/hal_configstore.te
index d5f2ef6f..c8051e14 100644
--- a/public/hal_configstore.te
+++ b/public/hal_configstore.te
@@ -49,7 +49,14 @@ neverallow hal_configstore_server {
49}:{ file fifo_file sock_file } *; 49}:{ file fifo_file sock_file } *;
50 50
51# Should never need sdcard access 51# Should never need sdcard access
52neverallow hal_configstore_server { fuse sdcardfs vfat }:file *; 52neverallow hal_configstore_server {
53 sdcard_type
54 fuse sdcardfs vfat exfat # manual expansion for completeness
55}:dir ~getattr;
56neverallow hal_configstore_server {
57 sdcard_type
58 fuse sdcardfs vfat exfat # manual expansion for completeness
59}:file *;
53 60
54# Do not permit access to service_manager and vndservice_manager 61# Do not permit access to service_manager and vndservice_manager
55neverallow hal_configstore_server *:service_manager *; 62neverallow hal_configstore_server *:service_manager *;
diff --git a/public/hal_telephony.te b/public/hal_telephony.te
index 31859aa5..5f8cc41c 100644
--- a/public/hal_telephony.te
+++ b/public/hal_telephony.te
@@ -21,7 +21,6 @@ allow hal_telephony_server efs_file:file create_file_perms;
21allow hal_telephony_server vendor_shell_exec:file rx_file_perms; 21allow hal_telephony_server vendor_shell_exec:file rx_file_perms;
22allow hal_telephony_server bluetooth_efs_file:file r_file_perms; 22allow hal_telephony_server bluetooth_efs_file:file r_file_perms;
23allow hal_telephony_server bluetooth_efs_file:dir r_dir_perms; 23allow hal_telephony_server bluetooth_efs_file:dir r_dir_perms;
24allow hal_telephony_server sdcard_type:dir r_dir_perms;
25 24
26# property service 25# property service
27set_prop(hal_telephony_server, radio_prop) 26set_prop(hal_telephony_server, radio_prop)