Inseob Kim | ff43be2 | 2021-06-07 16:56:56 +0900 | [diff] [blame^] | 1 | # ueventd seclabel is specified in init.rc since |
| 2 | # it lives in the rootfs and has no unique file type. |
| 3 | type ueventd, domain; |
| 4 | type ueventd_tmpfs, file_type; |
| 5 | |
| 6 | # Write to /dev/kmsg. |
| 7 | allow ueventd kmsg_device:chr_file rw_file_perms; |
| 8 | |
| 9 | allow ueventd self:global_capability_class_set { chown mknod net_admin setgid fsetid sys_rawio dac_override dac_read_search fowner setuid }; |
| 10 | allow ueventd device:file create_file_perms; |
| 11 | |
| 12 | r_dir_file(ueventd, rootfs) |
| 13 | |
| 14 | # ueventd needs write access to files in /sys to regenerate uevents |
| 15 | allow ueventd sysfs_type:file w_file_perms; |
| 16 | r_dir_file(ueventd, sysfs_type) |
| 17 | allow ueventd sysfs_type:{ file lnk_file } { relabelfrom relabelto setattr }; |
| 18 | allow ueventd sysfs_type:dir { relabelfrom relabelto setattr }; |
| 19 | allow ueventd tmpfs:chr_file rw_file_perms; |
| 20 | allow ueventd dev_type:dir create_dir_perms; |
| 21 | allow ueventd dev_type:lnk_file { create unlink }; |
| 22 | allow ueventd dev_type:chr_file { getattr create setattr unlink }; |
| 23 | allow ueventd dev_type:blk_file { getattr relabelfrom relabelto create setattr unlink }; |
| 24 | allow ueventd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; |
| 25 | allow ueventd efs_file:dir search; |
| 26 | allow ueventd efs_file:file r_file_perms; |
| 27 | |
| 28 | # Get SELinux enforcing status. |
| 29 | r_dir_file(ueventd, selinuxfs) |
| 30 | |
| 31 | # Access for /vendor/ueventd.rc and /vendor/firmware |
| 32 | r_dir_file(ueventd, { vendor_file_type -vendor_app_file -vendor_overlay_file }) |
| 33 | |
| 34 | # Access for /apex/*/firmware |
| 35 | allow ueventd apex_mnt_dir:dir r_dir_perms; |
| 36 | |
| 37 | # Get file contexts for new device nodes |
| 38 | allow ueventd file_contexts_file:file r_file_perms; |
| 39 | |
| 40 | # Use setfscreatecon() to label /dev directories and files. |
| 41 | allow ueventd self:process setfscreate; |
| 42 | |
| 43 | # Allow ueventd to read androidboot.android_dt_dir from kernel cmdline or bootconfig. |
| 44 | allow ueventd proc_cmdline:file r_file_perms; |
| 45 | allow ueventd proc_bootconfig:file r_file_perms; |
| 46 | |
| 47 | # Everything is labeled as rootfs in recovery mode. ueventd has to execute |
| 48 | # the dynamic linker and shared libraries. |
| 49 | recovery_only(` |
| 50 | allow ueventd rootfs:file { r_file_perms execute }; |
| 51 | ') |
| 52 | |
| 53 | # Suppress denials for ueventd to getattr /postinstall. This occurs when the |
| 54 | # linker tries to resolve paths in ld.config.txt. |
| 55 | dontaudit ueventd postinstall_mnt_dir:dir getattr; |
| 56 | |
| 57 | # ueventd loads modules in response to modalias events. |
| 58 | allow ueventd self:global_capability_class_set sys_module; |
| 59 | allow ueventd vendor_file:system module_load; |
| 60 | allow ueventd kernel:key search; |
| 61 | |
| 62 | # ueventd is using bootstrap bionic |
| 63 | allow ueventd system_bootstrap_lib_file:dir r_dir_perms; |
| 64 | allow ueventd system_bootstrap_lib_file:file { execute read open getattr map }; |
| 65 | |
| 66 | # Allow ueventd to run shell scripts from vendor |
| 67 | allow ueventd vendor_shell_exec:file execute; |
| 68 | |
| 69 | ##### |
| 70 | ##### neverallow rules |
| 71 | ##### |
| 72 | |
| 73 | # Restrict ueventd access on block devices to maintenence operations. |
| 74 | neverallow ueventd dev_type:blk_file ~{ getattr relabelfrom relabelto create setattr unlink }; |
| 75 | |
| 76 | # Only relabelto as we would never want to relabelfrom port_device |
| 77 | neverallow ueventd port_device:chr_file ~{ getattr create setattr unlink relabelto }; |
| 78 | |
| 79 | # Nobody should be able to ptrace ueventd |
| 80 | neverallow * ueventd:process ptrace; |
| 81 | |
| 82 | # ueventd should never execute a program without changing to another domain. |
| 83 | neverallow ueventd { file_type fs_type }:file execute_no_trans; |