Start tracking vendor seapp coredomain violations
As part of Treble, enforce that vendor's seapp_contexts can't label apps
using coredomains. Apps installed to system/system_ext/product should be
labeled with platform side sepolicy.
This change adds the violators attribute that will be used to mark
violating domains that need to be fixed.
Bug: 280547417
Test: manual
Change-Id: I64f3bb2880bd19e65450ea3d3692d1b424402d92
diff --git a/tools/check_seapp.c b/tools/check_seapp.c
index 862ecce..41a713d 100644
--- a/tools/check_seapp.c
+++ b/tools/check_seapp.c
@@ -22,6 +22,7 @@
#define APP_DATA_REQUIRED_ATTRIB "app_data_file_type"
#define COREDOMAIN "coredomain"
+#define VENDOR_SEAPP_ASSIGNS_COREDOMAIN_VIOLATORS "vendor_seapp_assigns_coredomain_violators"
/**
* Initializes an empty, static list.
@@ -449,7 +450,13 @@
return false;
}
- if (type_has_attribute(pol.db, type_dat, attrib_dat)) {
+ type_datum_t *attrib_violators = find_type(pol.db,
+ VENDOR_SEAPP_ASSIGNS_COREDOMAIN_VIOLATORS,
+ TYPE_ATTRIB);
+ bool allowlisted = attrib_violators != NULL &&
+ type_has_attribute(pol.db, type_dat, attrib_violators);
+
+ if (type_has_attribute(pol.db, type_dat, attrib_dat) && !allowlisted) {
coredomain_violation_entry *entry = (coredomain_violation_entry *)malloc(sizeof(*entry));
entry->domain = strdup(value);
entry->filename = strdup(filename);