Relabel /data/system/packages.list to new type.
Conservatively grant access to packages_list_file to everything that had
access to system_data_file:file even if the comment in the SELinux
policy suggests it was for another use.
Ran a diff on the resulting SEPolicy, the only difference of domains
being granted is those that had system_data_file:dir permissiosn which
is clearly not applicable for packages.list
diff -u0 <(sesearch --allow -t system_data_file ~/sepolicy | sed 's/system_data_file/packages_list_file/') <(sesearch --allow -t packages_list_file ~/sepolicy_new)
--- /proc/self/fd/16 2019-03-19 20:01:44.378409146 +0000
+++ /proc/self/fd/18 2019-03-19 20:01:44.378409146 +0000
@@ -3 +2,0 @@
-allow appdomain packages_list_file:dir getattr;
@@ -6 +4,0 @@
-allow coredomain packages_list_file:dir getattr;
@@ -8 +5,0 @@
-allow domain packages_list_file:dir search;
@@ -35 +31,0 @@
-allow system_server packages_list_file:dir { rename search setattr read lock create reparent getattr write relabelfrom ioctl rmdir remove_name open add_name };
@@ -40 +35,0 @@
-allow tee packages_list_file:dir { search read lock getattr ioctl open };
@@ -43,3 +37,0 @@
-allow traced_probes packages_list_file:dir { read getattr open search };
-allow vendor_init packages_list_file:dir { search setattr read create getattr write relabelfrom ioctl rmdir remove_name open add_name };
-allow vold packages_list_file:dir { search setattr read lock create getattr mounton write ioctl rmdir remove_name open add_name };
@@ -48 +39,0 @@
-allow vold_prepare_subdirs packages_list_file:dir { read write relabelfrom rmdir remove_name open add_name };
@@ -50 +40,0 @@
-allow zygote packages_list_file:dir { search read lock getattr ioctl open };
Bug: 123186697
Change-Id: Ieabf313653deb5314872b63cd47dadd535af7b07
diff --git a/private/compat/28.0/28.0.cil b/private/compat/28.0/28.0.cil
index 29efc22..a102ab0 100644
--- a/private/compat/28.0/28.0.cil
+++ b/private/compat/28.0/28.0.cil
@@ -1581,7 +1581,8 @@
(typeattributeset system_boot_reason_prop_28_0 (system_boot_reason_prop))
(typeattributeset system_data_file_28_0
( dropbox_data_file
- system_data_file))
+ system_data_file
+ packages_list_file))
(typeattributeset system_file_28_0
( system_file
system_asan_options_file
diff --git a/private/file_contexts b/private/file_contexts
index b913e94..cd1df0a 100644
--- a/private/file_contexts
+++ b/private/file_contexts
@@ -421,6 +421,7 @@
# propagate to the "Expanded data files" section.
#
/data(/.*)? u:object_r:system_data_file:s0
+/data/system/packages\.list u:object_r:packages_list_file:s0
/data/.layout_version u:object_r:install_data_file:s0
/data/unencrypted(/.*)? u:object_r:unencrypted_data_file:s0
/data/backup(/.*)? u:object_r:backup_data_file:s0
diff --git a/private/storaged.te b/private/storaged.te
index 0e31483..3ed24b2 100644
--- a/private/storaged.te
+++ b/private/storaged.te
@@ -12,6 +12,7 @@
# Read /data/system/packages.list
allow storaged system_data_file:file r_file_perms;
+allow storaged packages_list_file:file r_file_perms;
# Store storaged proto file
allow storaged storaged_data_file:dir rw_dir_perms;
diff --git a/private/system_server.te b/private/system_server.te
index 8fff848..bf9c950 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -357,6 +357,7 @@
# Manage system data files.
allow system_server system_data_file:dir create_dir_perms;
allow system_server system_data_file:notdevfile_class_set create_file_perms;
+allow system_server packages_list_file:file create_file_perms;
allow system_server keychain_data_file:dir create_dir_perms;
allow system_server keychain_data_file:file create_file_perms;
allow system_server keychain_data_file:lnk_file create_file_perms;
@@ -525,6 +526,10 @@
# Also used for measuring disk usage.
allow system_server media_rw_data_file:file { getattr read write append };
+# System server needs to setfscreate to packages_list_file when writing
+# /data/system/packages.list
+allow system_server system_server:process setfscreate;
+
# Relabel apk files.
allow system_server { apk_tmp_file apk_private_tmp_file }:{ dir file } { relabelfrom relabelto };
allow system_server { apk_data_file apk_private_data_file }:{ dir file } { relabelfrom relabelto };
diff --git a/public/file.te b/public/file.te
index 883f4a3..ccf6d85 100644
--- a/public/file.te
+++ b/public/file.te
@@ -221,6 +221,10 @@
type coredump_file, file_type;
# Default type for anything under /data.
type system_data_file, file_type, data_file_type, core_data_file_type;
+# Type for /data/system/packages.list.
+# TODO(b/129332765): Narrow down permissions to this.
+# Find out users of system_data_file that should be granted only this.
+type packages_list_file, file_type, data_file_type, core_data_file_type;
# Default type for anything under /data/vendor{_ce,_de}.
type vendor_data_file, file_type, data_file_type;
# Unencrypted data
diff --git a/public/logd.te b/public/logd.te
index 0cbefb4..57e29d9 100644
--- a/public/logd.te
+++ b/public/logd.te
@@ -13,6 +13,7 @@
allow logd kernel:system syslog_read;
allow logd kmsg_device:chr_file { getattr w_file_perms };
allow logd system_data_file:{ file lnk_file } r_file_perms;
+allow logd packages_list_file:file r_file_perms;
allow logd pstorefs:dir search;
allow logd pstorefs:file r_file_perms;
userdebug_or_eng(`
@@ -58,7 +59,7 @@
neverallow logd system_file:dir_file_class_set write;
# Write to files in /data/data or system files on /data
-neverallow logd { app_data_file privapp_data_file system_data_file }:dir_file_class_set write;
+neverallow logd { app_data_file privapp_data_file system_data_file packages_list_file }:dir_file_class_set write;
# Only init is allowed to enter the logd domain via exec()
neverallow { domain -init } logd:process transition;
diff --git a/public/runas.te b/public/runas.te
index b1daa31..356a019 100644
--- a/public/runas.te
+++ b/public/runas.te
@@ -13,6 +13,7 @@
# run-as reads package information.
allow runas system_data_file:file r_file_perms;
allow runas system_data_file:lnk_file getattr;
+allow runas packages_list_file:file r_file_perms;
# The app's data dir may be accessed through a symlink.
allow runas system_data_file:lnk_file read;
diff --git a/public/sdcardd.te b/public/sdcardd.te
index 6d9edfa..83c1840 100644
--- a/public/sdcardd.te
+++ b/public/sdcardd.te
@@ -20,6 +20,7 @@
# Read /data/system/packages.list.
allow sdcardd system_data_file:file r_file_perms;
+allow sdcardd packages_list_file:file r_file_perms;
# Read /data/.layout_version
allow sdcardd install_data_file:file r_file_perms;
diff --git a/public/simpleperf_app_runner.te b/public/simpleperf_app_runner.te
index 9f8e6e4..b7ff7a0 100644
--- a/public/simpleperf_app_runner.te
+++ b/public/simpleperf_app_runner.te
@@ -9,6 +9,7 @@
# simpleperf_app_runner reads package information.
allow simpleperf_app_runner system_data_file:file r_file_perms;
allow simpleperf_app_runner system_data_file:lnk_file getattr;
+allow simpleperf_app_runner packages_list_file:file r_file_perms;
# The app's data dir may be accessed through a symlink.
allow simpleperf_app_runner system_data_file:lnk_file read;