Introduce system_file_type
system_file_type is a new attribute used to identify files which exist
on the /system partition. It's useful for allow rules in init, which are
based off of a blacklist of writable files. Additionally, it's useful
for constructing neverallow rules to prevent regressions.
Additionally, add commented out tests which enforce that all files on
the /system partition have the system_file_type attribute. These tests
will be uncommented in a future change after all the device-specific
policies are cleaned up.
Test: Device boots and no obvious problems.
Change-Id: Id9bae6625f042594c8eba74ca712abb09702c1e5
diff --git a/private/atrace.te b/private/atrace.te
index 1b86d3e..ac9bedb 100644
--- a/private/atrace.te
+++ b/private/atrace.te
@@ -2,7 +2,7 @@
# It is spawned either by traced_probes or by init for the boottrace service.
type atrace, domain, coredomain;
-type atrace_exec, exec_type, file_type;
+type atrace_exec, exec_type, file_type, system_file_type;
# boottrace services uses /data/misc/boottrace/categories
allow atrace boottrace_data_file:dir search;
diff --git a/private/audioserver.te b/private/audioserver.te
index 3c20268..09a0a97 100644
--- a/private/audioserver.te
+++ b/private/audioserver.te
@@ -2,7 +2,7 @@
typeattribute audioserver coredomain;
-type audioserver_exec, exec_type, file_type;
+type audioserver_exec, exec_type, file_type, system_file_type;
init_daemon_domain(audioserver)
r_dir_file(audioserver, sdcard_type)
diff --git a/private/blank_screen.te b/private/blank_screen.te
index 43d273b..51310d1 100644
--- a/private/blank_screen.te
+++ b/private/blank_screen.te
@@ -1,5 +1,5 @@
type blank_screen, domain, coredomain;
-type blank_screen_exec, exec_type, file_type;
+type blank_screen_exec, exec_type, file_type, system_file_type;
init_daemon_domain(blank_screen)
diff --git a/private/blkid.te b/private/blkid.te
index 090912b..4e972ab 100644
--- a/private/blkid.te
+++ b/private/blkid.te
@@ -2,7 +2,7 @@
typeattribute blkid coredomain;
-type blkid_exec, exec_type, file_type;
+type blkid_exec, system_file_type, exec_type, file_type;
# Allowed read-only access to encrypted devices to extract UUID/label
allow blkid block_device:dir search;
diff --git a/private/bpfloader.te b/private/bpfloader.te
index 0b33811..83a74a2 100644
--- a/private/bpfloader.te
+++ b/private/bpfloader.te
@@ -1,6 +1,6 @@
# bpf program loader
type bpfloader, domain;
-type bpfloader_exec, exec_type, file_type;
+type bpfloader_exec, system_file_type, exec_type, file_type;
typeattribute bpfloader coredomain;
# Process need CAP_NET_ADMIN to run bpf programs as cgroup filter
diff --git a/private/dexoptanalyzer.te b/private/dexoptanalyzer.te
index 7d01ef5..212608b 100644
--- a/private/dexoptanalyzer.te
+++ b/private/dexoptanalyzer.te
@@ -1,6 +1,6 @@
# dexoptanalyzer
type dexoptanalyzer, domain, coredomain, mlstrustedsubject;
-type dexoptanalyzer_exec, exec_type, file_type;
+type dexoptanalyzer_exec, system_file_type, exec_type, file_type;
# Reading an APK opens a ZipArchive, which unpack to tmpfs.
# Use tmpfs_domain() which will give tmpfs files created by dexoptanalyzer their
diff --git a/private/hal_allocator_default.te b/private/hal_allocator_default.te
index 49ef178..7aa28aa 100644
--- a/private/hal_allocator_default.te
+++ b/private/hal_allocator_default.te
@@ -1,5 +1,5 @@
type hal_allocator_default, domain, coredomain;
hal_server_domain(hal_allocator_default, hal_allocator)
-type hal_allocator_default_exec, exec_type, file_type;
+type hal_allocator_default_exec, system_file_type, exec_type, file_type;
init_daemon_domain(hal_allocator_default)
diff --git a/private/hal_system_suspend_default.te b/private/hal_system_suspend_default.te
index 293f3de..c948051 100644
--- a/private/hal_system_suspend_default.te
+++ b/private/hal_system_suspend_default.te
@@ -1,5 +1,5 @@
type hal_system_suspend_default, domain, coredomain;
hal_server_domain(hal_system_suspend_default, hal_system_suspend)
-type hal_system_suspend_default_exec, exec_type, file_type;
+type hal_system_suspend_default_exec, system_file_type, exec_type, file_type;
init_daemon_domain(hal_system_suspend_default)
diff --git a/private/incident.te b/private/incident.te
index 1844898..98101e0 100644
--- a/private/incident.te
+++ b/private/incident.te
@@ -1,6 +1,6 @@
typeattribute incident coredomain;
-type incident_exec, exec_type, file_type;
+type incident_exec, system_file_type, exec_type, file_type;
# switch to incident domain for incident command
domain_auto_trans(shell, incident_exec, incident)
diff --git a/private/incident_helper.te b/private/incident_helper.te
index e1e3fc8..078aa24 100644
--- a/private/incident_helper.te
+++ b/private/incident_helper.te
@@ -1,6 +1,6 @@
typeattribute incident_helper coredomain;
-type incident_helper_exec, exec_type, file_type;
+type incident_helper_exec, system_file_type, exec_type, file_type;
# switch to incident_helper domain for incident_helper command
domain_auto_trans(incidentd, incident_helper_exec, incident_helper)
diff --git a/private/incidentd.te b/private/incidentd.te
index 334c243..7ad3a30 100644
--- a/private/incidentd.te
+++ b/private/incidentd.te
@@ -2,7 +2,7 @@
typeattribute incidentd mlstrustedsubject;
init_daemon_domain(incidentd)
-type incidentd_exec, exec_type, file_type;
+type incidentd_exec, system_file_type, exec_type, file_type;
binder_use(incidentd)
wakelock_use(incidentd)
diff --git a/private/mdnsd.te b/private/mdnsd.te
index 943f979..98e95da 100644
--- a/private/mdnsd.te
+++ b/private/mdnsd.te
@@ -3,7 +3,7 @@
typeattribute mdnsd coredomain;
typeattribute mdnsd mlstrustedsubject;
-type mdnsd_exec, exec_type, file_type;
+type mdnsd_exec, system_file_type, exec_type, file_type;
init_daemon_domain(mdnsd)
net_domain(mdnsd)
diff --git a/private/perfetto.te b/private/perfetto.te
index 9ac5d87..c068dc5 100644
--- a/private/perfetto.te
+++ b/private/perfetto.te
@@ -4,7 +4,7 @@
# daemon.
type perfetto, domain, coredomain;
-type perfetto_exec, exec_type, file_type;
+type perfetto_exec, system_file_type, exec_type, file_type;
tmpfs_domain(perfetto);
diff --git a/private/stats.te b/private/stats.te
index 4b29cf3..818d9f9 100644
--- a/private/stats.te
+++ b/private/stats.te
@@ -1,6 +1,6 @@
type stats, domain;
typeattribute stats coredomain;
-type stats_exec, exec_type, file_type;
+type stats_exec, system_file_type, exec_type, file_type;
# switch to stats domain for stats command
domain_auto_trans(shell, stats_exec, stats)
diff --git a/private/storaged.te b/private/storaged.te
index 8f70531..0e31483 100644
--- a/private/storaged.te
+++ b/private/storaged.te
@@ -1,6 +1,6 @@
# storaged daemon
type storaged, domain, coredomain, mlstrustedsubject;
-type storaged_exec, exec_type, file_type;
+type storaged_exec, system_file_type, exec_type, file_type;
init_daemon_domain(storaged)
diff --git a/private/surfaceflinger.te b/private/surfaceflinger.te
index a5ebfb0..000ebe1 100644
--- a/private/surfaceflinger.te
+++ b/private/surfaceflinger.te
@@ -2,7 +2,7 @@
typeattribute surfaceflinger coredomain;
-type surfaceflinger_exec, exec_type, file_type;
+type surfaceflinger_exec, system_file_type, exec_type, file_type;
init_daemon_domain(surfaceflinger)
typeattribute surfaceflinger mlstrustedsubject;
diff --git a/private/traced.te b/private/traced.te
index 49edc51..6571938 100644
--- a/private/traced.te
+++ b/private/traced.te
@@ -1,6 +1,6 @@
# Perfetto user-space tracing daemon (unprivileged)
type traced, domain, coredomain, mlstrustedsubject;
-type traced_exec, exec_type, file_type;
+type traced_exec, system_file_type, exec_type, file_type;
# Allow init to exec the daemon.
init_daemon_domain(traced)
diff --git a/private/traced_probes.te b/private/traced_probes.te
index 83dbe45..e173293 100644
--- a/private/traced_probes.te
+++ b/private/traced_probes.te
@@ -1,5 +1,5 @@
# Perfetto tracing probes, has tracefs access.
-type traced_probes_exec, exec_type, file_type;
+type traced_probes_exec, system_file_type, exec_type, file_type;
# Allow init to exec the daemon.
init_daemon_domain(traced_probes)
diff --git a/private/wait_for_keymaster.te b/private/wait_for_keymaster.te
index 8b8dd29..85a28da 100644
--- a/private/wait_for_keymaster.te
+++ b/private/wait_for_keymaster.te
@@ -1,6 +1,6 @@
# wait_for_keymaster service
type wait_for_keymaster, domain, coredomain;
-type wait_for_keymaster_exec, exec_type, file_type;
+type wait_for_keymaster_exec, system_file_type, exec_type, file_type;
init_daemon_domain(wait_for_keymaster)