Merge "Convert selinux_policy to Android.bp" into main
diff --git a/private/aconfigd.te b/private/aconfigd.te
index 97e7493..1601e61 100644
--- a/private/aconfigd.te
+++ b/private/aconfigd.te
@@ -1,15 +1,9 @@
# aconfigd -- manager for aconfig flags
-type aconfigd, domain;
+type aconfigd, domain, coredomain;
type aconfigd_exec, exec_type, file_type, system_file_type;
-typeattribute aconfigd coredomain;
-
init_daemon_domain(aconfigd)
-# only init is allowed to enter the aconfigd domain
-neverallow { domain -init } aconfigd:process transition;
-neverallow * aconfigd:process dyntransition;
-
allow aconfigd metadata_file:dir search;
allow aconfigd {
@@ -22,17 +16,15 @@
aconfig_storage_flags_metadata_file
}:file create_file_perms;
-allow aconfigd aconfigd_socket:unix_stream_socket { accept listen getattr read write };
-allow aconfigd aconfigd_socket:sock_file rw_file_perms;
-
# allow aconfigd to access shell_data_file for atest
userdebug_or_eng(`
allow aconfigd shell_data_file:dir search;
allow aconfigd shell_data_file:file { getattr read open map };
')
-# allow aconfigd to log to the kernel.
-allow aconfigd kmsg_device:chr_file w_file_perms;
+# allow aconfigd to log to the kernel dmesg via a file descriptor
+# passed from init to aconfigd
+allow aconfigd kmsg_device:chr_file write;
# allow aconfigd to read vendor partition storage files
allow aconfigd vendor_aconfig_storage_file:file r_file_perms;
@@ -41,3 +33,11 @@
# allow aconfigd to read /apex dir
allow aconfigd apex_mnt_dir:dir r_dir_perms;
allow aconfigd apex_mnt_dir:file r_file_perms;
+
+###
+### Neverallow assertions
+###
+
+# only init is allowed to enter the aconfigd domain
+neverallow { domain -init } aconfigd:process transition;
+neverallow * aconfigd:process dyntransition;
diff --git a/private/sdk_sandbox_all.te b/private/sdk_sandbox_all.te
index b4c655b..41b2799 100644
--- a/private/sdk_sandbox_all.te
+++ b/private/sdk_sandbox_all.te
@@ -124,3 +124,25 @@
# Only dirs should be created at sdk_sandbox_all_system_data_file level
neverallow { domain -init } sdk_sandbox_system_data_file:file *;
+# Restrict unix stream sockets for IPC.
+neverallow sdk_sandbox_all {
+ domain
+ -sdk_sandbox_all
+ -netd
+ -logd
+ -adbd
+ userdebug_or_eng(`-su')
+ # needed for profiling
+ -traced
+ -traced_perf
+ -heapprofd
+ # fallback crash handling for processes that can't exec crash_dump.
+ -tombstoned
+ # needed to connect to PRNG seeder daemon.
+ -prng_seeder
+}:unix_stream_socket connectto;
+neverallow {
+ domain
+ -adbd
+ -sdk_sandbox_all
+} sdk_sandbox_all:unix_stream_socket connectto;
diff --git a/private/shell.te b/private/shell.te
index a6e9975..839178c 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -273,12 +273,6 @@
# TODO (b/350628688): Remove this once it's safe to do so.
allow shell oatdump_exec:file rx_file_perms;
-# Allow shell access to socket for test
-userdebug_or_eng(`
- allow shell aconfigd_socket:sock_file write;
- allow shell aconfigd:unix_stream_socket connectto;
-')
-
# Create and use network sockets.
net_domain(shell)