| commit | fa1b5c7fb258aec0c2e0792d83beb245406160a9 | [log] [tgz] |
|---|---|---|
| author | Bo Hu <bohu@google.com> | Sun Dec 01 21:14:32 2024 +0000 |
| committer | Bo Hu <bohu@google.com> | Sun Dec 01 21:14:32 2024 +0000 |
| tree | 42df8a56b375559cdf4e1c44babb927d5fa930c3 | |
| parent | b6721d27df0ac99ed8bc8c3f89f974180748f7ee [diff] |
Revert "Update netlink_route_socket for nlmsg xperm" Revert submission 3316655 Reason for revert: emulator does not boot [ 6.468328] selinux: SELinux: Could not stat /data/dalvik-cache/arm: No such file or directory. [ 6.468892] ------------[ cut here ]------------ [ 6.469241] selinux: SELinux: Could not stat /data/dalvik-cache/arm64: No such file or directory. [ 6.469648] kernel BUG at security/selinux/ss/services.c:961! [ 6.470549] selinux: SELinux: Could not stat /data/dalvik-cache/riscv64: No such file or directory. [ 6.471166] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [ 6.471928] selinux: SELinux: Could not stat /data/dalvik-cache/x86: No such file or directory. [ 6.472389] CPU: 1 PID: 403 Comm: dhcpclient Tainted: G OE 6.6.56-android15-8-gb713239b1f7f-ab12714926 #1 1400000003000000474e5500b8d4777a75d64646 [ 6.473207] selinux: SELinux: Could not stat /data/dalvik-cache/x86_64: No such file or directory. [ 6.474476] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.11.1-0-g0551a4be2c-prebuilt.qemu-project.org 04/01/2014 [ 6.474478] RIP: 0010:services_compute_xperms_decision+0x19f/0x1b0 [ 6.474483] Code: 8b 4e 08 8b 49 18 09 48 14 48 8b 07 48 8b 4e 08 8b 49 1c 09 48 18 48 8b 07 48 8b 4e 08 8b 49 20 09 48 1c 5d c3 cc cc cc cc cc <0f> 0b 0f 0b 66 66 66 66 2e 0f 1f 84 00 00 00 00 00 b8 00 00 00 00 [ 6.474485] RSP: 0018:ffffaa1601553bf8 EFLAGS: 00010202 [ 6.474486] RAX: ffff8b5401052578 RBX: ffffaa1601553ca8 RCX: 0000000000000003 [ 6.475300] init: Service 'ranchu-net' (pid 392) exited with status 0 oneshot service took 0.050000 seconds in background [ 6.476348] RDX: 00000000000008a4 RSI: ffff8b540104fba0 RDI: ffffaa1601553ca8 [ 6.476912] init: Sending signal 9 to service 'ranchu-net' (pid 392) process group... [ 6.478581] RBP: ffffaa1601553bf8 R08: 00000000000008a4 R09: 000000000000001f [ 6.478582] R10: 00000000c7f20000 R11: ffff8b540c82a000 R12: ffff8b5402eae680 [ 6.478583] R13: ffff8b5402eae680 R14: 00000000000008a3 R15: ffff8b540104fba0 [ 6.478585] FS: 00007acc4a076fd8(0000) GS:ffff8b547da80000(0000) knlGS:0000000000000000 [ 6.478587] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 6.478588] CR2: 000063c8ffb69960 CR3: 000000000c9ea000 CR4: 00000000000006a0 [ 6.478590] Call Trace: [ 6.479124] libprocessgroup: Removed cgroup /sys/fs/cgroup/uid_0/pid_392 [ 6.479709] <TASK> [ 6.480943] init: processing action (post-fs-data) from (/system/etc/init/perfetto.rc:76) [ 6.481403] ? __die_body+0x67/0xb0 [ 6.482141] init: Command 'rm /data/misc/perfetto-traces/.guardraildata' action=post-fs-data (/system/etc/init/perfetto.rc:77) took 0ms and failed: unlink() failed: No such file or directory [ 6.482764] ? die+0xa9/0xd0 [ 6.483423] init: processing action (post-fs-data) from (/system/etc/init/profcollectd.rc:9) [ 6.484069] ? do_trap+0x88/0x160 [ 6.485330] init: processing action (post-fs-data) from (/system/etc/init/recovery-persist.rc:1) [ 6.485397] ? services_compute_xperms_decision+0x19f/0x1b0 [ 6.486136] init: starting service 'exec 13 (/system/bin/recovery-persist)'... [ 6.486273] ? handle_invalid_op+0x69/0x90 [ 6.487943] init: ... started service 'exec 13 (/system/bin/recovery-persist)' has pid 405 [ 6.488173] ? services_compute_xperms_decision+0x19f/0x1b0 [ 6.489818] init: processing action (post-fs-data) from (/system/etc/init/wifi.rc:18) [ 6.490068] ? exc_invalid_op+0x36/0x60 [ 6.490071] ? asm_exc_invalid_op+0x1f/0x30 [ 6.490073] ? services_compute_xperms_decision+0x19f/0x1b0 [ 6.490075] security_compute_xperms_decision+0x2b7/0x460 [ 6.490077] avc_has_extended_perms+0x2f6/0x610 [ 6.490080] ioctl_has_perm+0x12a/0x180 [ 6.491055] selinux: SELinux: Skipping restorecon on directory(/data/misc/apexdata/com.android.wifi) [ 6.491154] selinux_file_ioctl+0x1af/0x210 [ 6.491957] init: processing action (post-fs-data) from (/system_ext/etc/init/init.system_ext.radio.rc:1) [ 6.492462] ? alloc_file_pseudo+0xa6/0x110 [ 6.500532] security_file_ioctl+0x4a/0x60 [ 6.500917] __se_sys_ioctl+0x39/0xe0 [ 6.501263] __x64_sys_ioctl+0x1c/0x40 [ 6.501612] x64_sys_call+0x15b1/0x2e10 [ 6.501995] do_syscall_64+0x4a/0xa0 [ 6.502335] ? exc_page_fault+0x65/0xc0 [ 6.502680] entry_SYSCALL_64_after_hwframe+0x78/0xe2 [ 6.503128] RIP: 0033:0x7acc47fad527 [ 6.503462] Code: 00 00 00 b8 1b 00 00 00 0f 05 48 3d 01 f0 ff ff 72 09 f7 d8 89 c7 e8 e8 f7 ff ff c3 0f 1f 80 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 72 09 f7 d8 89 c7 e8 c8 f7 ff ff c3 0f 1f 80 00 [ 6.505170] RSP: 002b:00007fff9386e268 EFLAGS: 00000206 ORIG_RAX: 0000000000000010 [ 6.505869] RAX: ffffffffffffffda RBX: 00007fff9386e420 RCX: 00007acc47fad527 [ 6.506521] RDX: 00007fff9386e390 RSI: 0000000000008933 RDI: 0000000000000003 [ 6.507157] RBP: 00007fff9386e340 R08: 000000000000000a R09: 000000000000000b [ 6.507798] R10: 00000000fffff800 R11: 0000000000000206 R12: 0000000000000003 [ 6.508460] R13: 00007fff9386e390 R14: 00007fff9386f898 R15: 00007fff9386f899 [ 6.509121] </TASK> [ 6.509331] Modules linked in: virtio_snd(E) virtio_pmem(E) virtio_net(E) virtio_input(E) virtio_media(OE) virtio_gpu(E) virt_wifi(E) vhci_hcd(E) v4l2loopback(OE) usbip_core(E) test_meminit(E) system_heap(E) snd_aloop(E) rtc_test(E) pulse8_cec(E) net_failover(E) nd_virtio(E) mt76x2u(E) mt76x2_common(E) mt76x0u(E) mt76x02_usb(E) mt76x0_common(E) mt76x02_lib(E) mt76_usb(E) mt76(E) mac80211_hwsim(E) mac80211(E) libarc4 hci_vhci(E) gs_usb(E) can_dev goldfish_sync(OE) goldfish_pipe(OE) goldfish_battery(E) goldfish_address_space(OE) failover(E) dummy_hcd(E) dummy_cpufreq(E) cfg80211(E) btusb(E) btbcm btrtl(E) btintel(E) bluetooth zram rfkill zsmalloc vmw_vsock_virtio_transport(E) virtio_pci(E) virtio_pci_modern_dev(E) virtio_console(E) virtio_blk(E) virtio_rng(E) virtio_pci_legacy_dev(E) virtio_dma_buf(E) [ 6.515674] ---[ end trace 0000000000000000 ]--- [ 6.515799] init: Service 'exec 13 (/system/bin/recovery-persist)' (pid 405) exited with status 0 oneshot service took 0.028000 seconds in background [ 6.517623] init: Sending signal 9 to service 'exec 13 (/system/bin/recovery-persist)' (pid 405) process group... [ 6.518721] li Reverted changes: /q/submissionid:3316655 Change-Id: I9275693f478454b437359643d2f7240e411abbe0
This directory contains the core Android SELinux policy configuration. It defines the domains and types for the AOSP services and apps common to all devices. Device-specific policy should be placed under a separate device/<vendor>/<board>/sepolicy subdirectory and linked into the policy build as described below.
Additional, per device, policy files can be added into the policy build. These files should have each line including the final line terminated by a newline character (0x0A). This will allow files to be concatenated and processed whenever the m4(1) macro processor is called by the build process. Adding the newline will also make the intermediate text files easier to read when debugging build failures. The sets of file, service and property contexts files will automatically have a newline inserted between each file as these are common failure points.
These device policy files can be configured through the use of the BOARD_VENDOR_SEPOLICY_DIRS variable. This variable should be set in the BoardConfig.mk file in the device or vendor directories.
BOARD_VENDOR_SEPOLICY_DIRS contains a list of directories to search for additional policy files. Order matters in this list. For example, if you have 2 instances of widget.te files in the BOARD_VENDOR_SEPOLICY_DIRS search path, then the first one found (at the first search dir containing the file) will be concatenated first. Reviewing out/target/product/<device>/obj/ETC/vendor_sepolicy.conf_intermediates/vendor_sepolicy.conf will help sort out ordering issues.
Example BoardConfig.mk Usage: From the Tuna device BoardConfig.mk, device/samsung/tuna/BoardConfig.mk
BOARD_VENDOR_SEPOLICY_DIRS += device/samsung/tuna/sepolicy
Alongside vendor sepolicy dirs, OEMs can also amend the public and private policy of the product and system_ext partitions:
SYSTEM_EXT_PUBLIC_SEPOLICY_DIRS += device/acme/roadrunner-sepolicy/systemext/public SYSTEM_EXT_PRIVATE_SEPOLICY_DIRS += device/acme/roadrunner-sepolicy/systemext/private PRODUCT_PUBLIC_SEPOLICY_DIRS += device/acme/roadrunner-sepolicy/product/public PRODUCT_PRIVATE_SEPOLICY_DIRS += device/acme/roadrunner-sepolicy/product/private
The old BOARD_PLAT_PUBLIC_SEPOLICY_DIR and BOARD_PLAT_PRIVATE_SEPOLICY_DIR variables have been deprecated in favour of SYSTEM_EXT_*.
Additionally, OEMs can specify BOARD_SEPOLICY_M4DEFS to pass arbitrary m4 definitions during the build. A definition consists of a string in the form of macro-name=value. Spaces must NOT be present. This is useful for building modular policies, policy generation, conditional file paths, etc. It is supported in the following file types:
*.te and SELinux policy files as passed to checkpolicyfile_contextsservice_contextsproperty_contextskeys.confExample BoardConfig.mk Usage:
BOARD_SEPOLICY_M4DEFS += btmodule=foomatic \
btdevice=/dev/gps
The mac_permissions.xml file is used for controlling the mmac solutions as well as mapping a public base16 signing key with an arbitrary seinfo string. Details of the files contents can be found in a comment at the top of that file. The seinfo string, previously mentioned, is the same string that is referenced in seapp_contexts.
It is important to note the final processed version of this file is stripped of comments and whitespace. This is to preserve space on the system.img. If one wishes to view it in a more human friendly format, the tidy or xmllint command will assist you.
Is a helper script for mapping arbitrary tags in the signature stanzas of mac_permissions.xml to public keys found in pem files. This script takes a mac_permissions.xml file(s) and configuration file in order to operate. Details of the configuration file (keys.conf) can be found in the subsection keys.conf. This tool is also responsible for stripping the comments and whitespace during processing.
The keys.conf file is used for controlling the mapping of "tags" found in the mac_permissions.xml signature stanzas with actual public keys found in pem files. The configuration file is processed via m4.
The script allows for mapping any string contained in TARGET_BUILD_VARIANT with specific path to a pem file. Typically TARGET_BUILD_VARIANT is either user, eng or userdebug. Additionally, one can specify "ALL" to map a path to any string specified in TARGET_BUILD_VARIANT. All tags are matched verbatim and all options are matched lowercase. The options are tolowered automatically for the user, it is convention to specify tags and options in all uppercase and tags start with @. The option arguments can also use environment variables via the familiar $VARIABLE syntax. This is often useful for setting a location to ones release keys.
Often times, one will need to integrate an application that was signed by a separate organization and may need to extract the pem file for the insertkeys/keys.conf tools. Extraction of the public key in the pem format is possible via openssl. First you need to unzip the apk, once it is unzipped, cd into the META_INF directory and then execute
openssl pkcs7 -inform DER -in CERT.RSA -out CERT.pem -outform PEM -print_certs
On some occasions CERT.RSA has a different name, and you will need to adjust for that. After extracting the pem, you can rename it, and configure keys.conf and mac_permissions.xml to pick up the change. You MUST open the generated pem file in a text editor and strip out anything outside the opening and closing scissor lines. Failure to do so WILL cause a compile time issue thrown by insertkeys.py
NOTE: The pem files are base64 encoded and PackageManagerService, mac_permissions.xml and setool all use base16 encodings.