remove init/vendor_init access to bpffs_type
There should be no need for this and it fixes a long outstanding TODO.
Test: TreeHugger
Signed-off-by: Maciej Żenczykowski <maze@google.com>
Change-Id: Id1764cbc713addbbda6827fe6c6689e45e8f584c
diff --git a/private/bpfloader.te b/private/bpfloader.te
index 7c009ec..5f8cfa3 100644
--- a/private/bpfloader.te
+++ b/private/bpfloader.te
@@ -26,21 +26,20 @@
### Neverallow rules
###
-# TODO: get rid of init & vendor_init; Note: we don't care about getattr/mounton/search
-neverallow { domain -init -vendor_init } bpffs_type:dir { open read setattr };
+# Note: we don't care about getattr/mounton/search
+neverallow { domain } bpffs_type:dir { open read setattr };
neverallow { domain -bpfloader } bpffs_type:dir { add_name create remove_name write };
neverallow domain bpffs_type:dir ~{ add_name create getattr mounton open read remove_name search setattr write };
-# TODO: get rid of init & vendor_init
-neverallow { domain -bpfloader -init -vendor_init } bpffs_type:file { map open setattr };
+neverallow { domain -bpfloader } bpffs_type:file { map open setattr };
neverallow { domain -bpfloader } bpffs_type:file { create getattr rename };
-neverallow { domain -bpfloader -gpuservice -init -lmkd -mediaprovider_app -netd -netutils_wrapper -system_server -vendor_init } fs_bpf:file read;
-neverallow { domain -bpfloader -init -network_stack -vendor_init } fs_bpf_net_private:file read;
-neverallow { domain -bpfloader -init -network_stack -system_server -vendor_init } fs_bpf_net_shared:file read;
-neverallow { domain -bpfloader -init -netd -network_stack -system_server -vendor_init } fs_bpf_netd_readonly:file read;
-neverallow { domain -bpfloader -init -netd -netutils_wrapper -network_stack -system_server -vendor_init } fs_bpf_netd_shared:file read;
-neverallow { domain -bpfloader -init -network_stack -vendor_init } fs_bpf_tethering:file read;
-neverallow { domain -bpfloader -gpuservice -netd -netutils_wrapper -network_stack -system_server } { bpffs_type -fs_bpf_vendor }:file write;
+neverallow { domain -bpfloader -gpuservice -lmkd -mediaprovider_app -netd -netutils_wrapper -system_server } fs_bpf:file read;
+neverallow { domain -bpfloader -network_stack } fs_bpf_net_private:file read;
+neverallow { domain -bpfloader -network_stack -system_server } fs_bpf_net_shared:file read;
+neverallow { domain -bpfloader -netd -network_stack -system_server } fs_bpf_netd_readonly:file read;
+neverallow { domain -bpfloader -netd -netutils_wrapper -network_stack -system_server } fs_bpf_netd_shared:file read;
+neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:file read;
+neverallow { domain -bpfloader -gpuservice -netd -netutils_wrapper -network_stack -system_server } { bpffs_type -fs_bpf_vendor }:file write;
neverallow domain bpffs_type:file ~{ create getattr map open read rename setattr write };
neverallow { domain -bpfloader } bpffs_type:lnk_file ~read;
@@ -62,7 +61,7 @@
neverallow { domain -bpfloader -gpuservice -lmkd -mediaprovider_app -netd -network_stack -system_server } *:bpf { map_read map_write };
neverallow { domain -bpfloader -init } bpfloader_exec:file { execute execute_no_trans };
-neverallow { coredomain -bpfloader -init } fs_bpf_vendor:file *;
+neverallow { coredomain -bpfloader } fs_bpf_vendor:file *;
neverallow bpfloader *:{ tcp_socket udp_socket rawip_socket } *;
diff --git a/private/network_stack.te b/private/network_stack.te
index 3cdf884..dfee019 100644
--- a/private/network_stack.te
+++ b/private/network_stack.te
@@ -75,44 +75,27 @@
# This place is as good as any for these rules,
# and it is probably the most appropriate because
# network_stack itself is entirely mainline code.
-#
-# Unfortunately init/vendor_init have all sorts of extra privs
# T+: Only the bpfloader and the network_stack should ever touch 'fs_bpf_net_private' programs/maps.
-neverallow { domain -bpfloader -init -network_stack -vendor_init } fs_bpf_net_private:dir ~getattr;
-neverallow { domain -bpfloader -init -network_stack -vendor_init } fs_bpf_net_private:file *;
-
-neverallow { domain -bpfloader -network_stack } fs_bpf_net_private:dir ~{ getattr open read search setattr };
-neverallow { domain -bpfloader -network_stack } fs_bpf_net_private:file ~{ map open read setattr };
+neverallow { domain -bpfloader -network_stack } fs_bpf_net_private:dir ~getattr;
+neverallow { domain -bpfloader -network_stack } fs_bpf_net_private:file *;
# T+: Only the bpfloader, network_stack and system_server should ever touch 'fs_bpf_net_shared' programs/maps.
-neverallow { domain -bpfloader -init -network_stack -system_server -vendor_init } fs_bpf_net_shared:dir ~getattr;
-neverallow { domain -bpfloader -init -network_stack -system_server -vendor_init } fs_bpf_net_shared:file *;
-
-neverallow { domain -bpfloader -network_stack -system_server } fs_bpf_net_shared:dir ~{ getattr open read search setattr };
-neverallow { domain -bpfloader -network_stack -system_server } fs_bpf_net_shared:file ~{ map open read setattr };
+neverallow { domain -bpfloader -network_stack -system_server } fs_bpf_net_shared:dir ~getattr;
+neverallow { domain -bpfloader -network_stack -system_server } fs_bpf_net_shared:file *;
# T+: Only the bpfloader, netd, network_stack and system_server should ever touch 'fs_bpf_netd_readonly' programs/maps.
# netd's access should be readonly
-neverallow { domain -bpfloader -init -netd -network_stack -system_server -vendor_init } fs_bpf_netd_readonly:dir ~getattr;
-neverallow { domain -bpfloader -init -netd -network_stack -system_server -vendor_init } fs_bpf_netd_readonly:file *;
+neverallow { domain -bpfloader -netd -network_stack -system_server } fs_bpf_netd_readonly:dir ~getattr;
+neverallow { domain -bpfloader -netd -network_stack -system_server } fs_bpf_netd_readonly:file *;
neverallow netd fs_bpf_netd_readonly:file write;
-neverallow { domain -bpfloader -netd -network_stack -system_server } fs_bpf_netd_readonly:dir ~{ getattr open read search setattr };
-neverallow { domain -bpfloader -netd -network_stack -system_server } fs_bpf_netd_readonly:file ~{ map open read setattr };
-
# T+: Only the bpfloader, netd, netutils_wrapper, network_stack and system_server should ever touch 'fs_bpf_netd_shared' programs/maps.
# netutils_wrapper requires access to be able to run iptables and only needs readonly access
-neverallow { domain -bpfloader -init -netd -netutils_wrapper -network_stack -system_server -vendor_init } fs_bpf_netd_shared:dir ~getattr;
-neverallow { domain -bpfloader -init -netd -netutils_wrapper -network_stack -system_server -vendor_init } fs_bpf_netd_shared:file *;
+neverallow { domain -bpfloader -netd -netutils_wrapper -network_stack -system_server } fs_bpf_netd_shared:dir ~getattr;
+neverallow { domain -bpfloader -netd -netutils_wrapper -network_stack -system_server } fs_bpf_netd_shared:file *;
neverallow netutils_wrapper fs_bpf_netd_shared:file write;
-neverallow { domain -bpfloader -netd -netutils_wrapper -network_stack -system_server } fs_bpf_netd_shared:dir ~{ getattr open read search setattr };
-neverallow { domain -bpfloader -netd -netutils_wrapper -network_stack -system_server } fs_bpf_netd_shared:file ~{ map open read setattr };
-
# S+: Only the bpfloader and the network_stack should ever touch 'fs_bpf_tethering' programs/maps.
-neverallow { domain -bpfloader -init -network_stack -vendor_init } fs_bpf_tethering:dir ~getattr;
-neverallow { domain -bpfloader -init -network_stack -vendor_init } fs_bpf_tethering:file *;
-
-neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:dir ~{ getattr open read search setattr };
-neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:file ~{ map open read setattr };
+neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:dir ~getattr;
+neverallow { domain -bpfloader -network_stack } fs_bpf_tethering:file *;
diff --git a/public/init.te b/public/init.te
index d99172f..d74d1a8 100644
--- a/public/init.te
+++ b/public/init.te
@@ -199,6 +199,7 @@
allow init {
file_type
-app_data_file
+ -bpffs_type
-exec_type
-misc_logd_file
-nativetest_data_file
@@ -212,6 +213,7 @@
allow init {
file_type
-app_data_file
+ -bpffs_type
-credstore_data_file
-exec_type
-keystore_data_file
@@ -233,6 +235,7 @@
file_type
-apex_info_file
-app_data_file
+ -bpffs_type
-exec_type
-gsi_data_file
-credstore_data_file
@@ -259,6 +262,7 @@
allow init {
file_type
-app_data_file
+ -bpffs_type
-exec_type
-gsi_data_file
-credstore_data_file
@@ -278,6 +282,7 @@
file_type
-apex_mnt_dir
-app_data_file
+ -bpffs_type
-exec_type
-gsi_data_file
-credstore_data_file
@@ -297,6 +302,7 @@
allow init {
file_type
+ -bpffs_type
-system_dlkm_file_type
-system_file_type
-vendor_file_type
@@ -321,6 +327,7 @@
# chown/chmod on pseudo files.
allow init {
fs_type
+ -bpffs_type
-contextmount_type
-keychord_device
-proc_type
@@ -330,7 +337,14 @@
-rootfs
enforce_debugfs_restriction(`-debugfs_type')
}:file { open read setattr };
-allow init { fs_type -contextmount_type -sdcard_type -fusefs_type -rootfs }:dir { open read setattr search };
+allow init {
+ fs_type
+ -bpffs_type
+ -contextmount_type
+ -sdcard_type
+ -fusefs_type
+ -rootfs
+}:dir { open read setattr search };
allow init {
binder_device
diff --git a/public/vendor_init.te b/public/vendor_init.te
index 61fa686..683ab61 100644
--- a/public/vendor_init.te
+++ b/public/vendor_init.te
@@ -48,6 +48,7 @@
allow vendor_init {
file_type
+ -bpffs_type
-core_data_file_type
-exec_type
-system_dlkm_file_type
@@ -67,6 +68,7 @@
allow vendor_init {
file_type
+ -bpffs_type
-core_data_file_type
-exec_type
-password_slot_metadata_file
@@ -86,6 +88,7 @@
allow vendor_init {
file_type
+ -bpffs_type
-core_data_file_type
-exec_type
-password_slot_metadata_file
@@ -103,6 +106,7 @@
allow vendor_init {
file_type
-apex_mnt_dir
+ -bpffs_type
-core_data_file_type
-exec_type
-password_slot_metadata_file
@@ -119,6 +123,7 @@
allow vendor_init {
file_type
+ -bpffs_type
-core_data_file_type
-exec_type
-mnt_product_file
@@ -142,6 +147,7 @@
# chown/chmod on pseudo files.
allow vendor_init {
fs_type
+ -bpffs_type
-contextmount_type
-keychord_device
-sdcard_type
@@ -157,6 +163,7 @@
allow vendor_init {
fs_type
+ -bpffs_type
-contextmount_type
-sdcard_type
-fusefs_type
@@ -164,7 +171,7 @@
-proc_uid_time_in_state
-proc_uid_concurrent_active_time
-proc_uid_concurrent_policy_time
-}:dir { open read setattr search };
+}:dir { open read setattr search };
allow vendor_init dev_type:blk_file getattr;