Skip to content

GitLab

Switch branch/tag
  1. 08 Oct, 2013 1 commit
  3. 18 Sep, 2013 1 commit
  5. 17 Sep, 2013 1 commit
    • Geremy Condra's avatar
      Fix long-tail denials in enforcing domains. · 3bb1ccc2
      Geremy Condra authored 
      The specific denials we see are:

denied  { getattr } for  pid=169 comm=""installd"" path=""/data/data/com.android.providers.downloads/cache/downloadfile.jpeg"" dev=""mmcblk0p23"" ino=602861 scontext=u:r:installd:s0 tcontext=u:object_r:download_file:s0 tclass=file
denied  { fsetid } for  pid=598 comm=""netd"" capability=4  scontext=u:r:netd:s0 tcontext=u:r:netd:s0 tclass=capability
denied  { read } for  pid=209 comm=""installd"" name=""cache"" dev=""mmcblk0p28"" ino=81694 scontext=u:r:installd:s0 tcontext=u:object_r:download_file:s0 tclass=dir

Bug: 10786017
Change-Id: Ia5d0b6337f3de6a168ac0d5a77df2a1ac419ec29
      3bb1ccc2
  7. 12 Sep, 2013 1 commit
  9. 11 Sep, 2013 5 commits
  11. 10 Sep, 2013 4 commits
  13. 09 Sep, 2013 2 commits
  15. 05 Sep, 2013 1 commit
  17. 04 Sep, 2013 1 commit
  19. 29 Aug, 2013 1 commit
  21. 28 Aug, 2013 1 commit
  23. 17 Aug, 2013 1 commit
  25. 16 Aug, 2013 1 commit
  27. 06 Aug, 2013 1 commit
  29. 05 Aug, 2013 1 commit
  31. 30 Jul, 2013 1 commit
  33. 26 Jul, 2013 1 commit
  35. 17 Jul, 2013 1 commit
  37. 16 Jul, 2013 6 commits
  39. 15 Jul, 2013 6 commits
  41. 14 Jul, 2013 1 commit
    • Nick Kralevich's avatar
      untrusted_app.te / isolated_app.te / app.te first pass · 6634a108
      Nick Kralevich authored 
      This is my first attempt at creating an enforcing SELinux domain for
apps, untrusted_apps, and isolated_apps. Much of these rules are based on the
contents of app.te as of commit 11153ef3
with extensive modifications, some of which are included below.

* Allow communication with netd/dnsproxyd, to allow netd to handle
  dns requests
* Allow binder communications with the DNS server
* Allow binder communications with surfaceflinger
* Allow an app to bind to tcp/udp ports
* Allow all domains to read files from the root partition, assuming
  the DAC allows access.

In addition, I added a bunch of "neverallow" rules, to assert that
certain capabilities are never added.

This change has a high probability of breaking someone, somewhere.
If it does, then I'm happy to fix the breakage, rollback this change,
or put untrusted_app into permissive mode.

Change-Id: I83f220135d20ab4f70fbd7be9401b5b1def1fe35
      6634a108
  43. 13 Jul, 2013 1 commit
    • Nick Kralevich's avatar
      remove "self:process ptrace" from domain, netd neverallow rules · 9a19885c
      Nick Kralevich authored 
      Remove "self:process ptrace" from all SELinux enforced domains.
In general, a process should never need to ptrace itself.
We can add this back to more narrowly scoped domains as needed.

Add a bunch of neverallow assertions to netd.te, to verify that netd
never gets unexpected capabilities.

Change-Id: Ie862dc95bec84068536bb64705667e36210c5f4e
      9a19885c