Skip to content

GitLab

Switch branch/tag
  1. 10 Oct, 2013 1 commit
    • Geremy Condra's avatar
      DO NOT MERGE Fix denials seen during device upgrade. · 4fc702ec
      Geremy Condra authored 
      Fixes:
denied  { relabelto } for  pid=721 comm="PackageManager" name="vmdl-112554949.tmp" dev="mmcblk0p30" ino=712747 scontext=u:r:system:s0 tcontext=u:object_r:apk_private_tmp_file:s0 tclass=file
denied  { create } for  pid=240 comm="vold" name="smdl2tmp1.asec" scontext=u:r:vold:s0 tcontext=u:object_r:system_data_file:s0 tclass=file

Bug: 11149726
Change-Id: Iddc7592c757375a961f0d392c27622073c141b36
      4fc702ec
  3. 08 Oct, 2013 1 commit
  5. 18 Sep, 2013 1 commit
  7. 17 Sep, 2013 1 commit
    • Geremy Condra's avatar
      Fix long-tail denials in enforcing domains. · 3bb1ccc2
      Geremy Condra authored 
      The specific denials we see are:

denied  { getattr } for  pid=169 comm=""installd"" path=""/data/data/com.android.providers.downloads/cache/downloadfile.jpeg"" dev=""mmcblk0p23"" ino=602861 scontext=u:r:installd:s0 tcontext=u:object_r:download_file:s0 tclass=file
denied  { fsetid } for  pid=598 comm=""netd"" capability=4  scontext=u:r:netd:s0 tcontext=u:r:netd:s0 tclass=capability
denied  { read } for  pid=209 comm=""installd"" name=""cache"" dev=""mmcblk0p28"" ino=81694 scontext=u:r:installd:s0 tcontext=u:object_r:download_file:s0 tclass=dir

Bug: 10786017
Change-Id: Ia5d0b6337f3de6a168ac0d5a77df2a1ac419ec29
      3bb1ccc2
  9. 12 Sep, 2013 1 commit
  11. 11 Sep, 2013 5 commits
  13. 10 Sep, 2013 4 commits
  15. 09 Sep, 2013 2 commits
  17. 05 Sep, 2013 1 commit
  19. 04 Sep, 2013 1 commit
  21. 29 Aug, 2013 1 commit
  23. 28 Aug, 2013 1 commit
  25. 17 Aug, 2013 1 commit
  27. 16 Aug, 2013 1 commit
  29. 06 Aug, 2013 1 commit
  31. 05 Aug, 2013 1 commit
  33. 30 Jul, 2013 1 commit
  35. 26 Jul, 2013 1 commit
  37. 17 Jul, 2013 1 commit
  39. 16 Jul, 2013 6 commits
  41. 15 Jul, 2013 6 commits
  43. 14 Jul, 2013 1 commit
    • Nick Kralevich's avatar
      untrusted_app.te / isolated_app.te / app.te first pass · 6634a108
      Nick Kralevich authored 
      This is my first attempt at creating an enforcing SELinux domain for
apps, untrusted_apps, and isolated_apps. Much of these rules are based on the
contents of app.te as of commit 11153ef3
with extensive modifications, some of which are included below.

* Allow communication with netd/dnsproxyd, to allow netd to handle
  dns requests
* Allow binder communications with the DNS server
* Allow binder communications with surfaceflinger
* Allow an app to bind to tcp/udp ports
* Allow all domains to read files from the root partition, assuming
  the DAC allows access.

In addition, I added a bunch of "neverallow" rules, to assert that
certain capabilities are never added.

This change has a high probability of breaking someone, somewhere.
If it does, then I'm happy to fix the breakage, rollback this change,
or put untrusted_app into permissive mode.

Change-Id: I83f220135d20ab4f70fbd7be9401b5b1def1fe35
      6634a108