From: Stephen Smalley <sds@tycho.nsa.gov>
To: Bryan Hinton <bryan@bryanhinton.com>
Cc: selinux@tycho.nsa.gov
Subject: Re: [PATCH] (SCH-i515 US LTE) Added device specific policy and file context files.[PUBLIC DOMAIN]
Date: Thu, 08 Mar 2012 10:53:11 -0500 [thread overview]
Message-ID: <1331221991.13585.106.camel@moss-pluto> (raw)
In-Reply-To: <1331221727.13585.104.camel@moss-pluto>
On Thu, 2012-03-08 at 10:48 -0500, Stephen Smalley wrote:
> On Tue, 2012-03-06 at 19:28 -0600, Bryan Hinton wrote:
> > Change-Id: Iaf0aa012e48dd3084aae6f57c25a022b210308ff
> > ---
> > sepolicy.fc | 13 +++++++++++++
> > sepolicy.te | 4 ++++
> > 2 files changed, 17 insertions(+), 0 deletions(-)
> > create mode 100644 sepolicy.fc
> > create mode 100644 sepolicy.te
> >
> > diff --git a/sepolicy.fc b/sepolicy.fc
> > new file mode 100644
> > index 0000000..b2f612b
> > --- /dev/null
> > +++ b/sepolicy.fc
> > @@ -0,0 +1,13 @@
> > +/dev/cdma_.* u:object_r:radio_device:s0
> > +/dev/lte_.* u:object_r:radio_device:s0
> > +
> > +/dev/ttyO3 u:object_r:nfc_device:s0
> > +
> > +/data/data/com.android.providers.telephony/databases(/.*)? u:object_r:radio_data_file:s0
> > +/data/data/com.android.providers.telephony/optable.db u:object_r:radio_data_file:s0
> > +
> > +/data/radio/nv_data.bin.* u:object_r:radio_data_file:s0
> > +/factory(/.*)? u:object_r:efs_file:s0
> > +/factory/nv_data.bin.* u:object_r:radio_data_file:s0
> > +
> > +/sys/devices/platform/nfc-power/nfc_power -- u:object_r:sysfs_nfc_power_writable:s0
>
> I was thinking some of these could go into the base file_contexts and
> only the ones that are truly unique to this device would go here. In
> particular, /data/data/com.android.providers.telephony seems to be a
> standard part of Android. Not sure about the rest. If the device or
> file name is relatively standard and would apply to more than one
> device, then we can add it to file_contexts. If it is truly unique to
> that one device or might refer to something completely different on a
> different device (as with tty03), then it should stay in the per-device
> file.
Actually, the /data/data/com.android.providers.telephony directory is
already labeled radio_data_file because it has the radio UID and
seapp_contexts specifies radio_data_file for user=radio. So I don't
believe you need those entries at all.
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
next prev parent reply other threads:[~2012-03-08 15:53 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-03-07 1:28 [PATCH] (SCH-i515 US LTE) Added device specific policy and file context files.[PUBLIC DOMAIN] Bryan Hinton
2012-03-08 15:48 ` Stephen Smalley
2012-03-08 15:53 ` Stephen Smalley [this message]
2012-03-08 19:33 ` Bryan Hinton
2012-03-08 21:15 ` Bryan Hinton
2012-03-19 20:08 ` Stephen Smalley
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1331221991.13585.106.camel@moss-pluto \
--to=sds@tycho.nsa.gov \
--cc=bryan@bryanhinton.com \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.