* [PATCH] (SCH-i515 US LTE) Added device specific policy and file context files.[PUBLIC DOMAIN]
@ 2012-03-07 1:28 Bryan Hinton
2012-03-08 15:48 ` Stephen Smalley
2012-03-19 20:08 ` Stephen Smalley
0 siblings, 2 replies; 6+ messages in thread
From: Bryan Hinton @ 2012-03-07 1:28 UTC (permalink / raw)
To: sds, selinux; +Cc: Bryan Hinton
Change-Id: Iaf0aa012e48dd3084aae6f57c25a022b210308ff
---
sepolicy.fc | 13 +++++++++++++
sepolicy.te | 4 ++++
2 files changed, 17 insertions(+), 0 deletions(-)
create mode 100644 sepolicy.fc
create mode 100644 sepolicy.te
diff --git a/sepolicy.fc b/sepolicy.fc
new file mode 100644
index 0000000..b2f612b
--- /dev/null
+++ b/sepolicy.fc
@@ -0,0 +1,13 @@
+/dev/cdma_.* u:object_r:radio_device:s0
+/dev/lte_.* u:object_r:radio_device:s0
+
+/dev/ttyO3 u:object_r:nfc_device:s0
+
+/data/data/com.android.providers.telephony/databases(/.*)? u:object_r:radio_data_file:s0
+/data/data/com.android.providers.telephony/optable.db u:object_r:radio_data_file:s0
+
+/data/radio/nv_data.bin.* u:object_r:radio_data_file:s0
+/factory(/.*)? u:object_r:efs_file:s0
+/factory/nv_data.bin.* u:object_r:radio_data_file:s0
+
+/sys/devices/platform/nfc-power/nfc_power -- u:object_r:sysfs_nfc_power_writable:s0
diff --git a/sepolicy.te b/sepolicy.te
new file mode 100644
index 0000000..2964ae1
--- /dev/null
+++ b/sepolicy.te
@@ -0,0 +1,4 @@
+type sysfs_nfc_power_writable, fs_type, sysfs_type, mlstrustedobject;
+
+allow domain sysfs_nfc_power_writable:file rw_file_perms;
+allow rild self:netlink_route_socket { setopt };
--
1.7.5.4
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] (SCH-i515 US LTE) Added device specific policy and file context files.[PUBLIC DOMAIN]
2012-03-07 1:28 [PATCH] (SCH-i515 US LTE) Added device specific policy and file context files.[PUBLIC DOMAIN] Bryan Hinton
@ 2012-03-08 15:48 ` Stephen Smalley
2012-03-08 15:53 ` Stephen Smalley
2012-03-08 21:15 ` Bryan Hinton
2012-03-19 20:08 ` Stephen Smalley
1 sibling, 2 replies; 6+ messages in thread
From: Stephen Smalley @ 2012-03-08 15:48 UTC (permalink / raw)
To: Bryan Hinton; +Cc: selinux
On Tue, 2012-03-06 at 19:28 -0600, Bryan Hinton wrote:
> Change-Id: Iaf0aa012e48dd3084aae6f57c25a022b210308ff
> ---
> sepolicy.fc | 13 +++++++++++++
> sepolicy.te | 4 ++++
> 2 files changed, 17 insertions(+), 0 deletions(-)
> create mode 100644 sepolicy.fc
> create mode 100644 sepolicy.te
>
> diff --git a/sepolicy.fc b/sepolicy.fc
> new file mode 100644
> index 0000000..b2f612b
> --- /dev/null
> +++ b/sepolicy.fc
> @@ -0,0 +1,13 @@
> +/dev/cdma_.* u:object_r:radio_device:s0
> +/dev/lte_.* u:object_r:radio_device:s0
> +
> +/dev/ttyO3 u:object_r:nfc_device:s0
> +
> +/data/data/com.android.providers.telephony/databases(/.*)? u:object_r:radio_data_file:s0
> +/data/data/com.android.providers.telephony/optable.db u:object_r:radio_data_file:s0
> +
> +/data/radio/nv_data.bin.* u:object_r:radio_data_file:s0
> +/factory(/.*)? u:object_r:efs_file:s0
> +/factory/nv_data.bin.* u:object_r:radio_data_file:s0
> +
> +/sys/devices/platform/nfc-power/nfc_power -- u:object_r:sysfs_nfc_power_writable:s0
I was thinking some of these could go into the base file_contexts and
only the ones that are truly unique to this device would go here. In
particular, /data/data/com.android.providers.telephony seems to be a
standard part of Android. Not sure about the rest. If the device or
file name is relatively standard and would apply to more than one
device, then we can add it to file_contexts. If it is truly unique to
that one device or might refer to something completely different on a
different device (as with tty03), then it should stay in the per-device
file.
> diff --git a/sepolicy.te b/sepolicy.te
> new file mode 100644
> index 0000000..2964ae1
> --- /dev/null
> +++ b/sepolicy.te
> @@ -0,0 +1,4 @@
> +type sysfs_nfc_power_writable, fs_type, sysfs_type, mlstrustedobject;
> +
> +allow domain sysfs_nfc_power_writable:file rw_file_perms;
> +allow rild self:netlink_route_socket { setopt };
I think at least the last rule can go in the base policy rather than be
device-specific. I'm still not sure whether/why nfc_power needs to be
world writable; that worries me a little. init.tuna.rc sets the mode to
0600, so it isn't world readable/writable as far as DAC is concerned
(unless something changes it later - what does ls -l show on the
device?). Is it perhaps opened by the zygote and inherited by all
descendants? Or might it be an unintentional descriptor leak? What
happens if you just dontaudit it rather than allow it? Does it truly
appear for all domains or a particular set (e.g. all app domains, all
daemon domains, ...)?
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] (SCH-i515 US LTE) Added device specific policy and file context files.[PUBLIC DOMAIN]
2012-03-08 15:48 ` Stephen Smalley
@ 2012-03-08 15:53 ` Stephen Smalley
2012-03-08 19:33 ` Bryan Hinton
2012-03-08 21:15 ` Bryan Hinton
1 sibling, 1 reply; 6+ messages in thread
From: Stephen Smalley @ 2012-03-08 15:53 UTC (permalink / raw)
To: Bryan Hinton; +Cc: selinux
On Thu, 2012-03-08 at 10:48 -0500, Stephen Smalley wrote:
> On Tue, 2012-03-06 at 19:28 -0600, Bryan Hinton wrote:
> > Change-Id: Iaf0aa012e48dd3084aae6f57c25a022b210308ff
> > ---
> > sepolicy.fc | 13 +++++++++++++
> > sepolicy.te | 4 ++++
> > 2 files changed, 17 insertions(+), 0 deletions(-)
> > create mode 100644 sepolicy.fc
> > create mode 100644 sepolicy.te
> >
> > diff --git a/sepolicy.fc b/sepolicy.fc
> > new file mode 100644
> > index 0000000..b2f612b
> > --- /dev/null
> > +++ b/sepolicy.fc
> > @@ -0,0 +1,13 @@
> > +/dev/cdma_.* u:object_r:radio_device:s0
> > +/dev/lte_.* u:object_r:radio_device:s0
> > +
> > +/dev/ttyO3 u:object_r:nfc_device:s0
> > +
> > +/data/data/com.android.providers.telephony/databases(/.*)? u:object_r:radio_data_file:s0
> > +/data/data/com.android.providers.telephony/optable.db u:object_r:radio_data_file:s0
> > +
> > +/data/radio/nv_data.bin.* u:object_r:radio_data_file:s0
> > +/factory(/.*)? u:object_r:efs_file:s0
> > +/factory/nv_data.bin.* u:object_r:radio_data_file:s0
> > +
> > +/sys/devices/platform/nfc-power/nfc_power -- u:object_r:sysfs_nfc_power_writable:s0
>
> I was thinking some of these could go into the base file_contexts and
> only the ones that are truly unique to this device would go here. In
> particular, /data/data/com.android.providers.telephony seems to be a
> standard part of Android. Not sure about the rest. If the device or
> file name is relatively standard and would apply to more than one
> device, then we can add it to file_contexts. If it is truly unique to
> that one device or might refer to something completely different on a
> different device (as with tty03), then it should stay in the per-device
> file.
Actually, the /data/data/com.android.providers.telephony directory is
already labeled radio_data_file because it has the radio UID and
seapp_contexts specifies radio_data_file for user=radio. So I don't
believe you need those entries at all.
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] (SCH-i515 US LTE) Added device specific policy and file context files.[PUBLIC DOMAIN]
2012-03-08 15:53 ` Stephen Smalley
@ 2012-03-08 19:33 ` Bryan Hinton
0 siblings, 0 replies; 6+ messages in thread
From: Bryan Hinton @ 2012-03-08 19:33 UTC (permalink / raw)
To: Stephen Smalley; +Cc: selinux
Comments below.
On Thu, Mar 8, 2012 at 9:53 AM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> On Thu, 2012-03-08 at 10:48 -0500, Stephen Smalley wrote:
>> On Tue, 2012-03-06 at 19:28 -0600, Bryan Hinton wrote:
>> > Change-Id: Iaf0aa012e48dd3084aae6f57c25a022b210308ff
>> > ---
>> > sepolicy.fc | 13 +++++++++++++
>> > sepolicy.te | 4 ++++
>> > 2 files changed, 17 insertions(+), 0 deletions(-)
>> > create mode 100644 sepolicy.fc
>> > create mode 100644 sepolicy.te
>> >
>> > diff --git a/sepolicy.fc b/sepolicy.fc
>> > new file mode 100644
>> > index 0000000..b2f612b
>> > --- /dev/null
>> > +++ b/sepolicy.fc
>> > @@ -0,0 +1,13 @@
>> > +/dev/cdma_.* u:object_r:radio_device:s0
>> > +/dev/lte_.* u:object_r:radio_device:s0
>> > +
>> > +/dev/ttyO3 u:object_r:nfc_device:s0
>> > +
>> > +/data/data/com.android.providers.telephony/databases(/.*)? u:object_r:radio_data_file:s0
>> > +/data/data/com.android.providers.telephony/optable.db u:object_r:radio_data_file:s0
>> > +
>> > +/data/radio/nv_data.bin.* u:object_r:radio_data_file:s0
>> > +/factory(/.*)? u:object_r:efs_file:s0
>> > +/factory/nv_data.bin.* u:object_r:radio_data_file:s0
>> > +
>> > +/sys/devices/platform/nfc-power/nfc_power -- u:object_r:sysfs_nfc_power_writable:s0
>>
>> I was thinking some of these could go into the base file_contexts and
>> only the ones that are truly unique to this device would go here. In
>> particular, /data/data/com.android.providers.telephony seems to be a
>> standard part of Android. Not sure about the rest. If the device or
>> file name is relatively standard and would apply to more than one
>> device, then we can add it to file_contexts. If it is truly unique to
>> that one device or might refer to something completely different on a
>> different device (as with tty03), then it should stay in the per-device
>> file.
>
> Actually, the /data/data/com.android.providers.telephony directory is
> already labeled radio_data_file because it has the radio UID and
> seapp_contexts specifies radio_data_file for user=radio. So I don't
> believe you need those entries at all.
The files within the com.android.providers.telephony subdirectory were
not getting labeled. However; I will rebuild and retest.
> --
> Stephen Smalley
> National Security Agency
>
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] (SCH-i515 US LTE) Added device specific policy and file context files.[PUBLIC DOMAIN]
2012-03-08 15:48 ` Stephen Smalley
2012-03-08 15:53 ` Stephen Smalley
@ 2012-03-08 21:15 ` Bryan Hinton
1 sibling, 0 replies; 6+ messages in thread
From: Bryan Hinton @ 2012-03-08 21:15 UTC (permalink / raw)
To: Stephen Smalley; +Cc: selinux
Please see comments at bottom.
On Thu, Mar 8, 2012 at 9:48 AM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> On Tue, 2012-03-06 at 19:28 -0600, Bryan Hinton wrote:
>> Change-Id: Iaf0aa012e48dd3084aae6f57c25a022b210308ff
>> ---
>> sepolicy.fc | 13 +++++++++++++
>> sepolicy.te | 4 ++++
>> 2 files changed, 17 insertions(+), 0 deletions(-)
>> create mode 100644 sepolicy.fc
>> create mode 100644 sepolicy.te
>>
>> diff --git a/sepolicy.fc b/sepolicy.fc
>> new file mode 100644
>> index 0000000..b2f612b
>> --- /dev/null
>> +++ b/sepolicy.fc
>> @@ -0,0 +1,13 @@
>> +/dev/cdma_.* u:object_r:radio_device:s0
>> +/dev/lte_.* u:object_r:radio_device:s0
>> +
>> +/dev/ttyO3 u:object_r:nfc_device:s0
>> +
>> +/data/data/com.android.providers.telephony/databases(/.*)? u:object_r:radio_data_file:s0
>> +/data/data/com.android.providers.telephony/optable.db u:object_r:radio_data_file:s0
>> +
>> +/data/radio/nv_data.bin.* u:object_r:radio_data_file:s0
>> +/factory(/.*)? u:object_r:efs_file:s0
>> +/factory/nv_data.bin.* u:object_r:radio_data_file:s0
>> +
>> +/sys/devices/platform/nfc-power/nfc_power -- u:object_r:sysfs_nfc_power_writable:s0
>
> I was thinking some of these could go into the base file_contexts and
> only the ones that are truly unique to this device would go here. In
> particular, /data/data/com.android.providers.telephony seems to be a
> standard part of Android. Not sure about the rest. If the device or
> file name is relatively standard and would apply to more than one
> device, then we can add it to file_contexts. If it is truly unique to
> that one device or might refer to something completely different on a
> different device (as with tty03), then it should stay in the per-device
> file.
>
>> diff --git a/sepolicy.te b/sepolicy.te
>> new file mode 100644
>> index 0000000..2964ae1
>> --- /dev/null
>> +++ b/sepolicy.te
>> @@ -0,0 +1,4 @@
>> +type sysfs_nfc_power_writable, fs_type, sysfs_type, mlstrustedobject;
>> +
>> +allow domain sysfs_nfc_power_writable:file rw_file_perms;
>> +allow rild self:netlink_route_socket { setopt };
>
> I think at least the last rule can go in the base policy rather than be
> device-specific. I'm still not sure whether/why nfc_power needs to be
> world writable; that worries me a little. init.tuna.rc sets the mode to
> 0600, so it isn't world readable/writable as far as DAC is concerned
> (unless something changes it later - what does ls -l show on the
> device?). Is it perhaps opened by the zygote and inherited by all
> descendants? Or might it be an unintentional descriptor leak? What
> happens if you just dontaudit it rather than allow it? Does it truly
> appear for all domains or a particular set (e.g. all app domains, all
> daemon domains, ...)?
I just looked into what is going on with this and I came to the same conclusion.
It appears that the internal chip is being sent a power reset command
over the uart via the object attribute - nfc_power - in sys/ when nfc
is turned on (i.e. device wakeup). It seems that access to this path
in sys should be tightly confined. And yes, the open descriptor is a
problem which I think can be fixed by limiting access to the path in
sys by setting the label on the file so that only the Nfc system app
can read/write it.
Also, when NFC is off, SELinux is in Enforcing mode, and the device
goes to sleep, then upon device wakeup when you enable NFC via
Settings -> NFC On, the attempt to enable NFC will fail. As far as I
can tell, this is a non-deterministic bug as I have not been able to
reproduce it every time.
>
> --
> Stephen Smalley
> National Security Agency
>
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] (SCH-i515 US LTE) Added device specific policy and file context files.[PUBLIC DOMAIN]
2012-03-07 1:28 [PATCH] (SCH-i515 US LTE) Added device specific policy and file context files.[PUBLIC DOMAIN] Bryan Hinton
2012-03-08 15:48 ` Stephen Smalley
@ 2012-03-19 20:08 ` Stephen Smalley
1 sibling, 0 replies; 6+ messages in thread
From: Stephen Smalley @ 2012-03-19 20:08 UTC (permalink / raw)
To: Bryan Hinton; +Cc: selinux
On Tue, 2012-03-06 at 19:28 -0600, Bryan Hinton wrote:
> Change-Id: Iaf0aa012e48dd3084aae6f57c25a022b210308ff
> ---
> sepolicy.fc | 13 +++++++++++++
> sepolicy.te | 4 ++++
> 2 files changed, 17 insertions(+), 0 deletions(-)
> create mode 100644 sepolicy.fc
> create mode 100644 sepolicy.te
Merged, with some rules integrated into the base policy and some rules
removed based on our discussion. Thanks.
--
Stephen Smalley
National Security Agency
--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2012-03-19 20:08 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-03-07 1:28 [PATCH] (SCH-i515 US LTE) Added device specific policy and file context files.[PUBLIC DOMAIN] Bryan Hinton
2012-03-08 15:48 ` Stephen Smalley
2012-03-08 15:53 ` Stephen Smalley
2012-03-08 19:33 ` Bryan Hinton
2012-03-08 21:15 ` Bryan Hinton
2012-03-19 20:08 ` Stephen Smalley
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.