No description or website provided.
Makefile
Latest commit aa1cb7a Dec 12, 2016 Daniel Rosenberg committed with TheCrazyLex isolated_app.te: Give permissions for using sdcardfs
Sdcardfs does not use a userspace daemon, so the secontext
is currently the caller's when accessing files. This can be
removed if sdcardfs is modified to change the secontext before
calling into the lower filesystem.

Bug: 32735101
Test: Run any app that falls under isolated_app.
Test: See bug for example
Change-Id: I9433aa0f14ff0d5a518249079e07f57e55b09bcf
Signed-off-by: Alex Naidis <alex.naidis@linux.com>
Permalink
Failed to load latest commit information.
tools
Android.mk
CleanSpec.mk
MODULE_LICENSE_PUBLIC_DOMAIN
NOTICE Public domain notice Jun 19, 2012
README
access_vectors
adbd.te adbd: allow reading apk_data_file Jul 20, 2016
app.te sepolicy: move sdcardfs media_rw_data_file rules to app.te Jan 14, 2017
atrace.te
attributes
audioserver.te
autoplay_app.te
binderservicedomain.te allow binderservice domains to write to a fifo file Mar 7, 2016
blkid.te
blkid_untrusted.te
bluetooth.te
bluetoothdomain.te bluetoothdomain.te: drop allow bluetoothdomain self:socket create_soc… Dec 12, 2015
boot_control_hal.te Move boot_control HAL permissions to an attribute. Apr 22, 2016
bootanim.te
bootstat.te
cameraserver.te
clatd.te Create attribute for moving perms out of domain Nov 3, 2015
cppreopts.te
debuggerd.te
device.te Re-introduce camera_device type Apr 24, 2016
dex2oat.te
dhcp.te
dnsmasq.te
domain.te Allow getattr on rootfs:lnk_file for all domains Dec 22, 2016
domain_deprecated.te DO NOT MERGE. Remove isolated_app's ability to read sysfs. May 12, 2016
drmserver.te
dumpstate.te
file.te Merge \"Allow access to sysfs usb nodes.\" into nyc-dev Jun 13, 2016
file_contexts
file_contexts_asan
fingerprintd.te
fs_use fs_use: Enabled loading security xattrs for squashfs Jun 16, 2015
fsck.te
fsck_untrusted.te
gatekeeperd.te Renamed hardwareproperties to hardware_properties Mar 9, 2016
genfs_contexts sepolicy: add support for new tracefs May 13, 2016
global_macros
gpsd.te
hci_attach.te
healthd.te Keep pre-existing sysfs write permissions. Jun 14, 2016
hostapd.te Update netlink socket classes. Mar 3, 2016
idmap.te Create attribute for moving perms out of domain Nov 3, 2015
init.te sepolicy: init: Workaround for tracing_on labeling issue Jan 1, 2017
initial_sid_contexts
initial_sids
inputflinger.te Create attribute for moving perms out of domain Nov 3, 2015
install_recovery.te Creates a new permission for /cache/recovery Jan 4, 2016
installd.te
ioctl_defines
ioctl_macros
isolated_app.te isolated_app.te: Give permissions for using sdcardfs Jan 14, 2017
kernel.te Allow access to media_rw_data_file for now. Mar 31, 2016
keys.conf Make DEFAULT_SYSTEM_DEV_CERTIFICATE available in keys.conf Oct 28, 2013
keystore.te
lmkd.te
logd.te
mac_permissions.xml
mdnsd.te
mediacodec.te
mediadrmserver.te Fix SELinux denials for protected content playback Jul 13, 2016
mediaextractor.te buildtime/cts enforce no inet access for media domains Apr 22, 2016
mediaserver.te
mls sepolicy: Clean up mls constraints. Mar 13, 2015
mls_macros
mtp.te
net.te Further restrict socket ioctls available to apps Apr 15, 2016
netd.te Revert "netd.te: Remove allow netd toolbox_exec:file rx_file_perms;" Jan 3, 2017
neverallow_macros system_server: neverallow blk_file read/write Mar 11, 2015
nfc.te sepolicy: Fix android beam image transfer Dec 18, 2016
otapreopt_chroot.te Sepolicy: Ignore otapreopt_chroot setsched denial Oct 5, 2016
otapreopt_slot.te sepolicy: give otapreopt getattr Aug 13, 2016
perfprofd.te label /sys/kernel/debug/tracing and remove debugfs write Dec 14, 2015
platform_app.te
policy_capabilities SE Android policy. Jan 4, 2012
port_contexts Support for ocontexts per device. Jul 12, 2012
postinstall.te Allow executing update_engine_sideload from recovery. Aug 10, 2016
postinstall_dexopt.te
ppp.te ppp.te: Remove allow ppp toolbox_exec:file rx_file_perms; Jan 15, 2016
preopt2cachename.te Allow cppreopts to work with selinux Jun 30, 2016
priv_app.te Add ota_package_file label for OTA packages. Jun 6, 2016
profman.te
property.te
property_contexts logpersist: reserve persist.logd.logpersistd Jul 14, 2016
racoon.te racoon.te: Remove allow racoon toolbox_exec:file rx_file_perms; Jan 15, 2016
radio.te
recovery.te
recovery_persist.te Add recovery_persist & recovery_refresh Mar 24, 2016
recovery_refresh.te
rild.te
roles
runas.te
sdcardd.te sepolicy: allow sdcardd to remount sdcardfs Jan 14, 2017
seapp_contexts Add autoplay_app domain Nov 9, 2015
security_classes Update netlink socket classes. Mar 3, 2016
service.te
service_contexts New service name for IpConnectivity metrics Sep 9, 2016
servicemanager.te
sgdisk.te Replace "neverallow domain" by "neverallow *" Feb 5, 2016
shared_relro.te Create attribute for moving perms out of domain Nov 3, 2015
shell.te
slideshow.te
su.te su.te: drop domain_deprecated and app auditallow rules. Jan 7, 2016
surfaceflinger.te
system_app.te logpersist: reserve persist.logd.logpersistd Jul 14, 2016
system_server.te
te_macros
tee.te Update netlink socket classes. Mar 3, 2016
toolbox.te
tzdatacheck.te
ueventd.te Keep pre-existing sysfs write permissions. Jun 14, 2016
uncrypt.te
untrusted_app.te
update_engine.te Allow executing update_engine_sideload from recovery. Aug 10, 2016
update_engine_common.te
update_verifier.te Add sepolicy for update_verifier Jul 13, 2016
users SE Android policy. Jan 4, 2012
vdc.te
vold.te Keep pre-existing sysfs write permissions. Jun 14, 2016
watchdogd.te watchdog: remove domain_deprecated Jan 25, 2016
wpa.te Update netlink socket classes. Mar 3, 2016
zygote.te Allow the zygote to stat all files it opens. Sep 8, 2016

README

This directory contains the core Android SELinux policy configuration.
It defines the domains and types for the AOSP services and apps common to
all devices.  Device-specific policy should be placed under a
separate device/<vendor>/<board>/sepolicy subdirectory and linked
into the policy build as described below.

Policy Generation:

Additional, per device, policy files can be added into the
policy build. These files should have each line including the
final line terminated by a newline character (0x0A).  This
will allow files to be concatenated and processed whenever
the m4(1) macro processor is called by the build process.
Adding the newline will also make the intermediate text files
easier to read when debugging build failures.  The sets of file,
service and property contexts files will automatically have a
newline inserted between each file as these are common failure
points.

These device policy files can be configured through the use of
the BOARD_SEPOLICY_DIRS variable. This variable should be set
in the BoardConfig.mk file in the device or vendor directories.

BOARD_SEPOLICY_DIRS contains a list of directories to search
for additional policy files. Order matters in this list.
For example, if you have 2 instances of widget.te files in the
BOARD_SEPOLICY_DIRS search path, then the first one found (at the
first search dir containing the file) will be concatenated first.
Reviewing out/target/product/<device>/etc/sepolicy_intermediates/policy.conf
will help sort out ordering issues.

Example BoardConfig.mk Usage:
From the Tuna device BoardConfig.mk, device/samsung/tuna/BoardConfig.mk

BOARD_SEPOLICY_DIRS += device/samsung/tuna/sepolicy

Additionally, OEMs can specify BOARD_SEPOLICY_M4DEFS to pass arbitrary m4
definitions during the build. A definition consists of a string in the form
of macro-name=value. Spaces must NOT be present. This is useful for building modular
policies, policy generation, conditional file paths, etc. It is supported in
the following file types:
 * All *.te and SE Linux policy files as passed to checkpolicy
 * file_contexts
 * service_contexts
 * property_contexts
 * keys.conf

Example BoardConfig.mk Usage:
BOARD_SEPOLICY_M4DEFS += btmodule=foomatic \
                         btdevice=/dev/gps

SPECIFIC POLICY FILE INFORMATION

mac_permissions.xml:
  ABOUT:
    The mac_permissions.xml file is used for controlling the mmac solutions
    as well as mapping a public base16 signing key with an arbitrary seinfo
    string. Details of the files contents can be found in a comment at the
    top of that file. The seinfo string, previously mentioned, is the same string
    that is referenced in seapp_contexts.

    It is important to note the final processed version of this file
    is stripped of comments and whitespace. This is to preserve space on the
    system.img. If one wishes to view it in a more human friendly format,
    the "tidy" or "xmllint" command will assist you.

  TOOLING:
    insertkeys.py
      Is a helper script for mapping arbitrary tags in the signature stanzas of
      mac_permissions.xml to public keys found in pem files. This script takes
      a mac_permissions.xml file(s) and configuration file in order to operate.
      Details of the configuration file (keys.conf) can be found in the subsection
      keys.conf. This tool is also responsible for stripping the comments and
      whitespace during processing.

      keys.conf
        The keys.conf file is used for controlling the mapping of "tags" found in
        the mac_permissions.xml signature stanzas with actual public keys found in
        pem files. The configuration file is processed via m4.

        The script allows for mapping any string contained in TARGET_BUILD_VARIANT
        with specific path to a pem file. Typically TARGET_BUILD_VARIANT is either
        user, eng or userdebug. Additionally, one can specify "ALL" to map a path to
        any string specified in TARGET_BUILD_VARIANT. All tags are matched verbatim
        and all options are matched lowercase. The options are "tolowered" automatically
        for the user, it is convention to specify tags and options in all uppercase
        and tags start with @. The option arguments can also use environment variables
        via the familiar $VARIABLE syntax. This is often useful for setting a location
        to ones release keys.

        Often times, one will need to integrate an application that was signed by a separate
        organization and may need to extract the pem file for the insertkeys/keys.conf tools.
        Extraction of the public key in the pem format is possible via openssl. First you need
        to unzip the apk, once it is unzipped, cd into the META_INF directory and then execute
        openssl pkcs7 -inform DER -in CERT.RSA -out CERT.pem -outform PEM  -print_certs
        On some occasions CERT.RSA has a different name, and you will need to adjust for that.
        After extracting the pem, you can rename it, and configure keys.conf and
        mac_permissions.xml to pick up the change. You MUST open the generated pem file in a text
        editor and strip out anything outside the opening and closing scissor lines. Failure to do
        so WILL cause a compile time issue thrown by insertkeys.py

        NOTE: The pem files are base64 encoded and PackageManagerService, mac_permissions.xml
              and setool all use base16 encodings.