2014-11-26 21:34:15 +00:00
|
|
|
type superuser_device, file_type;
|
|
|
|
|
|
|
|
|
|
## Perms for the daemon
|
|
|
|
|
|
|
|
|
|
type sudaemon, domain;
|
|
|
|
|
|
|
|
|
|
userdebug_or_eng(`
|
|
|
|
|
domain_trans(init, su_exec, sudaemon)
|
|
|
|
|
# The userspace app uses /dev sockets to control per-app access
|
|
|
|
|
allow sudaemon superuser_device:dir { create rw_dir_perms setattr unlink };
|
|
|
|
|
allow sudaemon superuser_device:sock_file { create setattr unlink write };
|
|
|
|
|
|
|
|
|
|
# sudaemon is also permissive to permit setenforce.
|
|
|
|
|
permissive sudaemon;
|
|
|
|
|
|
|
|
|
|
# Add sudaemon to various domains
|
|
|
|
|
net_domain(sudaemon)
|
|
|
|
|
app_domain(sudaemon)
|
|
|
|
|
|
|
|
|
|
dontaudit sudaemon self:capability_class_set *;
|
|
|
|
|
dontaudit sudaemon kernel:security *;
|
|
|
|
|
dontaudit sudaemon kernel:system *;
|
|
|
|
|
dontaudit sudaemon self:memprotect *;
|
|
|
|
|
dontaudit sudaemon domain:process *;
|
|
|
|
|
dontaudit sudaemon domain:fd *;
|
|
|
|
|
dontaudit sudaemon domain:dir *;
|
|
|
|
|
dontaudit sudaemon domain:lnk_file *;
|
|
|
|
|
dontaudit sudaemon domain:{ fifo_file file } *;
|
|
|
|
|
dontaudit sudaemon domain:socket_class_set *;
|
|
|
|
|
dontaudit sudaemon domain:ipc_class_set *;
|
|
|
|
|
dontaudit sudaemon domain:key *;
|
|
|
|
|
dontaudit sudaemon fs_type:filesystem *;
|
|
|
|
|
dontaudit sudaemon {fs_type dev_type file_type}:dir_file_class_set *;
|
|
|
|
|
dontaudit sudaemon node_type:node *;
|
|
|
|
|
dontaudit sudaemon node_type:{ tcp_socket udp_socket rawip_socket } *;
|
|
|
|
|
dontaudit sudaemon netif_type:netif *;
|
|
|
|
|
dontaudit sudaemon port_type:socket_class_set *;
|
|
|
|
|
dontaudit sudaemon port_type:{ tcp_socket dccp_socket } *;
|
|
|
|
|
dontaudit sudaemon domain:peer *;
|
|
|
|
|
dontaudit sudaemon domain:binder *;
|
|
|
|
|
dontaudit sudaemon property_type:property_service *;
|
|
|
|
|
')
|
|
|
|
|
|
|
|
|
|
## Perms for the app
|
|
|
|
|
|
|
|
|
|
userdebug_or_eng(`
|
|
|
|
|
typealias shell alias suclient;
|
|
|
|
|
|
2014-12-06 04:37:45 +00:00
|
|
|
# Translate user and platform apps to the shell domain when using su
|
2014-11-26 21:34:15 +00:00
|
|
|
domain_auto_trans(untrusted_app, su_exec, suclient)
|
2014-12-06 04:37:45 +00:00
|
|
|
domain_auto_trans(platform_app, su_exec, suclient)
|
2014-11-26 21:34:15 +00:00
|
|
|
|
|
|
|
|
allow suclient sudaemon:unix_stream_socket { connectto read write setopt ioctl };
|
|
|
|
|
|
|
|
|
|
allow suclient superuser_device:dir { create rw_dir_perms setattr unlink };
|
|
|
|
|
allow suclient superuser_device:sock_file { create setattr unlink write };
|
|
|
|
|
allow suclient untrusted_app_devpts:chr_file { read write ioctl };
|
2014-11-27 15:30:01 +00:00
|
|
|
# For Settings control of access
|
2014-11-26 21:34:15 +00:00
|
|
|
allow system_app superuser_device:sock_file { read write create setattr unlink getattr };
|
|
|
|
|
allow system_app sudaemon:unix_stream_socket { connectto read write setopt ioctl };
|
|
|
|
|
allow system_app superuser_device:dir { create rw_dir_perms setattr unlink };
|
2014-12-06 04:37:45 +00:00
|
|
|
|
|
|
|
|
## From external/sepolicy/domain.te adjusted from sudaemon
|
|
|
|
|
# Same as adbd rules above, except allow su to do the same thing
|
|
|
|
|
allow domain sudaemon:unix_stream_socket connectto;
|
|
|
|
|
allow domain sudaemon:fd use;
|
|
|
|
|
allow domain sudaemon:unix_stream_socket { getattr getopt read write shutdown };
|
|
|
|
|
binder_call(domain, sudaemon)
|
|
|
|
|
# Running something like "pm dump com.android.bluetooth" requires
|
|
|
|
|
# fifo writes
|
|
|
|
|
allow domain sudaemon:fifo_file { write getattr };
|
|
|
|
|
# allow "gdbserver --attach" to work for su.
|
|
|
|
|
allow domain sudaemon:process sigchld;
|
2014-11-26 21:34:15 +00:00
|
|
|
')
|
