ADHOC/replicant-vendor_replicant
3
0
Fork 0
Code Issues 6 Pull Requests Releases Activity

selinux: Workaround for devices with PR_SET_NO_NEW_PRIVS enforcement

Browse Source 
PR_SET_NO_NEW_PRIVS blocks domain transitions from within app_process,
unless the new domain is bounded by the app's context. So we can't
switch to a domain that has perms not available to untrusted_app :(

This means any app can talk to the daemon, bypassing the su executable
client. That's not a good thing, and needs to be resolved.

Change-Id: I85b74f90b8737caaa193a0555b5262e7392519b2
This commit is contained in:
Ricardo Cerqueira 2014-12-10 20:28:57 +00:00
parent 7cd698341f
commit 4df29e013d
1 changed files with 10 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
sepolicy/su.te
View File

@ -44,16 +44,19 @@ userdebug_or_eng(`
## Perms for the app ## Perms for the app
userdebug_or_eng(` userdebug_or_eng(`
typealias shell alias suclient;
# Translate user apps to the shell domain when using su # Translate user apps to the shell domain when using su
domain_auto_trans(untrusted_app, su_exec, suclient) #
# PR_SET_NO_NEW_PRIVS blocks this :(
# we need to find a way to narrow this down to the actual exec.
# typealias shell alias suclient;
# domain_auto_trans(untrusted_app, su_exec, suclient)
allow untrusted_app su_exec:file { execute_no_trans getattr open read execute };
allow untrusted_app sudaemon:unix_stream_socket { connectto read write setopt ioctl };
allow untrusted_app superuser_device:dir { r_dir_perms };
allow untrusted_app superuser_device:sock_file { write };
allow suclient sudaemon:unix_stream_socket { connectto read write setopt ioctl };
allow suclient superuser_device:dir { create rw_dir_perms setattr unlink };
allow suclient superuser_device:sock_file { create setattr unlink write };
allow suclient untrusted_app_devpts:chr_file { read write ioctl };
# For Settings control of access # For Settings control of access
allow system_app superuser_device:sock_file { read write create setattr unlink getattr }; allow system_app superuser_device:sock_file { read write create setattr unlink getattr };
allow system_app sudaemon:unix_stream_socket { connectto read write setopt ioctl }; allow system_app sudaemon:unix_stream_socket { connectto read write setopt ioctl };