1. seandroid
  2. Untitled project
  3. external/sepolicy

Source

external/sepolicy /

Filename Size Date modified Message
tools
18.1 KB
suppress unnecessary makefile output
2.4 KB
Update Android.mk to support file_contexts.bin
0 B
Update MODULE_LICENSE
1.0 KB
Public domain notice
5.4 KB
Ensure newlines are added between context config files
6.4 KB
Add audit_read permission to capability2
3.3 KB
SELinux rule for ro.device_owner and persist.logd.security
15.4 KB
Allow bluetooth access to the tun device.
701 B
atrace.te: fix /sys/kernel/debug/tracing label
2.9 KB
checkfc: add attribute test
904 B
Enable permission checking by binderservicedomain.
708 B
Replace "neverallow domain" by "neverallow *"
1.1 KB
Replace "neverallow domain" by "neverallow *"
2.2 KB
Allow bluetooth access to the tun device.
167 B
bluetoothdomain.te: drop allow bluetoothdomain self:socket create_socket_perms;
774 B
domain: grant write perms to cgroups
359 B
bootstat: Fix the SELinux policy after removing domain_deprecated.
1.4 KB
Create attribute for moving perms out of domain
1.6 KB
debuggerd.te: allow debuggerd to drop root.
3.2 KB
camera_device: remove typealias
560 B
Create attribute for moving perms out of domain
1.2 KB
drop dhcp auditallow
936 B
Create attribute for moving perms out of domain
19.1 KB
uncrypt: drop generic block_device allow rules
2.8 KB
Label /proc/meminfo.
1.9 KB
Create attribute for moving perms out of domain
4.3 KB
Creates a new permission for /cache/recovery
9.0 KB
Label /proc/meminfo.
15.6 KB
bootstat: Fix the SELinux policy after removing domain_deprecated.
114 B
Add /data/vendor/lib as a library location under ASan.
758 B
Revert "fingerprintd.te: neverallow fingerprint data file access"
865 B
fs_use: Enabled loading security xattrs for squashfs
1.4 KB
Replace "neverallow domain" by "neverallow *"
1.1 KB
Replace "neverallow domain" by "neverallow *"
898 B
Create attribute for moving perms out of domain
2.2 KB
Label /proc/meminfo.
2.6 KB
Don't grant hard link capabilities by default.
899 B
gpsd: remove domain_deprecated
332 B
Create attribute for moving perms out of domain
1.5 KB
healthd: grant perms from domain_deprecated
1.2 KB
Create attribute for moving perms out of domain
394 B
Create attribute for moving perms out of domain
11.3 KB
init: allow to access console-ramoops with newer kernels
973 B
Restore devnull initial sid context.
416 B
SE Android policy.
441 B
Create attribute for moving perms out of domain
1.2 KB
Creates a new permission for /cache/recovery
4.4 KB
Remove handling of dalvik-cache/profiles
338 B
Revert "Migrate to upstream policy version 30"
1.9 KB
Allow bluetooth access to the tun device.
3.3 KB
Replace "neverallow domain" by "neverallow *"
851 B
Make DEFAULT_SYSTEM_DEV_CERTIFICATE available in keys.conf
1.1 KB
Replace "neverallow domain" by "neverallow *"
1.0 KB
Replace "neverallow domain" by "neverallow *"
1.8 KB
Allow logd.auditd to reboot to safe mode
1.9 KB
Drop the default stanza from mac_permissions.xml
188 B
mdnsd: Remove domain_deprecated
4.2 KB
Add SELinux label for app fuse.
mls
4.4 KB
sepolicy: Clean up mls constraints.
1.3 KB
SE Android policy.
307 B
Create attribute for moving perms out of domain
852 B
Introduce fwmarkd: a service to set the fwmark of sockets.
2.9 KB
Allow netd to use NETLINK_SOCK_DIAG.
369 B
system_server: neverallow blk_file read/write
984 B
Create attribute for moving perms out of domain
2.1 KB
label /sys/kernel/debug/tracing and remove debugfs write
2.0 KB
Creates a new permission for /cache/recovery
122 B
SE Android policy.
77 B
Support for ocontexts per device.
512 B
ppp.te: Remove allow ppp toolbox_exec:file rx_file_perms;
4.6 KB
Add recovery service.
1.8 KB
Allow logd.auditd to reboot to safe mode
3.9 KB
Allow logd.auditd to reboot to safe mode
893 B
racoon.te: Remove allow racoon toolbox_exec:file rx_file_perms;
1.1 KB
Create attribute for moving perms out of domain
4.7 KB
Enable recovery to read batteryinfo.
1.6 KB
rild: Remove toolbox_exec perms
29 B
Add explicit role declaration for newer checkpolicy versions.
1.2 KB
Create attribute for moving perms out of domain
1.4 KB
Allow sdcardd tmpfs read access.
4.1 KB
Add priv_app domain to global seapp_context
1.7 KB
Remove zygote security class declaration.
8.5 KB
Allow access to the daydream ("dreams") service.
9.9 KB
Add recovery service.
680 B
Create attribute for moving perms out of domain
759 B
Replace "neverallow domain" by "neverallow *"
588 B
Create attribute for moving perms out of domain
4.3 KB
app: connect to adbd
568 B
Create attribute for moving perms out of domain
2.0 KB
su.te: drop domain_deprecated and app auditallow rules.
2.3 KB
Delete policy it is alread included in binder_call macros.
1.9 KB
Allow system apps (Settings) to configure Bluetooth properties
18.8 KB
Allow logd.auditd to reboot to safe mode
11.0 KB
remove access_kmsg macro, because it to be more explicit.
453 B
Create attribute for moving perms out of domain
1.0 KB
Replace "neverallow domain" by "neverallow *"
272 B
Create attribute for moving perms out of domain
1.9 KB
Create sysfs_zram label.
1.0 KB
uncrypt: drop generic block_device allow rules
7.1 KB
Allow bluetooth access to the tun device.
1.5 KB
update_engine: Allow to access bootctrl_block_device.
314 B
Allow update_verifier to access bootctrl_block_device.
55 B
SE Android policy.
641 B
Create attribute for moving perms out of domain
7.2 KB
Add SELinux label for app fuse.
185 B
watchdog: remove domain_deprecated
1.3 KB
Create attribute for moving perms out of domain
3.8 KB
zygote: grant perms from domain_deprecated
This directory contains the core Android SELinux policy configuration.
It defines the domains and types for the AOSP services and apps common to
all devices.  Device-specific policy should be placed under a
separate device/<vendor>/<board>/sepolicy subdirectory and linked
into the policy build as described below.

Policy Generation:

Additional, per device, policy files can be added into the
policy build. These files should have each line including the
final line terminated by a newline character (0x0A).  This
will allow files to be concatenated and processed whenever
the m4(1) macro processor is called by the build process.
Adding the newline will also make the intermediate text files
easier to read when debugging build failures.  The sets of file,
service and property contexts files will automatically have a
newline inserted between each file as these are common failure
points.

These device policy files can be configured through the use of
the BOARD_SEPOLICY_DIRS variable. This variable should be set
in the BoardConfig.mk file in the device or vendor directories.

BOARD_SEPOLICY_DIRS contains a list of directories to search
for additional policy files. Order matters in this list.
For example, if you have 2 instances of widget.te files in the
BOARD_SEPOLICY_DIRS search path, then the first one found (at the
first search dir containing the file) will be concatenated first.
Reviewing out/target/product/<device>/etc/sepolicy_intermediates/policy.conf
will help sort out ordering issues.

Example BoardConfig.mk Usage:
From the Tuna device BoardConfig.mk, device/samsung/tuna/BoardConfig.mk

BOARD_SEPOLICY_DIRS += device/samsung/tuna/sepolicy

Additionally, OEMs can specify BOARD_SEPOLICY_M4DEFS to pass arbitrary m4
definitions during the build. A definition consists of a string in the form
of macro-name=value. Spaces must NOT be present. This is useful for building modular
policies, policy generation, conditional file paths, etc. It is supported in
the following file types:
 * All *.te and SE Linux policy files as passed to checkpolicy
 * file_contexts
 * service_contexts
 * property_contexts
 * keys.conf

Example BoardConfig.mk Usage:
BOARD_SEPOLICY_M4DEFS += btmodule=foomatic \
                         btdevice=/dev/gps

SPECIFIC POLICY FILE INFORMATION

mac_permissions.xml:
  ABOUT:
    The mac_permissions.xml file is used for controlling the mmac solutions
    as well as mapping a public base16 signing key with an arbitrary seinfo
    string. Details of the files contents can be found in a comment at the
    top of that file. The seinfo string, previously mentioned, is the same string
    that is referenced in seapp_contexts.

    It is important to note the final processed version of this file
    is stripped of comments and whitespace. This is to preserve space on the
    system.img. If one wishes to view it in a more human friendly format,
    the "tidy" or "xmllint" command will assist you.

  TOOLING:
    insertkeys.py
      Is a helper script for mapping arbitrary tags in the signature stanzas of
      mac_permissions.xml to public keys found in pem files. This script takes
      a mac_permissions.xml file(s) and configuration file in order to operate.
      Details of the configuration file (keys.conf) can be found in the subsection
      keys.conf. This tool is also responsible for stripping the comments and
      whitespace during processing.

      keys.conf
        The keys.conf file is used for controlling the mapping of "tags" found in
        the mac_permissions.xml signature stanzas with actual public keys found in
        pem files. The configuration file is processed via m4.

        The script allows for mapping any string contained in TARGET_BUILD_VARIANT
        with specific path to a pem file. Typically TARGET_BUILD_VARIANT is either
        user, eng or userdebug. Additionally, one can specify "ALL" to map a path to
        any string specified in TARGET_BUILD_VARIANT. All tags are matched verbatim
        and all options are matched lowercase. The options are "tolowered" automatically
        for the user, it is convention to specify tags and options in all uppercase
        and tags start with @. The option arguments can also use environment variables
        via the familiar $VARIABLE syntax. This is often useful for setting a location
        to ones release keys.

        Often times, one will need to integrate an application that was signed by a separate
        organization and may need to extract the pem file for the insertkeys/keys.conf tools.
        Extraction of the public key in the pem format is possible via openssl. First you need
        to unzip the apk, once it is unzipped, cd into the META_INF directory and then execute
        openssl pkcs7 -inform DER -in CERT.RSA -out CERT.pem -outform PEM  -print_certs
        On some occasions CERT.RSA has a different name, and you will need to adjust for that.
        After extracting the pem, you can rename it, and configure keys.conf and
        mac_permissions.xml to pick up the change. You MUST open the generated pem file in a text
        editor and strip out anything outside the opening and closing scissor lines. Failure to do
        so WILL cause a compile time issue thrown by insertkeys.py

        NOTE: The pem files are base64 encoded and PackageManagerService, mac_permissions.xml
              and setool all use base16 encodings.