From 9e3351da5aabff4ec3530566d1689200a9702ad8 Mon Sep 17 00:00:00 2001 From: Huaiming Li Date: Sat, 18 Jan 2020 10:21:42 +0800 Subject: [PATCH] [ALPS04758557] fix aee high risk rules 1. fix some high risk rules MTK-Commit-Id: b9c316d9b87f36e958f56273ffec3d6556639bdd Change-Id: I093cccaa98e2a157da359ef2ebf43134f86ddad2 CR-Id: ALPS04758557 Feature: Android Exception Engine(AEE) --- r_non_plat/aee_aed.te | 1 - r_non_plat/aee_aedv.te | 24 ++++++++---------------- r_non_plat/aee_core_forwarder.te | 4 ++-- r_non_plat/file.te | 3 +++ r_non_plat/genfs_contexts | 4 ++++ r_non_plat/vendor_shell.te | 5 +++++ 6 files changed, 22 insertions(+), 19 deletions(-) create mode 100644 r_non_plat/vendor_shell.te diff --git a/r_non_plat/aee_aed.te b/r_non_plat/aee_aed.te index 4e0a8a2..c845ce2 100644 --- a/r_non_plat/aee_aed.te +++ b/r_non_plat/aee_aed.te @@ -11,7 +11,6 @@ allow aee_aed aed_device:chr_file rw_file_perms; allow aee_aed expdb_device:chr_file rw_file_perms; allow aee_aed expdb_block_device:blk_file rw_file_perms; -allow aee_aed bootdevice_block_device:blk_file rw_file_perms; allow aee_aed etb_device:chr_file rw_file_perms; # open/dev/mtd/mtd12 failed(expdb) diff --git a/r_non_plat/aee_aedv.te b/r_non_plat/aee_aedv.te index 3b7197e..a54283f 100644 --- a/r_non_plat/aee_aedv.te +++ b/r_non_plat/aee_aedv.te @@ -5,6 +5,12 @@ # MTK Policy Rule # ============================================== +type aee_aedv, domain; + +type aee_aedv_exec, exec_type, file_type, vendor_file_type; +typeattribute aee_aedv mlstrustedsubject; + +init_daemon_domain(aee_aedv) # Date : WK14.32 # Operation : AEE UT @@ -18,17 +24,9 @@ allow aee_aedv etb_device:chr_file rw_file_perms; # AED start: /dev/block/expdb allow aee_aedv block_device:dir search; -# open/dev/mtd/mtd12 failed(expdb) -allow aee_aedv mtd_device:dir create_dir_perms; -allow aee_aedv mtd_device:chr_file rw_file_perms; - # NE flow: /dev/RT_Monitor allow aee_aedv RT_Monitor_device:chr_file r_file_perms; -# aee db dir and db files -allow aee_aedv sdcard_type:dir create_dir_perms; -allow aee_aedv sdcard_type:file create_file_perms; - #data/aee_exp allow aee_aedv aee_exp_vendor_file:dir create_dir_perms; allow aee_aedv aee_exp_vendor_file:file create_file_perms; @@ -51,13 +49,6 @@ allow aee_aedv domain:lnk_file getattr; #core-pattern allow aee_aedv usermodehelper:file r_file_perms; -#property -allow aee_aedv init:unix_stream_socket connectto; -allow aee_aedv property_socket:sock_file write; - -allow aee_aedv init:process getsched; -allow aee_aedv kernel:process getsched; - # Date: W15.34 # Operation: Migration # Purpose: For pagemap & pageflags information in NE DB @@ -283,7 +274,8 @@ allow aee_aedv debugfs_dynamic_debug:file r_file_perms; # [ 241.001976] <1>.(1)[209:logd.auditd]type=1400 audit(1262304586.172:515): avc: denied { read } # for pid=1978 comm="aee_aedv64" name="atag,devinfo" dev="sysfs" ino=2349 scontext=u:r:aee_aedv:s0 # tcontext=u:object_r:sysfs:s0 tclass=file permissive=0 -allow aee_aedv sysfs:file { r_file_perms write }; +allow aee_aedv sysfs:file r_file_perms; +allow aee_aedv sysfs_mrdump_lbaooo:file w_file_perms; # Purpose: Allow aee_aedv to use HwBinder IPC. hwbinder_use(aee_aedv) diff --git a/r_non_plat/aee_core_forwarder.te b/r_non_plat/aee_core_forwarder.te index 2a6d951..43e97fe 100644 --- a/r_non_plat/aee_core_forwarder.te +++ b/r_non_plat/aee_core_forwarder.te @@ -7,12 +7,12 @@ allow aee_core_forwarder aee_exp_data_file:dir { write add_name search }; allow aee_core_forwarder aee_exp_data_file:file { write create open getattr }; -allow aee_core_forwarder hwservicemanager_prop:file { read open getattr }; +get_prop(aee_core_forwarder, hwservicemanager_prop) # Date: 2019/06/14 # Operation : Migration # Purpose : interface=android.system.suspend::ISystemSuspend for aee_core_forwarder wakelock_use(aee_core_forwarder) allow aee_core_forwarder aee_aed:unix_stream_socket connectto; -allow aee_core_forwarder aee_core_data_file:dir read; +allow aee_core_forwarder aee_core_data_file:dir r_dir_perms; hwbinder_use(aee_core_forwarder) diff --git a/r_non_plat/file.te b/r_non_plat/file.te index ea7986b..412e0c0 100644 --- a/r_non_plat/file.te +++ b/r_non_plat/file.te @@ -408,3 +408,6 @@ type sysfs_fbt_fteh, fs_type, sysfs_type; # Purpose: Android Migration for video codec driver type sysfs_device_tree_model, fs_type, sysfs_type; +# Date : 2019/10/22 +# Purpose : allow aee_aedv write /sys/module/mrdump/parameters/lbaooo +type sysfs_mrdump_lbaooo, fs_type, sysfs_type; diff --git a/r_non_plat/genfs_contexts b/r_non_plat/genfs_contexts index 52e0e1d..6af7022 100644 --- a/r_non_plat/genfs_contexts +++ b/r_non_plat/genfs_contexts @@ -166,6 +166,10 @@ genfscon sysfs /devices/platform/bootdevice/host0/target0:0:0/0:0:0:2/block/sdc genfscon sysfs /devices/platform/externdevice/mmc_host/mmc0 u:object_r:sysfs_devices_block:s0 genfscon sysfs /devices/platform/externdevice/mmc_host/mmc1 u:object_r:sysfs_devices_block:s0 +# Date : 2019/10/22 +# Purpose : mrdump_tool(copy_process by aee_aedv) need to write data to lbaooo +genfscon sysfs /module/mrdump/parameters/lbaooo u:object_r:sysfs_mrdump_lbaooo:s0 + ############################# # debugfs files # diff --git a/r_non_plat/vendor_shell.te b/r_non_plat/vendor_shell.te new file mode 100644 index 0000000..46903b0 --- /dev/null +++ b/r_non_plat/vendor_shell.te @@ -0,0 +1,5 @@ +# ============================================== +# MTK Policy Rule +# ============================================= +# Purpose : allow vendor_shell to run aeev +allow vendor_shell aee_aedv_exec:file execute_no_trans;