Stephen Smalley | 6d10ca8 | 2014-01-13 09:45:45 -0500 | [diff] [blame] | 1 | # recovery console (used in recovery init.rc for /sbin/recovery) |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 2 | |
| 3 | # Declare the domain unconditionally so we can always reference it |
| 4 | # in neverallow rules. |
Stephen Smalley | 6d10ca8 | 2014-01-13 09:45:45 -0500 | [diff] [blame] | 5 | type recovery, domain; |
Stephen Smalley | 6d10ca8 | 2014-01-13 09:45:45 -0500 | [diff] [blame] | 6 | |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 7 | # But the allow rules are only included in the recovery policy. |
| 8 | # Otherwise recovery is only allowed the domain rules. |
| 9 | recovery_only(` |
Dirk Vogt | 982fd90 | 2016-03-22 12:11:07 +0100 | [diff] [blame] | 10 | permissive recovery; |
Stephen Smalley | 1095d69 | 2014-06-19 12:15:22 -0400 | [diff] [blame] | 11 | allow recovery self:capability { chown dac_override fowner fsetid setfcap setuid setgid sys_admin sys_tty_config }; |
Nick Kralevich | 03dbf07 | 2014-06-03 16:16:21 -0700 | [diff] [blame] | 12 | |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 13 | # Set security contexts on files that are not known to the loaded policy. |
| 14 | allow recovery self:capability2 mac_admin; |
Stephen Smalley | 6d10ca8 | 2014-01-13 09:45:45 -0500 | [diff] [blame] | 15 | |
Stephen Smalley | f3c3a1a | 2014-06-19 09:07:17 -0400 | [diff] [blame] | 16 | # Run helpers from / or /system without changing domain. |
| 17 | allow recovery rootfs:file execute_no_trans; |
| 18 | allow recovery system_file:file execute_no_trans; |
| 19 | |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 20 | # Mount filesystems. |
Nick Kralevich | 03dbf07 | 2014-06-03 16:16:21 -0700 | [diff] [blame] | 21 | allow recovery rootfs:dir mounton; |
Stephen Smalley | 75e2ef9 | 2014-06-16 13:05:38 -0400 | [diff] [blame] | 22 | allow recovery fs_type:filesystem ~relabelto; |
| 23 | allow recovery unlabeled:filesystem ~relabelto; |
| 24 | allow recovery contextmount_type:filesystem relabelto; |
Stephen Smalley | eb1bbf2 | 2014-05-29 14:35:55 -0400 | [diff] [blame] | 25 | |
Nick Kralevich | a03d761 | 2014-06-04 23:43:03 -0700 | [diff] [blame] | 26 | # Create and relabel files and directories under /system. |
| 27 | allow recovery exec_type:{ file lnk_file } { create_file_perms relabelfrom relabelto }; |
| 28 | allow recovery system_file:{ file lnk_file } { create_file_perms relabelfrom relabelto }; |
| 29 | allow recovery system_file:dir { create_dir_perms relabelfrom relabelto }; |
| 30 | |
Nick Kralevich | 558710c | 2014-07-07 13:19:24 -0700 | [diff] [blame] | 31 | # We may be asked to set an SELinux label for a type not known to the |
| 32 | # currently loaded policy. Allow it. |
Nick Kralevich | 683ac49 | 2014-10-23 12:12:58 -0700 | [diff] [blame] | 33 | allow recovery unlabeled:{ file lnk_file } { create_file_perms relabelfrom relabelto }; |
Nick Kralevich | 558710c | 2014-07-07 13:19:24 -0700 | [diff] [blame] | 34 | allow recovery unlabeled:dir { create_dir_perms relabelfrom relabelto }; |
| 35 | |
Nick Kralevich | ff409bb | 2014-06-15 09:40:12 -0700 | [diff] [blame] | 36 | # 0eb17d944704b3eb140bb9dded299d3be3aed77e in build/ added SELinux |
| 37 | # support to OTAs. However, that code has a bug. When an update occurs, |
| 38 | # some directories are inappropriately labeled as exec_type. This is |
| 39 | # only transient, and subsequent steps in the OTA script correct this |
| 40 | # mistake. |
| 41 | # Allow this behavior for now until we can fix the underlying bug. |
| 42 | # b/15575013 |
| 43 | allow recovery exec_type:dir { create_dir_perms relabelfrom relabelto }; |
| 44 | auditallow recovery exec_type:dir { create_dir_perms relabelfrom relabelto }; |
| 45 | |
Nick Kralevich | a03d761 | 2014-06-04 23:43:03 -0700 | [diff] [blame] | 46 | # Write to /proc/sys/vm/drop_caches |
| 47 | # TODO: create more specific label? |
| 48 | allow recovery proc:file w_file_perms; |
Nick Kralevich | 03ce512 | 2014-05-20 11:09:16 -0700 | [diff] [blame] | 49 | |
Stephen Smalley | 1095d69 | 2014-06-19 12:15:22 -0400 | [diff] [blame] | 50 | # Write to /sys/class/android_usb/android0/enable. |
| 51 | # TODO: create more specific label? |
| 52 | allow recovery sysfs:file w_file_perms; |
| 53 | |
Patrick Tjin | bd050a8 | 2014-12-09 12:43:26 -0800 | [diff] [blame] | 54 | access_kmsg(recovery) |
| 55 | |
Doug Zongker | 9f88bc5 | 2014-07-10 13:40:25 -0700 | [diff] [blame] | 56 | # Access /dev/android_adb or /dev/usb-ffs/adb/ep0 |
Stephen Smalley | 1095d69 | 2014-06-19 12:15:22 -0400 | [diff] [blame] | 57 | allow recovery adb_device:chr_file rw_file_perms; |
Doug Zongker | 9f88bc5 | 2014-07-10 13:40:25 -0700 | [diff] [blame] | 58 | allow recovery functionfs:dir search; |
| 59 | allow recovery functionfs:file rw_file_perms; |
Stephen Smalley | 1095d69 | 2014-06-19 12:15:22 -0400 | [diff] [blame] | 60 | |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 61 | # Required to e.g. wipe userdata/cache. |
Nick Kralevich | ff409bb | 2014-06-15 09:40:12 -0700 | [diff] [blame] | 62 | allow recovery device:dir r_dir_perms; |
Nick Kralevich | 03dbf07 | 2014-06-03 16:16:21 -0700 | [diff] [blame] | 63 | allow recovery block_device:dir r_dir_perms; |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 64 | allow recovery dev_type:blk_file rw_file_perms; |
Stephen Smalley | 3f40d4f | 2014-02-11 14:40:14 -0500 | [diff] [blame] | 65 | |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 66 | # GUI |
| 67 | allow recovery self:process execmem; |
| 68 | allow recovery ashmem_device:chr_file execute; |
Nick Kralevich | 03dbf07 | 2014-06-03 16:16:21 -0700 | [diff] [blame] | 69 | allow recovery graphics_device:chr_file rw_file_perms; |
| 70 | allow recovery graphics_device:dir r_dir_perms; |
| 71 | allow recovery input_device:dir r_dir_perms; |
| 72 | allow recovery input_device:chr_file r_file_perms; |
Nick Kralevich | 8b7ca45 | 2014-06-07 11:48:35 -0700 | [diff] [blame] | 73 | allow recovery tty_device:chr_file rw_file_perms; |
Stephen Smalley | 356f4be | 2014-05-23 11:26:19 -0400 | [diff] [blame] | 74 | |
Nick Kralevich | 03dbf07 | 2014-06-03 16:16:21 -0700 | [diff] [blame] | 75 | # Create /tmp/recovery.log and execute /tmp/update_binary. |
| 76 | allow recovery tmpfs:file { create_file_perms x_file_perms }; |
| 77 | allow recovery tmpfs:dir create_dir_perms; |
| 78 | |
| 79 | # Manage files on /cache |
| 80 | allow recovery cache_file:dir create_dir_perms; |
| 81 | allow recovery cache_file:file create_file_perms; |
| 82 | |
| 83 | # Reboot the device |
| 84 | allow recovery powerctl_prop:property_service set; |
| 85 | unix_socket_connect(recovery, property, init) |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 86 | |
Stephen Smalley | fee4915 | 2014-06-19 10:27:02 -0400 | [diff] [blame] | 87 | # Start/stop adbd via ctl.start adbd |
| 88 | allow recovery ctl_default_prop:property_service set; |
| 89 | |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 90 | # Use setfscreatecon() to label files for OTA updates. |
| 91 | allow recovery self:process setfscreate; |
Nick Kralevich | 03dbf07 | 2014-06-03 16:16:21 -0700 | [diff] [blame] | 92 | |
Ed Heyl | e9c90bd | 2014-07-14 23:29:21 -0700 | [diff] [blame] | 93 | # Allow recovery to create a fuse filesystem, and read files from it. |
Doug Zongker | 93d849b | 2014-07-02 10:28:20 -0700 | [diff] [blame] | 94 | allow recovery fuse_device:chr_file rw_file_perms; |
Ed Heyl | e9c90bd | 2014-07-14 23:29:21 -0700 | [diff] [blame] | 95 | allow recovery fuse:dir r_dir_perms; |
| 96 | allow recovery fuse:file r_file_perms; |
Doug Zongker | 93d849b | 2014-07-02 10:28:20 -0700 | [diff] [blame] | 97 | |
Nick Kralevich | 03dbf07 | 2014-06-03 16:16:21 -0700 | [diff] [blame] | 98 | wakelock_use(recovery) |
Nick Kralevich | 8b7ca45 | 2014-06-07 11:48:35 -0700 | [diff] [blame] | 99 | |
Nick Kralevich | f4e6902 | 2014-06-09 20:35:51 -0700 | [diff] [blame] | 100 | # This line seems suspect, as it should not really need to |
Nick Kralevich | 8b7ca45 | 2014-06-07 11:48:35 -0700 | [diff] [blame] | 101 | # set scheduling parameters for a kernel domain task. |
Nick Kralevich | 03dbf07 | 2014-06-03 16:16:21 -0700 | [diff] [blame] | 102 | allow recovery kernel:process setsched; |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 103 | ') |