mirror of
https://github.com/Evolution-X-Devices/device_google_gs201
synced 2026-01-27 18:37:19 +00:00
588e82af38
07af2808d5 (b/239632964) added
security policy support for /system_ext/bin/convert_to_ext4.sh.
This shell script converts f2fs filesystems into ext4 filesystems
on debuggable builds (userdebug or eng) only. Ever since 2022,
the security policy for this shell script has been in permissive
mode, meaning no SELinux rules were being enforced.
# convert-to-ext4-sh.te
permissive convert-to-ext4-sh;
In the intervening 2 years, there has been no attempt to move
this domain into enforcing mode. And by now, this script has
likely served its purpose, by converting f2fs /persist filesystems
on engineering builds to ext4, and is probably no longer needed.
This change eliminates the use of the unenforced convert-to-ext4-sh
security domain, preferring instead to use the "su" security domain.
Like convert-to-ext4-sh, the su security domain enforces no rules
on debuggable builds, and is equivalent to traditional root on
desktop Linux systems, or running /system/xbin/su. This change
eliminates unnecessary technical complexity, and unblocks other
hardening changes, such as WIP commit
https://android-review.googlesource.com/c/platform/system/sepolicy/+/3308856
Moving from one permissive domain ("convert-to-ext4-sh") to another
permissive domain ("su") should be a no-op from a security and
functionality perspective.
Test: compiles and builds, passes treehugger.
Bug: 239632964
Change-Id: Ifd628310a923926d1a57b568c7703cb857f0871b
99 lines
3.1 KiB
Plaintext
99 lines
3.1 KiB
Plaintext
# Data
|
|
type chre_data_file, file_type, data_file_type;
|
|
type rild_vendor_data_file, file_type, data_file_type;
|
|
type vendor_log_file, file_type, data_file_type;
|
|
type vendor_rfsd_log_file, file_type, data_file_type;
|
|
type modem_stat_data_file, file_type, data_file_type;
|
|
type vendor_slog_file, file_type, data_file_type;
|
|
type updated_wifi_firmware_data_file, file_type, data_file_type;
|
|
type vendor_misc_data_file, file_type, data_file_type;
|
|
type per_boot_file, file_type, data_file_type, core_data_file_type;
|
|
type uwb_data_vendor, file_type, data_file_type;
|
|
type powerstats_vendor_data_file, file_type, data_file_type;
|
|
type vendor_gps_file, file_type, data_file_type;
|
|
userdebug_or_eng(`
|
|
typeattribute vendor_gps_file mlstrustedobject;
|
|
typeattribute vendor_slog_file mlstrustedobject;
|
|
')
|
|
|
|
# Exynos Firmware
|
|
type vendor_fw_file, vendor_file_type, file_type;
|
|
|
|
# Trusty
|
|
type sysfs_trusty, sysfs_type, fs_type;
|
|
|
|
# EM Profile
|
|
type sysfs_em_profile, sysfs_type, fs_type;
|
|
|
|
# sysfs
|
|
type sysfs_chosen, sysfs_type, fs_type;
|
|
type bootdevice_sysdev, dev_type;
|
|
type sysfs_fabric, sysfs_type, fs_type;
|
|
type sysfs_acpm_stats, sysfs_type, fs_type;
|
|
type sysfs_wifi, sysfs_type, fs_type;
|
|
type sysfs_exynos_pcie_stats, sysfs_type, fs_type;
|
|
type sysfs_bcmdhd, sysfs_type, fs_type;
|
|
type sysfs_chargelevel, sysfs_type, fs_type;
|
|
type sysfs_camera, sysfs_type, fs_type;
|
|
type sysfs_write_leds, sysfs_type, fs_type;
|
|
type sysfs_pca, sysfs_type, fs_type;
|
|
type sysfs_ptracker, sysfs_type, fs_type;
|
|
# debugfs
|
|
type vendor_maxfg_debugfs, fs_type, debugfs_type;
|
|
type vendor_pm_genpd_debugfs, fs_type, debugfs_type;
|
|
type vendor_regmap_debugfs, fs_type, debugfs_type;
|
|
type vendor_usb_debugfs, fs_type, debugfs_type;
|
|
type vendor_charger_debugfs, fs_type, debugfs_type;
|
|
type vendor_votable_debugfs, fs_type, debugfs_type;
|
|
type vendor_battery_debugfs, fs_type, debugfs_type;
|
|
|
|
# vendor extra images
|
|
type modem_img_file, contextmount_type, file_type, vendor_file_type;
|
|
allow modem_img_file self:filesystem associate;
|
|
|
|
# persist
|
|
type persist_battery_file, file_type, vendor_persist_type;
|
|
type persist_camera_file, file_type, vendor_persist_type;
|
|
type persist_modem_file, file_type, vendor_persist_type;
|
|
type persist_ss_file, file_type, vendor_persist_type;
|
|
type persist_uwb_file, file_type, vendor_persist_type;
|
|
type persist_display_file, file_type, vendor_persist_type;
|
|
|
|
# CHRE
|
|
type chre_socket, file_type;
|
|
|
|
# Storage Health HAL
|
|
type proc_f2fs, proc_type, fs_type;
|
|
|
|
# Vendor tools
|
|
type vendor_dumpsys, vendor_file_type, file_type;
|
|
|
|
# Modem
|
|
type modem_efs_file, file_type;
|
|
type modem_userdata_file, file_type;
|
|
type sysfs_modem, sysfs_type, fs_type;
|
|
|
|
# SecureElement
|
|
type sysfs_st33spi, sysfs_type, fs_type;
|
|
typeattribute sysfs_st33spi mlstrustedobject;
|
|
|
|
# Vendor sched files
|
|
userdebug_or_eng(`
|
|
typeattribute proc_vendor_sched mlstrustedobject;
|
|
')
|
|
|
|
# SJTAG
|
|
type sysfs_sjtag, fs_type, sysfs_type;
|
|
userdebug_or_eng(`
|
|
typeattribute sysfs_sjtag mlstrustedobject;
|
|
')
|
|
|
|
# USB-C throttling stats
|
|
type sysfs_usbc_throttling_stats, sysfs_type, fs_type;
|
|
|
|
# WLC
|
|
type sysfs_wlc, sysfs_type, fs_type;
|
|
|
|
# /system_ext/bin/convert_to_ext4.sh
|
|
type convert-to-ext4-sh_exec, system_file_type, exec_type, file_type;
|