topjohnwu/selinux
1
0
Fork 0
mirror of https://github.com/topjohnwu/selinux.git synced 2024-11-26 21:10:36 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
5,473 Commits 1 Branch 0 Tags 18 MiB
master
Commit Graph

5473 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
vvb2060
48fcf8bba0 Copy over Android specific config bits 2024-03-19 02:52:32 -07:00
残页
6c226ef9e6 No more policydb validation 
Validation is useless in magiskpolicy's use case, and now it turns out the new more strict validation breaks compatibility with some existing devices, so skip it.
 2024-03-19 02:50:46 -07:00
topjohnwu
368f68e140 Revert "libsepol: Make an unknown permission an error in CIL" 
There are still invalid CILs out in the wild on Android.
Do not throw an error in this case, preserve the old behavior.

This reverts commit dc4e54126b.
 2024-03-19 02:50:46 -07:00
topjohnwu
161e64dfe7 Export several function symbols 
We need to access several non-exported functions in magiskpolicy.
 2024-03-19 02:50:46 -07:00
topjohnwu
2638c3a548 Add Android M policy compatibility 
Source: https://android-review.googlesource.com/c/kernel/common/+/179568/2/security/selinux/ss/avtab.c

Co-authored-by: canyie <a1364259@163.com>
 2024-03-19 02:50:46 -07:00
topjohnwu
a922c8457e Prebuild cil_lexer with flex 2024-03-19 02:50:46 -07:00
Thiébaud Weksteen
c20d8480e5 Merge "Add build flags for libselinux" into main am: c23cbe8ca5 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2971894

Change-Id: Iab88e01241410a5803177f30093e5b444692af6a
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-03-05 00:00:47 +00:00
Thiébaud Weksteen
c23cbe8ca5 Merge "Add build flags for libselinux" into main 2024-03-04 23:28:31 +00:00
Thiébaud Weksteen
b39171460b Merge "Add selabel_get_digests_all_partial_matches binary" into main am: 2273a74d00 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2981571

Change-Id: Icc0c501c6a3841b4bede6bdf2821c3627d6cb67e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-02-29 02:06:03 +00:00
Thiébaud Weksteen
2273a74d00 Merge "Add selabel_get_digests_all_partial_matches binary" into main 2024-02-29 01:16:38 +00:00
Thiébaud Weksteen
f3007e9fd4 Add selabel_get_digests_all_partial_matches binary 
Add build rule for selabel_get_digests_all_partial_matches. It is not
included by default in the system image, but can be useful to debug
the computation of security.sehash.

Bug: 317296680
Test: adb remount; adb push selabel_get_digests_all_partial_matches
  /system/bin; selabel_get_digests_all_partial_matches -r /data/data
Change-Id: I2b7e8d994f15539849d69ded5695293c4f2cf8b2
 2024-02-28 13:26:57 +11:00
Ellen Arteca
b97284595c The order the fields were printed in did not match the order in which their values are listed; likely a typo am: cd26ca2162 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2976012

Change-Id: I515a85b6ae5eb66afe302ac15db733790d348df5
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2024-02-27 11:46:40 +00:00
Ellen Arteca
cd26ca2162 The order the fields were printed in did not match the order in which their values are listed; likely a typo 
Change-Id: I2e00216ef7e3cedd274fb16aa361637d9a98ba2c
 2024-02-26 09:14:18 +00:00
Thiébaud Weksteen
8f719500fd Add build flags for libselinux 
Consider /data/data as an app data directory (and skip any restorcon) if
the flag release_selinux_data_data_ignore is enabled.

Test: boot;
      setfattr -x security.sehash /data;
      setfattr -x security.sehash /data/data;
      reboot, restorecon ignores /data/data
Bug: 317296680
Change-Id: If341864555398cd042dbe5b89085821cc2f8a0c0
 2024-02-23 15:46:51 +11:00
Daniel Chapin
a7b5fa81da Revert "Use generic isSelector" am: 27d4f93b76 am: fd16119838 am: 05a74fd219 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2858485

Change-Id: Ib50610278ec483c87d4d2c52f60ee340744c821b
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-05 06:55:43 +00:00
Daniel Chapin
6e81ec7ec2 Revert "Use generic isSelector" am: 27d4f93b76 am: a772618e5c am: a9be036f81 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2858485

Change-Id: Ic52cbb7c1e50bd97ca3e928f619e876d575e962e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-05 06:55:18 +00:00
Daniel Chapin
05a74fd219 Revert "Use generic isSelector" am: 27d4f93b76 am: fd16119838 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2858485

Change-Id: I52e564e9ce90b0118f0e1ed576ca784385151b32
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-05 06:06:46 +00:00
Daniel Chapin
a9be036f81 Revert "Use generic isSelector" am: 27d4f93b76 am: a772618e5c 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2858485

Change-Id: I335a819d7c851b62c3b0a123fbfe34c176469127
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-05 06:04:37 +00:00
Daniel Chapin
a772618e5c Revert "Use generic isSelector" am: 27d4f93b76 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2858485

Change-Id: Id3421f08cf85f2744b757cdd4e89726f98f1b9a5
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-05 05:28:47 +00:00
Daniel Chapin
fd16119838 Revert "Use generic isSelector" am: 27d4f93b76 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2858485

Change-Id: I71ff5b24278be5ee64a1d46ba39550c2826720e0
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-05 05:16:50 +00:00
Daniel Chapin
27d4f93b76 Revert "Use generic isSelector" 
This reverts commit 3d85f1e116.

Reason for revert: Droidfood blocking bug: b/314704483

Change-Id: I4cec1f1c4de25c28536c4f56cfd297ab1a9f3812
 2023-12-05 00:52:17 +00:00
Thiébaud Weksteen
5f0adaf824 Use generic isSelector am: 3d85f1e116 am: d26a4af638 am: 57857be7cb 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2839485

Change-Id: I907beaae8a76e6d3209fa6eb1d21298b5170e3f5
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-01 04:23:37 +00:00
Thiébaud Weksteen
2e514132bf Use generic isSelector am: 3d85f1e116 am: bce1d3689b am: 28f879de16 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2839485

Change-Id: I067484d72885ba209b0944a326474b2008cec004
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-01 04:23:22 +00:00
Thiébaud Weksteen
57857be7cb Use generic isSelector am: 3d85f1e116 am: d26a4af638 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2839485

Change-Id: I96867dca9a2731cf062a795fcfdf034beb9e9cab
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-01 04:05:52 +00:00
Thiébaud Weksteen
28f879de16 Use generic isSelector am: 3d85f1e116 am: bce1d3689b 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2839485

Change-Id: I408f1d9edea15863dde0e50ca5f2000ebf8fad5c
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-01 03:51:40 +00:00
Thiébaud Weksteen
d26a4af638 Use generic isSelector am: 3d85f1e116 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2839485

Change-Id: Iebf082e0c29320766b69c5ea6b9fb151c8676a25
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-01 03:34:32 +00:00
Thiébaud Weksteen
bce1d3689b Use generic isSelector am: 3d85f1e116 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2839485

Change-Id: I0aad333ba1526c0a61ea2d55c528b1e7373897e7
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-12-01 03:19:18 +00:00
Thiébaud Weksteen
3d85f1e116 Use generic isSelector 
seapp_contexts supports multiple boolean attributes: isPrivApp,
isEphemeralApp, isIsolatedComputeApp, isSdkSandboxAudit,
isSdkSandboxNext, fromRunAs. Each of these exists to support a specific
labelling scenario from the framework. When a new predicate is required,
an update to libselinux is also required. This change generically
handles any attribute starting with "is" and maps it directly
(case-insensitive) to the same seinfo field.

It is assumed that only one of these is required at a time. An error is
raised if seapp_contexts contains multiple is-selector within one rule.
An error is raised if seinfo contains multiple is-selector.

The order for comparison between seapp_contexts is altered: an entry
with an is-selector will be prioritized over one with an unspecifed
is-selector. This is not quite the previous order (e.g., isPrivApp <
targetSdkVersion < fromRunAs), but it is understood that the previous
order was not intentional and emerged from the incremental contributions
to this library.

The boolean info.isPreinstalledApp is replaced by checking the first
byte of info.partition.

Test: atest --host libselinux_test
Bug: 307635909
Change-Id: Ice3b84870e3255f6d9357d9750acbe9691b45aad
 2023-12-01 10:42:50 +11:00
Thiébaud Weksteen
148c2f327d Refactor the parsing of seinfo am: 7fd89c00f7 am: c4b477c1de am: f87183c61b 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2836178

Change-Id: I40a776d1e79ab6927464cb1bd5a5b612cd5c2292
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-11-21 23:35:07 +00:00
Thiébaud Weksteen
4268b21150 Refactor the parsing of seinfo am: 7fd89c00f7 am: 4bf49f0fb0 am: 6af667a24b 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2836178

Change-Id: I5742cf04e29ef3e54b81cdc2134170fbf3960f74
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-11-21 23:33:39 +00:00
Thiébaud Weksteen
f87183c61b Refactor the parsing of seinfo am: 7fd89c00f7 am: c4b477c1de 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2836178

Change-Id: Ia03b4d9c99c43b1644c949f5ca6cfb11147f383d
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-11-21 23:32:50 +00:00
Thiébaud Weksteen
6af667a24b Refactor the parsing of seinfo am: 7fd89c00f7 am: 4bf49f0fb0 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2836178

Change-Id: I5b172e06cd5efe1c18a0eb9bf7f69593aeb76d29
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-11-21 23:00:27 +00:00
Thiébaud Weksteen
c4b477c1de Refactor the parsing of seinfo am: 7fd89c00f7 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2836178

Change-Id: I11bfae9f5cb86c03642d30afb7b8f1ea46c9efb0
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-11-21 22:47:45 +00:00
Thiébaud Weksteen
4bf49f0fb0 Refactor the parsing of seinfo am: 7fd89c00f7 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2836178

Change-Id: Ifa4dbb6ccaa95af13c388fb60736517b77b34475
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-11-21 22:28:21 +00:00
Thiébaud Weksteen
7fd89c00f7 Refactor the parsing of seinfo 
The seinfo string contains many attributes provided by the caller to
match an seapp_contexts rule. Its usage has evolved organically and now
contains multiple fields for various purposes.

Refactor the parsing of seinfo, relying on strtok as the string
informally follows the convention of using colons between attributes and
an equal sign to separate an attribute and its value. For instance,

  default:privapp:targetSdkVersion=10000:partition=system:complete

A new internal structure is introduced to capture the attributes. The
new parse_seinfo function replaces seinfo_parse (which only parsed the
first attribute, historically the original seinfo), get_partition and
get_app_targetSdkVersion.

The new function is expected to behave similarly to the previous code.
Unknown attributes are now logged, but still ignored. The "complete"
attribute is now interpreted (as the last attribute), but not required.

Unit tests are added to cover standard and edge cases.

Test: boot and verify denial logs
Test: atest --host libselinux_test
Bug: 307635909
Change-Id: Ia0e3522c42c80e6e631ff1af644e03f53d88da93
 2023-11-21 13:59:42 +11:00
Sandro Montanari
9db97963d2 Introduce sdk_sandbox_audit SELinux domain am: 90c0d6546d am: 1163af38b5 am: bc58ce3f60 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2797594

Change-Id: I015b80f186fa32a50feff8ab92241718d17ad8e9
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-10-26 14:08:54 +00:00
Sandro Montanari
490887b089 Introduce sdk_sandbox_audit SELinux domain am: 90c0d6546d am: 1fb35a146a am: 7c4998952f 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2797594

Change-Id: I7a127b33fa31edb7413f52f96ac3d84dba8e8d6f
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-10-26 14:07:57 +00:00
Sandro Montanari
bc58ce3f60 Introduce sdk_sandbox_audit SELinux domain am: 90c0d6546d am: 1163af38b5 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2797594

Change-Id: Ife97c50400054605e3e9fe62574a05ee65bc3e31
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-10-26 13:37:52 +00:00
Sandro Montanari
7c4998952f Introduce sdk_sandbox_audit SELinux domain am: 90c0d6546d am: 1fb35a146a 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2797594

Change-Id: I21ce6a808a1db942978cf7195c59c1611766e50c
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-10-26 13:36:05 +00:00
Sandro Montanari
1163af38b5 Introduce sdk_sandbox_audit SELinux domain am: 90c0d6546d 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2797594

Change-Id: I99385f64dec55322fb600c15da8a648ee15b453d
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-10-26 13:14:40 +00:00
Sandro Montanari
1fb35a146a Introduce sdk_sandbox_audit SELinux domain am: 90c0d6546d 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2797594

Change-Id: I30e008c05bfa75bff1ffb60bd7c8c869c7fc062c
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-10-26 13:13:08 +00:00
Sandro Montanari
90c0d6546d Introduce sdk_sandbox_audit SELinux domain 
Bug: 295861450
Test: atest CtsSdkSandboxInprocessTests and adb shell ps -Z
Change-Id: Ic2dc4c854b3bbe5719b83fcd5504766a1e92e6a4
 2023-10-26 10:05:49 +00:00
Thiébaud Weksteen
d497bb75b7 Remove APEX sepolicy support am: e9448817b3 am: befd9372d7 am: 298608b246 am: 61ac3b9137 am: 32eb7e6bc4 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2736178

Change-Id: I24e805b894916f7e0d9a3ded5c0009abab7dc439
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-09-06 09:37:17 +00:00
Thiébaud Weksteen
32eb7e6bc4 Remove APEX sepolicy support am: e9448817b3 am: befd9372d7 am: 298608b246 am: 61ac3b9137 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2736178

Change-Id: I25227cf516e7a4799a4cbea23740cddbfac53919
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-09-06 08:43:01 +00:00
Thiébaud Weksteen
61ac3b9137 Remove APEX sepolicy support am: e9448817b3 am: befd9372d7 am: 298608b246 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2736178

Change-Id: I372c214844771151969d8b021023b6e7a6fe1862
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-09-06 07:21:22 +00:00
Thiébaud Weksteen
298608b246 Remove APEX sepolicy support am: e9448817b3 am: befd9372d7 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2736178

Change-Id: I3117e97c5ace1a8b69d869bf189a0e8b751849ec
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-09-06 05:45:28 +00:00
Thiébaud Weksteen
befd9372d7 Remove APEX sepolicy support am: e9448817b3 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2736178

Change-Id: I784f0839f4ce0d1aee5f87837529acd328f3e6f3
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-09-06 04:08:27 +00:00
Thiébaud Weksteen
e9448817b3 Remove APEX sepolicy support 
Test: boot aosp_cf_x86_64_phone
Bug: 297794885
Change-Id: Ia447f1ce783eb83db41454aaee5e93f7f09c36b1
 2023-09-04 14:14:05 +10:00
Inseob Kim
95f6333593 Add a comment to keep in sync with CTS am: 5cfac38d10 am: 03af209f74 am: 7959969e47 am: 603ac63b13 am: 6c035ce159 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2709434

Change-Id: I463e5a8cf24dd6361ea4e9b9aabcad4dd6a9ce98
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-08-16 17:19:58 +00:00
Inseob Kim
6c035ce159 Add a comment to keep in sync with CTS am: 5cfac38d10 am: 03af209f74 am: 7959969e47 am: 603ac63b13 
Original change: https://android-review.googlesource.com/c/platform/external/selinux/+/2709434

Change-Id: Ie9526b15e1cab0da56a2152f91cf99d4d7c5f5bf
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
 2023-08-16 16:33:27 +00:00