-
Notifications
You must be signed in to change notification settings - Fork 154
/
keystore.te
37 lines (30 loc) · 1.27 KB
/
keystore.te
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
type keystore, domain;
type keystore_exec, exec_type, file_type;
# keystore daemon
init_daemon_domain(keystore)
typeattribute keystore mlstrustedsubject;
binder_use(keystore)
binder_service(keystore)
allow keystore keystore_data_file:dir create_dir_perms;
allow keystore keystore_data_file:notdevfile_class_set create_file_perms;
allow keystore keystore_exec:file { getattr };
allow keystore tee_device:chr_file rw_file_perms;
allow keystore tee:unix_stream_socket connectto;
allow keystore keystore_service:service_manager { add find };
# Check SELinux permissions.
selinux_check_access(keystore)
###
### Neverallow rules
###
### Protect ourself from others
###
neverallow { domain -keystore -recovery } keystore_data_file:dir ~{ open create read getattr setattr search relabelto ioctl };
neverallow { domain -keystore -recovery } keystore_data_file:notdevfile_class_set ~{ relabelto getattr };
ifelse(shipping_build, `true',
`neverallow { domain -keystore -init } keystore_data_file:dir *;
neverallow { domain -keystore -init } keystore_data_file:notdevfile_class_set *;'
,
`neverallow { domain -keystore -init -recovery } keystore_data_file:dir *;
neverallow { domain -keystore -init -recovery } keystore_data_file:notdevfile_class_set *;'
)
neverallow domain keystore:process ptrace;