commit: 0e8ef804e3c6409094334dda3b320bcfd5bf29b8
Author: Jason Zaman <jason <AT> perfinion <DOT> com>
AuthorDate: Tue Jul 28 14:46:43 2015 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Fri Jul 31 08:09:03 2015 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=0e8ef804
android: add sdk in /opt and sysfs
adb needs to be able to read sysfs to find the USB device
policy/modules/contrib/android.fc | 4 ++++
policy/modules/contrib/android.if | 5 +++++
policy/modules/contrib/android.te | 11 +++++++++--
3 files changed, 18 insertions(+), 2 deletions(-)
diff --git a/policy/modules/contrib/android.fc
b/policy/modules/contrib/android.fc
index a16fc47..af98311 100644
--- a/policy/modules/contrib/android.fc
+++ b/policy/modules/contrib/android.fc
@@ -4,3 +4,7 @@ HOME_DIR/\.gradle(/.*)?
gen_context(system_u:object_r:android_home_t,s0)
/opt/android-studio/bin/studio.sh
gen_context(system_u:object_r:android_java_exec_t,s0)
+/opt/android-sdk-update-manager/platform-tools/adb --
gen_context(system_u:object_r:android_tools_exec_t,s0)
+/opt/android-sdk-update-manager/platform-tools/fastboot --
gen_context(system_u:object_r:android_tools_exec_t,s0)
+/opt/android-sdk-update-manager/tools/android --
gen_context(system_u:object_r:android_java_exec_t,s0)
+/opt/android-sdk-update-manager(/.*)?
gen_context(system_u:object_r:android_sdk_t,s0)
diff --git a/policy/modules/contrib/android.if
b/policy/modules/contrib/android.if
index f0173d5..a50093a 100644
--- a/policy/modules/contrib/android.if
+++ b/policy/modules/contrib/android.if
@@ -23,6 +23,7 @@ interface(`android_role',`
type android_tmp_t;
type android_java_t;
type android_java_exec_t;
+ type android_sdk_t;
')
role $1 types android_tools_t;
@@ -38,6 +39,10 @@ interface(`android_role',`
manage_files_pattern($2, android_home_t, android_home_t)
manage_lnk_files_pattern($2, android_home_t, android_home_t)
+ list_dirs_pattern($2, android_sdk_t, android_sdk_t)
+ read_files_pattern($2, android_sdk_t, android_sdk_t)
+ read_lnk_files_pattern($2, android_sdk_t, android_sdk_t)
+
userdom_user_home_dir_filetrans($2, android_home_t, dir, ".android")
userdom_user_home_dir_filetrans($2, android_home_t, dir,
".AndroidStudioBeta")
userdom_user_home_dir_filetrans($2, android_home_t, dir,
".AndroidStudio")
diff --git a/policy/modules/contrib/android.te
b/policy/modules/contrib/android.te
index a76061f..930c6b3 100644
--- a/policy/modules/contrib/android.te
+++ b/policy/modules/contrib/android.te
@@ -28,6 +28,8 @@ type android_home_t; # customizable
userdom_user_home_content(android_home_t)
userdom_user_home_dir_filetrans(android_tools_t, android_home_t, { dir file })
+type android_sdk_t;
+files_type(android_sdk_t)
############################
#
@@ -55,6 +57,7 @@ corenet_tcp_bind_adb_port(android_tools_t)
corenet_tcp_bind_generic_node(android_tools_t)
corenet_tcp_connect_adb_port(android_tools_t)
+dev_read_sysfs(android_tools_t)
dev_rw_generic_usb_dev(android_tools_t)
userdom_manage_user_home_content_dirs(android_tools_t)
@@ -75,10 +78,14 @@ allow android_java_t self:tcp_socket { accept listen };
can_exec(android_java_t, android_home_t)
can_exec(android_java_t, android_java_exec_t)
+can_exec(android_java_t, android_sdk_t)
manage_dirs_pattern(android_java_t, android_home_t, android_home_t)
manage_files_pattern(android_java_t, android_home_t, android_home_t)
+manage_dirs_pattern(android_java_t, android_sdk_t, android_sdk_t)
+manage_files_pattern(android_java_t, android_sdk_t, android_sdk_t)
+
manage_dirs_pattern(android_java_t, android_tmp_t, android_tmp_t)
manage_files_pattern(android_java_t, android_tmp_t, android_tmp_t)
@@ -87,8 +94,8 @@ corecmd_exec_shell(android_java_t)
corenet_tcp_bind_all_unreserved_ports(android_java_t)
corenet_tcp_bind_generic_node(android_java_t)
-corenet_tcp_connect_adb_port(android_tools_t)
-corenet_tcp_connect_http_port(android_tools_t)
+corenet_tcp_connect_adb_port(android_java_t)
+corenet_tcp_connect_http_port(android_java_t)
corenet_udp_bind_generic_node(android_java_t)
domain_dontaudit_getattr_all_domains(android_java_t)
