| Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 1 | type keystore, domain; |
| 2 | type keystore_exec, exec_type, file_type; |
| 3 | |
| 4 | # keystore daemon |
| 5 | init_daemon_domain(keystore) |
| Stephen Smalley | cdd83f4 | 2013-10-29 14:42:37 -0400 | [diff] [blame] | 6 | typeattribute keystore mlstrustedsubject; |
| 7 | binder_use(keystore) |
| 8 | binder_service(keystore) |
| 9 | allow keystore keystore_data_file:dir create_dir_perms; |
| 10 | allow keystore keystore_data_file:notdevfile_class_set create_file_perms; |
| 11 | allow keystore keystore_exec:file { getattr }; |
| 12 | allow keystore tee_device:chr_file rw_file_perms; |
| Nick Kralevich | b23d287 | 2014-01-08 11:47:00 -0800 | [diff] [blame] | 13 | allow keystore tee:unix_stream_socket connectto; |
| Nick Kralevich | cd905ec | 2014-05-08 23:28:52 -0700 | [diff] [blame] | 14 | |
| Stephen Smalley | b8caf7f | 2015-03-13 16:42:42 -0400 | [diff] [blame] | 15 | allow keystore keystore_service:service_manager { add find }; |
| 16 | |
| 17 | # Check SELinux permissions. |
| 18 | selinux_check_access(keystore) |
| 19 | |
| Nick Kralevich | cd905ec | 2014-05-08 23:28:52 -0700 | [diff] [blame] | 20 | ### |
| 21 | ### Neverallow rules |
| 22 | ### |
| Nick Kralevich | 8aa754c | 2014-05-19 21:49:50 -0700 | [diff] [blame] | 23 | ### Protect ourself from others |
| Nick Kralevich | cd905ec | 2014-05-08 23:28:52 -0700 | [diff] [blame] | 24 | ### |
| 25 | |
| Adnan Begovic | edb21bc | 2015-10-15 11:06:53 -0700 | [diff] [blame^] | 26 | neverallow { domain -keystore -recovery } keystore_data_file:dir ~{ open create read getattr setattr search relabelto ioctl }; |
| Ricardo Cerqueira | 43a9fce | 2015-01-03 04:21:06 +0000 | [diff] [blame] | 27 | neverallow { domain -keystore -recovery } keystore_data_file:notdevfile_class_set ~{ relabelto getattr }; |
| Nick Kralevich | cd905ec | 2014-05-08 23:28:52 -0700 | [diff] [blame] | 28 | |
| Stephen Smalley | d4731ad | 2014-10-22 11:13:17 -0400 | [diff] [blame] | 29 | neverallow { domain -keystore -init } keystore_data_file:dir *; |
| 30 | neverallow { domain -keystore -init } keystore_data_file:notdevfile_class_set *; |
| Nick Kralevich | 8aa754c | 2014-05-19 21:49:50 -0700 | [diff] [blame] | 31 | |
| 32 | neverallow domain keystore:process ptrace; |