8adb4d9d12
The property service uses an SELinux userspace check to determine if a
process is allowed to set a property. If the security check fails, a
userspace SELinux denial is generated. Currently, these denials are only
sent to dmesg.
Instead of sending these denials to dmesg, send it to the kernel audit
system. This will cause these userspace denials to be treated similarly
to kernel generated denials (eg, logd will pick them up and process
them). This will ensure that denials generated by the property service
will show up in logcat / dmesg / event log.
After this patch, running "setprop asdf asdf" from the unprivileged adb
shell user will result in the following audit message:
type=1107 audit(39582851.013:48): pid=1 uid=0 auid=4294967295
ses=4294967295 subj=u:r:init:s0 msg='avc: denied { set } for
property=asdf pid=5537 uid=2000 gid=2000 scontext=u:r:shell:s0
tcontext=u:object_r:default_prop:s0 tclass=property_service'
Test: manual
Bug: 27878170
Change-Id: I0b8994888653501f2f315eaa63d9e2ba32d851ef
135 lines
2.9 KiB
Makefile
135 lines
2.9 KiB
Makefile
# Copyright 2005 The Android Open Source Project
|
|
|
|
LOCAL_PATH:= $(call my-dir)
|
|
|
|
# --
|
|
|
|
ifneq (,$(filter userdebug eng,$(TARGET_BUILD_VARIANT)))
|
|
init_options += -DALLOW_LOCAL_PROP_OVERRIDE=1 -DALLOW_PERMISSIVE_SELINUX=1
|
|
else
|
|
init_options += -DALLOW_LOCAL_PROP_OVERRIDE=0 -DALLOW_PERMISSIVE_SELINUX=0
|
|
endif
|
|
|
|
init_options += -DLOG_UEVENTS=0
|
|
|
|
init_cflags += \
|
|
$(init_options) \
|
|
-Wall -Wextra \
|
|
-Wno-unused-parameter \
|
|
-Werror \
|
|
|
|
# --
|
|
|
|
# If building on Linux, then build unit test for the host.
|
|
ifeq ($(HOST_OS),linux)
|
|
include $(CLEAR_VARS)
|
|
LOCAL_CPPFLAGS := $(init_cflags)
|
|
LOCAL_SRC_FILES:= \
|
|
parser/tokenizer.cpp \
|
|
|
|
LOCAL_MODULE := libinit_parser
|
|
LOCAL_CLANG := true
|
|
include $(BUILD_HOST_STATIC_LIBRARY)
|
|
|
|
include $(CLEAR_VARS)
|
|
LOCAL_MODULE := init_parser_tests
|
|
LOCAL_SRC_FILES := \
|
|
parser/tokenizer_test.cpp \
|
|
|
|
LOCAL_STATIC_LIBRARIES := libinit_parser
|
|
LOCAL_CLANG := true
|
|
include $(BUILD_HOST_NATIVE_TEST)
|
|
endif
|
|
|
|
include $(CLEAR_VARS)
|
|
LOCAL_CPPFLAGS := $(init_cflags)
|
|
LOCAL_SRC_FILES:= \
|
|
action.cpp \
|
|
capabilities.cpp \
|
|
descriptors.cpp \
|
|
import_parser.cpp \
|
|
init_parser.cpp \
|
|
log.cpp \
|
|
parser.cpp \
|
|
service.cpp \
|
|
util.cpp \
|
|
|
|
LOCAL_STATIC_LIBRARIES := libbase libselinux liblog libprocessgroup libnl
|
|
LOCAL_WHOLE_STATIC_LIBRARIES := libcap
|
|
LOCAL_MODULE := libinit
|
|
LOCAL_SANITIZE := integer
|
|
LOCAL_CLANG := true
|
|
include $(BUILD_STATIC_LIBRARY)
|
|
|
|
include $(CLEAR_VARS)
|
|
LOCAL_CPPFLAGS := $(init_cflags)
|
|
LOCAL_SRC_FILES:= \
|
|
bootchart.cpp \
|
|
builtins.cpp \
|
|
devices.cpp \
|
|
init.cpp \
|
|
keychords.cpp \
|
|
property_service.cpp \
|
|
signal_handler.cpp \
|
|
ueventd.cpp \
|
|
ueventd_parser.cpp \
|
|
watchdogd.cpp \
|
|
|
|
LOCAL_MODULE:= init
|
|
LOCAL_C_INCLUDES += \
|
|
system/core/mkbootimg
|
|
|
|
LOCAL_FORCE_STATIC_EXECUTABLE := true
|
|
LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
|
|
LOCAL_UNSTRIPPED_PATH := $(TARGET_ROOT_OUT_UNSTRIPPED)
|
|
|
|
LOCAL_STATIC_LIBRARIES := \
|
|
libinit \
|
|
libbootloader_message \
|
|
libfs_mgr \
|
|
libfec \
|
|
libfec_rs \
|
|
libsquashfs_utils \
|
|
liblogwrap \
|
|
libcutils \
|
|
libext4_utils_static \
|
|
libbase \
|
|
libc \
|
|
libselinux \
|
|
liblog \
|
|
libcrypto_utils \
|
|
libcrypto \
|
|
libc++_static \
|
|
libdl \
|
|
libsparse_static \
|
|
libz \
|
|
libprocessgroup \
|
|
libnl \
|
|
|
|
# Create symlinks.
|
|
LOCAL_POST_INSTALL_CMD := $(hide) mkdir -p $(TARGET_ROOT_OUT)/sbin; \
|
|
ln -sf ../init $(TARGET_ROOT_OUT)/sbin/ueventd; \
|
|
ln -sf ../init $(TARGET_ROOT_OUT)/sbin/watchdogd
|
|
|
|
LOCAL_SANITIZE := integer
|
|
LOCAL_CLANG := true
|
|
include $(BUILD_EXECUTABLE)
|
|
|
|
|
|
# Unit tests.
|
|
# =========================================================
|
|
include $(CLEAR_VARS)
|
|
LOCAL_MODULE := init_tests
|
|
LOCAL_SRC_FILES := \
|
|
init_parser_test.cpp \
|
|
util_test.cpp \
|
|
|
|
LOCAL_SHARED_LIBRARIES += \
|
|
libcutils \
|
|
libbase \
|
|
|
|
LOCAL_STATIC_LIBRARIES := libinit
|
|
LOCAL_SANITIZE := integer
|
|
LOCAL_CLANG := true
|
|
LOCAL_CPPFLAGS := -Wall -Wextra -Werror
|
|
include $(BUILD_NATIVE_TEST)
|