From 83b54ecab73912a16d783f0d03c2aada378173a7 Mon Sep 17 00:00:00 2001 From: Robert Craig Date: Tue, 1 Jul 2014 13:53:11 -0700 Subject: [PATCH] Allow different SELinux policies for third party apps. Prior support forced all third party apps to be resolved against the default stanza of the mac_permissions.xml file when assigning seinfo labels. This meant that all third party apps, in effect, were untrusted regardless of cert and therefore received the same selinux domain. This also had the unfortunate side effect of forcing certain third party apps into the wrong domains because of shared userid requests among apps. This patch removes that restriction and instead allows all apps, regardless of location, to be matched against the full mac_permissions.xml policy file. This then allows all apps signed with known good certs to receive the same selinux domains of other apps with whom they share trust. Change-Id: Iba569c046135c0e81140faf6296c5da26a243037 Signed-off-by: rpcraig --- .../com/android/server/pm/SELinuxMMAC.java | 36 +++++++------------ 1 file changed, 13 insertions(+), 23 deletions(-) diff --git a/services/java/com/android/server/pm/SELinuxMMAC.java b/services/java/com/android/server/pm/SELinuxMMAC.java index c78249b8eb95c..81302b9e2169f 100644 --- a/services/java/com/android/server/pm/SELinuxMMAC.java +++ b/services/java/com/android/server/pm/SELinuxMMAC.java @@ -346,31 +346,21 @@ public final class SELinuxMMAC { */ public static boolean assignSeinfoValue(PackageParser.Package pkg) { - /* - * Non system installed apps should be treated the same. This - * means that any post-loaded apk will be assigned the default - * tag, if one exists in the policy, else null, without respect - * to the signing key. - */ - if (((pkg.applicationInfo.flags & ApplicationInfo.FLAG_SYSTEM) != 0) || - ((pkg.applicationInfo.flags & ApplicationInfo.FLAG_UPDATED_SYSTEM_APP) != 0)) { + // We just want one of the signatures to match. + for (Signature s : pkg.mSignatures) { + if (s == null) + continue; - // We just want one of the signatures to match. - for (Signature s : pkg.mSignatures) { - if (s == null) - continue; + Policy policy = sSigSeinfo.get(s); + if (policy != null) { + String seinfo = policy.checkPolicy(pkg.packageName); + if (seinfo != null) { + pkg.applicationInfo.seinfo = seinfo; + if (DEBUG_POLICY_INSTALL) + Slog.i(TAG, "package (" + pkg.packageName + + ") labeled with seinfo=" + seinfo); - Policy policy = sSigSeinfo.get(s); - if (policy != null) { - String seinfo = policy.checkPolicy(pkg.packageName); - if (seinfo != null) { - pkg.applicationInfo.seinfo = seinfo; - if (DEBUG_POLICY_INSTALL) - Slog.i(TAG, "package (" + pkg.packageName + - ") labeled with seinfo=" + seinfo); - - return true; - } + return true; } } }