Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Relabelfrom SEPolicy violation of init process #62

Open
Flamefire opened this issue Dec 16, 2021 · 0 comments
Open

Relabelfrom SEPolicy violation of init process #62

Flamefire opened this issue Dec 16, 2021 · 0 comments

Comments

@Flamefire
Copy link
Contributor

Seemingly some (pre-treble) devices try to do something to the /system partition causing this denial:

avc: denied { relabelfrom } for comm="init" name="modules" dev="sda66" ino=1179683 scontext=u:r:init:s0 tcontext=u:object_r:system_file:s0 tclass=dir permissive=0 ppid=0 pcomm="swapper/0"

Adding allow init system_file:dir relabelfrom; is not possible as it violates a neverallow rule in system/sepolicy/public/domain.te:

# Nobody should be doing writes to /system & /vendor
# These partitions are intended to be read-only and must never be
# modified. Doing so would violate important Android security guarantees
# and invalidate dm-verity signatures.
neverallow {
    domain
    with_asan(`-asan_extract')
    recovery_only(`userdebug_or_eng(`-fastbootd')')
} {
    system_file_type
    vendor_file_type
    exec_type
}:dir_file_class_set { create write setattr relabelfrom append unlink link rename };

Should we care about this? Maybe add an ignore rule to init.te.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant