1221803 - Remove system_data_file:file write permission for b2g domain

Status: RESOLVED FIXED

(Firefox OS Graveyard :: GonkIntegration, defect)

Description

[Julian Hector [:tedd] [:jhector]]

Currently the b2g domain is allowed to write files [1] which are labeled with system_data_file. This is the default type for files located in /data.

So far, this wasn't a problem, but shown Bug 1213259 Comment 32 and onward, the new Android M version contains a rule that prohibits to write to files labeled with system_data_file.

I filed this bug to investigate the possibility to remove this permission from the b2g domain, by either labeling files on the file system more specific or change code in Gecko. If at some point the decision is made that this would be too much work, this bug can simply be resolved to WONTFIX.

[1] https://github.com/mozilla-b2g/gonk-misc/blob/cc2d4f76e25677edb9016ce8c36b8ef24338489d/sepolicy/b2g.te#L136

Comment 1

[Julian Hector [:tedd] [:jhector]]

Attachment: Logged denials for system_data_file writes (on Sony Z3C)

I stripped the permission out of the policies and recompiled/flashed the phone without the permission to see what would have been denied.

This is the log of SELinux running in permissive mode.

Comment 2

[Julian Hector [:tedd] [:jhector]]

Based on some testing and the denials in dmesg etc, I could find the following files interesting:

> /data/local/permissions.sqlite
> /data/local/webapps/
> /data/b2g/mozilla/Crash Reports/InstallTime20151104213524
> /data/b2g/mozilla/ki5y3g1z.default/formhistory.sqlite
> /data/b2g/mozilla/ki5y3g1z.default/datareporting/aborted-session-ping.tmp
> /data/b2g/mozilla/ki5y3g1z.default/pkcs11.txt

On the file-system /data/b2g/ is labeled with system_data_file (can be seen with ls -Z).
I also believe that permissions.sqlite and /data/local/webapps/ is purely related to b2g.

Usually with SELinux it is the case that newly created files/directories inherit the domain from the parent directory, so even though the b2g process probably creates all/some of the profile files, they will be labeled with system_data_file.

I think we can solve this issue by creating a file type for b2g data files, and label /data/b2g and the before mentioned files in /data/local/ with that domain. Additionally all files created by a process running in the b2g domain should be labeled with that file type. 

This way we could avoid having b2g related files labeled with system_data_file which requires us to give system_data_file write privileges.

Comment 3

[Julian Hector [:tedd] [:jhector]]

what do you think of Comment 2 :kang? Does this sound like an acceptable solution?

I am going to make a PoC patch and see how it works out.

Comment 4

[Julian Hector [:tedd] [:jhector]]

Attachment: WIP Label b2g data files with a separate domain

This is a WIP patch to label all b2g related files in /data/ with the b2g_data_file domain and therefore effectively remove the need to write to files labeled with system_data_file.

Comment 5

[Julian Hector [:tedd] [:jhector]]

While testing the above WIP patch, I also tested removing more of the system_data_file rules, more precisely the following:

> allow b2g system_data_file:dir { open setattr rename read write rmdir remove_name create add_name };
> allow b2g system_data_file:fifo_file { open read setattr create getattr unlink };
> allow b2g system_data_file:file { lock open };
> allow b2g system_data_file:lnk_file { create unlink };
> allow b2g system_data_file:sock_file { create setattr getattr unlink };

It seems that these lines can be replaced with just:

> allow b2g system_data_file:dir { remove_name add_name };

During all my testing so far, it didn't seem to be a problem that those permissions are not granted.
I assume that this is because a lot of that file handling was done inside /data/b2g which was labeled with system_data_file while the rule generation was initially done.

Comment 6

[Guillaume Destuynder [:kang] [this account is no longer active]]

lgtm - and in fact this all makes sense.
I would favor adding the b2g data label because we'll need them anyway and it just makes sense (tm).

thanks for looking into it!

Comment 7

[Julian Hector [:tedd] [:jhector]]

Attachment: Bug 1221803 - Reduce system_data_file permissions r=kang

Comment 8

[Julian Hector [:tedd] [:jhector]]

Thank you very much :kang

Comment 9

[Carsten Book [:Tomcat]]

https://github.com/mozilla-b2g/gonk-misc/commit/9a58f2e395da17c252f61f28900b5b09aeb813bd