diff --git a/sepolicy/base/public/attributes b/sepolicy/base/public/attributes index 7561c01e1d5e1a1e3126f9b73c08f0bcb8dc7955..16d26748d3abe3adf4eb8abc40f637ec3c61592d 100644 --- a/sepolicy/base/public/attributes +++ b/sepolicy/base/public/attributes @@ -333,7 +333,9 @@ attribute violator_debug_domain_sa_lldb_server_file; attribute violator_lldb_server_file_entrypoint; attribute violator_lldb_server_transition; attribute violator_debug_domain_sa_lldb_server_transition; -attribute violator_lldb_server_ptrace; +attribute violator_domain_process_ptrace; +attribute violator_normal_hap_process_ptrace; +attribute violator_hap_domain_process_ptrace; attribute violator_ptrace_debug_hap; attribute violator_hap_domain_file_sock_file; diff --git a/sepolicy/base/public/domain.te b/sepolicy/base/public/domain.te index 4fc2fa1ed7cf407f5e963ca1404fb68f5976e180..22797a1dcde20985020edb97c965375b545192b4 100644 --- a/sepolicy/base/public/domain.te +++ b/sepolicy/base/public/domain.te @@ -283,7 +283,7 @@ neverallow { domain developer_only(`-wukong -aa -hdcd -sh -hnp -hnp_hap_domain_a #limit execmem use neverallow { domain -appspawn -hap_domain -isolated_render -rgm_violator_execmem } self:process execmem; -neverallow { domain -processdump -hap_domain -isolated_render -isolated_gpu developer_only(`-lldb_server -hiperf -native_daemon') debug_only(`-hiperf') -violator_lldb_server_ptrace } domain:process ptrace; +neverallow { domain -processdump -hap_domain -isolated_render -isolated_gpu developer_only(`-lldb_server -hiperf -native_daemon') debug_only(`-hiperf') -violator_domain_process_ptrace } domain:process ptrace; neverallow isolated_gpu {domain -isolated_gpu}:process ptrace; neverallow isolated_render {domain -isolated_render}:process ptrace; diff --git a/sepolicy/base/public/hap_domain.te b/sepolicy/base/public/hap_domain.te index 5bea395b6225e66bf4cccde9bf8474f90fd8cf9b..1292c5e171d41f5e23a4666a497104de542c1c27 100644 --- a/sepolicy/base/public/hap_domain.te +++ b/sepolicy/base/public/hap_domain.te @@ -21,7 +21,7 @@ typeattribute normal_hap normal_hap_attr; neverallow { normal_hap_attr -hap_domain_kernel_violators } { domain -normal_hap_attr }:file never_rw_file; neverallow { hap_domain -normal_hap_attr } normal_hap_attr:file never_rw_file; -neverallow { domain -normal_hap_attr -processdump developer_only(`-lldb_server -hiperf -native_daemon') debug_only(`-hiperf') -violator_lldb_server_ptrace } normal_hap_attr:process ptrace; +neverallow { domain -normal_hap_attr -processdump developer_only(`-lldb_server -hiperf -native_daemon') debug_only(`-hiperf') -violator_normal_hap_process_ptrace } normal_hap_attr:process ptrace; typeattribute system_core_hap hap_domain; typeattribute system_core_hap system_core_hap_attr; @@ -157,7 +157,7 @@ neverallow hap_domain domain:netlink_kobject_uevent_socket { write append }; #no use ptrace neverallow hap_domain { domain -hap_domain }:process ptrace; -neverallow { domain -hap_domain -processdump developer_only(`-lldb_server -hiperf -native_daemon') debug_only(`-hiperf') -violator_lldb_server_ptrace } hap_domain:process ptrace; +neverallow { domain -hap_domain -processdump developer_only(`-lldb_server -hiperf -native_daemon') debug_only(`-hiperf') -violator_hap_domain_process_ptrace } hap_domain:process ptrace; #hap don't bother other domain. neverallow hap_domain { domain -hap_domain }:process { sigkill sigstop signal };