Give system execute label into service daemons.

Change-Id: I21b0d348c3d89fb5042fb78fb52c5bf2581cfcbb

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 43195f41131668438da352d2bdd5c502c2e9a893..2f1c16cb391bacbd69e650457dff2bd66d9a419c 100755 (executable)
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -18,6 +18,22 @@ IF(NOT "${PROFILE}" STREQUAL "tv")
 INSTALL(FILES ${CMAKE_SOURCE_DIR}/smack/smack_default_labeling DESTINATION /usr/share/security-config)
 ENDIF()
 
+IF("${ARCH}" STREQUAL "arm" OR "${ARCH}" STREQUAL "aarch64")
+    IF("${PROFILE}" STREQUAL "mobile")
+        INSTALL(FILES ${CMAKE_SOURCE_DIR}/config/service_list/target/mobile/service_daemon_list DESTINATION /usr/share/security-config)
+    ELSEIF("${PROFILE}" STREQUAL "wearable")
+        INSTALL(FILES ${CMAKE_SOURCE_DIR}/config/service_list/target/wearable/service_daemon_list DESTINATION /usr/share/security-config)
+    ENDIF()
+ENDIF()
+
+IF("${ARCH}" STREQUAL "i386" OR "${ARCH}" STREQUAL "x86_64")
+    IF("${PROFILE}" STREQUAL "mobile")
+        INSTALL(FILES ${CMAKE_SOURCE_DIR}/config/service_list/emulator/mobile/service_daemon_list DESTINATION /usr/share/security-config)
+    ELSEIF("${PROFILE}" STREQUAL "wearable")
+        INSTALL(FILES ${CMAKE_SOURCE_DIR}/config/service_list/emulator/wearable/service_daemon_list DESTINATION /usr/share/security-config)
+    ENDIF()
+ENDIF()
+
 INSTALL(FILES
     ${CMAKE_SOURCE_DIR}/packaging/security-config.manifest
     DESTINATION

diff --git a/config/service_list/emulator/mobile/service_daemon_list b/config/service_list/emulator/mobile/service_daemon_list
new file mode 100644 (file)
index 0000000..0462cac
--- /dev/null
+++ b/config/service_list/emulator/mobile/service_daemon_list
@@ -0,0 +1,42 @@
+/usr/bin/account-svcd
+/usr/bin/alarm-server
+/usr/bin/app2sd-server
+/usr/bin/auth-fw
+/usr/bin/bt-service
+/usr/bin/bluetooth-share
+/usr/bin/browser-provider
+/usr/sbin/buxton2d
+/usr/bin/key-manager
+/usr/bin/cert-checker
+/usr/bin/cert-server
+/usr/sbin/connmand
+/usr/sbin/connman-vpnd
+/usr/bin/csr-server
+/usr/bin/cynara
+/usr/bin/data-provider-master
+/usr/bin/dbus-daemon
+/usr/bin/deviced-vibrator
+/usr/bin/device-policy-manager
+/usr/bin/enlightenment
+/usr/bin/dlog_logger
+/usr/bin/download-provider
+/usr/bin/esd
+/usr/bin/lbs-server
+/usr/bin/media-server
+/usr/bin/mobileap-agent
+/usr/bin/msg-server
+/usr/bin/muse-server
+/usr/sbin/net-config
+/usr/bin/nether
+/usr/bin/nfc-manager-daemon
+/usr/bin/pkgmgr-server
+/usr/bin/phonenumber-utils-daemon
+/usr/bin/pkgdir-tool
+/usr/bin/privacy-guard-server
+/usr/bin/pulseaudio
+/usr/bin/sensord
+/usr/bin/focus_server
+/usr/bin/telephony-daemon
+/usr/bin/tlm
+/usr/bin/launchpad-loader
+/usr/bin/wrt-loader

diff --git a/config/service_list/emulator/wearable/service_daemon_list b/config/service_list/emulator/wearable/service_daemon_list
new file mode 100644 (file)
index 0000000..68bf1e0
--- /dev/null
+++ b/config/service_list/emulator/wearable/service_daemon_list
@@ -0,0 +1,39 @@
+/usr/bin/account-svcd
+/usr/bin/alarm-server
+/usr/bin/app2sd-server
+/usr/bin/auth-fw
+/usr/bin/bt-service
+/usr/sbin/buxton2d
+/usr/bin/key-manager
+/usr/bin/cert-server
+/usr/sbin/connmand
+/usr/sbin/connman-vpnd
+/usr/bin/csr-server
+/usr/bin/cynara
+/usr/bin/data-provider-master
+/usr/bin/dbus-daemon
+/usr/bin/deviced-vibrator
+/usr/bin/device-policy-manager
+/usr/bin/enlightenment
+/usr/bin/dlog_logger
+/usr/bin/download-provider
+/usr/bin/esd
+/usr/bin/gumd
+/usr/bin/lbs-server
+/usr/bin/media-server
+/usr/bin/mobileap-agent
+/usr/bin/msg-server
+/usr/bin/muse-server
+/usr/sbin/net-config
+/usr/bin/nether
+/usr/bin/nfc-manager-daemon
+/usr/bin/pkgmgr-server
+/usr/bin/phonenumber-utils-daemon
+/usr/bin/pkgdir-tool
+/usr/bin/pulseaudio
+/usr/bin/sensord
+/usr/bin/focus_server
+/usr/bin/telephony-daemon
+/usr/bin/tlm
+/usr/bin/launchpad-loader
+/usr/bin/wrt-loader

diff --git a/config/service_list/target/mobile/service_daemon_list b/config/service_list/target/mobile/service_daemon_list
new file mode 100644 (file)
index 0000000..587082a
--- /dev/null
+++ b/config/service_list/target/mobile/service_daemon_list
@@ -0,0 +1,47 @@
+/usr/bin/account-svcd
+/usr/bin/alarm-server
+/usr/bin/app2sd-server
+/usr/bin/auth-fw
+/usr/bin/bt-service
+/usr/bin/bluetooth-share
+/usr/bin/browser-provider
+/usr/sbin/buxton2d
+/usr/bin/key-manager
+/usr/bin/cert-checker
+/usr/bin/cert-server
+/usr/sbin/connmand
+/usr/sbin/connman-vpnd
+/usr/bin/csr-server
+/usr/bin/cynara
+/usr/bin/data-provider-master
+/usr/bin/dbus-daemon
+/usr/bin/deviced-vibrator
+/usr/bin/device-policy-manager
+/usr/bin/enlightenment
+/usr/bin/dlog_logger
+/usr/bin/download-provider
+/usr/bin/esd
+/usr/bin/lbs-server
+/usr/bin/media-server
+/usr/bin/mobileap-agent
+/usr/bin/modemd
+/usr/bin/msg-server
+/usr/bin/mtp-initiator
+/usr/bin/mtp-responder
+/usr/bin/muse-server
+/usr/sbin/net-config
+/usr/bin/nether
+/usr/bin/nvitemd
+/usr/bin/pkgmgr-server
+/usr/bin/phonenumber-utils-daemon
+/usr/bin/pkgdir-tool
+/usr/bin/privacy-guard-server
+/usr/bin/pulseaudio
+/usr/bin/sensord
+/usr/bin/focus_server
+/usr/bin/telephony-daemon
+/usr/bin/tlm
+/usr/bin/wfd-manager
+/usr/bin/wifi-loader
+/usr/bin/launchpad-loader
+/usr/bin/wrt-loader

diff --git a/config/service_list/target/wearable/service_daemon_list b/config/service_list/target/wearable/service_daemon_list
new file mode 100644 (file)
index 0000000..fe8da3a
--- /dev/null
+++ b/config/service_list/target/wearable/service_daemon_list
@@ -0,0 +1,41 @@
+/usr/bin/account-svcd
+/usr/bin/alarm-server
+/usr/bin/app2sd-server
+/usr/bin/auth-fw
+/usr/bin/bt-service
+/usr/sbin/buxton2d
+/usr/bin/key-manager
+/usr/bin/cert-server
+/usr/sbin/connmand
+/usr/sbin/connman-vpnd
+/usr/bin/csr-server
+/usr/bin/cynara
+/usr/bin/data-provider-master
+/usr/bin/dbus-daemon
+/usr/bin/deviced-vibrator
+/usr/bin/device-policy-manager
+/usr/bin/enlightenment
+/usr/bin/dlog_logger
+/usr/bin/download-provider
+/usr/bin/esd
+/usr/bin/gumd
+/usr/bin/lbs-server
+/usr/bin/media-server
+/usr/bin/mobileap-agent
+/usr/bin/msg-server
+/usr/bin/mtp-responder
+/usr/bin/muse-server
+/usr/sbin/net-config
+/usr/bin/nether
+/usr/bin/nfc-manager-daemon
+/usr/bin/pkgmgr-server
+/usr/bin/phonenumber-utils-daemon
+/usr/bin/pkgdir-tool
+/usr/bin/pulseaudio
+/usr/bin/sensord
+/usr/bin/focus_server
+/usr/bin/telephony-daemon
+/usr/bin/tlm
+/usr/bin/wfd-manager
+/usr/bin/launchpad-loader
+/usr/bin/wrt-loader

diff --git a/config/set_capability b/config/set_capability
index 7ac7440af7efbbde47cc7ab8bfb72b372a66bef5..9ced960978383effaefdb5c088cc86288a14d78e 100755 (executable)
--- a/config/set_capability
+++ b/config/set_capability
@@ -108,3 +108,11 @@ PATH=/bin:/usr/bin:/sbin:/usr/sbin
 /usr/bin/chsmack -a "System::Shared" /etc/group*
 /usr/bin/chsmack -a "System::Shared" /etc/gshadow*
 /usr/bin/chsmack -a "System::Shared" /etc/shadow*
+
+## Give "System" execute label which do not have cap_mac_admin
+service_list_path="/usr/share/security-config/service_daemon_list"
+cat $service_list_path | while read line
+do
+       /usr/bin/chsmack -e "System" $line
+done
+

diff --git a/packaging/security-config.spec b/packaging/security-config.spec
index 3c3bb0c77488dad7304960d41f16299a40672d51..4d7f0a182a01c5cebf5aba804330fd8c9dbee215 100755 (executable)
--- a/packaging/security-config.spec
+++ b/packaging/security-config.spec
@@ -66,3 +66,6 @@ mkdir -p /usr/share/security-config/log
 %attr(-,root,root) %{_unitdir}/multi-user.target.wants/security-config.service
 %attr(755,root,root) /usr/share/security-config/smack_default_labeling
 %endif
+%if ("%{?profile}" == "mobile" || "%{?profile}" == "wearable") && ("%{?_arch}" == "arm" || "%{?_arch}" == "aarch64" || "%{?_arch}" == "i386" || "%{?_arch}" == "x86_64")
+%attr(755,root,root) /usr/share/security-config/service_daemon_list
+%endif