From 60fbeee6f89e2a61417033a854b3d2fdfc9f1a58 Mon Sep 17 00:00:00 2001
From: Dariusz Michaluk <d.michaluk@samsung.com>
Date: Thu, 8 Mar 2018 15:12:55 +0100
Subject: [PATCH] Improve optee access control configuration

- drop optee supplicant daemon capabilities,
- run optee supplicant daemon under System::TEF Smack label,
- protect privileged device nodes with security_fw group and System::TEF Smack label.

Change-Id: Idda142be300c9db4d1ad79dda267e8ab051cedb9
---
 packaging/tef-optee-client.spec                       | 2 +-
 systemd/{90-teedaemon.rules => 90-teedaemon.rules.in} | 1 +
 systemd/CMakeLists.txt                                | 3 +++
 systemd/tef-optee.service.in                          | 1 +
 4 files changed, 6 insertions(+), 1 deletion(-)
 rename systemd/{90-teedaemon.rules => 90-teedaemon.rules.in} (62%)

diff --git a/packaging/tef-optee-client.spec b/packaging/tef-optee-client.spec
index 52db477..a5a25bc 100644
--- a/packaging/tef-optee-client.spec
+++ b/packaging/tef-optee-client.spec
@@ -27,7 +27,7 @@ Requires: tef-libteec
 %define build_unit_dir %{buildroot}%{_unitdir}
 %define optee_libteec %{lib_dir}/tef/optee/
 
-%define smack_domain_name System
+%define smack_domain_name System::TEF
 
 %define use_sqlfs 0
 
diff --git a/systemd/90-teedaemon.rules b/systemd/90-teedaemon.rules.in
similarity index 62%
rename from systemd/90-teedaemon.rules
rename to systemd/90-teedaemon.rules.in
index 249d8a6..f7c4c4a 100644
--- a/systemd/90-teedaemon.rules
+++ b/systemd/90-teedaemon.rules.in
@@ -1,2 +1,3 @@
 SUBSYSTEM=="tee", KERNEL=="teepriv[0-9]", TAG+="systemd", ENV{SYSTEMD_WANTS}+="tef-optee.service"
+SUBSYSTEM=="tee", KERNEL=="teepriv[0-9]", GROUP="security_fw", MODE="0660", SECLABEL{smack}="@SMACK_DOMAIN_NAME@"
 SUBSYSTEM=="tee", KERNEL=="tee[0-9]", GROUP="priv_tee_client", MODE="0660", SECLABEL{smack}="*"
diff --git a/systemd/CMakeLists.txt b/systemd/CMakeLists.txt
index f65e2c1..21faa51 100644
--- a/systemd/CMakeLists.txt
+++ b/systemd/CMakeLists.txt
@@ -24,6 +24,9 @@ PROJECT("tef-optee")
 CONFIGURE_FILE(${CMAKE_SOURCE_DIR}/tef-optee.service.in
                ${CMAKE_SOURCE_DIR}/tef-optee.service @ONLY)
 
+CONFIGURE_FILE(${CMAKE_SOURCE_DIR}/90-teedaemon.rules.in
+               ${CMAKE_SOURCE_DIR}/90-teedaemon.rules @ONLY)
+
 INSTALL(FILES
     ${CMAKE_SOURCE_DIR}/tef-optee.service
     DESTINATION
diff --git a/systemd/tef-optee.service.in b/systemd/tef-optee.service.in
index 590b242..341987b 100644
--- a/systemd/tef-optee.service.in
+++ b/systemd/tef-optee.service.in
@@ -7,5 +7,6 @@ After=opt.mount
 User=root
 Group=security_fw
 SmackProcessLabel=@SMACK_DOMAIN_NAME@
+CapabilityBoundingSet=
 ExecStart=@SYSTEMD_CFG_BIN_DIR@/tee-supplicant
 RuntimeDirectory=@SERVICE_NAME@
-- 
2.34.1