Re: [PATCH] ofono: introduce dedicated SELinux domain ofono_t

Hi Chris PeBenito,

Thanks for your comments.

On 1/22/2026 5:05 AM, Christopher J. PeBenito wrote:
> On 1/21/26 7:15 AM, Wei Deng wrote:
>> Currently, the ofono daemon runs in the generic `initrc_t` domain.
>> While functional, this configuration lacks proper process isolation
>> and violates the principle of least privilege.
>>
>> Define a dedicated domain (`ofono_t`) to confine the service, ensuring
>> it operates in a restricted environment isolated from other init
>> processes.
>>
>> Grant the necessary permissions to resolve AVC denials observed during
>> the transition to enforcing mode:
>>
>> *   DBus: Allow service registration on the system bus and communication
>>      with `org.bluez`.
>> *   Network: Allow `net_admin` capability and netlink socket creation
>>      (route and kobject_uevent) for rmnet and udev handling.
>> *   Filesystem: Authorize read access to configuration files in `/etc`
>>      and `/usr`, and traversal of `/sys` and `/run/udev`.
>> *   Logging: Allow write access to `/dev/log` for syslog integration.
>>
>> Signed-off-by: Wei Deng <[email protected]>
>> ---
>>   policy/modules/services/ofono.fc |  1 +
>>   policy/modules/services/ofono.if |  1 +
>>   policy/modules/services/ofono.te | 83 ++++++++++++++++++++++++++++++++
>>   3 files changed, 85 insertions(+)
>>   create mode 100644 policy/modules/services/ofono.fc
>>   create mode 100644 policy/modules/services/ofono.if
>>   create mode 100644 policy/modules/services/ofono.te
>>
>> diff --git a/policy/modules/services/ofono.fc b/policy/modules/services/ofono.fc
>> new file mode 100644
>> index 000000000..7b62f91a0
>> --- /dev/null
>> +++ b/policy/modules/services/ofono.fc
>> @@ -0,0 +1 @@
>> +/usr/sbin/ofonod    --   gen_context(system_u:object_r:ofono_exec_t,s0)
>> diff --git a/policy/modules/services/ofono.if b/policy/modules/services/ofono.if
>> new file mode 100644
>> index 000000000..7d99d1aa8
>> --- /dev/null
>> +++ b/policy/modules/services/ofono.if
>> @@ -0,0 +1 @@
>> +## <summary>ofono</summary>
> 
> Please add something descriptive about ofono here (a sentence or two) so readers can know what ofono does without having to look it up.

OK, will add description about ofono here in the next patch.

> 
> 
>> diff --git a/policy/modules/services/ofono.te b/policy/modules/services/ofono.te
>> new file mode 100644
>> index 000000000..faa48f1ed
>> --- /dev/null
>> +++ b/policy/modules/services/ofono.te
>> @@ -0,0 +1,83 @@
>> +policy_module(ofono, 1.0)
>> +
>> +########################################
>> +#
>> +# Declarations
>> +#
>> +
>> +type ofono_t;
>> +type ofono_exec_t;
>> +
>> +init_daemon_domain(ofono_t, ofono_exec_t)
>> +
>> +########################################
>> +#
>> +# Local Policy
>> +#
>> +
>> +# 1. Self Rules (Capabilities & Sockets)
>> +# --------------------------------------
> 
> Please remove these extra section titles here and below.

OK, will remove.

> 
> 
>> +allow ofono_t self:capability net_admin;
>> +
>> +# Socket permissions
>> +allow ofono_t self:bluetooth_socket create_stream_socket_perms;
>> +allow ofono_t self:netlink_kobject_uevent_socket create_socket_perms;
>> +allow ofono_t self:netlink_route_socket create_netlink_socket_perms;
>> +allow ofono_t self:unix_dgram_socket { connect create write };
>> +
>> +# 2. File System Access
>> +# ---------------------
>> +# Generic sysfs access using standard interface
>> +dev_read_sysfs(ofono_t)
> 
> Which sysfs entries are read?  We would like to tighten the controls on sysfs, so adding a coment here about what is read would be helpful, if possible.

Based on our testing and AVC analysis, ofono requires read access to generic sysfs_t entries for device discovery 
and enumeration. Specifically, it accesses:

- Bus traversal: Reading /sys/bus (to list available buses).
- Device Symlinks: Reading and resolving symlinks in /sys/bus/pci/devices/ (e.g., /sys/bus/pci/devices/0001:00:00.0).
- Device Properties: Reading uevent files within specific device paths (e.g., /sys/devices/platform/.../uevent) 
  to identify hardware capabilities and driver binding.

Since these paths are labeled with the generic sysfs_t type, the dev_read_sysfs interface is necessary to allow this 
enumeration. I will add a comment to the policy clarifying that this is used for PCI/Platform device discovery and 
uevent reading.

> 
> 
>> +# Read configuration files in /etc
>> +files_read_etc_files(ofono_t)
>> +
>> +# Read files in /usr
>> +files_read_usr_files(ofono_t)
>> +allow ofono_t usr_t:file map;
> 
> This should not reference types that are not defined in this module. You should call an interface in the files module, creating an appropriate one if needed.  This same change is needed several times below too.
> 
> Please see https://github.com/SELinuxProject/refpolicy/wiki/StyleGuide
> 

OK, thanks for your guide, will modify in the next patch.

>> +# Udev runtime access
>> +gen_require(`
>> +    type udev_runtime_t;
>> +')
>> +allow ofono_t udev_runtime_t:dir search_dir_perms;
>> +allow ofono_t udev_runtime_t:file read_file_perms;
>> +
>> +# 3. Logging
>> +# ----------
>> +logging_send_syslog_msg(ofono_t)
>> +
>> +# Access to devlog
>> +gen_require(`
>> +    type devlog_t;
>> +')
>> +allow ofono_t devlog_t:sock_file write_sock_file_perms;
>> +
>> +# 4. IPC / DBus / Network
>> +# -----------------------
>> +# Connect to the system DBus
>> +dbus_system_bus_client(ofono_t)
>> +
>> +gen_require(`
>> +    type system_dbusd_t;
>> +    type system_dbusd_runtime_t;
>> +    class dbus { acquire_svc send_msg };
>> +')
>> +
>> +# DBus specific service interactions
>> +allow ofono_t system_dbusd_t:dbus { acquire_svc send_msg };
>> +
>> +# Manual socket handling for system_dbusd
>> +allow ofono_t system_dbusd_runtime_t:dir search_dir_perms;
>> +allow ofono_t system_dbusd_runtime_t:sock_file write_sock_file_perms;
>> +
>> +# Bluetooth interactions via DBus
>> +gen_require(`
>> +    type bluetooth_t;
>> +')
>> +allow bluetooth_t ofono_t:dbus send_msg;
>> +allow ofono_t bluetooth_t:dbus send_msg;
>> +
>> +# Init interactions
>> +init_dbus_chat(ofono_t)
> 
> 

-- 
Best Regards,
Wei Deng