text:
UPS standard delivery: Free delivery for every purchase
Items 1-20 of 99
You can unsubscribe at any time by using the unsubscribe link in each newsletter. In accordance with the applicable regulations, we remind you that you have a right of opposition, a right of rectification and a right to limit the processing of your data. To exercise these rights or for any question about the processing of your data and their use, you can contact us at the following address: firstname.lastname@example.com


text:
Our house cleaning services are comprehensive, and consistently so. The scope of house cleaning services is flexible: we clean your house, your way. The best house cleaning companies in your area are those who have the highest retention rates among their maids and clients. We provide exceptional house cleaning services for all of our service areas.
Book your appointment.
Sit back and relax. Enjoy your sparkling home!
We're the source for exceptional house cleaning solutions, offering a deeper, more efficient clean. Our services are 100 percent family-safe and eco-friendly home cleaning, which provides remarkable sparkle and glow. We give a comprehensive, comprehensive clean which protects every area of your house while eliminating odors.
If you're interested in a maid service, our maid services are the best companion for you. Our Cleaning Professionals have several years of critical experience to service your house while taking care of all your needs and requirements. Having several years of expertise, we have managed to meet every one of our client's needs. We service the greater Raymond, New Hampshire area.
An initial cleaning takes little extra time to get your home to 100%! We understand all of the hard to reach areas.
Deep cleaning is an excellent choice for homes that need a little more attention. You can always start with the initial clean, and we will call to upgrade if we find it necessary.
A beginning or end of tenancy house cleaning, including the insides of all closets, cabinets, drawers, inside the refrigerator, and all surfaces.
Our regular house cleaning to keep your home looking great. Deep cleaning items will be rotated in as needed, so no need to do a yearly deep clean.
A clean home provides a wide selection of physical, psychological, and psychological benefits. If you clean your home regularly, you are making sure everything is in great shape. Also, a well-kept home saves a great deal of cash as you don't have to invest in replacing furniture, carpets, and many other household items that tend to become destroyed from a cluttered house. Ill-maintained homes consistently have pollen, dust, pathogens, allergens, and different varieties of germs, together with poor indoor air quality, which makes you vulnerable to a good number of health complications. If you would like to breathe clean air, you need to clean your property. It feels great to wake up to a fresh house clear of clutter and filled with fresh air.
Family and work duties make it hard for many people to find the time to clean their homes. Even if they manage to find the time, they might rush things and will probably clean just a few crucial areas rather than the whole house. Different areas will be left unaffected, and the dirt, grime, dust, allergens, and bacteria present in such regions induce unwanted health complications. Another essential aspect of making a note of is that homeowners don't possess the abilities and expertise of specialist cleaning service suppliers — their cleaning procedures do not eliminate all impurities. All these aspects suggest that you want to employ a professional cleaning company to attain the deserved and expected results. We service the greater Raymond, New Hampshire area.
On top of that, our maid service means that you can get your house cleaned the way that you want, by selecting how frequently we clean for you in addition to the number of hours and cleaning that you want. We're fully bonded and insured.
We are wholly dedicated to providing high-quality neighborhood home cleaning solutions that fulfill the distinctive needs of every one of our clients. Not only will you benefit from our customized approach to the cleanup procedure, but you will also get access to the numerous benefits our state-of-the-art resources and best-in-class methods we supply. Eventually, they can go through the careful care of a different cleaner in addition to the commercial-grade processes of a"big brand" business when you decide to associate with our regional house cleaning services.
We wish to take out the strain of performing household tasks, and that means you don't need to find the time to do things such as vacuuming, scrubbing, or dusting.
Tip: To prevent mildew be sure to keep surfaces clean, improve air circulation when possible, and reduce wetness or dampness (for example, do not bunch wet washcloths). In poorly ventilated rooms, install open shelving and store items in airtight plastic containers with desiccants (silica gel). In musty closets, leave an incandescent lightbulb on to dry the air or hang packets of desiccants.
Tip: Dusting (go left to right, top to bottom) with microfiber cloths. This action lowers allergens and improves the air quality in your house. Dampened towels tied to the ends of mops and brooms work brilliantly for removing cobwebs.
If you're interested in a Cleaning Professional, our maid services are the best companion for you. Our Cleaning Professionals possess several years of critical experience to absolute service your house while adapting to all your needs and requirements. Having several years of expertise, we have managed to meet every one of our client's needs. Whether you aren't sure who's your best maid to select, or what is the very best method to take care of your housekeeper in some specific scenarios, do not worry. We've got the knowledge and expertise required to offer you proper solutions.
We also advise our Cleaning Professionals if any problems arise. We are so confident in our solutions since our Cleaning Pros are selected and educated by us. That is precisely what makes us very different and distinctive from the rest of the maid service businesses. To be the best, we've taken into consideration all of the cleanliness and other capacities of our Cleaning Professionals to satisfy your criteria and expectations.
Tip: You should clean your oven glass without harsh chemicals if you can. One of our favorites is using wet and dry Magic Erasers. We use these to clean all the grease and grime from oven glass. Start scrubbing in small sections until the entire glass is clean. You will love the results!
If you're residing in an apartment, then you're probably living in a city with a temperate atmosphere. This dust is due to traffic on streets and other polluting actions by the different residents of the region. Walls of houses also tend to collect cobwebs and other mold and fungi on moist walls because of moisture-laden chambers.
Every individual that has a home will love to have clean flooring. You'll have the same requirement even when you're renting a house since cleanliness is an issue of excellent health. A new apartment is one where you're delighted to go back to, have guests over, and you and your family are protected and disease-free. Learn how to pick things up and keep them within their appropriate places. Never leave food or perhaps scraps on the desk, since this will attract rodents and other pests such as rodents and cockroaches. Have a routine schedule for washing up your house, and make sure that you adhere to it. In the end, a clean home is something which you could remain pleased with, and it's a rare visitor that won't comment on the efforts you've taken and that are so readily observable.
If you would like to keep a clean home, aside from the clear vacuum cleaner, brooms, and mops, you'll require a supply of cleaning solutions. Be in sync with all the contemporary world, and select goods that are environmentally and green-friendly, and you'll end up living in a more healthy house. Most home cleaning begins with vacuuming or utilizing a broom on the flooring to remove all of the dirt and dust that has accumulated since your past cleaning attempts. You will then use a mop to make sure that the floors are clean and glossy as you want to view them. Other than that, you'll also need to dust surfaces, beginning from tables, cabinets and countertops, window sills, and any flat surface, which reveals a propensity to collect dust.
You'll also need to eliminate all dust gathered on furnishings and furniture though this might not be quite as obvious. You then must get down to cleaning the walls and floors of kitchens and bathrooms, which are extremely vulnerable to germs, due to the use that's made of those chambers. This is a job that's quite demanding and essential if you're supposed to live a disorder free in your home.

subset: commoncrawl


text:
WASHINGTON — Here is my nomination for the lowest moment of the "fiscal cliff" debate. Right before Christmas, President Obama met with Speaker John Boehner in the Oval Office. "He told Boehner," according to The Wall Street Journal, "that if the sides didn't reach agreement, he would use his inaugural address and his State of the Union speech to tell the country Republicans were at fault."
Forget Thomas Jefferson's First Inaugural: "We are all Republicans, we are all Federalists." Forget Abraham Lincoln's Second: "With malice toward none." Obama's Second Inaugural might drop a few choice one-liners on the elected Republicans gathered behind him on the West Front of the Capitol. Maybe he could have a struggling middle-class family hold the Bible as he takes the oath. Maybe Joe Biden could lead the crowd in a little chant: "Hey! Hey! The wealthy need to pay!"
It is bad enough that an American president should threaten to deploy his inaugural address in a vicious budget debate. It is worse that the threat seemed credible and unexceptional. Usually a presidential election involves a reset of American politics, with both sides (at least temporarily) forced to engage in the rhetoric and rituals of healing and unity. The 2012 election was not even a short pause in our swift partisan descent.
In cliff negotiations, Obama had one overriding goal: to make Republicans vote for rate increases on the wealthy. For 20 years the refusal to raise taxes has been one of the core issues that held together the disparate groups of the GOP. If Obama saw his job as bringing together a broad coalition to fix the long-term debt problem, he would have maneuvered Democrats to take on some of their core issues as part of a package, just as Republicans had to do. But Obama did not view his job this way. He wanted Republicans to swallow their humiliation pure.
Congressional Republicans are left with less influence than some apparently think. The debt ceiling is a form of leverage they can't responsibly use. A partial government shutdown or full implementation of the sequester are less toxic alternatives, but of questionable utility. (Threatening liberals with the prospect of huge defense cuts — a part of the sequester — is an attempt to menace them with their deepest desire.)
Given this weak Republican position, Obama must be tempted by a shiny political object: the destruction of the congressional GOP. He knows that Republicans are forced by the momentum of their ideology to take positions on spending that he can easily demagogue. He is in a good position to humiliate them again — to expose their internal divisions and unpopular policy views. It may even be a chance to discredit and then overturn the House Republican majority, finally reversing his own humiliation in the 2010 midterms.
This has left him with one economic approach: Raise taxes as much as possible, shift the burden to those he doesn't care about, and do as little as possible to slow spending growth, buying time until he can raise taxes again.
Some conservatives are convinced that this is the full emergence of Obama's democratic socialism. This explanation is not required. Obama probably still views himself as a pragmatist. He may comfort himself that he will take incremental action on Medicare in due time. But at this moment three factors overlap: his liberal policy instincts, a political opportunity to break his opponents, and the massively inflated self-confidence produced by re-election. So, force the GOP to surrender on the debt limit, with nothing in return. Require Republicans to accept new taxes in exchange for any real spending reductions. If they agree, their caucus is fractured (again). And if they refuse (which they are likely to do), paint them as obstructionists and extremists who are willing to destroy the economy/the nation's credit rating/the military for their own ideological purposes.
There is one main downside of this approach. It delays any serious action on long-term debt for at least another two (and probably four) years. It is the path of a government that moves from fiscal crisis to crisis, gradually undermining global confidence that it can manage its own affairs. An economy in which uncertainty, slow growth and high employment become norms. A federal budget increasingly devoted to entitlements at the expense of other purposes, including defense — eventually undercutting our international influence in the same way that Europe has become depleted, insular and toothless.
Obama's short-term political calculations are understandable. It is the cost to posterity that is unreasonable.
Michael Gerson's email address is email@example.com.


text:
"LANAP" Laser & Restorative
Dentist - Cerritos
10929 South Street
Cerritos, CA 90703
(562) 860-6587
Our team of dental specialists and staff strive to improve the overall health of our patients by focusing on preventing, diagnosing and treating conditions associated with your teeth and gums. Please use our dental library to learn more about dental problems and treatments available. If you have questions or need to schedule an appointment, contact us.
The LANAP Procedure – Dr. Robert H. Gregg II, D.D.S.
Dentures today are made from very advanced materials designed to give you a natural appearance.
However, keep in mind that just like your teeth, dentures should be cared for with the same diligence. This means daily brushing and regular visits to your dentist.
Regular visits to your dentist are critical. Your dentist also can make minor adjustments that ensure that your dentures continue fitting naturally and comfortably.
Just like natural teeth, dentures need to be cleansed of plaque, food particles and other debris. Keeping your dentures in top shape will also help keep the soft tissues of your mouth healthy; an unclean or malformed denture can cause infections and irritation.
Remember to rinse and brush your dentures after every meal, and soak them in denture solution overnight. This also allows your gums to breathe while you sleep.
Here are some simple techniques for keeping your dentures clean:
Over time, even daily care of your dentures may require them to be cleaned by the dentist. A powerful ultrasonic cleaner may be used to remove hard accumulations of tartar and other substances.


text:
Obama vs. Romney, Round 3: Highlights From the Final Presidential Debate
Tonight in Boca Raton, Florida, President Barack Obama and Governor Mitt Romney sat down for their third and final debate before the upcoming election. Bob Schieffer of CBS News was the moderator. The debate's focus was foreign policy.
Here are some noteworthy moments from the discussion:
This time, like in the first debate, Obama wore a blue tie and Romney a red one. It was switched in the second debate.
On the Middle East in general:
- Romney, after congratulating the president on the killing of Osama Bin Laden: "We can't kill our way out of this mess. … We must have a comprehensive strategy to combat this kind of extremism. … The key is to get the Muslim world to reject extremism on its own."
- Obama: "The 1980s are calling and asking for their foreign policy back. … You seem to want to import the policy of the 1980s, the social policies of the 1950s and the economic policies of the 1920s."
- Romney: "Attacking me is not an agenda."
On Syria: Neither candidate said he wanted American troops directly involved. They seemed to largely agree on most policy here, even if they tried to pick smaller fights.
- Obama: "I am confident that Assad's days are numbered."
- Romney: "Assad must go. I believe Assad must go."
On Egypt:
- Obama: "They have to abide by their treaty with Israel. That is a red line for us."
- Romney turned the discussion back to the economy: "For us to be able to promote the principles of peace requires us to be strong. And that begins with a strong economy."
- Romney: "We are the great nation that has allies, 42 around the world."
On what America's role in the world is:
- Romney: "America has the responsibility and privilege of helping defend freedom and promote the principles that make the world more peaceful."
- Obama: "America remains the one indispensable nation … and it is stronger now than it was when I came into office."
Both men used this opportunity to pivot to the economy.
- Obama said Romney wanted to take the country back to the policies of George W. Bush and Dick Cheney.
- Romney: "I know what it takes to create 12 million new jobs and rising take-home pay."
After a brief talk about education policy, the moderator tried his hardest to bring things back to foreign policy, but that didn't last long.
- Obama, regarding Romney's comment that we have fewer ships than we did in 1916: "We also have fewer horses and bayonets. We have these things called aircraft carriers where planes land on them. We have ships that go underwater, nuclear submarines."
On Israel and Iran:
- Obama: "I will stand with Israel if they are attacked."
- Romney: "I would make sure Ahmadinejad is indicted under the genocide convention."
- Romney: "Mr. President, America has not dictated to other nations. We have freed other nations from dictators."
- Obama: "It was worth moving heaven and earth to get [Bin Laden]."
On Afghanistan:
- Romney: "We'll be finished by the end of 2014 ... The surge has been successful."
- Obama: "There's no reason why Americans should die when Afghans are capable of defending their own people. … After a decade at war… it's time to do some nation-building at home."
On China:
- Romney: "It's not government that makes business successful. … We'll make sure that we have trade relations with China that work for us."
- Obama: "U.S. exports [to China] have doubled since I've come into office."
Bob Schieffer concluded the debate by mentioning one point of agreement between the two candidates: "I think we all love teachers."


text:
Sell your Google Play gift card on Raise to get cash back. We suggest you discount your Google Play gift card between 2% and 20% off, but with Raise, you have the freedom to choose the selling price! Our secured gift card marketplace is full of buyers searching for discount gift cards, so your Google Play gift card is sure sell quickly. Just fill out the form below to get started.
|Listing a Card
|It's always free to list gift cards for sale.
|Selling a Card
|15% is deducted from the selling price when the card sells.
|Electronic Delivery
|Over 90% of cards are delivered electronically. We send them to the buyer for you, free of charge.


text:
Flyers All-Star Claude Giroux received the wakeup call he waited to hear for 113 days.
Locked out for months, the NHL was indeed ready to drop the puck.
"It's a beautiful day for Hockey," he posted Sunday on Twitter.
Call the overseas players and tell them to come on home to New Jersey and Pennsylvania and other states where the NHL only existed in the form of messy labor updates. The NHL and the players' association agreed on a tentative pact to end the lockout and save what is left of a fractured schedule.
"I'm ready to play," Flyers veteran defenseman Kimmo Timonen said. "We're just waiting for the season to get started. It's been a long four months."
But, finally, fans can stop thinking about board rooms and talking heads dressed in suits. Rather, it's time to get ready for Sid the Kid. It's time for the Los Angeles Kings to go defend the Stanley Cup. It's time to watch your team play, oh, about four times per week.
Sure, the Winter Classic was wiped out. The All-Star game went bust.
But at 48 or 50 games, it's still hockey at the highest level.
One of the questions that arises now, of course, and after any sort of stoppage for that matter, is will the fans come back? This is the third labor dispute in Commissioner Gary Bettman's tenure, and though the fans returned in the past, the jury is out this time.
NHL fan Steve Chase started the grass roots "Just Drop It" campaign that encouraged fans to skip one NHL game for every game canceled after Dec. 21st. He asked fans to pledge they would not spend a penny or a minute of their time on tickets, TV, merchandise, all things NHL.
Nearly 21,000 fans had clicked the "like" button on the group's Facebook page by Sunday afternoon. And Chase, who lives in Los Angeles, wrote on the site he would stay true to his commitment.
"AS IT STANDS RIGHT NOW: Games canceled from Dec 21 to Jan 14th average out to 10 per team," he wrote. "They took 10 from us, we'll take 10 from them. No tickets, no TV, no merchandise."
Chase said there was growing sentiment among his friends to skip the entire season. He said the league and players didn't think enough about the part-time employees and local businesses who needed the sport to help survive the winter months.
"Look at all the bars around the rinks and all the shops that sold jerseys. They're all getting killed," he said by phone. "We kept promoting, go to those bars and buy pizza. Keep them going. When hockey comes back, you're going to want somewhere to go."
At downtown Detroit's Rub BBQ Pub, manager Chris Eid said he was "ecstatic" when he heard the news Sunday morning. And the settlement and the promise of a return to NHL action was a big topic of conversation among his afternoon customers, he said.
"Everyone misses hockey," Eid said. "And now we're getting it back."
Many of the NHL players can understand the chilly reception from the fans.
"To the fans that won't come back, I can understand," Phoenix Coyotes forward Paul Bissonnette wrote on Twitter. "To the ones that will, thank you for your patience. Welcome back NHL hockey."
Amid the realization they'll have to repair the damaged relationship with the die-hards, Flyers chairman Ed Snider told The Associated Press he hoped the fans returned to support the league.
"I'm hoping that our fans understand this was something that had to be done for the strength of the league, for the strength of the Players Association," Snider said by phone. "I hope they don't hold it against us and just come out and see some great hockey. If I had to guess, I think we're going to be in great shape."
The Nashville Predators encouraged fans to wear team colors on Monday in a show of solidarity. Tennessee Titans quarterback Matt Hasselbeck tweeted, "Welcome back!" at a trio of Predators.
It won't be a rosy return for every player. The New Jersey Devils have four players still overseas, including star forward Ilya Kovalchuk, who could well become the team's captain now that forward Zach Parise is in Minnesota. Giroux (neck) and his Flyers teammate, forward Danny Briere (wrist), were injured in their European stints. Giroux is expected to be ready for training camp. Briere's status is unknown.
The players have been locked out since Sept. 16, the day after the previous agreement expired. That deal came after an extended lockout that wiped out the entire 2004-05 season.
Coyotes captain Shane Doan said the players agreed to the best deal it could thanks to union executive director Donald Fehr.
"From being in the room quite a bit, there was a sense this was the best deal available," he said in New York. "It's always tough because we're all fans of the game and we wish we didn't have to go through this. But we did, and we're on the other side now."
All games through Jan. 14 had already been canceled, claiming more than 50 percent of the original schedule. Teams will hold a brief training camp, maybe a week, before starting at least a 48-game season.
"Training camp, usually you do three days then you start exhibition games," Flyers forward Max Talbot said. "I believe it's enough. Sometimes training camp is too long. It's nice to get in the action. Forty-eight games in a little bit of time ... I think it would be exciting."
The Flyers, Bruins and the Sidney Crosby-led Penguins were among the teams that worked out on their own, some paying for ice time at their team's own practice rinks.
Bruins captain Zdeno Chara was set to return to North America this week after playing for Prague Lev of the KHL. The Russian league was a popular landing spot for locked-out players, who decided the structure — and payday — was worth the risk of injury as they waited out the dispute.
"It was fun, it was great to be doing the practices and being with my (Bruins) teammates," Chara, a defenseman, said. "At the same time, it wasn't organized hockey under some kind of a system and schedule. That's why I choose to go to Europe and play over here."
Well, he can pack his sticks and catch a plane. That practice ice time price is about to get slashed to "free."
Flyers forward Jody Shelley said teammate Scott Hartnell gave him the good news the lockout was about over via a text at 5:30 a.m. Sunday. Shelley expected more of his teammates to trickle in this week to the Flyers' New Jersey training facility.
"We can get back as a group, get back as a team," he said. "We're the Philadelphia Flyers. That's what we want to be, all of us. We left there last May and we couldn't wait to get back in September and get at it.
Four months later, it's time to play. Finally.
Game on.


text:
The National Law Center on Homelessness & Poverty is a leader in the national movement to prevent and end homelessness. Through policy advocacy, public education, and impact litigation, our team addresses the root causes of homelessness and meets both the immediate and long-term needs of homeless and poor people.
To learn more, visit: www.nlchp.org.


text:
MyMediTravel currently has no pricing information available for Hearing Assessment procedures in Bucharova. However, by submitting your enquiry, you'll hear back from the facility with more details of the pricing.
A reliable Institution with qualified employees. At the beginning I was very unsure, wether we would be successful there. Today I am happy to have gotten the gift of a wonder on the second try. So, so happy, thank you!
At MyMediTravel, we're making medical easy. You can search, compare, discuss, and book your medical all in one place. We open the door to the best medical providers worldwide, saving you time and energy along the way, and it's all for FREE, no hidden fees, and no price markups guaranteed. So what are you waiting for?
Hearing Assessment is a non-invasive medical procedure that does not require surgery. This type of Ear, Nose and Throat (ENT) procedure / treatment is very affordable the world over, and particularly in Bucharova - this is mostly because the skill set, experience and equipment required by the specialist doesn't need to be especially advanced. For Hearing Assessment, medical records, reports or any supporting documents may be required for the specialist to assess prior to the treatment.
Given the non-invasive nature of Hearing Assessment, there is no downtime, so you won't need to consider your recovery and aftercare much. However, if a consultation leads on to surgery, then you should expect to follow that with an extended period of rest.
Depending on how many sessions or follow ups you require, you can expect to leave Bucharova immediately after. In most cases, the success of the outcome can be judged by yourself.
Whilst the information presented here has been accurately sourced and verified by a medical professional for its accuracy, it is still advised to consult with your doctor before pursuing a medical treatment at one of the listed medical providers. This content was last updated on 22/01/2023.
Enquire Now


text:
The Rolling Stones frontman told BBC Radio Friday that his music career has not been challenging intellectually and that teaching might have been "gratifying" instead. He also said he had considered becoming a politician or a journalist when he was a teen.
Instead he has become one of the most successful rock singers in history.
Despite his interest in other careers, Jagger says he's "very pleased" with how things have turned out.
The band is marking its 50th year together with a series of concerts that will also include a first ever appearance at the Glastonbury festival this weekend and a return in July to Hyde Park in central London.


text:
Rule #1 - Be Patient - Rule #2 - Don't ask when, if you don't contribute - Rule #3 - You have coding skills - LinuxMCE's small brother is available: http://www.agocontrol.com
I've already reinstalled 0810 but will install 1004 on second disc tomorrow and post 70-persistent-net.rules. Hardware works fine with 0810 installation and i double checked every piece of hardware while trying to setup 1004.
Hi L3mceI did a fresh install off the previously mentioned snap. and after the reboot I got the following screen.http://i934.photobucket.com/albums/ad184/PreDeToR_/LinuxMCE/photo2.jpghttp://i934.photobucket.com/albums/ad184/PreDeToR_/LinuxMCE/photo1.jpgAs you can see it uses only a small section of the screen and goes straight to the "if you can see and hear me" video.I then popped into terminal and tried running the AVWizard and AVWizard Wrapper, I can get/set the settings there, but it doesnt seem to save them.Is there any logs or other information that I can give you?


text:
Fellow Dog Owner, If You'd Cry If Your Dog Died, Then You Need To See This..
"Discover The Deadly Secret The Dog Food Industry Is
Spending Millions To Make Sure You Never Find Out"
The 'Secret' reason every dog, including yours, is now at risk of an early death!
Why continuing with your current system of care will cut your dog's life short by up to 8.3years
The greedy billion-dollar companies spending millions to keep the truth hidden from you!
The 3 quick & easy steps you MUST take today to prevent your dog's early, painful death
"See What Other Dog Owners Are
Saying About Dog Food SECRETS"
Customer comments
Justin Kyle
If I hadn't seen it with my own eyes I wouldn't believe it! My dog actually looks younger, it's amazing.
He's also got much more pep.
He slowed down somewhat in the last few years and I put it down to approaching old age, but since I started feeding him the way you teach, he's had a new burst of life!
Once again he's running instead of walking, alert instead of sleeping... it's like having the young-guy back again, I love it.
Pretty sure he's rather pleased as well!
Cassie Overton
Sweetpea, my Shitzu is the love of my life!
Every time I bought a tin of dog food for Sweetpea, I stressed over what I would be feeding her because reading the double-talk (as you call it) on the can labeling is frustratingly difficult.
Now, after reading your book, I know exactly what to look for and what to avoid in dog food ingredients.
I love my dog and want to care for her the best I can, thanks for making that possible Andrew!
Thank you,
PS. I visited your site today and see you've added the Confidential Dog Food Report, it looks perfect for people like me who love their dogs but don't have the time to cook home meals... count me in for a copy
Dr. David Huddlestonsmith, M.D.
"Dulcinea had loose stools and skin difficulties from 8 weeks when I picked her up at the breeders. I tried basically every dog food on the market, but without success.
She developed such bad hot spots that I tried Benadryl which helped a bit, but then finally gave her 2 steroid injections (I am a retired Physician).
The hot spots disappeared, the skin calmed down, but then she started to lose her hair in spots all over her body. What had I done to m' Lady???
After trying every skin remedy out, I finally
Dulcinea 1 month after Dr Huddlestonsmith began follwing our
advice, the mange is cured & hair almost completely grown back in.
took her to the vet. Skin scrapings showed generalized Yellow Mange.
The first advice [from the vet] was to put her down; now that really irked me, as the vet had not listened to the whole story. (By the way, she still had loose stools with mucus daily; foul smelling).
At 14 months, I wasn't about to put this fine lady down, so got to researching.
The Ivermectin Injections have killed the mange, the hair is growing back in, but the skin remained horribly inflamed.
Then, I purchased your "Gold Package", and finally realized that she was having food allergies to much of the crap that was in her dog food.
I have switched her over to home cooked meals, as outlined, and she no longer has loose, foul smelling stools, and her skin is almost totally back to normal in less than one month!
Thank you so very much for doing what no vet would take the time to investigate and recommend to me...other than to "put her down".
I have 4 other Bloodhounds (from 10 months up to 4 years old), and 5 puppies from a litter of 15. They all are getting the "good stuff", and finally love their food (instead of leaving it in the bowls).
Now the Knight-n-Troll's Sleuthhound Kennels recommends this diet and book to all that come to check out our dogs/purchase puppies."
Darlene Christchurch
The biggest of our 3 kids is a beautiful 59kg (130 lb) Rottweiler called Maxine.
My other 2 kids (both human) , my husband and I are all quite sporty so it was a source of amusement amongst our friends that Maxine was a fatty!
I didn't like to hear her teased but as far as we knew, we were feeding her a decent diet of commercial dog food.
When I saw your book shows how to prepare calorie controlled meals for dogs, I knew I must find out how.
...and the results are astounding! She obviously looks better but to our surprise also has better breath, smaller, less stinky poos and seems to have improved self-control which we guess is from an improved diet.
Now she's a beautiful beast for sure, a few more pounds and Maxine will be the cutest dog in town!
Mercedes Dublin
I had big problems as one of my dogs, a mungril called Allie gained a lot of weight and I couldn't tell why cause she only eats dry dog food.
My other dog, a bearded collie called Panda, was quite slim as she didn't like that food and only ate a little when she was starving.
Since I tried your recipes, not only Allie lost a lot of weight and is happier, Panda loves the food and licks the bowl when finished!!
Their feces are not as smelly and are smaller and dry. And their coats are really shinny and moist!!
It's been only a couple of months and the difference is huge.
I'm never buying commercial dog food again as I wonder now what was I giving to my dogs before. And it's costing me much less as well.
Thank you for your books. They opened my eyes.
Betty White
Hi, My husband and I raise Rough Collies.
Brandy is our female, a beautiful sable and white.
Unfortunately, she was not doing well on store bought dog kibbles. Her coat was not growing in and she shed a lot- lots more than I believe Collies should!
I searched the internet looking for answers since most breeders and vets recommend only high price dog food. Since we have 4 dogs we didn't want that expense.
I found your site and bought you e-books. Since we were already feeding table scrapes it made sense to me to go that way.
Now [since following your recipes and feeding advice], Brandy has a beautiful coat, lots of energy, and smells really good. As an added bonus since we always sprinkle garlic on their food, none of our pups have fleas!
Brandy will turn 2 yrs old in a few weeks and just delivered 11 healthy collie pups less than 2 days ago! She has her figure back, is eating well and her coat looks great!
I'm convinced it's because we feed her "people" food. She is getting a cup of puppy chow along with her good food as she is nursing so many pups.
Right now I have her on a high protien diet.
The proud papa, Duke, is on the same diet and he looks stunning also. We also have a 10 yr old terrier and a mixed breed that are looking and acting younger since on this diet.
Everytime we bring them to the vet's she is amazed at what good shape they are in and how clean they are. I tell her it's their diet. I only wish I had your books a few years ago for my GSD. I know it would have helped her too.
Thanks for setting us on the right track so we can enjoy many years with our beloved fur babies!
Michelle Schroder
The reason I got Dog Food Secrets was because a few months ago my cat Siris died at age 3 from kidney failure.
I was devastated.
Mia (my new puppy) has helped me deal with that. I am still having a hard time coping when I think of how Siris suffered.
I won't make the same mistake with Mia.
Being just a puppy, I don't have any wonderful stories for her. But I do have an uplifting story from Buddy.
Buddy is 7 years old (he is my brothers dog). Buddy had been having some joint problems and tiring very quickly.
Some kind person warned me that big dogs don't live as long as smaller dogs. I am sure they were trying to prepare me for what they thought were his last days.
When I found Dog food secrets, I started Buddy on the food as well. He is now keeping up with Mia who is 4 months old.
Unfortunately, his joints are feeling so much better, that he feels the need to jump the fence again. We were amazed to see him not only jump the fence but clear it by a foot! .
I am very please that he doesn't smell like he used to. He doesn't have as much gas and his breath has improved.
I look forward to many more years with Buddy and a long happy life with Mia.
Thank you!
Mary Sutter
Hope is 2 yrs old and Faith is 6 months they are both Mini Australian Shepherds.
Hope was 38 pounds and the vet was very unhappy. Of course we love our girls very much and love to give them treats.
I have started using your recipes for the past 2 weeks and Hope has dropped 1/2 lb which isn't a huge amount but it is a start in the right direction.
Because of Hope's weight she was very sluggish and didn't play with Faith too much.
Since using your recipes for her treats and changing their dog food to one you recommend, she is as full of life as a 2 yr old should be.
I haven't yet had a chance to try the food recipes but the treats are a big hit.
I can only hope that both my girls live to the ripe old age of 27+. Thank you very much for the recipes and the information.
The girls like homemade much better than store bought. Plus it saves TONS of money and I know what they are eating.
We always watch what we eat but until your book I never really thought about what was in their dog food.
For treats I bought mostly chicken jerky but there of course were other items that I picked up.
It is disgusting that the manufacturer's are killing our animals because they can use any ingredients they want.
I like to know that my girls are eating as healthy as I am. That way we can all be around for a very long time.
I have already started assembling treat baskets for my friends pets for Christmas. We need to get everyone feeding their pets healthy treats and food.
Thanks for writing the book. Unfortunately what got you motivated was the loss of your beloved pet.
Please accept my sympathy and my girls thanks.
Joanna Hugo
Carrying on the Sea Gypsy Dog tradition, Sooty knows that freshly caught fish, brown rice, fruit and veggies are far better for her to stay happy and healthy.
She would rather fast for days than eat that commercial poison off the supermarket shelves!
The only biscuits she eats are the ones we bake ourselves on board using the great Dog Secrets Recipes.
We are so impressed with the 'inside info' and vast selection of tasty and nutritious recipes that we have even created our own small website as an affiliate: www.freewebs.com/mysooty
A thousand thanks. Woof! Woof!
Patt Brownstown
Snickers is a 5 month old Schnoodle.
I thank God I was able to get this information on Dog Food.
Snickers had an ear infection for 2 months, since I've been giving him "good" food, no more ear infections!
I threw out a 8 pound bag of dog food after I found out what was in it! Thank you for extending Snickers life!
Steven Gibbs
It's really common sense that your dog should be healthier if they stop eating processed food. If I ate nothing but tinned food for a month I'm certain I'd feel like crap and probably look it too.
...but the great thing I liked about your book Andrew, is you hand-picked the recipes after trying them on your own dog. Believe me, that saves me a lot of friggin' around trying to work out what my dog likes that is also healthy for him, that's kinda the reason I hadn't done it before seeing your book.
It's now day 26 since I started following your advice & using your recipes and I gotta say it's going much better than I expected.
'Tornado' has a much shinier coat (which I did expect to see) but I'm completely surprised to discover his eyes have much become clearer. I didn't realize but they were kind of yellowish before... now they are a very clear white.
Even more suprising is he has lost the 'wet-dog' smell my girlfriend always complained about. But I was thinking about it and it makes sense that if you're healthier, you should have less unpleasant body odor...
Anyway Andrew, your advice rocks. Now I can have my 2 loves, my girlfriend & my dog, in the same room at the same time!!
"Here's One of the Recipes FREE!"
Have this recipe as my gift.
This is the format we use for every recipe, take a look and see for yourself why our recipes are better than you'll find anywhere else.
"I Absolutely, 100% Guarantee That Once You See
"Dog Food SECRETS™", You Will Be Convinced It Can
Improve the Health & Add Years to the Life of Your Dog"
"I'm So Confident, You Get My Risk-Free, 60-Day,
100% Money Back Promise!"
Buy and read Dog Food SECRETS™...
If you aren't completely satisfied with the info in Dog Food SECRETS™, you can contact my staff and I for a full refund.
That's a 100% guarantee proving beyond the shadow of a doubt how certain I am you'll be totally satisfied with this info.
I know this can add years to the life of your dog.
So, if at any time within the first 60-days you are not satisfied for any reason or no reason at all, let me know (you get a link for requesting support, including asking for a refund) and I refund 100% of your money ASAP, no questions asked.
I believe in Dog Food SECRETS™ so much I'm prepared to take all the risk to get a copy in your hands.
https://healthy-k9.clickfunnels.com/sales-page2392001 https://maxlife.healthy-k9.com/whyyourdogisatrisk


text:
SexyLana. Age: 29. Hello,Boys!I'm Lana - The Best Independent Companion!I'm a so sensual and sexy girl with good education:-)who waiting you for make relax and happy!So,don't hesitate to call me and I promise you a wonderful time toghether!
Margarita. Age: 26. My name is Margarita. I am a sexy and naughty girl. Sweet, sexy, friendly and outgoing. I will definitely make you feel Happy, Relaxed. I offer an Amazing service. I'm Pretty Girl with a fantastic Body!


text:
Are charitable donations good gifts?
By Janet Clarke, Contributing writer
The holidays are a time for giving and thinking of others. During this time, many of us decide to donate to charities to help others. There are some of us who may even give donations to a charity as a gift during this time of giving. However, the recipients of that type of gift may have mixed feelings. Some may feel like they are not receiving anything, or the giver is being cheap. Giving a donation to charity as a gift is a good gesture if done in a caring and thoughtful way.
Think About The Gift Recipient
Donating to charity and gift giving can sometimes be different things. To make sure your donation to charity is truly a gift, you have to remember to think about who you are giving the gift to. Thinking about what your recipient likes will help you choose the right charity to donate to. Does the recipient of your gift have any favorite charities or causes?
One good thing to do is to make a list of things or companies that your gift recipient likes. Based on that list, choose the perfect charity to donate to.
Web sites such as Mainstreet.com can help you with your search and give you ideas about charities.
What Should You Donate?
When donating to charity and giving it as a gift, you have to make sure you are donating the proper amount or item. Since this donation is a gift, you have to think about how much you would spend on a gift for this person.
If you donate items to charity such as toys or food, remember to donate a decent amount. If you make an inexpensive contribution to the charity and give it as a gift, the recipient may think you are miserly. If you make a decent contribution to a charity, then your recipient will know you care about them as well as for the charity.
How To Present Your Gift
Your donation to charity can still be presented like a gift. One of the best ways is to include a card. You can get any holiday card that you think the recipient will like. On the card you can write something thoughtful, and acknowledge why you thought of donating to charity in his or her name.
Some charities give a thank you letter or card for donating to them. Make sure that you include the recipient's name.


text:
Hoop Earrings - Rope
Get Free Shipping
Free standard shipping on orders over $90
Estimated shipping time for in-stock items: 3 business days.
Estimated shipping time for made-to-order items: 2 weeks
We can ship to virtually any address in the world. Note that there are restrictions on some products, and some products cannot be shipped to international destinations.
When you place an order, we will estimate shipping and delivery dates for you based on the availability of your items and the shipping options you choose. Depending on the shipping provider you choose, shipping date estimates may appear on the shipping quotes page.
Please also note that the shipping rates for many items we sell are weight-based. To reflect the policies of the shipping companies we use, all weights will be rounded up to the next full pound.
Returns & Exchanges
Items returned within 30-days are subject to a 30% restocking fee.
Items may be exchanged within 30-days without fees (aside from price discrepancies)
Returns Policy
You may return most new, unopened items within 30 days of delivery. We will pay the return shipping costs if the return is a result of our error (you received an incorrect or defective item, etc.) and you will not have to pay the 30% restocking fee.
You should expect to receive your refund within four weeks of giving your package to the return shipper, however, in many cases you will receive a refund more quickly. This time period includes the transit time for us to receive your return from the shipper (5 to 10 business days), the time it takes us to process your return once we receive it (3 to 5 business days), and the time it takes your bank to process our refund request (5 to 10 business days).
If you need to return an item, simply login to your account, view the order using the "Complete Orders" link under the My Account menu and click the Return Item(s) button. We'll notify you via e-mail of your refund once we've received and processed the returned item.
Click the icon above to learn more about each metal type
They don't call it the gold standard for nothing. Gold is one of the most versatile, non-oxidizing metals that has been at the heart of jewelry for centuries. Gold is talked about in terms of karat. All gold is made of 24 parts. The karat is how many of those parts are pure gold. For example, 14K gold is 14 parts pure gold and 10 parts of another metal alloy (to provide the gold with more strength and scratch resistance), or put in other terms, 14K gold is 58.3% pure gold. Pure gold will never tarnish, turn your skin green (even when exposed to chemicals), and retain its value for generations. Gold is a rather soft metal. While sweat and salt water will not tarnish the metal, if put under too much stress or pressure, it can bend or scratch. The lower the karat, the stronger the gold - but the less gold it will contain overall. The higher the carat, the more gold it will have, but it will also be much softer.
Silver has been a staple and iconic metal for jewelry for centuries. Sterling Silver, or 925, 0.925 silver, is the standard for silver jewelry, and as you may have guessed, is 92.5% pure silver. The remaining percentage is an alloy of metals to provide more strength and durability. Silver is a highly oxidative metal type. This allows silver to take on a variety of hues, blue, red, purple, yellow, and black. Daily or frequent wear will either maintain the current patina or even return the metal to its pure silver finish. Silver is great for a more casual look, as it patinas with wear.
Stainless steel is one of the strongest metals used in jewelry production. It doesn't tarnish, rust, turn your skin green, or cause allergic reactions. Ion-plated Stainless Steel contains a fraction of the gold that you'll find in Vermeil or Solid gold, but it will wear for years and is far less susceptible to breaking. But as is the case with any plating --even state of the art plating-- you are getting a layer of gold only microns thick (far thinner than a strand of hair) and under a certain amount of stress or abrasion it will scratch and reveal the base metal below.
Prounounced, ver-may, vermeil is a classic french style of plating 925 silver with 3 microns of gold. (The average human hair is about 50 microns thick). Vermeil allows for more budget minded consumers to get the sparkle and warmth of gold without the overall cost. Vermeil is sensitive to oxidization and is not recommended for items that will received a lot of wear or surface contact. We also suggest removing and storing away from humidity when working out, swimming, showering or engaging in physical activities. We recommend keeping vermeil to pieces such as earrings and necklaces.


text:
Top Papercraft Brands
Treat yourself to something new from one of your favourite papercrafting brands! With new brands and exciting products added regularly, you're sure to find something perfect for all your papercraft projects. Browse through some of your favourites, including Gemini, Die'sire and Tim Holtz.
Shop By
Now Shopping by
- Brand Crafter's Companion Remove This Item
- Price $8.00 - $8.99 Remove This Item


text:
COLUMBIA, S.C. (AP) — A Clemson's men track athlete ran in five indoor meets after his eligibility was complete and a women's track team member received impermissible school expenses from former program director Lawrence Johnson while training for a foreign Olympic team.
The violations were outlined in the school's report sent to the NCAA last month. The report was obtained by The Associated Press through a Freedom of Information Act Request. Other violations include a Clemson runner receiving shoes from a volunteer assistant and a prospect getting bottled water on a recruiting visit last fall. Names of the athletes were redacted in the documents.
The school's letter to the NCAA said Johnson did not promote "an atmosphere of compliance" in the men's and women's track programs. He was resigned as director on Jan. 8. Johnson did not return emails left by the AP.
School spokeswoman Libby Kehn said athletic director Dan Radakovich and other school representatives would not comment on the violations until the NCAA completes its investigation.
Clemson blacked-out the names of those athletes involved in the report released to the AP. Clemson classified the violations as secondary in nature, the less serious category of NCAA transgressions.
The school told the NCAA it received an anonymous letter last September about track and field violations and hired an outside law firm, Bond, Schnoeneck & King, to conduct an independent review of the program.
The review was completed Jan. 8, the same day as Johnson's resignation.
The inquiry found Clemson used the ineligible athlete during the 2012 indoor season, including at the Atlantic Coast Conference championships. The school said as punishment, it would dock itself one track scholarship for the 2014-15 and 2015-16 seasons. It also agreed to pay a $2,500 fine and revamp some procedures for tracking an athlete's eligibility.
A second violation involved an athlete who competed for a foreign Olympic team in London, yet received funds from Johnson while training with her college teammates competing at the U.S. Olympic Trials in Eugene, Ore., last year. The school said it repaid the cost of the transportation expenses, $175.60, to a Clemson area children's shelter. The athlete missed the first two indoor meets of the season before here eligibility was restored by the NCAA.
Another member of the women's team was found to have received a pair of Adidas running shoes, valued at $95, from volunteer assistant Kristi Castlin. The athlete was declared ineligible by the school and has not practiced with the team since the spring semester began.
All the violations, Clemson associate athletic director compliance services Stephanie Ellison wrote the NCAA, show that Johnson "failed to promote an atmosphere of compliance within his men's and women's track and field program."
As a result, Ellison continued in the letter, "Johnson is no longer employed by the institution."
From: http://thegardenisland.com/sports_wire/clemson-documents-outline-ncaa-track-violations/article_35c718a5-f7be-5cae-9fd4-97774edc3b2a.html


text:
NB SEforAndroid 1
- 1 SE for Android
- 1.1 Introduction
- 1.2 Supported MAC Services
- 1.3 Overview of Android changes to support MAC
- 1.4 SE for Android Project Updates
- 1.5 Kernel LSM / SELinux Support
- 1.6 SE for Android Classes and Permissions
- 1.7 SELinux Commands
- 1.8 SELinux Public Methods
- 1.9 Android Init Language SELinux Extensions
- 1.10 Policy Construction and Build
- 1.10.1 SELinux MAC Policy Files
- 1.10.2 Install-time MMAC Configuration
- 1.10.3 Intent MAC Configuration
- 1.10.4 Revoke Permissions Configuration
- 1.10.5 Building the Policy
- 1.11 Logging and Auditing
- 2 Policy File Configuration Details
SE for Android
This section gives an overview of the enhancements made to Android to produce Security Enhancements for Android™ (SE for Android) as it stood in April '13. As this project is continually being enhanced, it is recommended that the official project wiki is checked for the latest enhancements at SEforAndroid
The following email is also useful regarding the merging of SE for Andriod: http://article.gmane.org/gmane.comp.security.seandroid/675/match=mainstreaming
The main objective of this document is to provide a reference for the tools, commands, policy building tools and file formats of SE for Android as currently there are no man pages and useful information is buried in code or git log summaries (although there are some README's).
The SEforAndriod page will also describe how to obtain the code, install SE for Android and the features that have been implemented. It also has useful reference papers with Security Enhanced (SE) Android: Bringing Flexible MAC to Android being a recommended read.
The http://en.wikipedia.org/wiki/Android_%28operating_system%29 site gives a good introduction to Android and http://source.android.com gives details on installation of the source.
The sections that follow cover:
- Overview of current MAC and Middleware MAC support.
- Overview of Android package additions and updates to support MAC
- Additional kernel LSM / SELinux support
- SE for Android Classes and Permissions
- SELinux commands and methods to support SE for Android
- SELinux extensions for init
- Policy construction and build
- Build file locations (helps determine errors)
- Policy booleans
- Policy configuration files
- Policy support tools
- Install / run time MMAC configuration
- Intent MMAC configuration
- Revoke permissions middleware configuration
- Logging and auditing
- SE for Android libselinux additional functions
- Policy configuration file detail
Supported MAC Services
The information here is subject to change, however the SELinux MAC and install-time MMAC seem to be stable, the others will probably change[1] and content provider support will be added soon.
The four MAC services listed are with respect to SE for Android builds using the following local manifests checked out from the git repository on 10th April '13 (see https://bitbucket.org/seandroid/manifests):
- git checkout master - Builds SELinux MAC + Install-time MMAC
- git checkout intent_mac - Builds SELinux MAC + Install-time MMAC + Intent MAC
- git checkout revoke-perms - Builds SELinux MAC + Install-time MMAC + Revoke permissions.
An overview of the four MAC services is as follows:
- The 'standard' SELinux MAC policy based on type enforcement (TE) / multi-level system[2] (MLS) services (i.e. deny all access unless specifically allowed).
- Install-time MMAC policy that checks whether app permissions are allowed or not. If not allowed, the app cannot be installed or if the app is already installed before the updated policy, then the app cannot be run after the update. The configuration supports allow, deny and allow all permissions and checks these in the following way:
- If installing or updating a third party app, its permissions will be checked against the <default> entry of the install-time MMAC policy. If the default is to deny any of its permissions, then the installation will fail.
- Pre-installed apps and their updates will have their permissions checked against the against the complete install-time MMAC policy. Should a deny permission be found in policy for the app on a package and/or signature basis, then the installation will fail. The installation will also fail if the app has not specifically been allowed the permission in its package and/or signature entry and there is a deny permission entry in the <default> entry.
- The install-time MMAC policy also supports an seinfo tag on a package and/or signature basis that is used to compute an SELinux security context for labeling apps. These apps must be pre-installed (system) apps, third party apps cannot be be relabeled.
- Intent MMAC policy that checks whether the policy configured app intents (on a package and/or signature basis) are allowed or not at run time. If not allowed, that intent will not be sent. It is currently limited to the features described at SEforAndroid Middleware_MAC. This is an optional policy and does not require any specific SELinux policy support, however it does allow source context validation to take place. The configuration supports allow and allow all intents (i.e. deny all unless specifically allowed).
- Revoke permissions policy that checks whether the policy configured permissions on a package basis will be revoked at run time. If not allowed, that permission will be revoked (i.e. allow all unless specifically revoked). This is an optional policy and does not require any specific SELinux policy support.
Overview of Android changes to support MAC
SE for Android enhances the Android system by adding SELinux support to the kernel and userspace with the main objectives being to (taken from documents at SEforAndroid):
- Confine privileged daemons to protect them from misuse and limit the damage that can be done via them.
- Sandbox and isolate apps from each other and from the system
- Prevent privilege escalation by apps.
- Allow application privileges to be controlled at installation and run-time using Middleware-MAC.
- Provide a centralized, analyzable policy.
These objectives are achieved by:
- Per-file security labeling support for yaffs2
- Filesystem images (yaffs2 and ext4) labeled at build time
- Labeling support in the recovery console and updater program
- Kernel permission checks controlling Binder IPC
- Labeling of service sockets and socket files created by init
- Labeling of device nodes created by ueventd
- Flexible, configurable labeling of apps and app data directories
- Minimal port of SELinux userspace
- SELinux support for the Android toolbox
- JNI bindings for SELinux APIs
- Userspace permission checks controlling use of the Zygote socket commands
- Userspace permission checks controlling setting of Android properties
- Small TE policy written from scratch for Android
- Confined domains for system services and apps
- Use of MLS categories to isolate apps
The Android git repositories can be found at https://android.googlesource.com and the SE for Android enhancements at https://bitbucket.org/seandroid.
But do read the information at SEforAndroid first.
SE for Android Project Updates
This gives a high level view of the new and updated projects to support the SE for Android build:
- external/libselinux
- Provides the SELinux userspace function library that is installed on the device. It is based on a version of the Linux library but has additional functions to support Android. The additional functions are:
- selinux_android_setcontext
- Sets the correct domain context for applications using setcon(3). Information contained in the seapp_contexts file is used to compute the correct context. This function also calls selinux_android_seapp_context_reload on initialisation to load the seapp_contexts file and sort the entries in order of precedence as discussed in the seapp_contexts File section.
- It is called by dalvik/vm/native/dalvik-system-Zygote.cpp and system/core/run-as/run-as.c
- selinux_android_setfilecon2
- This is used to set the correct context on application directory / files using setfilecon(3). Information contained in the seapp_contexts file is used to compute the correct context. This function also calls selinux_android_seapp_context_reload on initialisation to load the seapp_contexts file and sort the entries in order of precedence as discussed in the seapp_contexts file section.
- Used by frameworks/base/cmds/installd/commands.c for package install, make_user_data and protect functions.
- selinux_android_restorecon
- Set file contexts to match entries defined in the file_contexts file using lsetfilecon(3). Used by various commands to reset contexts during initialisation, installation etc.
- selinux_android_load_policy
- Mounts the SELinux filesystem if SELinux is enabled and then calls selinux_android_reload_policy to load the policy into the kernel. Used by system/core/init/init.c - main() to mount selinuxfs and load the policy.
- selinux_android_reload_policy
- Loads the policy into the kernel. Used by system/core/init/init.c to reload the policy.
- selinux_android_setcontext
- There is also a new labeling service for selabel_lookup(3) to query the property_contexts file (see external/libselinux/src/label_android_property.c). This file is loaded at init time (see system/core/init/init.c) and used by system/core/init/property_service.c. that checks property MAC permissions at system initialisation time.
- Provides the SELinux userspace function library that is installed on the device. It is based on a version of the Linux library but has additional functions to support Android. The additional functions are:
- external/libsepol
- Provides the policy userspace library. There are no specific updates to support SE for Android, also this library is not available on the device.
- external/checkpolicy
- Provides the policy build tool. There are no specific updates to support SE for Android, also this is not available on the device (therefore policy rebuilds must be done in the development environment).
- external/sepolicy
- This is a new policy specifically for SE for Android. It looks much like the reference policy but is contained in one directory that has the policy modules (*.te files), class / permission files etc.. The policy is built by the Android.mk file and the resulting policy is installed on the target device (as sepolicy) along with its supporting configuration files (file_contexts, seapp_contexts and property_contexts). There are facilities that enable policy to be modified depending on the device as discussed in the Building the Policy section.
- The policy files are discussed in the SELinux MAC Policy Files section and support tools in Policy Build Tools.
- There are three new object classes defined for the policy that are described in the SE for Android Classes and Permissions section.
- The directory also contains the install / run time MMAC and if configured the intent MMAC configuration files (also see: SEforAndroid - Middleware_MAC).
- external/mac-policy
- Contains the revoke permissions middleware policy file (revoke_permissions.xml) that allows Android permissions to be revoked at run time. The revoke-perms branch will enable this functionality.
- external/yaffs2
- mkyaffs2image support for labeling and extended attributes (xattr)
- packages/apps/SEAandroidAdmin
- This is an Android application to manage the SE for Android environment. It allows control of the enforcement modes, booleans etc. There is also an optional SEAndroidManager app that is not installed by default.
- packages/apps/Settings
- SELinux settings for the settings manager application.
- bionic
- Bionic is the Android libc that is a derived from the BSD standard C library code. It contains enhancements to support security providers such as SELinux.
- bootable/recovery
- Changes to manage file labeling on recovery.
- build
- Changes to build SE for Android (see the "# SELinux packages" comment in the build/target/product/core.mk file) and manage file labeling on images and OTA (over the air) target files.
- dalvik
- Set the context using selinux_android_setcontext on the dalvik process being forked.
- libcore
- Add additional parameters seInfo and niceName to Zygote.java
- frameworks/base
- JNI - Add SELinux support functions such as isSELinuxEnabled and setFSCreateCon.
- SELinux Java class and method definitions.
- Checking Zygote connection contexts.
- Managing file permissions for the package manager and wallpaper services.
- SELinux additions to support install / run time MMAC, intent MMAC and revoke permissions middleware.
- system/core
- SELinux support services for toolbox (e.g. load_policy, runcon).
- SELinux support for system initialisation (e.g. init, init.rc).
- SELinux support for auditing avc's (auditd).
- system/extras
- SELinux support for the ext4 file system.
- kernel
- There are a number of kernels that have been enhanced to support LSM and SELinux services and are listed at SEforAndroid - Building for a Device.
- Note that the Android kernels are based on various versions (currently 3.4 for the goldfish used by the emulator), therefore the latest SELinux enhancements may not always be present. The Kernel LSM / SELinux Support section describes the kernel changes.
- device
- Details regarding supported devices can be found at SEforAndroid - Building for a Device
- Device configurations can be modified to allow the policy to be tailored, see the Policy Generation section.
Kernel LSM / SELinux Support
The paper Security Enhanced (SE) Android: Bringing Flexible MAC to Android gives a good review of what did and didn't changed in the kernel to support Android. This section briefly describes the only major change that was to support the Binder IPC service, these changes consist of:
- Linux Security Module (LSM) hooks in the binder code (drivers/staging/android/binder.c) and (include/linux/security.h)
- Default support for capabilities (security/capability.c) in case no other module is loaded.
- Hooks in the LSM security module (security/security.c).
- SELinux support for the binder object class and permissions (security/selinux/include/classmap.h) that are shown in the SE for Android Classes and Permissions section. Support for these permission checks are added to security/selinux/hooks.c.
SE for Android Classes and Permissions
Three additional classes (binder, zygote and property_service) have been added to SE for Android and are listed in the following tables with descriptions of their permissions:
|binder class - This is a kernel object to manage the Binder IPC service.
|Perform a binder IPC to a given target process (can A call B?).
| Perform a binder IPC on behalf of another process (can A impersonate B on an IPC?).
Not currently used in policy but kernel (selinux/hooks.c) checks permission in selinux_binder_transaction call.
|Receive a binder reference from another process (can A receive a binder referenced owned by B?).
| Register self as the Binder Context Manager aka servicemanager (global name service). Can A set the context manager to B, where normally A == B.
See policy module servicemanager.te.
|Transfer a binder reference to another process (can A transfer a binder reference owned by B?).
|zygote class – This is a userspace object to manage the Android application loader. See Java SELinux.checkSELinuxAccess. In ZygoteConnection.java
|Peer may specify uid's or gid's.
|Peer may specify rlimits.
|Peer may specify capabilities.
|Peer may specify --invoke-with to launch Zygote with a wrapper command.
|Specify a seinfo string for use in determining the app security label.
|property_service class – This is a userspace object to manage the Android Property Service.
|Description (1 unique permission)
|Set a property.
SELinux Commands
A subset of the Linux SELinux commands have been implemented for SE for Android and are listed in Table 1. They are available as Toolbox commands (see system/core/toolbox) and can be run via adb shell, for example:
adb shell su o setenforce permissive
Table 1: SELinux enabled adb shell commands (in Android toolbox)
| Change security context of file. Not as chcon(1) as only supports context path parameters, therefore to change multiple files, need to list as pairs:
chcon context pathname ... ...
| Get current enforcing mode:
| Get SELinux boolean value(s):
getsebool [-a | boolean]
|Supports -Z option to display security context.
| Load new policy into kernel:
load_policy policy-file
|Supports -Z option to display security context.
| Restore file default security context as defined in the file_contexts file. As restorecon(8) but supports less options:
restorecon [-nrRv] pathname
| Run command in specified security context:
runcon context program args...
| Modify the SELinux enforcing mode:
setenforce [enforcing|permissive|1|0]
| Set SELinux boolean to a value (note that the cmd does not set the boolean across reboots):
setsebool name [1|true|on|0|false|off]
SELinux Public Methods
The public methods implemented are equivalent to libselinux functions are show in Table 2. They have been taken from framework/base/core/java/android/os/SELinux.java.
Table 2: SELinux class public methods
| boolean isSELinuxEnabled()
Determine whether SELinux is disabled or enabled.
Return true if SELinux is enabled.
| boolean isSELinuxEnforced()
Determine whether SELinux is permissive or enforcing.
Returns true if SELinux is enforcing.
| boolean setSELinuxEnforce(boolean value)
Set whether SELinux is in permissive or enforcing modes.
value of true sets SELinux to enforcing mode.
Returns true if the desired mode was set.
| boolean setFSCreateContext(String context)
Sets the security context for newly created file objects.
context is the security context to set.
Returns true if the operation succeeded.
| boolean setFileContext(String path, String context)
Change the security context of an existing file object.
path represents the path of file object to relabel.
context is the new security context to set .
Returns true if the operation succeeded.
| String getFileContext(String path)
Get the security context of a file object.
path the pathname of the file object.
Returns the requested security context or null.
| String getPeerContext(FileDescriptor fd)
Get the security context of a peer socket.
FileDescriptor is the file descriptor class of the peer socket.
Returns the peer socket security context or null.
| String getContext()
Gets the security context of the current process.
Returns the current process security context or null.
| String getPidContext(int pid)
Gets the security context of a given process id. Use of this function is discouraged for Binder transactions. Use Binder.getCallingSecctx() instead.
pid an int representing the process id to check.
Returns the security context of the given pid or null.
| String[] getBooleanNames()
Gets a list of the SELinux boolean names.
Return an array of strings containing the SELinux boolean names.
| boolean getBooleanValue(String name)
Gets the value for the given SELinux boolean name.
name is the name of the SELinux boolean.
Returns true or false indicating whether the SELinux boolean is set or not.
| boolean setBooleanValue(String name, boolean value)
Sets the value for the given SELinux boolean name. Note that this will be set the boolean permanently across reboots.
name is the name of the SELinux boolean.
value is the new value of the SELinux boolean.
Returns true if the operation succeeded.
| boolean checkSELinuxAccess(String scon, String tcon, String tclass, String perm)
Check permissions between two security contexts.
scon is the source or subject security context.
tcon is the target or object security context.
tclass is the object security class name.
perm is the permission name.
Returns true if permission was granted.
| boolean restorecon(String pathname)
Restores a file to its default SELinux security context. If the system is not compiled with SELinux, then true is automatically returned. If SELinux is compiled in, but disabled, then true is returned.
pathname is the pathname of the file to be relabeled.
Returns true if the relabeling succeeded.
exception NullPointerException if the pathname is a null object.
| boolean restorecon(File file)
Restores a file to its default SELinux security context. If the system is not compiled with SELinux, then true is automatically returned. If SELinux is compiled in, but disabled, then true is returned.
file is the file object representing the path to be relabeled.
Returns true if the relabeling succeeded.
exception NullPointerException if the file is a null object.
Android Init Language SELinux Extensions
The Android init process language has been expanded to support SELinux as shown in Table 3. The complete Android init language description is available in the system/core/init/readme.txt file.
Table 3: SELinux init extensions
| seclabel <securitycontext>
Change to security context before exec'ing this service. Primarily for use by services run from the rootfs, e.g. ueventd, adbd. Services on the system partition can instead use policy defined transitions based on their file security context. If not specified and no transition is defined in policy, defaults to the init context.
| restorecon <path>
Restore the file named by <path> to the security context specified in the file_contexts configuration. Not required for directories created by the init.rc as these are automatically labeled correctly by init.
| setcon <securitycontext>
Set the current process security context to the specified string. This is typically only used from early-init to set the init context before any other process is started (see init.rc example above).
| setenforce 0|1
Set the SELinux system-wide enforcing status. 0 is permissive (i.e. log but do not deny), 1 is enforcing.
| setsebool <name> <value>
Set SELinux boolean <name> to <value>.
<value> may be 1|true|on or 0|false|off
Examples of their usage are shown in the following init file segments:
# system/core/rootdir/init.rc ... on early-init # Set init and its forked children's oom_adj. write /proc/1/oom_adj -16 # Set the security context for the init process. # This should occur before anything else (e.g. ueventd) is started. setcon u:r:init:s0 start ueventd ... on boot ... service ueventd /sbin/ueventd class core critical seclabel u:r:ueventd:s0
# system/core/rootdir/init.goldfish.rc ... on boot setsebool in_qemu 1 restorecon /sys/qemu_trace/process_name restorecon /sys/qemu_trace/state restorecon /sys/qemu_trace/symbol ...
Policy Construction and Build
An overview of the sections that cover the configuration and building of SELinux MAC and MMAC policies are as follows:
- SELinux MAC Policy Files - Describes the SELinux MAC policy files that define the policy and how they relate, and also the SELinux MAC Policy Files required. The Policy Booleans are also detailed with their default state.
- Install-time MMAC Configuration - This is installed as part of default policy and contains information that is used to determine permissions allowed and/or denied.
- Intent MAC Configuration - Describes how the intent MMAC is configured and built when using the intent_mac branch build.
- Revoke Permissions Configuration - Describes how the revoke permissions middleware is configured and built when using the revoke-perms branch build.
- Policy Build Tools - Describes the tools available that assist in building the policy and their configuration files.
- Building the Policy - Describes how the SELinux MAC and MMAC policies are configured and built during the make process including support for device dependent policy.
SELinux MAC Policy Files
The MAC policy configuration files are contained in the external/sepolicy directory, however there may also be policy configuration files to enable specific device features under device/<vendor> directories (see the Policy Generation section). Once generated, the policy and its supporting configuration files are installed on the device as part of the build process.
The following files are used to build the kernel binary policy file that will be named sepolicy and installed by default in the root directory. An updated policy may be installed at /data/security/sepolicy. The initialisation or policy reload process will always check for a policy at /data/security/sepolicy first and then if not present at /sepolicy. The policy files consist of the following:
- access_vectors, security_classes
- These have been modified to support the new SE for Android classes and permissions.
- initial_sids, initial_sids_contexts, fs_use, genfs_contexts, port_contexts
- For flexibility of policy building, these files have been separated to allow additional policy files to be defined for specific devices as discussed below.
- users, roles
- These define the only user (u) and role (r) used by the policy, although there is no reason why others cannot be added.
- mls
- Contains the constraints applied to the defined classes and permissions.
- global_macros, mls_macro, te_marcos
- These contain the m4 macros that expand the policy files to build a policy in the kernel policy language as described in the Policy Language section. The policy can then be compiled by checkpolicy(8). For reference, the policy text file is built and placed in:
- out/target/product/<device>/obj/ETC/sepolicy_intermediates/policy.conf
- These contain the m4 macros that expand the policy files to build a policy in the kernel policy language as described in the Policy Language section. The policy can then be compiled by checkpolicy(8). For reference, the policy text file is built and placed in:
- The compiled kernel policy can also be found in this directory and is named sepolicy. There are also policy.conf.dontaudit and sepolicy.dontaudit files that have the dontaudit rules removed. Stripping out these rules stops the auditing of denial messages as they are known events and do not cause any issues. This also helps to manage the audit log by excluding known denial events.
- attributes
- Contains the attribute names (forming the attribute statements) that will be used to group type identifiers defined by the policy.
- policy_capabilities
- Contains the policy capabilities enabled for the kernel policy (see policycap statement).
- *.te
- The *.te files are the policy module definition files. These are the same format as the standard reference policy and are expanded by the m4 macros. There is (generally) one .te file for each domain/service defined for the device and will contain all the required allow, type_transition etc. rules. It will also call any te_macros to access other domains resources (e.g. init_daemon_domain, binder_call).
The following files are used to compute and/or configure SE for Android security contexts and reflect information configured within the kernel policy. These files are:
- file_contexts
- Contains default file contexts for setting the filesystem as standard SELinux. The format of this file is defined in file_contexts(5). The file is installed by default in the root directory. SE for Android services (such as restorecon(8)) will first check for this file at (this is where updated files should be placed):
- /data/security/file_contexts
- If not present they will then check the root directory:
- /file_contexts
- Contains default file contexts for setting the filesystem as standard SELinux. The format of this file is defined in file_contexts(5). The file is installed by default in the root directory. SE for Android services (such as restorecon(8)) will first check for this file at (this is where updated files should be placed):
- property_contexts
- Contains default contexts to be applied to Android property services as discussed in the property_contexts file section. The file is installed by default in the root directory. The SE for Android initialisation / reload process will first check for this file at (this is where updated files should be placed):
- /data/security/property_contexts
- If not present they will then check the root directory:
- /property_contexts
- Contains default contexts to be applied to Android property services as discussed in the property_contexts file section. The file is installed by default in the root directory. The SE for Android initialisation / reload process will first check for this file at (this is where updated files should be placed):
- seapp_contexts
- Contains information to allow domain or file contexts to be computed based on parameters as discussed in the seapp_contexts file section. The file is installed by default in the root directory. The SE for Android initialisation / reload process will first check for this file at (this is where updated files should be placed):
- /data/security/seapp_contexts
- If not present they will then check the root directory:
- /seapp_contexts
- Contains information to allow domain or file contexts to be computed based on parameters as discussed in the seapp_contexts file section. The file is installed by default in the root directory. The SE for Android initialisation / reload process will first check for this file at (this is where updated files should be placed):
- selinux-network.sh
- If using iptables(8) then SECMARK information may be configured in this file as part of the build. It is installed in system/bin and executed at system initialisation time.
SELinux Policy Versions
The default SELinux policy version is 26 that requires a kernel >= 3.0 and is set in external/sepolicy/Android.mk as follows:
If an older kernel must be supported POLICYVERS can be set in your environment as follows:
export POLICYVERS=24
Information regarding policy versions can be found at Policy Versions.
Note that the current libsepol used by SE for Android will support a maximum of version 27. If greater required, then upgrade libsepol to a later version and check that the kernel will also support the higher version.
SELinux Policy Booleans
Table 4 describes the SELinux policy booleans and their default state. Their state can be changed permanently across reboots using the SEAdmin app (as it calls the setBooleanValue()) method, or temporarily using the adb shell setsebool command.
Table 4: SE for Android SELinux Policy Booleans
|Allow the Android CTS to run if TRUE. Do not enable in production policy.
|Allow untrusted_app domain external SD card rw access if TRUE.
|Allow untrusted_app domain internal SD card rw access if TRUE.
|Allow domain rw access on debugfs if TRUE.
| Allow domain rw access on /sys/qemu_trace files in the emulator if TRUE.
Note that when running the emulator this is automatically set TRUE on boot (see init.goldfish.rc)
|Support the Android adb shell run-as command if TRUE.
| When set to TRUE will allow the system_app domain the ability to manage SE for Android (as well as the system domain).
When set to FALSE only the system domain can manage SE for Android.
The management is based on the status of the manage_selinux and manage_mac booleans logically anded with system_app_manage i.e. if system_app_manage is TRUE, but mmac_manage is FALSE, the system_app domain will not be able to manage MMAC.
|Allow management of SELinux policy if TRUE. Also see the system_app_manage boolean.
|Allow management of MMAC policy if TRUE. Also see the system_app_manage boolean.
Setting Permissive / Enforcing Mode
There are two ways to set permissive or enforcing mode in SE for Android:
- Using the SEAdmin or SEManager apps.
- Using the conventional setenforce command:
# 1 = enforcing 0 = permissive adb shell su 0 setenforce 1
Modifying and Reloading Policy
This is covered at SEforAndroid - Policy in detail. This section gives a brief overview:
- Modify the required policy source files, then regenerate the kernel policy file by:
make sepolicy
- Copy the policy file to the device:
adb push out/target/product/<device>/root/sepolicy /data/security
- Then load the new policy by:
adb shell su 0 setprop selinux.reload_policy 1
Install-time MMAC Configuration
The install-time MMAC is part of the standard policy build but is classed as a middleware MAC. The file that configures policy is called mac_permissions.xml and its format is discussed in the mac_permissions.xml file section. The file is installed by default at:
- /system/etc/security/mac_permissions.xml
The SE for Android initialisation / reload process will first check for this file at (this is where updated files should be placed):
- /data/security/mac_permissions.xml
This file can be replaced through BOARD_SEPOLICY_REPLACE containing the value mac_permissions.xml, or appended to by using the BOARD_SEPOLICY_UNION variable as described in the Building the Policy section. The main code for the service is frameworks/base/services/java/com/android/server/pm/SELinuxMMAC.java, however it does hook into other Android services. There is a system property to control whether the service is in permissive or enforcing mode and can be set by the SEAdmin app or using adb (note that this property also used for intent MAC):
# 1 = enforcing 0 = permissive adb shell su 0 setprop persist.mmac.enforce 1
Intent MAC Configuration
Intent MAC is not part of the standard policy and can be found in the intent_mac branch as described in IntentMAC. However if it is enabled, the build process will automatically install and update the required components (such as SEAdmin to set enforcing / permissive mode). The files that configure policy are intent_mac.xml and mmac_types.xml and by default they are installed at:
- /system/etc/security/intent_mac.xml
- /system/etc/security/mmac_types.xml
The SE for Android initialisation / reload process will first check for these files at (this is where updated files should be placed):
- /data/security/intent_mac.xml
- /data/security/mmac_types.xml
The file formats and their usage are discussed in the Intent MAC Files section. The files can also be replaced through BOARD_SEPOLICY_REPLACE containing the required file name, however only the mmac_types.xml file can be appended to by using the BOARD_SEPOLICY_UNION variable as described in the Building the Policy section. The main code for the service is frameworks/base/core/java/andriod/content/pm/IntentMAC.java and MMACtypes.java, however it does hook into other Android services. There are a number of system properties that control the service and are defined in Table 5 with their default values. The enforcing mode is set using the SEAdmin app (Enforce MMAC policy tick box), however it may be also be set using setprop, for example:
# 1 = Enforcing 0 = Permissive adb shell su 0 setprop persist.mmac_enforce 1
Table 5: Intent MAC system properties and their default values
| persist.mmac.enforce = false
True turns on Intent MAC enforcing mode (as well as install-time MMAC). The SEAdmin app will also toggle this property.
| persist.mac_intent_allowSelf = true
True allows intents going to an app's own component. This reduces amount of work required to create useful policy. If an app gets owned, this allows malicious code to send an Intent to an component running in the same process.
| persist.mac_intent_allowSystem = true
True allows all intents coming from the system_server. This reduces the amount of work required to create useful policy.
| persist.mac_intent_allowSig = true
True allows apps signed with the same signature to bypass checks. This boolean is intended to allow custom intents to work between apps that were written by the same author.
| persist.mac_intent_allowUid = true
True allows apps running with the same UID to bypass checks. This boolean is a little stronger than same signature, since apps can have different UIDs but authored by the same developer.
| persist.mac_intent_printJSON = false
True prints a JSON formatted debugging string.
| persist.mac_applyNameTypes = false
True - A type that is the same as a package name will be added to the list of types.
| persist.mac_applyPermTypes = false
True - For each permission, a type that is the same as that permission will be added to the list of types.
Revoke Permissions Configuration
The revoke permission MAC is not part of the standard policy and can be found in the revoke-perms branch as described at SEforAndroid - Permission_revocation. The file that configures the policy is the revoke_permissions.xml and by default is installed at:
- /system/etc/security/revoke_permissions.xml
The SE for Android initialisation / reload process will first check for this file at (this is where updated files should be placed):
- /data/system/revoke_permissions.xml
The file format is shown in the Revoke Permissions file section.
The main code for the service is self contained in:
- frameworks/base/services/java/com/android/server/pm/PackageManagerService.java
Building the Policy
Some of this section has been extracted from the external/sepolicy/README file that should be checked in case there have been updates. It describes how files in external/sepolicy can be manipulated during the build process to reflect requirements of different device vendors whose policy files would normally be located in the device/<vendor> directories.
Build Tools
The kernel policy is compiled using checkpolicy(8) via the external/sepolicy/Android.mk file. There are also a number of SE for Android specific tools used to assist in policy configuration that are described in Policy Build Tools, with a summary as follows:
- checkfc - Used to parse the file_contexts file against the binary policy sepolicy. This is to ensure all file contexts are valid for the policy. There is a -p option that is used to validate the contexts defined in the property_contexts file.
- checkseapp - Used to parse the seapp_contexts file against the binary policy sepolicy. This is to ensure policy related information is valid (e.g. checks booleans, types, levels etc.).
- insertkeys.py - Used to replace keywords in the signature sections of the mac_permissions.xml and mmac_types.xml files with keys obtained from pem files. This uses information contained in the external/sepolicy/keys.conf file that is detailed in the keys.conf section. This utility will also strip files of comments.
- setool - This is not used by the actual build process but assists in generating new entries for the mac_permissions.xml file. It will extract permissions from one or more packages with their signatures then generate the package sections. Its output may need to be modified before inclusion in the master file as detailed in the setool section.
README Extract
Additional per device policy files can be added or removed during the policy build. They can be configured through the use of the following four variables:
The variables should be set in the BoardConfig.mk file in the device or vendor directories.
- BOARD_SEPOLICY_DIRS contains a list of directories to search for BOARD_SEPOLICY_UNION and BOARD_SEPOLICY_REPLACE files. Order matters in this list. e.g. If you have:
- BOARD_SEPOLICY_UNION := widget.te
- and two instances of widget.te files are on BOARD_SEPOLICY_DIRS search path, the first one found (at the first search directory containing the file) gets processed first. Reviewing the devices policy.conf[3] will help sort out ordering issues and is located at:
- out/target/product/<device>/obj/ETC/sepolicy_intermediates/policy.conf
- BOARD_SEPOLICY_UNION is a list of files that will be "unioned", i.e. concatenated, at the END of their respective files in external/sepolicy
- Note to add a unique/new file you would use this variable.
- BOARD_SEPOLICY_REPLACE is a list of files that will be used instead of the corresponding file in external/sepolicy
- BOARD_SEPOLICY_IGNORE is a list of paths (directory + filename) of files that are not to be included in the resulting policy. This list is passed to filter-out to remove any paths you may want to ignore. This is useful if you have numerous configuration directories that contain a file and you want to NOT include a particular file in your resulting policy file, either by BOARD_SEPOLICY_UNION or BOARD_SEPOLICY_REPLACE.
- For example, suppose the following:
- with directories X and Y containing a copy of file A. The resulting policy is created by using Y/A only, thus X/A was ignored.
Error Handling:
- It is an error to specify a BOARD_POLICY_REPLACE file that does not exist in external/sepolicy.
- It is an error to specify a BOARD_POLICY_REPLACE file that appears multiple times on the policy search path defined by BOARD_SEPOLICY_DIRS.
- For example, if you specify shell.te in BOARD_SEPOLICY_REPLACE and BOARD_SEPOLICY_DIRS is set to:
- vendor/widget/common/sepolicy device/widget/x/sepolicy
- and shell.te appears in both locations, it is an error. Unless it is in BOARD_SEPOLICY_IGNORE to be filtered out. See BOARD_SEPOLICY_IGNORE for more details.
- It is an error to specify the same file name in both BOARD_POLICY_REPLACE and BOARD_POLICY_UNION.
- It is an error to specify a BOARD_SEPOLICY_DIRS that has no entries when specifying BOARD_SEPOLICY_REPLACE.
- An example BoardConfig.mk entry taken from device/samsung/tuna/BoardConfig.mk will take the files referenced in BOARD_SEPOLICY_DIRS and add their contents to the end of the respective files in external/sepolicy
BOARD_SEPOLICY_DIRS := \ device/samsung/tuna/sepolicy BOARD_SEPOLICY_UNION := \ genfs_contexts \ file_contexts
Logging and Auditing
Kernel Logs
The SE for Android version from 4.2.2 includes an optional audit daemon, if this is not available then the messages will be logged in the kernel buffers that can be read using dmesg(1):
adb shell su 0 dmesg
Note that if auditing is available, then before the auditing daemon is loaded messages will be logged in the kernel buffers.
SE for Android App and Service Logging
SE for Android services will log errors using the standard Android logging service logcat. The entries will generally be categorised by the service such as SELinuxMMAC, IntentMMAC, MMACtypes, however as the SELinux services hook into Android services, there will be entries that related to these, for example an intent denial will show as:
E/PackageManager( 281): INTENT_DENIAL: {"intent":{"action":"android.intent.action.CALL_PRIVILEGED", "data":"tel:085-2369"}, "callingPid":600, "callingPkgs":["com.android.providers.contacts","com.android.providers.applications","com.android.contacts", "com.android.providers.userdictionary"], "callingTypes":["phone_state_perm","nfc_handler"], "destPkgs":["com.android.phone"], "destTypes":["wappush_manager","phone_state_perm","telephony_app"]}
Generally though, there are enough clues to find most errors, and be aware that events logged may change with each update.
auditd Daemon
The majority of this text has been extracted from system/core/auditd/README that describes its configuration, however note that:
- Kernel auditing is automatically enabled when building the SE for Android supplied kernels (e.g. for goldfish kernel see the kernel/goldfish/arch/arm/configs/goldfish_arm7_defconfig file) and auditd daemon is also built and installed (see build/target/product/core.mk - under the SELinux packages).
- The audit daemon output is formatted so that ausearch(8) can be used to search for SELinux events.
The audit daemon is a simplified version of its desktop counterpart designed to gather the audit logs from the audit kernel subsystem. The audit subsystem of the kernel includes Linux Security Modules (LSM) messages as well. To enable the audit subsystem, you must add this to your kernel config:
- CONFIG_AUDIT=y
- CONFIG_AUDITSYSCALL=y
To enable a LSM, you must consult that LSM's documentation, the example below is for SELinux:
- CONFIG_SECURITY_SELINUX=y
This does not include possible dependencies that may need to be satisfied for that particular LSM.
The daemon maintains two log files audit.log and audit.old at /data/misc/audit/. On boot, if audit.log exists, and the size is greater than 0, audit.log is renamed to audit.old. The log file is also renamed, or rotated, when a threshold is hit. This threshold is hard-coded to 100KB but can be adjusted through the AUDITD_MAX_LOG_FILE_SIZEKB Makefile file variable that can be overridden in the device.mk. Note that the value is in kilobytes e.g. AUDITD_MAX_LOG_FILE_SIZEKB := 50 will set the threshold to 50KB.
The daemon is not included by default, and must explicitly be added to PRODUCT_PACKAGES. This could be set in the device.mk with an example configuration as follows:
# 1MB Log file threshold AUDITD_MAX_LOG_FILE_SIZEKB := 1000 PRODUCT_PACKAGES += auditd
The daemon also has no external interfaces, but one could use inotify to start and build a system from this. The log files are owned by UID audit and readable by system. A system UID application could conceivably be used to consume these logs.
Policy File Configuration Details
These are detailed in the following section:
- ↑ With regard to AOSP, their stance is that all third party apps must be treated alike. This means that these apps cannot be run in different domains to provide isolation or have individual MMAC policies applied. AOSP does allow system apps to have different policies applied to them though. The SE for Android repository at https://bitbucket.org/seandroid holds the source code that may be modified to support different MAC policies for third party apps, however this would be outside AOSP.
- ↑ More precisely the multi-category system (MCS) as currently only a single level is used.
- ↑ The policy.conf file contains the policy language statements as described at Policy Language. These define the policy that will be enforced and devices labeled.