platform_system_sepolicy/isolated_app.te

###
### Services with isolatedProcess=true in their manifest.
###
### This file defines the rules for isolated apps. An "isolated
### app" is an APP with UID between AID_ISOLATED_START (99000)
### and AID_ISOLATED_END (99999).
###
### isolated_app includes all the appdomain rules, plus the
### additional following rules:
###

type isolated_app, domain;
app_domain(isolated_app)

# Access already open app data files received over Binder or local socket IPC.
allow isolated_app app_data_file:file { read write getattr };

# Isolated apps should not directly open app data files themselves.
neverallow isolated_app app_data_file:file open;

# Isolated apps shouldn't be able to access the driver directly.
neverallow isolated_app gpu_device:file { rw_file_perms execute };

allow isolated_app radio_service:service_manager find;
allow isolated_app surfaceflinger_service:service_manager find;
allow isolated_app system_server_service:service_manager find;
allow isolated_app tmp_system_server_service:service_manager find;

# address tmp_system_server_service accesses
allow isolated_app activity_service:service_manager find;
allow isolated_app connectivity_service:service_manager find;
allow isolated_app display_service:service_manager find;
allow isolated_app dropbox_service:service_manager find;

service_manager_local_audit_domain(isolated_app)
auditallow isolated_app {
    tmp_system_server_service
    -activity_service
    -connectivity_service
    -display_service
    -dropbox_service
}:service_manager find;
Move *_app into their own file app.te covers a lot of different apps types (platform_app, media_app, shared_app, release_app, isolated_app, and untrusted_app), all of which are going to have slightly different security policies. Separate the different domains from app.te. Over time, these files are likely to grow substantially, and mixing different domain types is a recipe for confusion and mistakes. No functional change. Change-Id: Ida4e77fadb510f5993eb2d32f2f7649227edff4f 2013-07-13 01:33:29 +02:00			`###`
			`### Services with isolatedProcess=true in their manifest.`
			`###`
			`### This file defines the rules for isolated apps. An "isolated`
			`### app" is an APP with UID between AID_ISOLATED_START (99000)`
			`### and AID_ISOLATED_END (99999).`
			`###`
			`### isolated_app includes all the appdomain rules, plus the`
			`### additional following rules:`
			`###`

			`type isolated_app, domain;`
			`app_domain(isolated_app)`
isolated_app: allow app_data_file execute Chrome renderer processes dlopen() a shared library from gmscore. Open and read on app data file is already allowed, but execute isn't, so the dlopen() fails. This is a regression from K, where the dlopen succeeded. Longer term, there's questions about whether this is appropriate behavior for an isolated app. For now, allow the behavior. See the discussion in b/15902433 for details. Addresses the following denial: I/auditd ( 5087): type=1400 audit(0.0:76): avc: denied { execute } for comm="CrRendererMain" path="/data/data/com.google.android.gms/files/libAppDataSearchExt_armeabi_v7a.so" dev="mmcblk0p28" ino=83196 scontext=u:r:isolated_app:s0 tcontext=u:object_r:app_data_file:s0 tclass=file Bug: 15902433 Change-Id: Ie98605d43753be8c31a6fe510ef2dde0bdb52678 2014-06-28 00:19:04 +02:00
Do not allow isolated_app to directly open app data files. Only allow it to read/write/stat already open app data files received via Binder or local socket IPC. Change-Id: Ie66f240e109410a17aa93d9d5dea4c2b87d47009 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2014-11-21 18:28:42 +01:00			`# Access already open app data files received over Binder or local socket IPC.`
			`allow isolated_app app_data_file:file { read write getattr };`

			`# Isolated apps should not directly open app data files themselves.`
			`neverallow isolated_app app_data_file:file open;`

isolated_app: Do not allow access to the gpu_device. Bug: 17471434 Change-Id: I6fd1079be29a454f46ab84f0c43fcf816e679c98 2014-09-11 20:33:12 +02:00			`# Isolated apps shouldn't be able to access the driver directly.`
			`neverallow isolated_app gpu_device:file { rw_file_perms execute };`

Restrict service_manager find and list access. All domains are currently granted list and find service_manager permissions, but this is not necessary. Pare the permissions which did not trigger any of the auditallow reporting. Bug: 18106000 Change-Id: Ie0ce8de2af8af2cbe4ce388a2dcf4534694c994a 2014-12-12 01:01:27 +01:00			`allow isolated_app radio_service:service_manager find;`
			`allow isolated_app surfaceflinger_service:service_manager find;`
			`allow isolated_app system_server_service:service_manager find;`
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef 2014-12-17 00:45:26 +01:00			`allow isolated_app tmp_system_server_service:service_manager find;`

			`# address tmp_system_server_service accesses`
			`allow isolated_app activity_service:service_manager find;`
			`allow isolated_app connectivity_service:service_manager find;`
			`allow isolated_app display_service:service_manager find;`
			`allow isolated_app dropbox_service:service_manager find;`

			`service_manager_local_audit_domain(isolated_app)`
			`auditallow isolated_app {`
			`tmp_system_server_service`
			`-activity_service`
			`-connectivity_service`
			`-display_service`
			`-dropbox_service`
			`}:service_manager find;`