2013-07-13 01:33:29 +02:00
|
|
|
###
|
|
|
|
|
### Untrusted apps.
|
|
|
|
|
###
|
|
|
|
|
### This file defines the rules for untrusted apps. An "untrusted
|
|
|
|
|
### app" is an APP with UID between APP_AID (10000)
|
|
|
|
|
### and AID_ISOLATED_START (99000).
|
|
|
|
|
###
|
|
|
|
|
### untrusted_app includes all the appdomain rules, plus the
|
|
|
|
|
### additional following rules:
|
|
|
|
|
###
|
|
|
|
|
|
|
|
|
|
type untrusted_app, domain;
|
2013-07-16 20:33:14 +02:00
|
|
|
permissive untrusted_app;
|
2013-07-13 01:33:29 +02:00
|
|
|
app_domain(untrusted_app)
|
|
|
|
|
net_domain(untrusted_app)
|
|
|
|
|
bluetooth_domain(untrusted_app)
|
untrusted_app.te / isolated_app.te / app.te first pass
This is my first attempt at creating an enforcing SELinux domain for
apps, untrusted_apps, and isolated_apps. Much of these rules are based on the
contents of app.te as of commit 11153ef34928ab9d13658606695cba192aa03e21
with extensive modifications, some of which are included below.
* Allow communication with netd/dnsproxyd, to allow netd to handle
dns requests
* Allow binder communications with the DNS server
* Allow binder communications with surfaceflinger
* Allow an app to bind to tcp/udp ports
* Allow all domains to read files from the root partition, assuming
the DAC allows access.
In addition, I added a bunch of "neverallow" rules, to assert that
certain capabilities are never added.
This change has a high probability of breaking someone, somewhere.
If it does, then I'm happy to fix the breakage, rollback this change,
or put untrusted_app into permissive mode.
Change-Id: I83f220135d20ab4f70fbd7be9401b5b1def1fe35
2013-07-13 03:45:56 +02:00
|
|
|
|
|
|
|
|
allow untrusted_app tun_device:chr_file rw_file_perms;
|
|
|
|
|
|
|
|
|
|
# Internal SDCard rw access.
|
|
|
|
|
allow untrusted_app sdcard_internal:dir create_dir_perms;
|
|
|
|
|
allow untrusted_app sdcard_internal:file create_file_perms;
|
|
|
|
|
|
|
|
|
|
# External SDCard rw access.
|
|
|
|
|
allow untrusted_app sdcard_external:dir create_dir_perms;
|
|
|
|
|
allow untrusted_app sdcard_external:file create_file_perms;
|
|
|
|
|
|
|
|
|
|
# ASEC
|
|
|
|
|
allow untrusted_app asec_apk_file:dir { getattr };
|
|
|
|
|
allow untrusted_app asec_apk_file:file r_file_perms;
|
|
|
|
|
|
2013-07-16 18:03:58 +02:00
|
|
|
# Create tcp/udp sockets
|
untrusted_app.te / isolated_app.te / app.te first pass
This is my first attempt at creating an enforcing SELinux domain for
apps, untrusted_apps, and isolated_apps. Much of these rules are based on the
contents of app.te as of commit 11153ef34928ab9d13658606695cba192aa03e21
with extensive modifications, some of which are included below.
* Allow communication with netd/dnsproxyd, to allow netd to handle
dns requests
* Allow binder communications with the DNS server
* Allow binder communications with surfaceflinger
* Allow an app to bind to tcp/udp ports
* Allow all domains to read files from the root partition, assuming
the DAC allows access.
In addition, I added a bunch of "neverallow" rules, to assert that
certain capabilities are never added.
This change has a high probability of breaking someone, somewhere.
If it does, then I'm happy to fix the breakage, rollback this change,
or put untrusted_app into permissive mode.
Change-Id: I83f220135d20ab4f70fbd7be9401b5b1def1fe35
2013-07-13 03:45:56 +02:00
|
|
|
allow untrusted_app node_type:{ tcp_socket udp_socket } node_bind;
|
2013-07-16 18:03:58 +02:00
|
|
|
allow untrusted_app self:{ tcp_socket udp_socket } { create_socket_perms accept listen };
|
2013-07-16 18:45:39 +02:00
|
|
|
# Bind to a particular hostname/address/interface (e.g., localhost) instead of
|
|
|
|
|
# ANY. Normally, apps should not be listening on all interfaces.
|
|
|
|
|
allow untrusted_app port:{ tcp_socket udp_socket } name_bind;
|
untrusted_app.te / isolated_app.te / app.te first pass
This is my first attempt at creating an enforcing SELinux domain for
apps, untrusted_apps, and isolated_apps. Much of these rules are based on the
contents of app.te as of commit 11153ef34928ab9d13658606695cba192aa03e21
with extensive modifications, some of which are included below.
* Allow communication with netd/dnsproxyd, to allow netd to handle
dns requests
* Allow binder communications with the DNS server
* Allow binder communications with surfaceflinger
* Allow an app to bind to tcp/udp ports
* Allow all domains to read files from the root partition, assuming
the DAC allows access.
In addition, I added a bunch of "neverallow" rules, to assert that
certain capabilities are never added.
This change has a high probability of breaking someone, somewhere.
If it does, then I'm happy to fix the breakage, rollback this change,
or put untrusted_app into permissive mode.
Change-Id: I83f220135d20ab4f70fbd7be9401b5b1def1fe35
2013-07-13 03:45:56 +02:00
|
|
|
|
|
|
|
|
# Allow the allocation and use of ptys
|
|
|
|
|
# Used by: https://play.google.com/store/apps/details?id=jackpal.androidterm
|
2013-09-27 15:44:32 +02:00
|
|
|
create_pty(untrusted_app)
|
2013-07-16 00:48:34 +02:00
|
|
|
|
|
|
|
|
# Used by Finsky / Android "Verify Apps" functionality when
|
|
|
|
|
# running "adb install foo.apk".
|
|
|
|
|
# TODO: Long term, we don't want apps probing into shell data files.
|
|
|
|
|
# Figure out a way to remove these rules.
|
2013-09-05 01:12:33 +02:00
|
|
|
allow untrusted_app shell_data_file:file r_file_perms;
|
2013-07-16 00:48:34 +02:00
|
|
|
allow untrusted_app shell_data_file:dir r_dir_perms;
|
