2021-10-27 16:12:44 +02:00
|
|
|
# /proc/net access.
|
|
|
|
|
# TODO(b/9496886) Audit access for removal.
|
|
|
|
|
# proc_net access for the negated domains below is granted (or not) in their
|
|
|
|
|
# individual .te files.
|
|
|
|
|
r_dir_file({
|
|
|
|
|
appdomain
|
|
|
|
|
-ephemeral_app
|
|
|
|
|
-isolated_app
|
|
|
|
|
-platform_app
|
|
|
|
|
-priv_app
|
|
|
|
|
-shell
|
|
|
|
|
-supplemental_process
|
|
|
|
|
-system_app
|
|
|
|
|
-untrusted_app_all
|
|
|
|
|
}, proc_net_type)
|
|
|
|
|
# audit access for all these non-core app domains.
|
|
|
|
|
userdebug_or_eng(`
|
|
|
|
|
auditallow {
|
|
|
|
|
appdomain
|
|
|
|
|
-ephemeral_app
|
|
|
|
|
-isolated_app
|
|
|
|
|
-platform_app
|
|
|
|
|
-priv_app
|
|
|
|
|
-shell
|
|
|
|
|
-su
|
|
|
|
|
-supplemental_process
|
|
|
|
|
-system_app
|
|
|
|
|
-untrusted_app_all
|
|
|
|
|
} proc_net_type:{ dir file lnk_file } { getattr open read };
|
|
|
|
|
')
|
|
|
|
|
|
2019-01-15 22:39:30 +01:00
|
|
|
# Allow apps to read the Test Harness Mode property. This property is used in
|
|
|
|
|
# the implementation of ActivityManager.isDeviceInTestHarnessMode()
|
|
|
|
|
get_prop(appdomain, test_harness_prop)
|
|
|
|
|
|
2020-05-21 13:12:55 +02:00
|
|
|
get_prop(appdomain, boot_status_prop)
|
|
|
|
|
get_prop(appdomain, dalvik_config_prop)
|
2020-07-06 15:24:11 +02:00
|
|
|
get_prop(appdomain, media_config_prop)
|
2020-06-30 18:27:49 +02:00
|
|
|
get_prop(appdomain, packagemanager_config_prop)
|
2020-08-03 07:29:47 +02:00
|
|
|
get_prop(appdomain, radio_control_prop)
|
2020-05-21 13:12:55 +02:00
|
|
|
get_prop(appdomain, surfaceflinger_color_prop)
|
|
|
|
|
get_prop(appdomain, systemsound_config_prop)
|
2020-06-05 03:40:16 +02:00
|
|
|
get_prop(appdomain, telephony_config_prop)
|
2020-05-21 13:12:55 +02:00
|
|
|
get_prop(appdomain, userspace_reboot_config_prop)
|
|
|
|
|
get_prop(appdomain, vold_config_prop)
|
2020-07-28 00:15:53 +02:00
|
|
|
get_prop(appdomain, adbd_config_prop)
|
2021-12-23 04:13:25 +01:00
|
|
|
get_prop(appdomain, dck_prop)
|
2020-05-21 13:12:55 +02:00
|
|
|
|
2021-05-19 00:33:08 +02:00
|
|
|
# Allow ART to be configurable via device_config properties
|
|
|
|
|
# (ART "runs" inside the app process)
|
|
|
|
|
get_prop(appdomain, device_config_runtime_native_prop)
|
|
|
|
|
get_prop(appdomain, device_config_runtime_native_boot_prop)
|
|
|
|
|
|
2019-10-08 17:15:14 +02:00
|
|
|
userdebug_or_eng(`perfetto_producer({ appdomain })')
|
|
|
|
|
|
2019-12-16 10:59:03 +01:00
|
|
|
# Prevent apps from causing presubmit failures.
|
|
|
|
|
# Apps can cause selinux denials by accessing CE storage
|
|
|
|
|
# and/or external storage. In either case, the selinux denial is
|
|
|
|
|
# not the cause of the failure, but just a symptom that
|
|
|
|
|
# storage isn't ready. Many apps handle the failure appropriately.
|
|
|
|
|
#
|
|
|
|
|
# Apps cannot access external storage before it becomes available.
|
|
|
|
|
dontaudit appdomain storage_stub_file:dir getattr;
|
|
|
|
|
# Attempts to write to system_data_file is generally a sign
|
|
|
|
|
# that apps are attempting to access encrypted storage before
|
|
|
|
|
# the ACTION_USER_UNLOCKED intent is delivered. Apps are not
|
|
|
|
|
# allowed to write to CE storage before it's available.
|
|
|
|
|
# Attempting to do so will be blocked by both selinux and unix
|
|
|
|
|
# permissions.
|
|
|
|
|
dontaudit appdomain system_data_file:dir write;
|
2020-04-02 13:36:17 +02:00
|
|
|
# Apps should not be reading vendor-defined properties.
|
|
|
|
|
dontaudit appdomain vendor_default_prop:file read;
|
2019-12-16 10:59:03 +01:00
|
|
|
|
2021-04-08 13:20:26 +02:00
|
|
|
# Access to /mnt/media_rw/<vol> (limited by DAC to apps with external_storage gid)
|
|
|
|
|
allow appdomain mnt_media_rw_file:dir search;
|
|
|
|
|
|
2017-12-15 03:20:30 +01:00
|
|
|
neverallow appdomain system_server:udp_socket {
|
2018-03-27 15:34:54 +02:00
|
|
|
accept append bind create ioctl listen lock name_bind
|
|
|
|
|
relabelfrom relabelto setattr shutdown };
|
2018-11-29 02:50:24 +01:00
|
|
|
|
|
|
|
|
# Transition to a non-app domain.
|
|
|
|
|
# Exception for the shell and su domains, can transition to runas, etc.
|
2018-12-12 18:06:05 +01:00
|
|
|
# Exception for crash_dump to allow for app crash reporting.
|
|
|
|
|
# Exception for renderscript binaries (/system/bin/bcc, /system/bin/ld.mc)
|
|
|
|
|
# to allow renderscript to create privileged executable files.
|
|
|
|
|
neverallow { appdomain -shell userdebug_or_eng(`-su') }
|
|
|
|
|
{ domain -appdomain -crash_dump -rs }:process { transition };
|
|
|
|
|
neverallow { appdomain -shell userdebug_or_eng(`-su') }
|
|
|
|
|
{ domain -appdomain }:process { dyntransition };
|
2020-05-12 07:50:40 +02:00
|
|
|
|
|
|
|
|
# Don't allow regular apps access to storage configuration properties.
|
|
|
|
|
neverallow { appdomain -mediaprovider_app } storage_config_prop:file no_rw_file_perms;
|
2020-06-03 21:20:41 +02:00
|
|
|
|
2020-07-16 15:25:47 +02:00
|
|
|
# Allow to read sendbug.preferred.domain
|
|
|
|
|
get_prop(appdomain, sendbug_config_prop)
|
|
|
|
|
|
2020-06-03 21:20:41 +02:00
|
|
|
# Allow to read graphics related properties.
|
|
|
|
|
get_prop(appdomain, graphics_config_prop)
|
2020-07-20 13:26:07 +02:00
|
|
|
|
|
|
|
|
# Allow to read persist.config.calibration_fac
|
|
|
|
|
get_prop(appdomain, camera_calibration_prop)
|
2020-11-17 05:54:52 +01:00
|
|
|
|
|
|
|
|
# Allow to read db.log.detailed, db.log.slow_query_threshold*
|
|
|
|
|
get_prop(appdomain, sqlite_log_prop)
|
2020-10-16 16:29:55 +02:00
|
|
|
|
2021-01-21 22:08:31 +01:00
|
|
|
# Allow font file read by apps.
|
|
|
|
|
allow appdomain font_data_file:file r_file_perms;
|
|
|
|
|
allow appdomain font_data_file:dir r_dir_perms;
|
|
|
|
|
|
2021-03-29 13:51:35 +02:00
|
|
|
# Enter /data/misc/apexdata/
|
|
|
|
|
allow appdomain apex_module_data_file:dir search;
|
2021-04-27 16:51:33 +02:00
|
|
|
# Read /data/misc/apexdata/com.android.art, execute signed AOT artifacts.
|
2021-03-29 13:51:35 +02:00
|
|
|
allow appdomain apex_art_data_file:dir r_dir_perms;
|
2021-04-27 16:51:33 +02:00
|
|
|
allow appdomain apex_art_data_file:file rx_file_perms;
|
2020-10-16 16:29:55 +02:00
|
|
|
|
2021-02-04 03:35:06 +01:00
|
|
|
# Allow access to tombstones if an fd to one is given to you.
|
|
|
|
|
# This is restricted by unix permissions, so an app must go through system_server to get one.
|
|
|
|
|
allow appdomain tombstone_data_file:file { getattr read };
|
|
|
|
|
neverallow appdomain tombstone_data_file:file ~{ getattr read };
|
|
|
|
|
|
2021-10-27 16:12:44 +02:00
|
|
|
# Execute the shell or other system executables.
|
|
|
|
|
allow { appdomain -ephemeral_app -supplemental_process } shell_exec:file rx_file_perms;
|
|
|
|
|
allow { appdomain -ephemeral_app -supplemental_process } toolbox_exec:file rx_file_perms;
|
|
|
|
|
not_full_treble(`allow { appdomain -ephemeral_app -supplemental_process } vendor_file:file x_file_perms;')
|
|
|
|
|
|
|
|
|
|
# Allow apps access to /vendor/app except for privileged
|
|
|
|
|
# apps which cannot be in /vendor.
|
|
|
|
|
r_dir_file({ appdomain -ephemeral_app -supplemental_process }, vendor_app_file)
|
|
|
|
|
allow { appdomain -ephemeral_app -supplemental_process } vendor_app_file:file execute;
|
|
|
|
|
|
|
|
|
|
# Perform binder IPC to supplemental process.
|
|
|
|
|
binder_call(appdomain, supplemental_process)
|
|
|
|
|
|
|
|
|
|
# Allow access to external storage; we have several visible mount points under /storage
|
|
|
|
|
# and symlinks to primary storage at places like /storage/sdcard0 and /mnt/user/0/primary
|
|
|
|
|
allow { appdomain -isolated_app -ephemeral_app -supplemental_process } storage_file:dir r_dir_perms;
|
|
|
|
|
allow { appdomain -isolated_app -ephemeral_app -supplemental_process } storage_file:lnk_file r_file_perms;
|
|
|
|
|
allow { appdomain -isolated_app -ephemeral_app -supplemental_process } mnt_user_file:dir r_dir_perms;
|
|
|
|
|
allow { appdomain -isolated_app -ephemeral_app -supplemental_process } mnt_user_file:lnk_file r_file_perms;
|
|
|
|
|
|
|
|
|
|
# Read/write visible storage
|
|
|
|
|
allow { appdomain -isolated_app -ephemeral_app -supplemental_process } { sdcard_type fuse }:dir create_dir_perms;
|
|
|
|
|
allow { appdomain -isolated_app -ephemeral_app -supplemental_process } { sdcard_type fuse }:file create_file_perms;
|
|
|
|
|
# This should be removed if sdcardfs is modified to alter the secontext for its
|
|
|
|
|
# accesses to the underlying FS.
|
|
|
|
|
allow { appdomain -isolated_app -ephemeral_app -supplemental_process } media_rw_data_file:dir create_dir_perms;
|
|
|
|
|
allow { appdomain -isolated_app -ephemeral_app -supplemental_process } media_rw_data_file:file create_file_perms;
|
|
|
|
|
|
|
|
|
|
# Allow apps to use the USB Accessory interface.
|
|
|
|
|
# http://developer.android.com/guide/topics/connectivity/usb/accessory.html
|
|
|
|
|
#
|
|
|
|
|
# USB devices are first opened by the system server (USBDeviceManagerService)
|
|
|
|
|
# and the file descriptor is passed to the right Activity via binder.
|
|
|
|
|
allow { appdomain -isolated_app -ephemeral_app -supplemental_process } usb_device:chr_file { read write getattr ioctl };
|
|
|
|
|
allow { appdomain -isolated_app -ephemeral_app -supplemental_process } usbaccessory_device:chr_file { read write getattr };
|
|
|
|
|
|
|
|
|
|
#logd access
|
|
|
|
|
control_logd({ appdomain -ephemeral_app -supplemental_process })
|
|
|
|
|
|
|
|
|
|
# application inherit logd write socket (urge is to deprecate this long term)
|
|
|
|
|
allow { appdomain -isolated_app -ephemeral_app -supplemental_process } keystore:keystore_key { get_state get insert delete exist list sign verify };
|
|
|
|
|
allow { appdomain -isolated_app -ephemeral_app -supplemental_process } keystore:keystore2_key { delete use get_info rebind update };
|
|
|
|
|
|
|
|
|
|
allow { appdomain -isolated_app -ephemeral_app -supplemental_process } keystore_maintenance_service:service_manager find;
|
|
|
|
|
allow { appdomain -isolated_app -ephemeral_app -supplemental_process } keystore:keystore2 get_state;
|
|
|
|
|
|
|
|
|
|
use_keystore({ appdomain -isolated_app -ephemeral_app -supplemental_process })
|
|
|
|
|
|
|
|
|
|
use_credstore({ appdomain -isolated_app -ephemeral_app -supplemental_process })
|
|
|
|
|
|
|
|
|
|
# For app fuse.
|
|
|
|
|
pdx_client({ appdomain -isolated_app -ephemeral_app -supplemental_process }, display_client)
|
|
|
|
|
pdx_client({ appdomain -isolated_app -ephemeral_app -supplemental_process }, display_manager)
|
|
|
|
|
pdx_client({ appdomain -isolated_app -ephemeral_app -supplemental_process }, display_vsync)
|
|
|
|
|
pdx_client({ appdomain -isolated_app -ephemeral_app -supplemental_process }, performance_client)
|
|
|
|
|
# Apps do not directly open the IPC socket for bufferhubd.
|
|
|
|
|
pdx_use({ appdomain -isolated_app -ephemeral_app -supplemental_process }, bufferhub_client)
|
|
|
|
|
|
|
|
|
|
# Apps receive an open tun fd from the framework for
|
|
|
|
|
# device traffic. Do not allow untrusted app to directly open tun_device
|
|
|
|
|
allow { appdomain -isolated_app -ephemeral_app -supplemental_process } tun_device:chr_file { read write getattr append ioctl };
|
|
|
|
|
allowxperm { appdomain -isolated_app -ephemeral_app -supplemental_process } tun_device:chr_file ioctl TUNGETIFF;
|
|
|
|
|
|
2020-10-16 16:29:55 +02:00
|
|
|
# Sensitive app domains are not allowed to execute from /data
|
|
|
|
|
# to prevent persistence attacks and ensure all code is executed
|
|
|
|
|
# from read-only locations.
|
|
|
|
|
neverallow {
|
|
|
|
|
bluetooth
|
|
|
|
|
isolated_app
|
|
|
|
|
nfc
|
|
|
|
|
radio
|
|
|
|
|
shared_relro
|
|
|
|
|
system_app
|
|
|
|
|
} {
|
|
|
|
|
data_file_type
|
|
|
|
|
-apex_art_data_file
|
|
|
|
|
-dalvikcache_data_file
|
|
|
|
|
-system_data_file # shared libs in apks
|
|
|
|
|
-apk_data_file
|
|
|
|
|
}:file no_x_file_perms;
|
2021-10-06 07:13:20 +02:00
|
|
|
|
|
|
|
|
# For now, don't allow apps other than gmscore to access /data/misc_ce/<userid>/checkin
|
|
|
|
|
neverallow { appdomain -gmscore_app } checkin_data_file:dir *;
|
|
|
|
|
neverallow { appdomain -gmscore_app } checkin_data_file:file *;
|
