2017-02-07 00:39:36 +01:00
|
|
|
#
|
|
|
|
|
# System Server aka system_server spawned by zygote.
|
|
|
|
|
# Most of the framework services run in this process.
|
|
|
|
|
#
|
|
|
|
|
|
2017-03-23 22:27:32 +01:00
|
|
|
typeattribute system_server coredomain;
|
2017-02-07 00:39:36 +01:00
|
|
|
typeattribute system_server mlstrustedsubject;
|
2019-04-22 19:09:38 +02:00
|
|
|
typeattribute system_server scheduler_service_server;
|
|
|
|
|
typeattribute system_server sensor_service_server;
|
2017-02-07 00:39:36 +01:00
|
|
|
|
2016-07-22 22:13:11 +02:00
|
|
|
# Define a type for tmpfs-backed ashmem regions.
|
|
|
|
|
tmpfs_domain(system_server)
|
2017-02-07 00:39:36 +01:00
|
|
|
|
2016-10-19 23:39:30 +02:00
|
|
|
# Create a socket for connections from crash_dump.
|
2016-07-22 22:13:11 +02:00
|
|
|
type_transition system_server system_data_file:sock_file system_ndebug_socket "ndebugsocket";
|
2016-10-12 23:58:09 +02:00
|
|
|
|
|
|
|
|
allow system_server zygote_tmpfs:file read;
|
2019-01-29 23:43:45 +01:00
|
|
|
allow system_server appdomain_tmpfs:file { getattr map read write };
|
2016-10-12 23:58:09 +02:00
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# For art.
|
|
|
|
|
allow system_server dalvikcache_data_file:dir r_dir_perms;
|
2017-05-03 23:01:58 +02:00
|
|
|
allow system_server dalvikcache_data_file:file r_file_perms;
|
|
|
|
|
|
2017-04-04 00:23:16 +02:00
|
|
|
# When running system server under --invoke-with, we'll try to load the boot image under the
|
|
|
|
|
# system server domain, following links to the system partition.
|
|
|
|
|
with_asan(`allow system_server dalvikcache_data_file:lnk_file r_file_perms;')
|
2017-02-07 00:39:36 +01:00
|
|
|
|
|
|
|
|
# /data/resource-cache
|
|
|
|
|
allow system_server resourcecache_data_file:file r_file_perms;
|
|
|
|
|
allow system_server resourcecache_data_file:dir r_dir_perms;
|
|
|
|
|
|
|
|
|
|
# ptrace to processes in the same domain for debugging crashes.
|
|
|
|
|
allow system_server self:process ptrace;
|
|
|
|
|
|
|
|
|
|
# Child of the zygote.
|
|
|
|
|
allow system_server zygote:fd use;
|
|
|
|
|
allow system_server zygote:process sigchld;
|
|
|
|
|
|
|
|
|
|
# May kill zygote on crashes.
|
|
|
|
|
allow system_server zygote:process sigkill;
|
|
|
|
|
allow system_server crash_dump:process sigkill;
|
2018-01-30 16:54:33 +01:00
|
|
|
allow system_server webview_zygote:process sigkill;
|
2018-11-05 11:39:15 +01:00
|
|
|
allow system_server app_zygote:process sigkill;
|
2017-02-07 00:39:36 +01:00
|
|
|
|
|
|
|
|
# Read /system/bin/app_process.
|
|
|
|
|
allow system_server zygote_exec:file r_file_perms;
|
|
|
|
|
|
|
|
|
|
# Needed to close the zygote socket, which involves getopt / getattr
|
|
|
|
|
allow system_server zygote:unix_stream_socket { getopt getattr };
|
|
|
|
|
|
|
|
|
|
# system server gets network and bluetooth permissions.
|
|
|
|
|
net_domain(system_server)
|
|
|
|
|
# in addition to ioctls whitelisted for all domains, also allow system_server
|
|
|
|
|
# to use privileged ioctls commands. Needed to set up VPNs.
|
|
|
|
|
allowxperm system_server self:udp_socket ioctl priv_sock_ioctls;
|
|
|
|
|
bluetooth_domain(system_server)
|
|
|
|
|
|
2019-01-16 12:23:58 +01:00
|
|
|
# Allow setup of tcp keepalive offload. This gives system_server the permission to
|
|
|
|
|
# call ioctl on app domains' tcp sockets. Additional ioctl commands still need to
|
|
|
|
|
# be granted individually, except for a small set of safe values whitelisted in
|
|
|
|
|
# public/domain.te.
|
|
|
|
|
allow system_server appdomain:tcp_socket ioctl;
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# These are the capabilities assigned by the zygote to the
|
|
|
|
|
# system server.
|
2017-11-09 23:51:26 +01:00
|
|
|
allow system_server self:global_capability_class_set {
|
2017-02-07 00:39:36 +01:00
|
|
|
ipc_lock
|
|
|
|
|
kill
|
|
|
|
|
net_admin
|
|
|
|
|
net_bind_service
|
|
|
|
|
net_broadcast
|
|
|
|
|
net_raw
|
|
|
|
|
sys_boot
|
|
|
|
|
sys_nice
|
2017-02-16 00:04:43 +01:00
|
|
|
sys_ptrace
|
2017-02-07 00:39:36 +01:00
|
|
|
sys_time
|
|
|
|
|
sys_tty_config
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
# Trigger module auto-load.
|
|
|
|
|
allow system_server kernel:system module_request;
|
|
|
|
|
|
|
|
|
|
# Allow alarmtimers to be set
|
2017-11-09 23:51:26 +01:00
|
|
|
allow system_server self:global_capability2_class_set wake_alarm;
|
2017-02-07 00:39:36 +01:00
|
|
|
|
2017-06-27 07:06:20 +02:00
|
|
|
# Create and share netlink_netfilter_sockets for tetheroffload.
|
|
|
|
|
allow system_server self:netlink_netfilter_socket create_socket_perms_no_ioctl;
|
|
|
|
|
|
2018-07-24 07:05:38 +02:00
|
|
|
# Create/use netlink_tcpdiag_socket for looking up connection UIDs for VPN apps.
|
|
|
|
|
allow system_server self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read };
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# Use netlink uevent sockets.
|
|
|
|
|
allow system_server self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
|
|
|
|
|
|
|
|
|
|
# Use generic netlink sockets.
|
|
|
|
|
allow system_server self:netlink_socket create_socket_perms_no_ioctl;
|
|
|
|
|
allow system_server self:netlink_generic_socket create_socket_perms_no_ioctl;
|
|
|
|
|
|
2017-05-18 18:59:05 +02:00
|
|
|
# libvintf reads the kernel config to verify vendor interface compatibility.
|
|
|
|
|
allow system_server config_gz:file { read open };
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# Use generic "sockets" where the address family is not known
|
|
|
|
|
# to the kernel. The ioctl permission is specifically omitted here, but may
|
|
|
|
|
# be added to device specific policy along with the ioctl commands to be
|
|
|
|
|
# whitelisted.
|
|
|
|
|
allow system_server self:socket create_socket_perms_no_ioctl;
|
|
|
|
|
|
|
|
|
|
# Set and get routes directly via netlink.
|
|
|
|
|
allow system_server self:netlink_route_socket nlmsg_write;
|
|
|
|
|
|
|
|
|
|
# Kill apps.
|
2017-06-13 23:49:17 +02:00
|
|
|
allow system_server appdomain:process { getpgid sigkill signal };
|
2017-02-07 00:39:36 +01:00
|
|
|
|
|
|
|
|
# Set scheduling info for apps.
|
|
|
|
|
allow system_server appdomain:process { getsched setsched };
|
|
|
|
|
allow system_server audioserver:process { getsched setsched };
|
|
|
|
|
allow system_server hal_audio:process { getsched setsched };
|
2017-03-23 18:03:49 +01:00
|
|
|
allow system_server hal_bluetooth:process { getsched setsched };
|
2019-04-30 14:09:28 +02:00
|
|
|
allow system_server hal_codec2_server:process { getsched setsched };
|
2018-05-26 01:23:37 +02:00
|
|
|
allow system_server hal_omx_server:process { getsched setsched };
|
2019-04-17 03:16:38 +02:00
|
|
|
allow system_server mediaswcodec:process { getsched setsched };
|
2017-02-07 00:39:36 +01:00
|
|
|
allow system_server cameraserver:process { getsched setsched };
|
2017-02-15 22:38:25 +01:00
|
|
|
allow system_server hal_camera:process { getsched setsched };
|
2017-02-07 00:39:36 +01:00
|
|
|
allow system_server mediaserver:process { getsched setsched };
|
|
|
|
|
allow system_server bootanim:process { getsched setsched };
|
|
|
|
|
|
2019-05-01 18:38:18 +02:00
|
|
|
# Set scheduling info for psi monitor thread.
|
2019-05-02 17:29:21 +02:00
|
|
|
# TODO: delete this line b/131761776
|
2019-05-01 18:38:18 +02:00
|
|
|
allow system_server kernel:process { getsched setsched };
|
|
|
|
|
|
2019-03-11 19:27:25 +01:00
|
|
|
# Allow system_server to write to /proc/<pid>/*
|
|
|
|
|
allow system_server domain:file w_file_perms;
|
2017-07-18 19:18:35 +02:00
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# Read /proc/pid data for all domains. This is used by ProcessCpuTracker
|
|
|
|
|
# within system_server to keep track of memory and CPU usage for
|
|
|
|
|
# all processes on the device. In addition, /proc/pid files access is needed
|
|
|
|
|
# for dumping stack traces of native processes.
|
|
|
|
|
r_dir_file(system_server, domain)
|
|
|
|
|
|
|
|
|
|
# Write /proc/uid_cputime/remove_uid_range.
|
|
|
|
|
allow system_server proc_uid_cputime_removeuid:file { w_file_perms getattr };
|
|
|
|
|
|
|
|
|
|
# Write /proc/uid_procstat/set.
|
|
|
|
|
allow system_server proc_uid_procstat_set:file { w_file_perms getattr };
|
|
|
|
|
|
|
|
|
|
# Write to /proc/sysrq-trigger.
|
|
|
|
|
allow system_server proc_sysrq:file rw_file_perms;
|
|
|
|
|
|
2018-03-29 20:07:13 +02:00
|
|
|
# Delete /data/misc/stats-data/ and /data/misc/stats-service/ directories.
|
|
|
|
|
allow system_server stats_data_file:dir { open read remove_name search write };
|
|
|
|
|
allow system_server stats_data_file:file unlink;
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# Read /sys/kernel/debug/wakeup_sources.
|
2018-01-22 23:00:46 +01:00
|
|
|
allow system_server debugfs_wakeup_sources:file r_file_perms;
|
2017-02-07 00:39:36 +01:00
|
|
|
|
|
|
|
|
# The DhcpClient and WifiWatchdog use packet_sockets
|
|
|
|
|
allow system_server self:packet_socket create_socket_perms_no_ioctl;
|
|
|
|
|
|
|
|
|
|
# 3rd party VPN clients require a tun_socket to be created
|
|
|
|
|
allow system_server self:tun_socket create_socket_perms_no_ioctl;
|
|
|
|
|
|
|
|
|
|
# Talk to init and various daemons via sockets.
|
|
|
|
|
unix_socket_connect(system_server, lmkd, lmkd)
|
|
|
|
|
unix_socket_connect(system_server, mtpd, mtp)
|
|
|
|
|
unix_socket_connect(system_server, zygote, zygote)
|
|
|
|
|
unix_socket_connect(system_server, racoon, racoon)
|
|
|
|
|
unix_socket_connect(system_server, uncrypt, uncrypt)
|
|
|
|
|
|
2018-10-08 22:15:10 +02:00
|
|
|
# Allow system_server to write to statsd.
|
|
|
|
|
unix_socket_send(system_server, statsdw, statsd)
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# Communicate over a socket created by surfaceflinger.
|
|
|
|
|
allow system_server surfaceflinger:unix_stream_socket { read write setopt };
|
|
|
|
|
|
2018-11-01 21:47:51 +01:00
|
|
|
allow system_server gpuservice:unix_stream_socket { read write setopt };
|
|
|
|
|
|
2018-01-30 16:54:33 +01:00
|
|
|
# Communicate over a socket created by webview_zygote.
|
|
|
|
|
allow system_server webview_zygote:unix_stream_socket { read write connectto setopt };
|
|
|
|
|
|
2018-11-05 11:39:15 +01:00
|
|
|
# Communicate over a socket created by app_zygote.
|
|
|
|
|
allow system_server app_zygote:unix_stream_socket { read write connectto setopt };
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# Perform Binder IPC.
|
|
|
|
|
binder_use(system_server)
|
|
|
|
|
binder_call(system_server, appdomain)
|
|
|
|
|
binder_call(system_server, binderservicedomain)
|
|
|
|
|
binder_call(system_server, dumpstate)
|
|
|
|
|
binder_call(system_server, fingerprintd)
|
|
|
|
|
binder_call(system_server, gatekeeperd)
|
2018-06-15 08:08:19 +02:00
|
|
|
binder_call(system_server, idmap)
|
2017-02-07 00:39:36 +01:00
|
|
|
binder_call(system_server, installd)
|
2016-11-21 08:23:04 +01:00
|
|
|
binder_call(system_server, incidentd)
|
2018-11-30 00:37:22 +01:00
|
|
|
binder_call(system_server, iorapd)
|
2017-02-07 00:39:36 +01:00
|
|
|
binder_call(system_server, netd)
|
2019-02-05 23:21:01 +01:00
|
|
|
binder_call(system_server, notify_traceur)
|
2017-12-19 00:14:33 +01:00
|
|
|
binder_call(system_server, statsd)
|
2017-10-17 01:39:13 +02:00
|
|
|
binder_call(system_server, storaged)
|
2018-11-21 19:10:54 +01:00
|
|
|
binder_call(system_server, update_engine)
|
2017-09-06 19:17:32 +02:00
|
|
|
binder_call(system_server, vold)
|
2017-02-07 00:39:36 +01:00
|
|
|
binder_call(system_server, wificond)
|
2017-08-04 23:51:36 +02:00
|
|
|
binder_call(system_server, wpantund)
|
2017-02-07 00:39:36 +01:00
|
|
|
binder_service(system_server)
|
|
|
|
|
|
2017-04-14 04:05:27 +02:00
|
|
|
# Use HALs
|
Mark all clients of Allocator HAL
This change associates all domains which are clients of Allocator HAL
with hal_allocator_client and the, required for all HAL client
domains, halclientdomain.
This enables this commit to remove the now unnecessary hwallocator_use
macro because its binder_call(..., hal_allocator_server) is covered by
binder_call(hal_allocator_client, hal_allocator_server) added in this
commit.
Unfortunately apps, except isolated app, are clients of Allocator HAL
as well. This makes it hard to use the hal_client_domain(...,
hal_allocator) macro because it translates into "typeattribute" which
currently does not support being provided with a set of types, such as
{ appdomain -isolated_app }. As a workaround, hopefully until
typeattribute is improved, this commit expresses the necessary
association operation in CIL. private/technical_debt.cil introduced by
this commit is appended into the platform policy CIL file, thus
ensuring that the hack has effect on the final monolithic policy.
P. S. This change also removes Allocator HAL access from isolated_app.
Isolated app shouldn't have access to this HAL anyway.
Test: Google Play Music plays back radios
Test: Google Camera records video with sound and that video is then
successfully played back with sound
Test: YouTube app plays back clips with sound
Test: YouTube in Chrome plays back clips with sound
Bug: 34170079
Change-Id: Id00bba6fde83e7cf04fb58bc1c353c2f66333f92
2017-03-21 22:28:53 +01:00
|
|
|
hal_client_domain(system_server, hal_allocator)
|
2018-01-10 17:11:46 +01:00
|
|
|
hal_client_domain(system_server, hal_authsecret)
|
2017-08-08 02:06:06 +02:00
|
|
|
hal_client_domain(system_server, hal_broadcastradio)
|
2019-04-30 14:09:28 +02:00
|
|
|
hal_client_domain(system_server, hal_codec2)
|
2017-06-23 17:40:16 +02:00
|
|
|
hal_client_domain(system_server, hal_configstore)
|
2017-03-17 02:48:40 +01:00
|
|
|
hal_client_domain(system_server, hal_contexthub)
|
2018-05-24 09:59:40 +02:00
|
|
|
hal_client_domain(system_server, hal_face)
|
Switch Fingerprint HAL policy to _client/_server
This switches Fingerprint HAL policy to the design which enables us to
conditionally remove unnecessary rules from domains which are clients
of Bluetooth HAL.
Domains which are clients of Fingerprint HAL, such as system_server
domain, are granted rules targeting hal_fingerprint only when the
Fingerprint HAL runs in passthrough mode (i.e., inside the client's
process). When the HAL runs in binderized mode (i.e., in another
process/domain, with clients talking to the HAL over HwBinder IPC),
rules targeting hal_fingerprint are not granted to client domains.
Domains which offer a binderized implementation of Fingerprint HAL,
such as hal_fingerprint_default domain, are always granted rules
targeting hal_fingerprint.
NOTE: This commit also removes unnecessary allow rules from
Fingerprint HAL, such access to servicemanager (not hwservicemanager)
and access to keystore daemon over Binder IPC. Fingerprint HAL does
not use this functionality anyway and shouldn't use it either.
Test: Enable fingerprint + PIN secure lock screen, confirm it unlocks
with fingerprint or PIN
Test: Disable PIN (and thus fingerprint) secure lock screen
Test: make FingerprintDialog, install, make a fake purchase
Test: Add fingerprint_hidl_hal_test to device.mk, build & add to device,
adb shell stop,
adb shell /data/nativetest64/fingerprint_hidl_hal_test/fingerprint_hidl_hal_test -- all tests pass
Bug: 34170079
Change-Id: I6951c0f0640194c743ff7049357c77f5f21b71a1
2017-02-22 00:35:16 +01:00
|
|
|
hal_client_domain(system_server, hal_fingerprint)
|
2017-03-17 02:48:40 +01:00
|
|
|
hal_client_domain(system_server, hal_gnss)
|
2017-04-17 21:53:40 +02:00
|
|
|
hal_client_domain(system_server, hal_graphics_allocator)
|
2017-06-02 22:59:39 +02:00
|
|
|
hal_client_domain(system_server, hal_health)
|
2018-01-17 21:27:06 +01:00
|
|
|
hal_client_domain(system_server, hal_input_classifier)
|
2017-03-17 02:48:40 +01:00
|
|
|
hal_client_domain(system_server, hal_ir)
|
|
|
|
|
hal_client_domain(system_server, hal_light)
|
|
|
|
|
hal_client_domain(system_server, hal_memtrack)
|
2017-06-30 03:33:03 +02:00
|
|
|
hal_client_domain(system_server, hal_neuralnetworks)
|
2017-03-27 16:40:21 +02:00
|
|
|
hal_client_domain(system_server, hal_oemlock)
|
2018-05-26 01:23:37 +02:00
|
|
|
hal_client_domain(system_server, hal_omx)
|
2017-03-17 02:48:40 +01:00
|
|
|
hal_client_domain(system_server, hal_power)
|
2018-12-10 23:59:57 +01:00
|
|
|
hal_client_domain(system_server, hal_power_stats)
|
2017-03-13 23:13:52 +01:00
|
|
|
hal_client_domain(system_server, hal_sensors)
|
2017-05-22 01:49:37 +02:00
|
|
|
hal_client_domain(system_server, hal_tetheroffload)
|
2017-03-17 02:48:40 +01:00
|
|
|
hal_client_domain(system_server, hal_thermal)
|
2017-04-05 04:20:48 +02:00
|
|
|
hal_client_domain(system_server, hal_tv_cec)
|
2017-03-30 00:03:59 +02:00
|
|
|
hal_client_domain(system_server, hal_tv_input)
|
2017-03-17 02:48:40 +01:00
|
|
|
hal_client_domain(system_server, hal_usb)
|
2018-01-08 18:29:40 +01:00
|
|
|
hal_client_domain(system_server, hal_usb_gadget)
|
2017-03-17 02:48:40 +01:00
|
|
|
hal_client_domain(system_server, hal_vibrator)
|
|
|
|
|
hal_client_domain(system_server, hal_vr)
|
2017-03-27 15:27:20 +02:00
|
|
|
hal_client_domain(system_server, hal_weaver)
|
Switch Wi-Fi HAL policy to _client/_server
This switches Wi-Fi HAL policy to the design which enables us to
conditionally remove unnecessary rules from domains which are clients
of Wi-Fi HAL.
Domains which are clients of Wi-Fi HAL, such as system_server domain,
are granted rules targeting hal_wifi only when the Wi-Fi HAL runs in
passthrough mode (i.e., inside the client's process). When the HAL
runs in binderized mode (i.e., in another process/domain, with clients
talking to the HAL over HwBinder IPC), rules targeting hal_wifi are
not granted to client domains.
Domains which offer a binderized implementation of Wi-Fi HAL, such as
hal_wifi_default domain, are always granted rules targeting hal_wifi.
Test: Setup Wizard (incl. adding a Google Account) completes fine with
Wi-Fi connectivity only
Test: Toggle Wi-Fi off, on, off, on
Test: Use System UI to see list of WLANs and connect to one which does
not require a password, and to one which requries a PSK
Test: ip6.me loads fine in Chrome over Wi-Fi
Bug: 34170079
Change-Id: I7a216a06727c88b7f2c23d529f67307e83bed17f
2017-02-23 00:12:19 +01:00
|
|
|
hal_client_domain(system_server, hal_wifi)
|
2017-12-23 00:03:15 +01:00
|
|
|
hal_client_domain(system_server, hal_wifi_hostapd)
|
2017-03-01 19:25:44 +01:00
|
|
|
hal_client_domain(system_server, hal_wifi_offload)
|
2017-02-19 06:32:32 +01:00
|
|
|
hal_client_domain(system_server, hal_wifi_supplicant)
|
2017-02-07 00:39:36 +01:00
|
|
|
|
2017-04-15 00:55:20 +02:00
|
|
|
# Talk with graphics composer fences
|
|
|
|
|
allow system_server hal_graphics_composer:fd use;
|
|
|
|
|
|
2017-04-14 04:05:27 +02:00
|
|
|
# Use RenderScript always-passthrough HAL
|
|
|
|
|
allow system_server hal_renderscript_hwservice:hwservice_manager find;
|
2018-10-18 21:39:35 +02:00
|
|
|
allow system_server same_process_hal_file:file { execute read open getattr map };
|
2017-04-14 04:05:27 +02:00
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# Talk to tombstoned to get ANR traces.
|
|
|
|
|
unix_socket_connect(system_server, tombstoned_intercept, tombstoned)
|
|
|
|
|
|
2017-04-20 23:34:00 +02:00
|
|
|
# List HAL interfaces to get ANR traces.
|
|
|
|
|
allow system_server hwservicemanager:hwservice_manager list;
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# Send signals to trigger ANR traces.
|
|
|
|
|
allow system_server {
|
2017-03-24 17:37:17 +01:00
|
|
|
# This is derived from the list that system server defines as interesting native processes
|
|
|
|
|
# to dump during ANRs or watchdog aborts, defined in NATIVE_STACKS_OF_INTEREST in
|
|
|
|
|
# frameworks/base/services/core/java/com/android/server/Watchdog.java.
|
2017-02-07 00:39:36 +01:00
|
|
|
audioserver
|
|
|
|
|
cameraserver
|
|
|
|
|
drmserver
|
2018-11-01 21:47:51 +01:00
|
|
|
gpuservice
|
2017-02-07 00:39:36 +01:00
|
|
|
inputflinger
|
|
|
|
|
mediadrmserver
|
|
|
|
|
mediaextractor
|
|
|
|
|
mediametrics
|
2019-04-19 21:13:33 +02:00
|
|
|
mediaserver
|
|
|
|
|
mediaswcodec
|
2017-02-07 00:39:36 +01:00
|
|
|
sdcardd
|
2018-01-25 02:56:25 +01:00
|
|
|
statsd
|
2017-02-07 00:39:36 +01:00
|
|
|
surfaceflinger
|
2019-02-05 22:39:02 +01:00
|
|
|
vold
|
2017-03-24 17:37:17 +01:00
|
|
|
|
|
|
|
|
# This list comes from HAL_INTERFACES_OF_INTEREST in
|
|
|
|
|
# frameworks/base/services/core/java/com/android/server/Watchdog.java.
|
|
|
|
|
hal_audio_server
|
|
|
|
|
hal_bluetooth_server
|
|
|
|
|
hal_camera_server
|
2019-04-30 14:09:28 +02:00
|
|
|
hal_codec2_server
|
2019-06-19 20:12:11 +02:00
|
|
|
hal_face_server
|
2018-08-10 00:56:09 +02:00
|
|
|
hal_graphics_allocator_server
|
2017-04-20 23:34:00 +02:00
|
|
|
hal_graphics_composer_server
|
2018-11-28 02:35:31 +01:00
|
|
|
hal_health_server
|
2018-05-26 01:23:37 +02:00
|
|
|
hal_omx_server
|
2019-06-19 02:56:47 +02:00
|
|
|
hal_power_stats_server
|
2017-07-12 06:18:53 +02:00
|
|
|
hal_sensors_server
|
2017-03-24 17:37:17 +01:00
|
|
|
hal_vr_server
|
2019-06-28 04:37:42 +02:00
|
|
|
system_suspend_server
|
2017-02-07 00:39:36 +01:00
|
|
|
}:process { signal };
|
|
|
|
|
|
|
|
|
|
# Use sockets received over binder from various services.
|
|
|
|
|
allow system_server audioserver:tcp_socket rw_socket_perms;
|
|
|
|
|
allow system_server audioserver:udp_socket rw_socket_perms;
|
|
|
|
|
allow system_server mediaserver:tcp_socket rw_socket_perms;
|
|
|
|
|
allow system_server mediaserver:udp_socket rw_socket_perms;
|
|
|
|
|
|
|
|
|
|
# Use sockets received over binder from various services.
|
|
|
|
|
allow system_server mediadrmserver:tcp_socket rw_socket_perms;
|
|
|
|
|
allow system_server mediadrmserver:udp_socket rw_socket_perms;
|
|
|
|
|
|
2017-03-24 23:02:13 +01:00
|
|
|
# Get file context
|
|
|
|
|
allow system_server file_contexts_file:file r_file_perms;
|
2017-03-27 21:06:04 +02:00
|
|
|
# access for mac_permissions
|
|
|
|
|
allow system_server mac_perms_file: file r_file_perms;
|
2017-02-07 00:39:36 +01:00
|
|
|
# Check SELinux permissions.
|
|
|
|
|
selinux_check_access(system_server)
|
|
|
|
|
|
2017-12-19 22:23:11 +01:00
|
|
|
allow system_server sysfs_type:dir search;
|
|
|
|
|
|
2017-10-10 05:39:34 +02:00
|
|
|
r_dir_file(system_server, sysfs_android_usb)
|
|
|
|
|
allow system_server sysfs_android_usb:file w_file_perms;
|
|
|
|
|
|
2019-02-15 21:15:21 +01:00
|
|
|
allow system_server sysfs_extcon:dir r_dir_perms;
|
|
|
|
|
|
2017-10-10 05:39:34 +02:00
|
|
|
r_dir_file(system_server, sysfs_ipv4)
|
|
|
|
|
allow system_server sysfs_ipv4:file w_file_perms;
|
|
|
|
|
|
|
|
|
|
r_dir_file(system_server, sysfs_rtc)
|
|
|
|
|
r_dir_file(system_server, sysfs_switch)
|
|
|
|
|
r_dir_file(system_server, sysfs_wakeup_reasons)
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
allow system_server sysfs_nfc_power_writable:file rw_file_perms;
|
2017-10-17 21:40:02 +02:00
|
|
|
allow system_server sysfs_power:dir search;
|
2017-10-10 05:39:34 +02:00
|
|
|
allow system_server sysfs_power:file rw_file_perms;
|
2017-02-07 00:39:36 +01:00
|
|
|
allow system_server sysfs_thermal:dir search;
|
|
|
|
|
allow system_server sysfs_thermal:file r_file_perms;
|
|
|
|
|
|
|
|
|
|
# TODO: Remove when HALs are forced into separate processes
|
|
|
|
|
allow system_server sysfs_vibrator:file { write append };
|
|
|
|
|
|
|
|
|
|
# TODO: added to match above sysfs rule. Remove me?
|
|
|
|
|
allow system_server sysfs_usb:file w_file_perms;
|
|
|
|
|
|
|
|
|
|
# Access devices.
|
|
|
|
|
allow system_server device:dir r_dir_perms;
|
|
|
|
|
allow system_server mdns_socket:sock_file rw_file_perms;
|
|
|
|
|
allow system_server gpu_device:chr_file rw_file_perms;
|
|
|
|
|
allow system_server input_device:dir r_dir_perms;
|
|
|
|
|
allow system_server input_device:chr_file rw_file_perms;
|
|
|
|
|
allow system_server tty_device:chr_file rw_file_perms;
|
|
|
|
|
allow system_server usbaccessory_device:chr_file rw_file_perms;
|
|
|
|
|
allow system_server video_device:dir r_dir_perms;
|
|
|
|
|
allow system_server video_device:chr_file rw_file_perms;
|
|
|
|
|
allow system_server adbd_socket:sock_file rw_file_perms;
|
|
|
|
|
allow system_server rtc_device:chr_file rw_file_perms;
|
|
|
|
|
allow system_server audio_device:dir r_dir_perms;
|
|
|
|
|
|
2018-11-28 22:47:44 +01:00
|
|
|
# write access to ALSA interfaces (/dev/snd/*) needed for MIDI
|
2017-02-07 00:39:36 +01:00
|
|
|
allow system_server audio_device:chr_file rw_file_perms;
|
|
|
|
|
|
|
|
|
|
# tun device used for 3rd party vpn apps
|
|
|
|
|
allow system_server tun_device:chr_file rw_file_perms;
|
2018-10-31 04:12:41 +01:00
|
|
|
allowxperm system_server tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF };
|
2017-02-07 00:39:36 +01:00
|
|
|
|
2018-11-21 19:10:54 +01:00
|
|
|
# Manage data/ota_package
|
|
|
|
|
allow system_server ota_package_file:dir rw_dir_perms;
|
|
|
|
|
allow system_server ota_package_file:file create_file_perms;
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# Manage system data files.
|
|
|
|
|
allow system_server system_data_file:dir create_dir_perms;
|
|
|
|
|
allow system_server system_data_file:notdevfile_class_set create_file_perms;
|
Relabel /data/system/packages.list to new type.
Conservatively grant access to packages_list_file to everything that had
access to system_data_file:file even if the comment in the SELinux
policy suggests it was for another use.
Ran a diff on the resulting SEPolicy, the only difference of domains
being granted is those that had system_data_file:dir permissiosn which
is clearly not applicable for packages.list
diff -u0 <(sesearch --allow -t system_data_file ~/sepolicy | sed 's/system_data_file/packages_list_file/') <(sesearch --allow -t packages_list_file ~/sepolicy_new)
--- /proc/self/fd/16 2019-03-19 20:01:44.378409146 +0000
+++ /proc/self/fd/18 2019-03-19 20:01:44.378409146 +0000
@@ -3 +2,0 @@
-allow appdomain packages_list_file:dir getattr;
@@ -6 +4,0 @@
-allow coredomain packages_list_file:dir getattr;
@@ -8 +5,0 @@
-allow domain packages_list_file:dir search;
@@ -35 +31,0 @@
-allow system_server packages_list_file:dir { rename search setattr read lock create reparent getattr write relabelfrom ioctl rmdir remove_name open add_name };
@@ -40 +35,0 @@
-allow tee packages_list_file:dir { search read lock getattr ioctl open };
@@ -43,3 +37,0 @@
-allow traced_probes packages_list_file:dir { read getattr open search };
-allow vendor_init packages_list_file:dir { search setattr read create getattr write relabelfrom ioctl rmdir remove_name open add_name };
-allow vold packages_list_file:dir { search setattr read lock create getattr mounton write ioctl rmdir remove_name open add_name };
@@ -48 +39,0 @@
-allow vold_prepare_subdirs packages_list_file:dir { read write relabelfrom rmdir remove_name open add_name };
@@ -50 +40,0 @@
-allow zygote packages_list_file:dir { search read lock getattr ioctl open };
Bug: 123186697
Change-Id: Ieabf313653deb5314872b63cd47dadd535af7b07
2019-03-19 19:14:38 +01:00
|
|
|
allow system_server packages_list_file:file create_file_perms;
|
2017-02-07 00:39:36 +01:00
|
|
|
allow system_server keychain_data_file:dir create_dir_perms;
|
|
|
|
|
allow system_server keychain_data_file:file create_file_perms;
|
|
|
|
|
allow system_server keychain_data_file:lnk_file create_file_perms;
|
|
|
|
|
|
|
|
|
|
# Manage /data/app.
|
|
|
|
|
allow system_server apk_data_file:dir create_dir_perms;
|
|
|
|
|
allow system_server apk_data_file:{ file lnk_file } { create_file_perms link };
|
|
|
|
|
allow system_server apk_tmp_file:dir create_dir_perms;
|
|
|
|
|
allow system_server apk_tmp_file:file create_file_perms;
|
|
|
|
|
|
2018-10-08 21:04:15 +02:00
|
|
|
# Access input configuration files in the /vendor directory
|
|
|
|
|
r_dir_file(system_server, vendor_keylayout_file)
|
|
|
|
|
r_dir_file(system_server, vendor_keychars_file)
|
|
|
|
|
r_dir_file(system_server, vendor_idc_file)
|
|
|
|
|
|
2018-02-28 17:19:48 +01:00
|
|
|
# Access /vendor/{app,framework,overlay}
|
2017-04-02 02:17:12 +02:00
|
|
|
r_dir_file(system_server, vendor_app_file)
|
2018-02-28 17:19:48 +01:00
|
|
|
r_dir_file(system_server, vendor_framework_file)
|
2017-04-06 01:16:13 +02:00
|
|
|
r_dir_file(system_server, vendor_overlay_file)
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# Manage /data/app-private.
|
|
|
|
|
allow system_server apk_private_data_file:dir create_dir_perms;
|
|
|
|
|
allow system_server apk_private_data_file:file create_file_perms;
|
|
|
|
|
allow system_server apk_private_tmp_file:dir create_dir_perms;
|
|
|
|
|
allow system_server apk_private_tmp_file:file create_file_perms;
|
|
|
|
|
|
|
|
|
|
# Manage files within asec containers.
|
|
|
|
|
allow system_server asec_apk_file:dir create_dir_perms;
|
|
|
|
|
allow system_server asec_apk_file:file create_file_perms;
|
|
|
|
|
allow system_server asec_public_file:file create_file_perms;
|
|
|
|
|
|
|
|
|
|
# Manage /data/anr.
|
2017-05-15 19:39:16 +02:00
|
|
|
#
|
|
|
|
|
# TODO: Some of these permissions can be withdrawn once we've switched to the
|
|
|
|
|
# new stack dumping mechanism, see b/32064548 and the rules below. In particular,
|
|
|
|
|
# the system_server should never need to create a new anr_data_file:file or write
|
|
|
|
|
# to one, but it will still need to read and append to existing files.
|
2017-02-07 00:39:36 +01:00
|
|
|
allow system_server anr_data_file:dir create_dir_perms;
|
|
|
|
|
allow system_server anr_data_file:file create_file_perms;
|
|
|
|
|
|
2017-05-15 19:39:16 +02:00
|
|
|
# New stack dumping scheme : request an output FD from tombstoned via a unix
|
|
|
|
|
# domain socket.
|
|
|
|
|
#
|
|
|
|
|
# Allow system_server to connect and write to the tombstoned java trace socket in
|
2017-05-30 18:52:46 +02:00
|
|
|
# order to dump its traces. Also allow the system server to write its traces to
|
2018-03-13 00:21:40 +01:00
|
|
|
# dumpstate during bugreport capture and incidentd during incident collection.
|
2017-05-15 19:39:16 +02:00
|
|
|
unix_socket_connect(system_server, tombstoned_java_trace, tombstoned)
|
|
|
|
|
allow system_server tombstoned:fd use;
|
2017-05-30 18:52:46 +02:00
|
|
|
allow system_server dumpstate:fifo_file append;
|
2018-03-13 00:21:40 +01:00
|
|
|
allow system_server incidentd:fifo_file append;
|
2018-07-17 21:46:01 +02:00
|
|
|
# Write to a pipe created from `adb shell` (for debuggerd -j `pidof system_server`)
|
|
|
|
|
userdebug_or_eng(`
|
|
|
|
|
allow system_server su:fifo_file append;
|
|
|
|
|
')
|
2017-05-15 19:39:16 +02:00
|
|
|
|
2019-03-16 23:45:45 +01:00
|
|
|
# Allow system_server to read pipes from incidentd (used to deliver incident reports
|
|
|
|
|
# to dropbox)
|
|
|
|
|
allow system_server incidentd:fifo_file read;
|
|
|
|
|
|
2016-11-21 08:23:04 +01:00
|
|
|
# Read /data/misc/incidents - only read. The fd will be sent over binder,
|
|
|
|
|
# with no DAC access to it, for dropbox to read.
|
|
|
|
|
allow system_server incident_data_file:file read;
|
|
|
|
|
|
2018-01-24 17:07:09 +01:00
|
|
|
# Allow dropbox to read /data/misc/perfetto-traces. Only the fd is sent over
|
|
|
|
|
# binder.
|
|
|
|
|
allow system_server perfetto_traces_data_file:file read;
|
|
|
|
|
allow system_server perfetto:fd use;
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# Manage /data/backup.
|
|
|
|
|
allow system_server backup_data_file:dir create_dir_perms;
|
|
|
|
|
allow system_server backup_data_file:file create_file_perms;
|
|
|
|
|
|
2018-04-16 16:49:49 +02:00
|
|
|
# Write to /data/system/dropbox
|
|
|
|
|
allow system_server dropbox_data_file:dir create_dir_perms;
|
|
|
|
|
allow system_server dropbox_data_file:file create_file_perms;
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# Write to /data/system/heapdump
|
|
|
|
|
allow system_server heapdump_data_file:dir rw_dir_perms;
|
|
|
|
|
allow system_server heapdump_data_file:file create_file_perms;
|
|
|
|
|
|
|
|
|
|
# Manage /data/misc/adb.
|
|
|
|
|
allow system_server adb_keys_file:dir create_dir_perms;
|
|
|
|
|
allow system_server adb_keys_file:file create_file_perms;
|
|
|
|
|
|
2017-12-14 10:56:32 +01:00
|
|
|
# Manage /data/misc/network_watchlist
|
|
|
|
|
allow system_server network_watchlist_data_file:dir create_dir_perms;
|
|
|
|
|
allow system_server network_watchlist_data_file:file create_file_perms;
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# Manage /data/misc/sms.
|
|
|
|
|
# TODO: Split into a separate type?
|
|
|
|
|
allow system_server radio_data_file:dir create_dir_perms;
|
|
|
|
|
allow system_server radio_data_file:file create_file_perms;
|
|
|
|
|
|
|
|
|
|
# Manage /data/misc/systemkeys.
|
|
|
|
|
allow system_server systemkeys_data_file:dir create_dir_perms;
|
|
|
|
|
allow system_server systemkeys_data_file:file create_file_perms;
|
|
|
|
|
|
2017-04-26 22:20:20 +02:00
|
|
|
# Manage /data/misc/textclassifier.
|
|
|
|
|
allow system_server textclassifier_data_file:dir create_dir_perms;
|
|
|
|
|
allow system_server textclassifier_data_file:file create_file_perms;
|
2017-02-07 00:39:36 +01:00
|
|
|
|
|
|
|
|
# Access /data/tombstones.
|
|
|
|
|
allow system_server tombstone_data_file:dir r_dir_perms;
|
|
|
|
|
allow system_server tombstone_data_file:file r_file_perms;
|
|
|
|
|
|
|
|
|
|
# Manage /data/misc/vpn.
|
|
|
|
|
allow system_server vpn_data_file:dir create_dir_perms;
|
|
|
|
|
allow system_server vpn_data_file:file create_file_perms;
|
|
|
|
|
|
|
|
|
|
# Manage /data/misc/wifi.
|
|
|
|
|
allow system_server wifi_data_file:dir create_dir_perms;
|
|
|
|
|
allow system_server wifi_data_file:file create_file_perms;
|
|
|
|
|
|
|
|
|
|
# Manage /data/misc/zoneinfo.
|
|
|
|
|
allow system_server zoneinfo_data_file:dir create_dir_perms;
|
|
|
|
|
allow system_server zoneinfo_data_file:file create_file_perms;
|
|
|
|
|
|
2019-02-27 12:21:20 +01:00
|
|
|
# Manage /data/app-staging.
|
2019-01-02 15:20:52 +01:00
|
|
|
allow system_server staging_data_file:dir create_dir_perms;
|
|
|
|
|
allow system_server staging_data_file:file create_file_perms;
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# Walk /data/data subdirectories.
|
|
|
|
|
# Types extracted from seapp_contexts type= fields.
|
2018-08-03 00:54:23 +02:00
|
|
|
allow system_server {
|
|
|
|
|
system_app_data_file
|
|
|
|
|
bluetooth_data_file
|
|
|
|
|
nfc_data_file
|
|
|
|
|
radio_data_file
|
|
|
|
|
shell_data_file
|
|
|
|
|
app_data_file
|
|
|
|
|
privapp_data_file
|
|
|
|
|
}:dir { getattr read search };
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# Also permit for unlabeled /data/data subdirectories and
|
|
|
|
|
# for unlabeled asec containers on upgrades from 4.2.
|
|
|
|
|
allow system_server unlabeled:dir r_dir_perms;
|
|
|
|
|
# Read pkg.apk file before it has been relabeled by vold.
|
|
|
|
|
allow system_server unlabeled:file r_file_perms;
|
|
|
|
|
|
|
|
|
|
# Populate com.android.providers.settings/databases/settings.db.
|
|
|
|
|
allow system_server system_app_data_file:dir create_dir_perms;
|
|
|
|
|
allow system_server system_app_data_file:file create_file_perms;
|
|
|
|
|
|
|
|
|
|
# Receive and use open app data files passed over binder IPC.
|
|
|
|
|
# Types extracted from seapp_contexts type= fields.
|
2018-08-03 00:54:23 +02:00
|
|
|
allow system_server {
|
|
|
|
|
system_app_data_file
|
|
|
|
|
bluetooth_data_file
|
|
|
|
|
nfc_data_file
|
|
|
|
|
radio_data_file
|
|
|
|
|
shell_data_file
|
|
|
|
|
app_data_file
|
|
|
|
|
privapp_data_file
|
2018-04-11 19:43:57 +02:00
|
|
|
}:file { getattr read write append map };
|
2017-02-07 00:39:36 +01:00
|
|
|
|
|
|
|
|
# Access to /data/media for measuring disk usage.
|
|
|
|
|
allow system_server media_rw_data_file:dir { search getattr open read };
|
|
|
|
|
|
|
|
|
|
# Receive and use open /data/media files passed over binder IPC.
|
|
|
|
|
# Also used for measuring disk usage.
|
|
|
|
|
allow system_server media_rw_data_file:file { getattr read write append };
|
|
|
|
|
|
Relabel /data/system/packages.list to new type.
Conservatively grant access to packages_list_file to everything that had
access to system_data_file:file even if the comment in the SELinux
policy suggests it was for another use.
Ran a diff on the resulting SEPolicy, the only difference of domains
being granted is those that had system_data_file:dir permissiosn which
is clearly not applicable for packages.list
diff -u0 <(sesearch --allow -t system_data_file ~/sepolicy | sed 's/system_data_file/packages_list_file/') <(sesearch --allow -t packages_list_file ~/sepolicy_new)
--- /proc/self/fd/16 2019-03-19 20:01:44.378409146 +0000
+++ /proc/self/fd/18 2019-03-19 20:01:44.378409146 +0000
@@ -3 +2,0 @@
-allow appdomain packages_list_file:dir getattr;
@@ -6 +4,0 @@
-allow coredomain packages_list_file:dir getattr;
@@ -8 +5,0 @@
-allow domain packages_list_file:dir search;
@@ -35 +31,0 @@
-allow system_server packages_list_file:dir { rename search setattr read lock create reparent getattr write relabelfrom ioctl rmdir remove_name open add_name };
@@ -40 +35,0 @@
-allow tee packages_list_file:dir { search read lock getattr ioctl open };
@@ -43,3 +37,0 @@
-allow traced_probes packages_list_file:dir { read getattr open search };
-allow vendor_init packages_list_file:dir { search setattr read create getattr write relabelfrom ioctl rmdir remove_name open add_name };
-allow vold packages_list_file:dir { search setattr read lock create getattr mounton write ioctl rmdir remove_name open add_name };
@@ -48 +39,0 @@
-allow vold_prepare_subdirs packages_list_file:dir { read write relabelfrom rmdir remove_name open add_name };
@@ -50 +40,0 @@
-allow zygote packages_list_file:dir { search read lock getattr ioctl open };
Bug: 123186697
Change-Id: Ieabf313653deb5314872b63cd47dadd535af7b07
2019-03-19 19:14:38 +01:00
|
|
|
# System server needs to setfscreate to packages_list_file when writing
|
|
|
|
|
# /data/system/packages.list
|
|
|
|
|
allow system_server system_server:process setfscreate;
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# Relabel apk files.
|
|
|
|
|
allow system_server { apk_tmp_file apk_private_tmp_file }:{ dir file } { relabelfrom relabelto };
|
|
|
|
|
allow system_server { apk_data_file apk_private_data_file }:{ dir file } { relabelfrom relabelto };
|
|
|
|
|
|
|
|
|
|
# Relabel wallpaper.
|
|
|
|
|
allow system_server system_data_file:file relabelfrom;
|
|
|
|
|
allow system_server wallpaper_file:file relabelto;
|
|
|
|
|
allow system_server wallpaper_file:file { rw_file_perms rename unlink };
|
|
|
|
|
|
|
|
|
|
# Backup of wallpaper imagery uses temporary hard links to avoid data churn
|
|
|
|
|
allow system_server { system_data_file wallpaper_file }:file link;
|
|
|
|
|
|
|
|
|
|
# ShortcutManager icons
|
|
|
|
|
allow system_server system_data_file:dir relabelfrom;
|
|
|
|
|
allow system_server shortcut_manager_icons:dir { create_dir_perms relabelto };
|
|
|
|
|
allow system_server shortcut_manager_icons:file create_file_perms;
|
|
|
|
|
|
|
|
|
|
# Manage ringtones.
|
|
|
|
|
allow system_server ringtone_file:dir { create_dir_perms relabelto };
|
|
|
|
|
allow system_server ringtone_file:file create_file_perms;
|
|
|
|
|
|
|
|
|
|
# Relabel icon file.
|
|
|
|
|
allow system_server icon_file:file relabelto;
|
|
|
|
|
allow system_server icon_file:file { rw_file_perms unlink };
|
|
|
|
|
|
|
|
|
|
# FingerprintService.java does a restorecon of the directory /data/system/users/[0-9]+/fpdata(/.*)?
|
|
|
|
|
allow system_server system_data_file:dir relabelfrom;
|
|
|
|
|
|
2018-11-27 22:23:21 +01:00
|
|
|
# server_configurable_flags_data_file is used for storing server configurable flags which
|
|
|
|
|
# have been reset during current booting. system_server needs to read the data to perform related
|
|
|
|
|
# disaster recovery actions.
|
|
|
|
|
allow system_server server_configurable_flags_data_file:dir r_dir_perms;
|
|
|
|
|
allow system_server server_configurable_flags_data_file:file r_file_perms;
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# Property Service write
|
|
|
|
|
set_prop(system_server, system_prop)
|
2017-10-19 09:54:49 +02:00
|
|
|
set_prop(system_server, exported_system_prop)
|
|
|
|
|
set_prop(system_server, exported2_system_prop)
|
|
|
|
|
set_prop(system_server, exported3_system_prop)
|
2017-02-07 00:39:36 +01:00
|
|
|
set_prop(system_server, safemode_prop)
|
2019-06-15 02:00:16 +02:00
|
|
|
set_prop(system_server, theme_prop)
|
2017-02-07 00:39:36 +01:00
|
|
|
set_prop(system_server, dhcp_prop)
|
|
|
|
|
set_prop(system_server, net_radio_prop)
|
2017-02-10 01:08:11 +01:00
|
|
|
set_prop(system_server, net_dns_prop)
|
2017-02-07 00:39:36 +01:00
|
|
|
set_prop(system_server, system_radio_prop)
|
2017-10-19 09:54:49 +02:00
|
|
|
set_prop(system_server, exported_system_radio_prop)
|
2017-02-07 00:39:36 +01:00
|
|
|
set_prop(system_server, debug_prop)
|
|
|
|
|
set_prop(system_server, powerctl_prop)
|
|
|
|
|
set_prop(system_server, fingerprint_prop)
|
2018-01-12 02:19:48 +01:00
|
|
|
set_prop(system_server, exported_fingerprint_prop)
|
2017-02-07 00:39:36 +01:00
|
|
|
set_prop(system_server, device_logging_prop)
|
|
|
|
|
set_prop(system_server, dumpstate_options_prop)
|
|
|
|
|
set_prop(system_server, overlay_prop)
|
2017-10-19 09:54:49 +02:00
|
|
|
set_prop(system_server, exported_overlay_prop)
|
2017-11-16 06:28:14 +01:00
|
|
|
set_prop(system_server, pm_prop)
|
2017-10-19 09:54:49 +02:00
|
|
|
set_prop(system_server, exported_pm_prop)
|
2017-02-07 00:39:36 +01:00
|
|
|
userdebug_or_eng(`set_prop(system_server, wifi_log_prop)')
|
|
|
|
|
|
|
|
|
|
# ctl interface
|
|
|
|
|
set_prop(system_server, ctl_default_prop)
|
|
|
|
|
set_prop(system_server, ctl_bugreport_prop)
|
2019-02-28 03:31:11 +01:00
|
|
|
set_prop(system_server, ctl_gsid_prop)
|
2017-02-07 00:39:36 +01:00
|
|
|
|
|
|
|
|
# cppreopt property
|
|
|
|
|
set_prop(system_server, cppreopt_prop)
|
|
|
|
|
|
2018-11-16 01:27:18 +01:00
|
|
|
# server configurable flags properties
|
2019-01-14 23:18:38 +01:00
|
|
|
set_prop(system_server, device_config_input_native_boot_prop)
|
2018-12-27 11:01:25 +01:00
|
|
|
set_prop(system_server, device_config_netd_native_prop)
|
2019-01-17 22:30:05 +01:00
|
|
|
set_prop(system_server, device_config_activity_manager_native_boot_prop)
|
2019-02-01 22:43:11 +01:00
|
|
|
set_prop(system_server, device_config_runtime_native_boot_prop)
|
2019-01-29 18:57:11 +01:00
|
|
|
set_prop(system_server, device_config_runtime_native_prop)
|
2019-01-31 00:28:31 +01:00
|
|
|
set_prop(system_server, device_config_media_native_prop)
|
2019-04-05 17:41:30 +02:00
|
|
|
set_prop(system_server, device_config_sys_traced_prop)
|
2018-11-16 01:27:18 +01:00
|
|
|
|
2017-08-14 23:25:10 +02:00
|
|
|
# BootReceiver to read ro.boot.bootreason
|
|
|
|
|
get_prop(system_server, bootloader_boot_reason_prop)
|
2018-06-05 18:41:59 +02:00
|
|
|
# PowerManager to read sys.boot.reason
|
|
|
|
|
get_prop(system_server, system_boot_reason_prop)
|
2017-08-14 23:25:10 +02:00
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# Collect metrics on boot time created by init
|
|
|
|
|
get_prop(system_server, boottime_prop)
|
|
|
|
|
|
|
|
|
|
# Read device's serial number from system properties
|
|
|
|
|
get_prop(system_server, serialno_prop)
|
|
|
|
|
|
|
|
|
|
# Read/write the property which keeps track of whether this is the first start of system_server
|
|
|
|
|
set_prop(system_server, firstboot_prop)
|
|
|
|
|
|
2018-06-20 23:08:02 +02:00
|
|
|
# Audio service in system server can read exported audio properties,
|
|
|
|
|
# such as camera shutter enforcement
|
|
|
|
|
get_prop(system_server, exported_audio_prop)
|
|
|
|
|
|
2018-11-16 23:59:10 +01:00
|
|
|
# system server reads this property to keep track of whether server configurable flags have been
|
|
|
|
|
# reset during current boot.
|
|
|
|
|
get_prop(system_server, device_config_reset_performed_prop)
|
|
|
|
|
|
2019-01-15 22:39:30 +01:00
|
|
|
# Read/write the property that enables Test Harness Mode
|
|
|
|
|
set_prop(system_server, test_harness_prop)
|
|
|
|
|
|
2019-02-07 22:14:20 +01:00
|
|
|
# Read gsid.image_running.
|
|
|
|
|
get_prop(system_server, gsid_prop)
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# Create a socket for connections from debuggerd.
|
|
|
|
|
allow system_server system_ndebug_socket:sock_file create_file_perms;
|
|
|
|
|
|
|
|
|
|
# Manage cache files.
|
2017-07-26 18:54:36 +02:00
|
|
|
allow system_server cache_file:lnk_file r_file_perms;
|
2017-02-07 00:39:36 +01:00
|
|
|
allow system_server { cache_file cache_recovery_file }:dir { relabelfrom create_dir_perms };
|
|
|
|
|
allow system_server { cache_file cache_recovery_file }:file { relabelfrom create_file_perms };
|
|
|
|
|
allow system_server { cache_file cache_recovery_file }:fifo_file create_file_perms;
|
|
|
|
|
|
|
|
|
|
allow system_server system_file:dir r_dir_perms;
|
|
|
|
|
allow system_server system_file:lnk_file r_file_perms;
|
|
|
|
|
|
2019-05-10 03:44:47 +02:00
|
|
|
# ART locks profile files.
|
|
|
|
|
allow system_server system_file:file lock;
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# LocationManager(e.g, GPS) needs to read and write
|
|
|
|
|
# to uart driver and ctrl proc entry
|
|
|
|
|
allow system_server gps_control:file rw_file_perms;
|
|
|
|
|
|
|
|
|
|
# Allow system_server to use app-created sockets and pipes.
|
|
|
|
|
allow system_server appdomain:{ tcp_socket udp_socket } { getattr getopt setopt read write shutdown };
|
|
|
|
|
allow system_server appdomain:{ fifo_file unix_stream_socket } { getattr read write };
|
|
|
|
|
|
|
|
|
|
# BackupManagerService needs to manipulate backup data files
|
|
|
|
|
allow system_server cache_backup_file:dir rw_dir_perms;
|
|
|
|
|
allow system_server cache_backup_file:file create_file_perms;
|
|
|
|
|
# LocalTransport works inside /cache/backup
|
|
|
|
|
allow system_server cache_private_backup_file:dir create_dir_perms;
|
|
|
|
|
allow system_server cache_private_backup_file:file create_file_perms;
|
|
|
|
|
|
|
|
|
|
# Allow system to talk to usb device
|
|
|
|
|
allow system_server usb_device:chr_file rw_file_perms;
|
|
|
|
|
allow system_server usb_device:dir r_dir_perms;
|
|
|
|
|
|
|
|
|
|
# Read from HW RNG (needed by EntropyMixer).
|
|
|
|
|
allow system_server hw_random_device:chr_file r_file_perms;
|
|
|
|
|
|
|
|
|
|
# Read and delete files under /dev/fscklogs.
|
|
|
|
|
r_dir_file(system_server, fscklogs)
|
|
|
|
|
allow system_server fscklogs:dir { write remove_name };
|
|
|
|
|
allow system_server fscklogs:file unlink;
|
|
|
|
|
|
|
|
|
|
# logd access, system_server inherit logd write socket
|
|
|
|
|
# (urge is to deprecate this long term)
|
|
|
|
|
allow system_server zygote:unix_dgram_socket write;
|
|
|
|
|
|
|
|
|
|
# Read from log daemon.
|
|
|
|
|
read_logd(system_server)
|
|
|
|
|
read_runtime_log_tags(system_server)
|
|
|
|
|
|
|
|
|
|
# Be consistent with DAC permissions. Allow system_server to write to
|
|
|
|
|
# /sys/module/lowmemorykiller/parameters/adj
|
|
|
|
|
# /sys/module/lowmemorykiller/parameters/minfree
|
|
|
|
|
allow system_server sysfs_lowmemorykiller:file { getattr w_file_perms };
|
|
|
|
|
|
|
|
|
|
# Read /sys/fs/pstore/console-ramoops
|
|
|
|
|
# Don't worry about overly broad permissions for now, as there's
|
|
|
|
|
# only one file in /sys/fs/pstore
|
|
|
|
|
allow system_server pstorefs:dir r_dir_perms;
|
|
|
|
|
allow system_server pstorefs:file r_file_perms;
|
|
|
|
|
|
|
|
|
|
# /sys access
|
|
|
|
|
allow system_server sysfs_zram:dir search;
|
2019-01-09 20:24:26 +01:00
|
|
|
allow system_server sysfs_zram:file rw_file_perms;
|
2017-02-07 00:39:36 +01:00
|
|
|
|
|
|
|
|
add_service(system_server, system_server_service);
|
|
|
|
|
allow system_server audioserver_service:service_manager find;
|
|
|
|
|
allow system_server batteryproperties_service:service_manager find;
|
|
|
|
|
allow system_server cameraserver_service:service_manager find;
|
2019-02-25 13:12:15 +01:00
|
|
|
allow system_server dnsresolver_service:service_manager find;
|
2017-02-07 00:39:36 +01:00
|
|
|
allow system_server drmserver_service:service_manager find;
|
|
|
|
|
allow system_server dumpstate_service:service_manager find;
|
|
|
|
|
allow system_server fingerprintd_service:service_manager find;
|
|
|
|
|
allow system_server gatekeeper_service:service_manager find;
|
2018-11-01 21:47:51 +01:00
|
|
|
allow system_server gpu_service:service_manager find;
|
2019-01-13 12:13:19 +01:00
|
|
|
allow system_server gsi_service:service_manager find;
|
|
|
|
|
allow system_server hal_fingerprint_service:service_manager find;
|
2018-06-15 08:08:19 +02:00
|
|
|
allow system_server idmap_service:service_manager find;
|
2016-11-21 08:23:04 +01:00
|
|
|
allow system_server incident_service:service_manager find;
|
2017-02-07 00:39:36 +01:00
|
|
|
allow system_server installd_service:service_manager find;
|
2018-11-30 00:37:22 +01:00
|
|
|
allow system_server iorapd_service:service_manager find;
|
2017-02-07 00:39:36 +01:00
|
|
|
allow system_server keystore_service:service_manager find;
|
|
|
|
|
allow system_server mediaserver_service:service_manager find;
|
|
|
|
|
allow system_server mediametrics_service:service_manager find;
|
|
|
|
|
allow system_server mediaextractor_service:service_manager find;
|
|
|
|
|
allow system_server mediacodec_service:service_manager find;
|
|
|
|
|
allow system_server mediadrmserver_service:service_manager find;
|
|
|
|
|
allow system_server netd_service:service_manager find;
|
|
|
|
|
allow system_server nfc_service:service_manager find;
|
|
|
|
|
allow system_server radio_service:service_manager find;
|
2017-12-19 00:14:33 +01:00
|
|
|
allow system_server stats_service:service_manager find;
|
2017-10-17 01:39:13 +02:00
|
|
|
allow system_server storaged_service:service_manager find;
|
2017-02-07 00:39:36 +01:00
|
|
|
allow system_server surfaceflinger_service:service_manager find;
|
2018-11-21 19:10:54 +01:00
|
|
|
allow system_server update_engine_service:service_manager find;
|
2017-09-06 19:17:32 +02:00
|
|
|
allow system_server vold_service:service_manager find;
|
2017-02-07 00:39:36 +01:00
|
|
|
allow system_server wificond_service:service_manager find;
|
|
|
|
|
|
2017-10-18 03:30:06 +02:00
|
|
|
add_service(system_server, batteryproperties_service)
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
allow system_server keystore:keystore_key {
|
|
|
|
|
get_state
|
|
|
|
|
get
|
|
|
|
|
insert
|
|
|
|
|
delete
|
|
|
|
|
exist
|
|
|
|
|
list
|
|
|
|
|
reset
|
|
|
|
|
password
|
|
|
|
|
lock
|
|
|
|
|
unlock
|
|
|
|
|
is_empty
|
|
|
|
|
sign
|
|
|
|
|
verify
|
|
|
|
|
grant
|
|
|
|
|
duplicate
|
|
|
|
|
clear_uid
|
|
|
|
|
add_auth
|
|
|
|
|
user_changed
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
# Allow system server to search and write to the persistent factory reset
|
|
|
|
|
# protection partition. This block device does not get wiped in a factory reset.
|
|
|
|
|
allow system_server block_device:dir search;
|
|
|
|
|
allow system_server frp_block_device:blk_file rw_file_perms;
|
2018-11-21 02:57:04 +01:00
|
|
|
allowxperm system_server frp_block_device:blk_file ioctl { BLKSECDISCARD BLKDISCARD };
|
2017-02-07 00:39:36 +01:00
|
|
|
|
|
|
|
|
# Clean up old cgroups
|
|
|
|
|
allow system_server cgroup:dir { remove_name rmdir };
|
|
|
|
|
|
|
|
|
|
# /oem access
|
|
|
|
|
r_dir_file(system_server, oemfs)
|
|
|
|
|
|
|
|
|
|
# Allow resolving per-user storage symlinks
|
|
|
|
|
allow system_server { mnt_user_file storage_file }:dir { getattr search };
|
|
|
|
|
allow system_server { mnt_user_file storage_file }:lnk_file { getattr read };
|
|
|
|
|
|
|
|
|
|
# Allow statfs() on storage devices, which happens fast enough that
|
|
|
|
|
# we shouldn't be killed during unsafe removal
|
|
|
|
|
allow system_server sdcard_type:dir { getattr search };
|
|
|
|
|
|
|
|
|
|
# Traverse into expanded storage
|
|
|
|
|
allow system_server mnt_expand_file:dir r_dir_perms;
|
|
|
|
|
|
|
|
|
|
# Allow system process to relabel the fingerprint directory after mkdir
|
|
|
|
|
# and delete the directory and files when no longer needed
|
|
|
|
|
allow system_server fingerprintd_data_file:dir { r_dir_perms remove_name rmdir relabelto write };
|
|
|
|
|
allow system_server fingerprintd_data_file:file { getattr unlink };
|
|
|
|
|
|
|
|
|
|
userdebug_or_eng(`
|
|
|
|
|
# Allow system server to create and write method traces in /data/misc/trace.
|
|
|
|
|
allow system_server method_trace_data_file:dir w_dir_perms;
|
|
|
|
|
allow system_server method_trace_data_file:file { create w_file_perms };
|
|
|
|
|
|
|
|
|
|
# Allow system server to read dmesg
|
|
|
|
|
allow system_server kernel:system syslog_read;
|
2017-11-17 17:23:32 +01:00
|
|
|
|
2017-11-21 00:21:56 +01:00
|
|
|
# Allow writing and removing window traces in /data/misc/wmtrace.
|
2017-11-17 17:23:32 +01:00
|
|
|
allow system_server wm_trace_data_file:dir rw_dir_perms;
|
2017-11-21 00:21:56 +01:00
|
|
|
allow system_server wm_trace_data_file:file { getattr setattr create unlink w_file_perms };
|
2017-02-07 00:39:36 +01:00
|
|
|
')
|
|
|
|
|
|
|
|
|
|
# For AppFuse.
|
|
|
|
|
allow system_server vold:fd use;
|
|
|
|
|
allow system_server fuse_device:chr_file { read write ioctl getattr };
|
2018-10-30 18:29:22 +01:00
|
|
|
allow system_server app_fuse_file:file { read write getattr };
|
2017-02-07 00:39:36 +01:00
|
|
|
|
|
|
|
|
# For configuring sdcardfs
|
|
|
|
|
allow system_server configfs:dir { create_dir_perms };
|
2017-12-01 11:18:31 +01:00
|
|
|
allow system_server configfs:file { getattr open create unlink write };
|
2017-02-07 00:39:36 +01:00
|
|
|
|
|
|
|
|
# Connect to adbd and use a socket transferred from it.
|
|
|
|
|
# Used for e.g. jdwp.
|
|
|
|
|
allow system_server adbd:unix_stream_socket connectto;
|
|
|
|
|
allow system_server adbd:fd use;
|
|
|
|
|
allow system_server adbd:unix_stream_socket { getattr getopt ioctl read write shutdown };
|
|
|
|
|
|
|
|
|
|
# Allow invoking tools like "timeout"
|
|
|
|
|
allow system_server toolbox_exec:file rx_file_perms;
|
|
|
|
|
|
2019-01-04 22:06:20 +01:00
|
|
|
# Allow system process to setup and measure fs-verity
|
|
|
|
|
allowxperm system_server apk_data_file:file ioctl {
|
|
|
|
|
FS_IOC_ENABLE_VERITY FS_IOC_MEASURE_VERITY
|
|
|
|
|
};
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# Postinstall
|
|
|
|
|
#
|
|
|
|
|
# For OTA dexopt, allow calls coming from postinstall.
|
|
|
|
|
binder_call(system_server, postinstall)
|
|
|
|
|
|
|
|
|
|
allow system_server postinstall:fifo_file write;
|
|
|
|
|
allow system_server update_engine:fd use;
|
|
|
|
|
allow system_server update_engine:fifo_file write;
|
|
|
|
|
|
|
|
|
|
# Access to /data/preloads
|
|
|
|
|
allow system_server preloads_data_file:file { r_file_perms unlink };
|
|
|
|
|
allow system_server preloads_data_file:dir { r_dir_perms write remove_name rmdir };
|
2017-03-14 19:42:03 +01:00
|
|
|
allow system_server preloads_media_file:file { r_file_perms unlink };
|
|
|
|
|
allow system_server preloads_media_file:dir { r_dir_perms write remove_name rmdir };
|
2017-02-07 00:39:36 +01:00
|
|
|
|
|
|
|
|
r_dir_file(system_server, cgroup)
|
|
|
|
|
allow system_server ion_device:chr_file r_file_perms;
|
|
|
|
|
|
2017-10-06 19:20:53 +02:00
|
|
|
r_dir_file(system_server, proc_asound)
|
Start the process of locking down proc/net
Files in /proc/net leak information. This change is the first step in
determining which files apps may use, whitelisting benign access, and
otherwise removing access while providing safe alternative APIs.
To that end, this change:
* Introduces the proc_net_type attribute which will assigned to any
new SELinux types in /proc/net to avoid removing access to privileged
processes. These processes may be evaluated later, but are lower
priority than apps.
* Labels /proc/net/{tcp,tcp6,udp,udp6} as proc_net_vpn due to existing
use by VPN apps. This may be replaced by an alternative API.
* Audits all other proc/net access for apps.
* Audits proc/net access for other processes which are currently
granted broad read access to /proc/net but should not be including
storaged, zygote, clatd, logd, preopt2cachename and vold.
Bug: 9496886
Bug: 68016944
Test: Boot Taimen-userdebug. On both wifi and cellular: stream youtube
navigate maps, send text message, make voice call, make video call.
Verify no avc "granted" messages in the logs.
Test: A few VPN apps including "VPN Monster", "Turbo VPN", and
"Freighter". Verify no logspam with the current setup.
Test: atest CtsNativeNetTestCases
Test: atest netd_integration_test
Test: atest QtaguidPermissionTest
Test: atest FileSystemPermissionTest
Change-Id: I7e49f796a25cf68bc698c6c9206e24af3ae11457
Merged-In: I7e49f796a25cf68bc698c6c9206e24af3ae11457
(cherry picked from commit 087318957f26e921d62f2e234fc14bff3c59030e)
2018-04-10 21:47:48 +02:00
|
|
|
r_dir_file(system_server, proc_net_type)
|
2018-01-02 22:10:46 +01:00
|
|
|
r_dir_file(system_server, proc_qtaguid_stat)
|
2017-11-15 01:32:36 +01:00
|
|
|
allow system_server {
|
|
|
|
|
proc_loadavg
|
|
|
|
|
proc_meminfo
|
|
|
|
|
proc_pagetypeinfo
|
|
|
|
|
proc_pipe_conf
|
|
|
|
|
proc_stat
|
|
|
|
|
proc_uid_cputime_showstat
|
2018-09-24 19:31:52 +02:00
|
|
|
proc_uid_io_stats
|
2017-11-15 01:32:36 +01:00
|
|
|
proc_uid_time_in_state
|
2017-11-10 23:10:19 +01:00
|
|
|
proc_uid_concurrent_active_time
|
|
|
|
|
proc_uid_concurrent_policy_time
|
2017-11-15 01:32:36 +01:00
|
|
|
proc_version
|
|
|
|
|
proc_vmallocinfo
|
|
|
|
|
}:file r_file_perms;
|
|
|
|
|
|
2017-11-18 00:40:51 +01:00
|
|
|
allow system_server proc_uid_time_in_state:dir r_dir_perms;
|
2018-01-19 22:48:31 +01:00
|
|
|
allow system_server proc_uid_cpupower:file r_file_perms;
|
2017-11-18 00:40:51 +01:00
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
r_dir_file(system_server, rootfs)
|
|
|
|
|
|
2017-02-23 03:01:00 +01:00
|
|
|
# Allow WifiService to start, stop, and read wifi-specific trace events.
|
|
|
|
|
allow system_server debugfs_tracing_instances:dir search;
|
2017-07-06 19:59:11 +02:00
|
|
|
allow system_server debugfs_wifi_tracing:dir search;
|
2017-02-23 03:01:00 +01:00
|
|
|
allow system_server debugfs_wifi_tracing:file rw_file_perms;
|
2017-02-07 00:39:36 +01:00
|
|
|
|
2017-05-04 17:35:03 +02:00
|
|
|
# allow system_server to exec shell, asanwrapper & zygote(app_process) on ASAN builds. Needed to run
|
2017-03-13 20:22:15 +01:00
|
|
|
# asanwrapper.
|
|
|
|
|
with_asan(`
|
|
|
|
|
allow system_server shell_exec:file rx_file_perms;
|
2017-04-04 00:23:16 +02:00
|
|
|
allow system_server asanwrapper_exec:file rx_file_perms;
|
2017-05-04 17:35:03 +02:00
|
|
|
allow system_server zygote_exec:file rx_file_perms;
|
2017-03-13 20:22:15 +01:00
|
|
|
')
|
|
|
|
|
|
2018-12-05 02:59:18 +01:00
|
|
|
# allow system_server to read the eBPF maps that stores the traffic stats information and update
|
2017-11-21 19:53:01 +01:00
|
|
|
# the map after snapshot is recorded
|
2018-03-24 00:01:10 +01:00
|
|
|
allow system_server fs_bpf:dir search;
|
2018-12-05 02:59:18 +01:00
|
|
|
allow system_server fs_bpf:file { read write };
|
|
|
|
|
allow system_server bpfloader:bpf { map_read map_write };
|
2017-11-21 19:53:01 +01:00
|
|
|
|
2017-11-22 09:09:25 +01:00
|
|
|
# ART Profiles.
|
|
|
|
|
# Allow system_server to open profile snapshots for read.
|
|
|
|
|
# System server never reads the actual content. It passes the descriptor to
|
|
|
|
|
# to privileged apps which acquire the permissions to inspect the profiles.
|
2018-05-04 05:14:51 +02:00
|
|
|
allow system_server user_profile_data_file:dir { getattr search };
|
2017-11-30 03:35:04 +01:00
|
|
|
allow system_server user_profile_data_file:file { getattr open read };
|
2017-11-22 09:09:25 +01:00
|
|
|
|
2018-05-05 02:44:33 +02:00
|
|
|
# System server may dump profile data for debuggable apps in the /data/misc/profman.
|
|
|
|
|
# As such it needs to be able create files but it should never read from them.
|
|
|
|
|
allow system_server profman_dump_data_file:file { create getattr setattr w_file_perms};
|
|
|
|
|
allow system_server profman_dump_data_file:dir w_dir_perms;
|
|
|
|
|
|
2018-05-04 05:14:51 +02:00
|
|
|
# On userdebug build we may profile system server. Allow it to write and create its own profile.
|
|
|
|
|
userdebug_or_eng(`
|
|
|
|
|
allow system_server user_profile_data_file:file create_file_perms;
|
|
|
|
|
')
|
|
|
|
|
|
2017-12-07 01:13:59 +01:00
|
|
|
# UsbDeviceManager uses /dev/usb-ffs
|
|
|
|
|
allow system_server functionfs:dir search;
|
|
|
|
|
allow system_server functionfs:file rw_file_perms;
|
|
|
|
|
|
2018-06-25 16:36:51 +02:00
|
|
|
# system_server contains time / time zone detection logic so reads the associated properties.
|
|
|
|
|
get_prop(system_server, time_prop)
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
###
|
|
|
|
|
### Neverallow rules
|
|
|
|
|
###
|
|
|
|
|
### system_server should NEVER do any of this
|
|
|
|
|
|
|
|
|
|
# Do not allow opening files from external storage as unsafe ejection
|
|
|
|
|
# could cause the kernel to kill the system_server.
|
|
|
|
|
neverallow system_server sdcard_type:dir { open read write };
|
|
|
|
|
neverallow system_server sdcard_type:file rw_file_perms;
|
|
|
|
|
|
|
|
|
|
# system server should never be operating on zygote spawned app data
|
|
|
|
|
# files directly. Rather, they should always be passed via a
|
|
|
|
|
# file descriptor.
|
|
|
|
|
# Types extracted from seapp_contexts type= fields, excluding
|
|
|
|
|
# those types that system_server needs to open directly.
|
2018-08-03 00:54:23 +02:00
|
|
|
neverallow system_server {
|
|
|
|
|
bluetooth_data_file
|
|
|
|
|
nfc_data_file
|
|
|
|
|
shell_data_file
|
|
|
|
|
app_data_file
|
|
|
|
|
privapp_data_file
|
|
|
|
|
}:file { open create unlink link };
|
2017-02-07 00:39:36 +01:00
|
|
|
|
|
|
|
|
# Forking and execing is inherently dangerous and racy. See, for
|
|
|
|
|
# example, https://www.linuxprogrammingblog.com/threads-and-fork-think-twice-before-using-them
|
|
|
|
|
# Prevent the addition of new file execs to stop the problem from
|
|
|
|
|
# getting worse. b/28035297
|
2017-03-13 20:22:15 +01:00
|
|
|
neverallow system_server {
|
|
|
|
|
file_type
|
|
|
|
|
-toolbox_exec
|
|
|
|
|
-logcat_exec
|
2017-04-04 00:23:16 +02:00
|
|
|
with_asan(`-shell_exec -asanwrapper_exec -zygote_exec')
|
2017-03-13 20:22:15 +01:00
|
|
|
}:file execute_no_trans;
|
2017-02-07 00:39:36 +01:00
|
|
|
|
|
|
|
|
# Ensure that system_server doesn't perform any domain transitions other than
|
|
|
|
|
# transitioning to the crash_dump domain when a crash occurs.
|
|
|
|
|
neverallow system_server { domain -crash_dump }:process transition;
|
|
|
|
|
neverallow system_server *:process dyntransition;
|
|
|
|
|
|
|
|
|
|
# Only allow crash_dump to connect to system_ndebug_socket.
|
|
|
|
|
neverallow { domain -init -system_server -crash_dump } system_ndebug_socket:sock_file { open write };
|
|
|
|
|
|
2018-11-16 01:27:18 +01:00
|
|
|
# Only allow init, system_server, flags_health_check to set properties for server configurable flags
|
|
|
|
|
neverallow {
|
|
|
|
|
domain
|
|
|
|
|
-init
|
|
|
|
|
-system_server
|
|
|
|
|
-flags_health_check
|
|
|
|
|
} {
|
2019-01-17 22:30:05 +01:00
|
|
|
device_config_activity_manager_native_boot_prop
|
2019-01-14 23:18:38 +01:00
|
|
|
device_config_input_native_boot_prop
|
2018-12-27 11:01:25 +01:00
|
|
|
device_config_netd_native_prop
|
2019-02-01 22:43:11 +01:00
|
|
|
device_config_runtime_native_boot_prop
|
2019-01-29 18:57:11 +01:00
|
|
|
device_config_runtime_native_prop
|
2019-01-31 00:28:31 +01:00
|
|
|
device_config_media_native_prop
|
2019-04-05 17:41:30 +02:00
|
|
|
device_config_sys_traced_prop
|
2018-11-16 01:27:18 +01:00
|
|
|
}:property_service set;
|
|
|
|
|
|
2017-02-07 00:39:36 +01:00
|
|
|
# system_server should never be executing dex2oat. This is either
|
|
|
|
|
# a bug (for example, bug 16317188), or represents an attempt by
|
|
|
|
|
# system server to dynamically load a dex file, something we do not
|
|
|
|
|
# want to allow.
|
|
|
|
|
neverallow system_server dex2oat_exec:file no_x_file_perms;
|
|
|
|
|
|
|
|
|
|
# system_server should never execute or load executable shared libraries
|
2018-09-13 00:41:54 +02:00
|
|
|
# in /data. Executable files in /data are a persistence vector.
|
|
|
|
|
# https://bugs.chromium.org/p/project-zero/issues/detail?id=955 for example.
|
2017-10-20 22:27:26 +02:00
|
|
|
neverallow system_server data_file_type:file no_x_file_perms;
|
2017-02-07 00:39:36 +01:00
|
|
|
|
|
|
|
|
# The only block device system_server should be accessing is
|
|
|
|
|
# the frp_block_device. This helps avoid a system_server to root
|
|
|
|
|
# escalation by writing to raw block devices.
|
|
|
|
|
neverallow system_server { dev_type -frp_block_device }:blk_file no_rw_file_perms;
|
|
|
|
|
|
|
|
|
|
# system_server should never use JIT functionality
|
2018-09-13 00:41:54 +02:00
|
|
|
# See https://googleprojectzero.blogspot.com/2016/12/bitunmap-attacking-android-ashmem.html
|
|
|
|
|
# in the section titled "A Short ROP Chain" for why.
|
2017-02-07 00:39:36 +01:00
|
|
|
neverallow system_server self:process execmem;
|
|
|
|
|
neverallow system_server ashmem_device:chr_file execute;
|
|
|
|
|
|
2016-10-12 23:58:09 +02:00
|
|
|
# TODO: deal with tmpfs_domain pub/priv split properly
|
2016-12-10 05:14:31 +01:00
|
|
|
neverallow system_server system_server_tmpfs:file execute;
|
2017-01-18 05:31:31 +01:00
|
|
|
|
2018-10-04 19:57:29 +02:00
|
|
|
# Resources handed off by system_server_startup
|
|
|
|
|
allow system_server system_server_startup:fd use;
|
|
|
|
|
allow system_server system_server_startup_tmpfs:file { read write map };
|
|
|
|
|
allow system_server system_server_startup:unix_dgram_socket write;
|
|
|
|
|
|
2018-10-18 13:50:06 +02:00
|
|
|
# Allow system server to communicate to apexd
|
|
|
|
|
allow system_server apex_service:service_manager find;
|
|
|
|
|
allow system_server apexd:binder call;
|
|
|
|
|
|
2019-01-21 14:45:47 +01:00
|
|
|
# Allow system server to communicate to system-suspend's control interface
|
|
|
|
|
allow system_server system_suspend_control_service:service_manager find;
|
2019-02-27 01:45:40 +01:00
|
|
|
binder_call(system_server, system_suspend)
|
|
|
|
|
binder_call(system_suspend, system_server)
|
|
|
|
|
|
|
|
|
|
# Allow system server to communicate to system-suspend's wakelock interface
|
|
|
|
|
wakelock_use(system_server)
|
2019-01-21 14:45:47 +01:00
|
|
|
|
2019-01-04 17:22:19 +01:00
|
|
|
# Allow the system server to read files under /data/apex. The system_server
|
|
|
|
|
# needs these privileges to compare file signatures while processing installs.
|
|
|
|
|
#
|
|
|
|
|
# Only apexd is allowed to create new entries or write to any file under /data/apex.
|
2019-06-28 17:28:28 +02:00
|
|
|
allow system_server apex_data_file:dir { getattr search };
|
2019-01-04 17:22:19 +01:00
|
|
|
allow system_server apex_data_file:file r_file_perms;
|
|
|
|
|
|
2019-02-28 23:11:34 +01:00
|
|
|
# Allow PasswordSlotManager rw access to /metadata/password_slots, so GSIs and the host image can
|
|
|
|
|
# communicate which slots are available for use.
|
|
|
|
|
allow system_server metadata_file:dir search;
|
|
|
|
|
allow system_server password_slot_metadata_file:dir rw_dir_perms;
|
|
|
|
|
allow system_server password_slot_metadata_file:file create_file_perms;
|
|
|
|
|
|
2019-02-14 18:26:46 +01:00
|
|
|
# Read/Write /proc/pressure/memory
|
|
|
|
|
allow system_server proc_pressure_mem:file rw_file_perms;
|
|
|
|
|
|
2017-01-18 05:31:31 +01:00
|
|
|
# dexoptanalyzer is currently used only for secondary dex files which
|
|
|
|
|
# system_server should never access.
|
|
|
|
|
neverallow system_server dexoptanalyzer_exec:file no_x_file_perms;
|
2017-02-16 00:04:43 +01:00
|
|
|
|
|
|
|
|
# No ptracing others
|
|
|
|
|
neverallow system_server { domain -system_server }:process ptrace;
|
|
|
|
|
|
|
|
|
|
# CAP_SYS_RESOURCE was traditionally needed for sensitive /proc/PID
|
|
|
|
|
# file read access. However, that is now unnecessary (b/34951864)
|
2017-11-22 18:59:08 +01:00
|
|
|
neverallow system_server system_server:global_capability_class_set sys_resource;
|
2019-02-28 23:11:34 +01:00
|
|
|
|
|
|
|
|
# Only system_server/init should access /metadata/password_slots.
|
|
|
|
|
neverallow { domain -init -system_server } password_slot_metadata_file:dir *;
|
|
|
|
|
neverallow {
|
|
|
|
|
domain
|
|
|
|
|
-init
|
|
|
|
|
-system_server
|
|
|
|
|
} password_slot_metadata_file:notdevfile_class_set ~{ relabelto getattr };
|
|
|
|
|
neverallow { domain -init -system_server } password_slot_metadata_file:notdevfile_class_set *;
|
