Move allow rules from public/app.te to private/app.te
Allow rules in public/*.te can only reference types defined in public/*.te files. This can be quite cumbersome in cases a rule needs to be updated to reference a type that is only defined in private/*.te. This change moves all the allow rules from public/app.te to private/app.te to make it possible to reference private types in the allow rules. Bug: 211761016 Test: m Test: presubmit Change-Id: I0c4a3f1ef568bbfdfb2176869fcd92ee648617fa Merged-In: I0c4a3f1ef568bbfdfb2176869fcd92ee648617fa
This commit is contained in:
Nikita Ioffe
parent
70cd2da646
commit
269e7cfc51
2 changed files with 369 additions and 369 deletions
369
private/app.te
369
private/app.te
|
|
@ -87,6 +87,375 @@ allow appdomain apex_art_data_file:file rx_file_perms;
|
||||||
allow appdomain tombstone_data_file:file { getattr read };
|
allow appdomain tombstone_data_file:file { getattr read };
|
||||||
neverallow appdomain tombstone_data_file:file ~{ getattr read };
|
neverallow appdomain tombstone_data_file:file ~{ getattr read };
|
||||||
|
|
||||||
|
# WebView and other application-specific JIT compilers
|
||||||
|
allow appdomain self:process execmem;
|
||||||
|
|
||||||
|
allow appdomain { ashmem_device ashmem_libcutils_device }:chr_file execute;
|
||||||
|
|
||||||
|
# Receive and use open file descriptors inherited from zygote.
|
||||||
|
allow appdomain zygote:fd use;
|
||||||
|
|
||||||
|
# Receive and use open file descriptors inherited from app zygote.
|
||||||
|
allow appdomain app_zygote:fd use;
|
||||||
|
|
||||||
|
# gdbserver for ndk-gdb reads the zygote.
|
||||||
|
# valgrind needs mmap exec for zygote
|
||||||
|
allow appdomain zygote_exec:file rx_file_perms;
|
||||||
|
|
||||||
|
# Notify zygote of death;
|
||||||
|
allow appdomain zygote:process sigchld;
|
||||||
|
|
||||||
|
# Read /data/dalvik-cache.
|
||||||
|
allow appdomain dalvikcache_data_file:dir { search getattr };
|
||||||
|
allow appdomain dalvikcache_data_file:file r_file_perms;
|
||||||
|
|
||||||
|
# Read the /sdcard and /mnt/sdcard symlinks
|
||||||
|
allow { appdomain -isolated_app } rootfs:lnk_file r_file_perms;
|
||||||
|
allow { appdomain -isolated_app } tmpfs:lnk_file r_file_perms;
|
||||||
|
|
||||||
|
# Search /storage/emulated tmpfs mount.
|
||||||
|
allow appdomain tmpfs:dir r_dir_perms;
|
||||||
|
|
||||||
|
# Notify zygote of the wrapped process PID when using --invoke-with.
|
||||||
|
allow appdomain zygote:fifo_file write;
|
||||||
|
|
||||||
|
userdebug_or_eng(`
|
||||||
|
# Allow apps to create and write method traces in /data/misc/trace.
|
||||||
|
allow appdomain method_trace_data_file:dir w_dir_perms;
|
||||||
|
allow appdomain method_trace_data_file:file { create w_file_perms };
|
||||||
|
')
|
||||||
|
|
||||||
|
# Notify shell and adbd of death when spawned via runas for ndk-gdb.
|
||||||
|
allow appdomain shell:process sigchld;
|
||||||
|
allow appdomain adbd:process sigchld;
|
||||||
|
|
||||||
|
# child shell or gdbserver pty access for runas.
|
||||||
|
allow appdomain devpts:chr_file { getattr read write ioctl };
|
||||||
|
|
||||||
|
# Use pipes and sockets provided by system_server via binder or local socket.
|
||||||
|
allow appdomain system_server:fd use;
|
||||||
|
allow appdomain system_server:fifo_file rw_file_perms;
|
||||||
|
allow appdomain system_server:unix_stream_socket { read write setopt getattr getopt shutdown };
|
||||||
|
allow appdomain system_server:tcp_socket { read write getattr getopt shutdown };
|
||||||
|
|
||||||
|
# For AppFuse.
|
||||||
|
allow appdomain vold:fd use;
|
||||||
|
|
||||||
|
# Communication with other apps via fifos
|
||||||
|
allow appdomain appdomain:fifo_file rw_file_perms;
|
||||||
|
|
||||||
|
# Communicate with surfaceflinger.
|
||||||
|
allow appdomain surfaceflinger:unix_stream_socket { read write setopt getattr getopt shutdown };
|
||||||
|
|
||||||
|
# App sandbox file accesses.
|
||||||
|
allow { appdomain -isolated_app -mlstrustedsubject } { app_data_file privapp_data_file }:dir create_dir_perms;
|
||||||
|
allow { appdomain -isolated_app -mlstrustedsubject } { app_data_file privapp_data_file }:file create_file_perms;
|
||||||
|
|
||||||
|
# Access via already open fds is ok even for mlstrustedsubject.
|
||||||
|
allow { appdomain -isolated_app } { app_data_file privapp_data_file system_app_data_file }:file { getattr map read write };
|
||||||
|
|
||||||
|
# Traverse into expanded storage
|
||||||
|
allow appdomain mnt_expand_file:dir r_dir_perms;
|
||||||
|
|
||||||
|
# Keychain and user-trusted credentials
|
||||||
|
r_dir_file(appdomain, keychain_data_file)
|
||||||
|
allow appdomain misc_user_data_file:dir r_dir_perms;
|
||||||
|
allow appdomain misc_user_data_file:file r_file_perms;
|
||||||
|
|
||||||
|
# TextClassifier
|
||||||
|
r_dir_file({ appdomain -isolated_app }, textclassifier_data_file)
|
||||||
|
|
||||||
|
# Access to OEM provided data and apps
|
||||||
|
allow appdomain oemfs:dir r_dir_perms;
|
||||||
|
allow appdomain oemfs:file rx_file_perms;
|
||||||
|
|
||||||
|
# Execute the shell or other system executables.
|
||||||
|
allow { appdomain -ephemeral_app } shell_exec:file rx_file_perms;
|
||||||
|
allow { appdomain -ephemeral_app } toolbox_exec:file rx_file_perms;
|
||||||
|
allow appdomain system_file:file x_file_perms;
|
||||||
|
not_full_treble(`allow { appdomain -ephemeral_app } vendor_file:file x_file_perms;')
|
||||||
|
|
||||||
|
# Renderscript needs the ability to read directories on /system
|
||||||
|
allow appdomain system_file:dir r_dir_perms;
|
||||||
|
allow appdomain system_file:lnk_file { getattr open read };
|
||||||
|
# Renderscript specific permissions to open /system/vendor/lib64.
|
||||||
|
not_full_treble(`
|
||||||
|
allow appdomain vendor_file_type:dir r_dir_perms;
|
||||||
|
allow appdomain vendor_file_type:lnk_file { getattr open read };
|
||||||
|
')
|
||||||
|
|
||||||
|
full_treble_only(`
|
||||||
|
# For looking up Renderscript vendor drivers
|
||||||
|
allow { appdomain -isolated_app } vendor_file:dir { open read };
|
||||||
|
')
|
||||||
|
|
||||||
|
# Allow apps access to /vendor/app except for privileged
|
||||||
|
# apps which cannot be in /vendor.
|
||||||
|
r_dir_file({ appdomain -ephemeral_app }, vendor_app_file)
|
||||||
|
allow { appdomain -ephemeral_app } vendor_app_file:file execute;
|
||||||
|
|
||||||
|
# Allow apps access to /vendor/overlay
|
||||||
|
r_dir_file(appdomain, vendor_overlay_file)
|
||||||
|
|
||||||
|
# Allow apps access to /vendor/framework
|
||||||
|
# for vendor provided libraries.
|
||||||
|
r_dir_file(appdomain, vendor_framework_file)
|
||||||
|
|
||||||
|
# Allow apps read / execute access to vendor public libraries.
|
||||||
|
allow appdomain {vendor_public_framework_file vendor_public_lib_file}:dir r_dir_perms;
|
||||||
|
allow appdomain {vendor_public_framework_file vendor_public_lib_file}:file { execute read open getattr map };
|
||||||
|
|
||||||
|
# Read/write wallpaper file (opened by system).
|
||||||
|
allow appdomain wallpaper_file:file { getattr read write map };
|
||||||
|
|
||||||
|
# Read/write cached ringtones (opened by system).
|
||||||
|
allow appdomain ringtone_file:file { getattr read write map };
|
||||||
|
|
||||||
|
# Read ShortcutManager icon files (opened by system).
|
||||||
|
allow appdomain shortcut_manager_icons:file { getattr read map };
|
||||||
|
|
||||||
|
# Read icon file (opened by system).
|
||||||
|
allow appdomain icon_file:file { getattr read map };
|
||||||
|
|
||||||
|
# Old stack dumping scheme : append to a global trace file (/data/anr/traces.txt).
|
||||||
|
#
|
||||||
|
# TODO: All of these permissions except for anr_data_file:file append can be
|
||||||
|
# withdrawn once we've switched to the new stack dumping mechanism, see b/32064548
|
||||||
|
# and the rules below.
|
||||||
|
allow appdomain anr_data_file:dir search;
|
||||||
|
allow appdomain anr_data_file:file { open append };
|
||||||
|
|
||||||
|
# New stack dumping scheme : request an output FD from tombstoned via a unix
|
||||||
|
# domain socket.
|
||||||
|
#
|
||||||
|
# Allow apps to connect and write to the tombstoned java trace socket in
|
||||||
|
# order to dump their traces. Also allow them to append traces to pipes
|
||||||
|
# created by dumptrace. (Also see the rules below where they are given
|
||||||
|
# additional permissions to dumpstate pipes for other aspects of bug report
|
||||||
|
# creation).
|
||||||
|
unix_socket_connect(appdomain, tombstoned_java_trace, tombstoned)
|
||||||
|
allow appdomain tombstoned:fd use;
|
||||||
|
allow appdomain dumpstate:fifo_file append;
|
||||||
|
allow appdomain incidentd:fifo_file append;
|
||||||
|
|
||||||
|
# Allow apps to send dump information to dumpstate
|
||||||
|
allow appdomain dumpstate:fd use;
|
||||||
|
allow appdomain dumpstate:unix_stream_socket { read write getopt getattr shutdown };
|
||||||
|
allow appdomain dumpstate:fifo_file { write getattr };
|
||||||
|
allow appdomain shell_data_file:file { write getattr };
|
||||||
|
|
||||||
|
# Allow apps to send dump information to incidentd
|
||||||
|
allow appdomain incidentd:fd use;
|
||||||
|
allow appdomain incidentd:fifo_file { write getattr };
|
||||||
|
|
||||||
|
# Allow apps to send information to statsd socket.
|
||||||
|
unix_socket_send(appdomain, statsdw, statsd)
|
||||||
|
|
||||||
|
# Write profiles /data/misc/profiles
|
||||||
|
allow appdomain user_profile_root_file:dir search;
|
||||||
|
allow appdomain user_profile_data_file:dir { search write add_name };
|
||||||
|
allow appdomain user_profile_data_file:file create_file_perms;
|
||||||
|
|
||||||
|
# Send heap dumps to system_server via an already open file descriptor
|
||||||
|
# % adb shell am set-watch-heap com.android.systemui 1048576
|
||||||
|
# % adb shell dumpsys procstats --start-testing
|
||||||
|
# debuggable builds only.
|
||||||
|
userdebug_or_eng(`
|
||||||
|
allow appdomain heapdump_data_file:file append;
|
||||||
|
')
|
||||||
|
|
||||||
|
# /proc/net access.
|
||||||
|
# TODO(b/9496886) Audit access for removal.
|
||||||
|
# proc_net access for the negated domains below is granted (or not) in their
|
||||||
|
# individual .te files.
|
||||||
|
r_dir_file({
|
||||||
|
appdomain
|
||||||
|
-ephemeral_app
|
||||||
|
-isolated_app
|
||||||
|
-platform_app
|
||||||
|
-priv_app
|
||||||
|
-shell
|
||||||
|
-system_app
|
||||||
|
-untrusted_app_all
|
||||||
|
}, proc_net_type)
|
||||||
|
# audit access for all these non-core app domains.
|
||||||
|
userdebug_or_eng(`
|
||||||
|
auditallow {
|
||||||
|
appdomain
|
||||||
|
-ephemeral_app
|
||||||
|
-isolated_app
|
||||||
|
-platform_app
|
||||||
|
-priv_app
|
||||||
|
-shell
|
||||||
|
-su
|
||||||
|
-system_app
|
||||||
|
-untrusted_app_all
|
||||||
|
} proc_net_type:{ dir file lnk_file } { getattr open read };
|
||||||
|
')
|
||||||
|
|
||||||
|
# Grant GPU access to all processes started by Zygote.
|
||||||
|
# They need that to render the standard UI.
|
||||||
|
allow { appdomain -isolated_app } gpu_device:chr_file rw_file_perms;
|
||||||
|
|
||||||
|
# Use the Binder.
|
||||||
|
binder_use(appdomain)
|
||||||
|
# Perform binder IPC to binder services.
|
||||||
|
binder_call(appdomain, binderservicedomain)
|
||||||
|
# Perform binder IPC to other apps.
|
||||||
|
binder_call(appdomain, appdomain)
|
||||||
|
# Perform binder IPC to ephemeral apps.
|
||||||
|
binder_call(appdomain, ephemeral_app)
|
||||||
|
# Perform binder IPC to gpuservice.
|
||||||
|
binder_call({ appdomain -isolated_app }, gpuservice)
|
||||||
|
|
||||||
|
# Talk with graphics composer fences
|
||||||
|
allow appdomain hal_graphics_composer:fd use;
|
||||||
|
|
||||||
|
# Already connected, unnamed sockets being passed over some other IPC
|
||||||
|
# hence no sock_file or connectto permission. This appears to be how
|
||||||
|
# Chrome works, may need to be updated as more apps using isolated services
|
||||||
|
# are examined.
|
||||||
|
allow appdomain appdomain:unix_stream_socket { getopt getattr read write shutdown };
|
||||||
|
|
||||||
|
# Backup ability for every app. BMS opens and passes the fd
|
||||||
|
# to any app that has backup ability. Hence, no open permissions here.
|
||||||
|
allow appdomain backup_data_file:file { read write getattr map };
|
||||||
|
allow appdomain cache_backup_file:file { read write getattr map };
|
||||||
|
allow appdomain cache_backup_file:dir getattr;
|
||||||
|
# Backup ability using 'adb backup'
|
||||||
|
allow appdomain system_data_file:lnk_file r_file_perms;
|
||||||
|
allow appdomain system_data_file:file { getattr read map };
|
||||||
|
|
||||||
|
# Allow read/stat of /data/media files passed by Binder or local socket IPC.
|
||||||
|
allow { appdomain -isolated_app } media_rw_data_file:file { read getattr };
|
||||||
|
|
||||||
|
# Read and write /data/data/com.android.providers.telephony files passed over Binder.
|
||||||
|
allow { appdomain -isolated_app } radio_data_file:file { read write getattr };
|
||||||
|
|
||||||
|
# Allow access to external storage; we have several visible mount points under /storage
|
||||||
|
# and symlinks to primary storage at places like /storage/sdcard0 and /mnt/user/0/primary
|
||||||
|
allow { appdomain -isolated_app -ephemeral_app } storage_file:dir r_dir_perms;
|
||||||
|
allow { appdomain -isolated_app -ephemeral_app } storage_file:lnk_file r_file_perms;
|
||||||
|
allow { appdomain -isolated_app -ephemeral_app } mnt_user_file:dir r_dir_perms;
|
||||||
|
allow { appdomain -isolated_app -ephemeral_app } mnt_user_file:lnk_file r_file_perms;
|
||||||
|
|
||||||
|
# Read/write visible storage
|
||||||
|
allow { appdomain -isolated_app -ephemeral_app } { sdcard_type fuse }:dir create_dir_perms;
|
||||||
|
allow { appdomain -isolated_app -ephemeral_app } { sdcard_type fuse }:file create_file_perms;
|
||||||
|
# This should be removed if sdcardfs is modified to alter the secontext for its
|
||||||
|
# accesses to the underlying FS.
|
||||||
|
allow { appdomain -isolated_app -ephemeral_app } media_rw_data_file:dir create_dir_perms;
|
||||||
|
allow { appdomain -isolated_app -ephemeral_app } media_rw_data_file:file create_file_perms;
|
||||||
|
|
||||||
|
# Allow apps to use the USB Accessory interface.
|
||||||
|
# http://developer.android.com/guide/topics/connectivity/usb/accessory.html
|
||||||
|
#
|
||||||
|
# USB devices are first opened by the system server (USBDeviceManagerService)
|
||||||
|
# and the file descriptor is passed to the right Activity via binder.
|
||||||
|
allow { appdomain -isolated_app -ephemeral_app } usb_device:chr_file { read write getattr ioctl };
|
||||||
|
allow { appdomain -isolated_app -ephemeral_app } usbaccessory_device:chr_file { read write getattr };
|
||||||
|
|
||||||
|
# For art.
|
||||||
|
allow appdomain dalvikcache_data_file:file execute;
|
||||||
|
allow appdomain dalvikcache_data_file:lnk_file r_file_perms;
|
||||||
|
|
||||||
|
# Allow any app to read shared RELRO files.
|
||||||
|
allow appdomain shared_relro_file:dir search;
|
||||||
|
allow appdomain shared_relro_file:file r_file_perms;
|
||||||
|
|
||||||
|
# Allow apps to read/execute installed binaries
|
||||||
|
allow appdomain apk_data_file:dir r_dir_perms;
|
||||||
|
allow appdomain apk_data_file:file rx_file_perms;
|
||||||
|
|
||||||
|
# /data/resource-cache
|
||||||
|
allow appdomain resourcecache_data_file:file r_file_perms;
|
||||||
|
allow appdomain resourcecache_data_file:dir r_dir_perms;
|
||||||
|
|
||||||
|
# logd access
|
||||||
|
read_logd(appdomain)
|
||||||
|
control_logd({ appdomain -ephemeral_app })
|
||||||
|
# application inherit logd write socket (urge is to deprecate this long term)
|
||||||
|
allow appdomain zygote:unix_dgram_socket write;
|
||||||
|
|
||||||
|
allow { appdomain -isolated_app -ephemeral_app } keystore:keystore_key { get_state get insert delete exist list sign verify };
|
||||||
|
allow { appdomain -isolated_app -ephemeral_app } keystore:keystore2_key { delete use get_info rebind update };
|
||||||
|
|
||||||
|
allow { appdomain -isolated_app -ephemeral_app } keystore_maintenance_service:service_manager find;
|
||||||
|
allow { appdomain -isolated_app -ephemeral_app } keystore:keystore2 get_state;
|
||||||
|
|
||||||
|
use_keystore({ appdomain -isolated_app -ephemeral_app })
|
||||||
|
|
||||||
|
use_credstore({ appdomain -isolated_app -ephemeral_app })
|
||||||
|
|
||||||
|
allow appdomain console_device:chr_file { read write };
|
||||||
|
|
||||||
|
# only allow unprivileged socket ioctl commands
|
||||||
|
allowxperm { appdomain -bluetooth } self:{ rawip_socket tcp_socket udp_socket }
|
||||||
|
ioctl { unpriv_sock_ioctls unpriv_tty_ioctls };
|
||||||
|
|
||||||
|
allow { appdomain -isolated_app } ion_device:chr_file r_file_perms;
|
||||||
|
allow { appdomain -isolated_app } dmabuf_system_heap_device:chr_file r_file_perms;
|
||||||
|
allow { appdomain -isolated_app } dmabuf_system_secure_heap_device:chr_file r_file_perms;
|
||||||
|
|
||||||
|
# Allow AAudio apps to use shared memory file descriptors from the HAL
|
||||||
|
allow { appdomain -isolated_app } hal_audio:fd use;
|
||||||
|
|
||||||
|
# Allow app to access shared memory created by camera HAL1
|
||||||
|
allow { appdomain -isolated_app } hal_camera:fd use;
|
||||||
|
|
||||||
|
# Allow apps to access shared memory file descriptor from the tuner HAL
|
||||||
|
allow {appdomain -isolated_app} hal_tv_tuner_server:fd use;
|
||||||
|
|
||||||
|
# RenderScript always-passthrough HAL
|
||||||
|
allow { appdomain -isolated_app } hal_renderscript_hwservice:hwservice_manager find;
|
||||||
|
allow appdomain same_process_hal_file:file { execute read open getattr map };
|
||||||
|
|
||||||
|
# TODO: switch to meminfo service
|
||||||
|
allow appdomain proc_meminfo:file r_file_perms;
|
||||||
|
|
||||||
|
# For app fuse.
|
||||||
|
allow appdomain app_fuse_file:file { getattr read append write map };
|
||||||
|
|
||||||
|
pdx_client({ appdomain -isolated_app -ephemeral_app }, display_client)
|
||||||
|
pdx_client({ appdomain -isolated_app -ephemeral_app }, display_manager)
|
||||||
|
pdx_client({ appdomain -isolated_app -ephemeral_app }, display_vsync)
|
||||||
|
pdx_client({ appdomain -isolated_app -ephemeral_app }, performance_client)
|
||||||
|
# Apps do not directly open the IPC socket for bufferhubd.
|
||||||
|
pdx_use({ appdomain -isolated_app -ephemeral_app }, bufferhub_client)
|
||||||
|
|
||||||
|
###
|
||||||
|
### CTS-specific rules
|
||||||
|
###
|
||||||
|
|
||||||
|
# For cts/tests/tests/permission/src/android/permission/cts/FileSystemPermissionTest.java.
|
||||||
|
# testRunAsHasCorrectCapabilities
|
||||||
|
allow appdomain runas_exec:file getattr;
|
||||||
|
# Others are either allowed elsewhere or not desired.
|
||||||
|
|
||||||
|
# Apps receive an open tun fd from the framework for
|
||||||
|
# device traffic. Do not allow untrusted app to directly open tun_device
|
||||||
|
allow { appdomain -isolated_app -ephemeral_app } tun_device:chr_file { read write getattr append ioctl };
|
||||||
|
allowxperm { appdomain -isolated_app -ephemeral_app } tun_device:chr_file ioctl TUNGETIFF;
|
||||||
|
|
||||||
|
# Connect to adbd and use a socket transferred from it.
|
||||||
|
# This is used for e.g. adb backup/restore.
|
||||||
|
allow appdomain adbd:unix_stream_socket connectto;
|
||||||
|
allow appdomain adbd:fd use;
|
||||||
|
allow appdomain adbd:unix_stream_socket { getattr getopt ioctl read write shutdown };
|
||||||
|
|
||||||
|
allow appdomain cache_file:dir getattr;
|
||||||
|
|
||||||
|
# Allow apps to run with asanwrapper.
|
||||||
|
with_asan(`allow appdomain asanwrapper_exec:file rx_file_perms;')
|
||||||
|
|
||||||
|
# Read access to FDs from the DropboxManagerService.
|
||||||
|
allow appdomain dropbox_data_file:file { getattr read };
|
||||||
|
|
||||||
|
# Read tmpfs types from these processes.
|
||||||
|
allow appdomain audioserver_tmpfs:file { getattr map read write };
|
||||||
|
allow appdomain system_server_tmpfs:file { getattr map read write };
|
||||||
|
allow appdomain zygote_tmpfs:file { map read };
|
||||||
|
|
||||||
# Sensitive app domains are not allowed to execute from /data
|
# Sensitive app domains are not allowed to execute from /data
|
||||||
# to prevent persistence attacks and ensure all code is executed
|
# to prevent persistence attacks and ensure all code is executed
|
||||||
# from read-only locations.
|
# from read-only locations.
|
||||||
|
|
|
||||||
369
public/app.te
369
public/app.te
|
|
@ -8,375 +8,6 @@
|
||||||
###
|
###
|
||||||
type appdomain_tmpfs, file_type;
|
type appdomain_tmpfs, file_type;
|
||||||
|
|
||||||
# WebView and other application-specific JIT compilers
|
|
||||||
allow appdomain self:process execmem;
|
|
||||||
|
|
||||||
allow appdomain { ashmem_device ashmem_libcutils_device }:chr_file execute;
|
|
||||||
|
|
||||||
# Receive and use open file descriptors inherited from zygote.
|
|
||||||
allow appdomain zygote:fd use;
|
|
||||||
|
|
||||||
# Receive and use open file descriptors inherited from app zygote.
|
|
||||||
allow appdomain app_zygote:fd use;
|
|
||||||
|
|
||||||
# gdbserver for ndk-gdb reads the zygote.
|
|
||||||
# valgrind needs mmap exec for zygote
|
|
||||||
allow appdomain zygote_exec:file rx_file_perms;
|
|
||||||
|
|
||||||
# Notify zygote of death;
|
|
||||||
allow appdomain zygote:process sigchld;
|
|
||||||
|
|
||||||
# Read /data/dalvik-cache.
|
|
||||||
allow appdomain dalvikcache_data_file:dir { search getattr };
|
|
||||||
allow appdomain dalvikcache_data_file:file r_file_perms;
|
|
||||||
|
|
||||||
# Read the /sdcard and /mnt/sdcard symlinks
|
|
||||||
allow { appdomain -isolated_app } rootfs:lnk_file r_file_perms;
|
|
||||||
allow { appdomain -isolated_app } tmpfs:lnk_file r_file_perms;
|
|
||||||
|
|
||||||
# Search /storage/emulated tmpfs mount.
|
|
||||||
allow appdomain tmpfs:dir r_dir_perms;
|
|
||||||
|
|
||||||
# Notify zygote of the wrapped process PID when using --invoke-with.
|
|
||||||
allow appdomain zygote:fifo_file write;
|
|
||||||
|
|
||||||
userdebug_or_eng(`
|
|
||||||
# Allow apps to create and write method traces in /data/misc/trace.
|
|
||||||
allow appdomain method_trace_data_file:dir w_dir_perms;
|
|
||||||
allow appdomain method_trace_data_file:file { create w_file_perms };
|
|
||||||
')
|
|
||||||
|
|
||||||
# Notify shell and adbd of death when spawned via runas for ndk-gdb.
|
|
||||||
allow appdomain shell:process sigchld;
|
|
||||||
allow appdomain adbd:process sigchld;
|
|
||||||
|
|
||||||
# child shell or gdbserver pty access for runas.
|
|
||||||
allow appdomain devpts:chr_file { getattr read write ioctl };
|
|
||||||
|
|
||||||
# Use pipes and sockets provided by system_server via binder or local socket.
|
|
||||||
allow appdomain system_server:fd use;
|
|
||||||
allow appdomain system_server:fifo_file rw_file_perms;
|
|
||||||
allow appdomain system_server:unix_stream_socket { read write setopt getattr getopt shutdown };
|
|
||||||
allow appdomain system_server:tcp_socket { read write getattr getopt shutdown };
|
|
||||||
|
|
||||||
# For AppFuse.
|
|
||||||
allow appdomain vold:fd use;
|
|
||||||
|
|
||||||
# Communication with other apps via fifos
|
|
||||||
allow appdomain appdomain:fifo_file rw_file_perms;
|
|
||||||
|
|
||||||
# Communicate with surfaceflinger.
|
|
||||||
allow appdomain surfaceflinger:unix_stream_socket { read write setopt getattr getopt shutdown };
|
|
||||||
|
|
||||||
# App sandbox file accesses.
|
|
||||||
allow { appdomain -isolated_app -mlstrustedsubject } { app_data_file privapp_data_file }:dir create_dir_perms;
|
|
||||||
allow { appdomain -isolated_app -mlstrustedsubject } { app_data_file privapp_data_file }:file create_file_perms;
|
|
||||||
|
|
||||||
# Access via already open fds is ok even for mlstrustedsubject.
|
|
||||||
allow { appdomain -isolated_app } { app_data_file privapp_data_file system_app_data_file }:file { getattr map read write };
|
|
||||||
|
|
||||||
# Traverse into expanded storage
|
|
||||||
allow appdomain mnt_expand_file:dir r_dir_perms;
|
|
||||||
|
|
||||||
# Keychain and user-trusted credentials
|
|
||||||
r_dir_file(appdomain, keychain_data_file)
|
|
||||||
allow appdomain misc_user_data_file:dir r_dir_perms;
|
|
||||||
allow appdomain misc_user_data_file:file r_file_perms;
|
|
||||||
|
|
||||||
# TextClassifier
|
|
||||||
r_dir_file({ appdomain -isolated_app }, textclassifier_data_file)
|
|
||||||
|
|
||||||
# Access to OEM provided data and apps
|
|
||||||
allow appdomain oemfs:dir r_dir_perms;
|
|
||||||
allow appdomain oemfs:file rx_file_perms;
|
|
||||||
|
|
||||||
# Execute the shell or other system executables.
|
|
||||||
allow { appdomain -ephemeral_app } shell_exec:file rx_file_perms;
|
|
||||||
allow { appdomain -ephemeral_app } toolbox_exec:file rx_file_perms;
|
|
||||||
allow appdomain system_file:file x_file_perms;
|
|
||||||
not_full_treble(`allow { appdomain -ephemeral_app } vendor_file:file x_file_perms;')
|
|
||||||
|
|
||||||
# Renderscript needs the ability to read directories on /system
|
|
||||||
allow appdomain system_file:dir r_dir_perms;
|
|
||||||
allow appdomain system_file:lnk_file { getattr open read };
|
|
||||||
# Renderscript specific permissions to open /system/vendor/lib64.
|
|
||||||
not_full_treble(`
|
|
||||||
allow appdomain vendor_file_type:dir r_dir_perms;
|
|
||||||
allow appdomain vendor_file_type:lnk_file { getattr open read };
|
|
||||||
')
|
|
||||||
|
|
||||||
full_treble_only(`
|
|
||||||
# For looking up Renderscript vendor drivers
|
|
||||||
allow { appdomain -isolated_app } vendor_file:dir { open read };
|
|
||||||
')
|
|
||||||
|
|
||||||
# Allow apps access to /vendor/app except for privileged
|
|
||||||
# apps which cannot be in /vendor.
|
|
||||||
r_dir_file({ appdomain -ephemeral_app }, vendor_app_file)
|
|
||||||
allow { appdomain -ephemeral_app } vendor_app_file:file execute;
|
|
||||||
|
|
||||||
# Allow apps access to /vendor/overlay
|
|
||||||
r_dir_file(appdomain, vendor_overlay_file)
|
|
||||||
|
|
||||||
# Allow apps access to /vendor/framework
|
|
||||||
# for vendor provided libraries.
|
|
||||||
r_dir_file(appdomain, vendor_framework_file)
|
|
||||||
|
|
||||||
# Allow apps read / execute access to vendor public libraries.
|
|
||||||
allow appdomain {vendor_public_framework_file vendor_public_lib_file}:dir r_dir_perms;
|
|
||||||
allow appdomain {vendor_public_framework_file vendor_public_lib_file}:file { execute read open getattr map };
|
|
||||||
|
|
||||||
# Read/write wallpaper file (opened by system).
|
|
||||||
allow appdomain wallpaper_file:file { getattr read write map };
|
|
||||||
|
|
||||||
# Read/write cached ringtones (opened by system).
|
|
||||||
allow appdomain ringtone_file:file { getattr read write map };
|
|
||||||
|
|
||||||
# Read ShortcutManager icon files (opened by system).
|
|
||||||
allow appdomain shortcut_manager_icons:file { getattr read map };
|
|
||||||
|
|
||||||
# Read icon file (opened by system).
|
|
||||||
allow appdomain icon_file:file { getattr read map };
|
|
||||||
|
|
||||||
# Old stack dumping scheme : append to a global trace file (/data/anr/traces.txt).
|
|
||||||
#
|
|
||||||
# TODO: All of these permissions except for anr_data_file:file append can be
|
|
||||||
# withdrawn once we've switched to the new stack dumping mechanism, see b/32064548
|
|
||||||
# and the rules below.
|
|
||||||
allow appdomain anr_data_file:dir search;
|
|
||||||
allow appdomain anr_data_file:file { open append };
|
|
||||||
|
|
||||||
# New stack dumping scheme : request an output FD from tombstoned via a unix
|
|
||||||
# domain socket.
|
|
||||||
#
|
|
||||||
# Allow apps to connect and write to the tombstoned java trace socket in
|
|
||||||
# order to dump their traces. Also allow them to append traces to pipes
|
|
||||||
# created by dumptrace. (Also see the rules below where they are given
|
|
||||||
# additional permissions to dumpstate pipes for other aspects of bug report
|
|
||||||
# creation).
|
|
||||||
unix_socket_connect(appdomain, tombstoned_java_trace, tombstoned)
|
|
||||||
allow appdomain tombstoned:fd use;
|
|
||||||
allow appdomain dumpstate:fifo_file append;
|
|
||||||
allow appdomain incidentd:fifo_file append;
|
|
||||||
|
|
||||||
# Allow apps to send dump information to dumpstate
|
|
||||||
allow appdomain dumpstate:fd use;
|
|
||||||
allow appdomain dumpstate:unix_stream_socket { read write getopt getattr shutdown };
|
|
||||||
allow appdomain dumpstate:fifo_file { write getattr };
|
|
||||||
allow appdomain shell_data_file:file { write getattr };
|
|
||||||
|
|
||||||
# Allow apps to send dump information to incidentd
|
|
||||||
allow appdomain incidentd:fd use;
|
|
||||||
allow appdomain incidentd:fifo_file { write getattr };
|
|
||||||
|
|
||||||
# Allow apps to send information to statsd socket.
|
|
||||||
unix_socket_send(appdomain, statsdw, statsd)
|
|
||||||
|
|
||||||
# Write profiles /data/misc/profiles
|
|
||||||
allow appdomain user_profile_root_file:dir search;
|
|
||||||
allow appdomain user_profile_data_file:dir { search write add_name };
|
|
||||||
allow appdomain user_profile_data_file:file create_file_perms;
|
|
||||||
|
|
||||||
# Send heap dumps to system_server via an already open file descriptor
|
|
||||||
# % adb shell am set-watch-heap com.android.systemui 1048576
|
|
||||||
# % adb shell dumpsys procstats --start-testing
|
|
||||||
# debuggable builds only.
|
|
||||||
userdebug_or_eng(`
|
|
||||||
allow appdomain heapdump_data_file:file append;
|
|
||||||
')
|
|
||||||
|
|
||||||
# /proc/net access.
|
|
||||||
# TODO(b/9496886) Audit access for removal.
|
|
||||||
# proc_net access for the negated domains below is granted (or not) in their
|
|
||||||
# individual .te files.
|
|
||||||
r_dir_file({
|
|
||||||
appdomain
|
|
||||||
-ephemeral_app
|
|
||||||
-isolated_app
|
|
||||||
-platform_app
|
|
||||||
-priv_app
|
|
||||||
-shell
|
|
||||||
-system_app
|
|
||||||
-untrusted_app_all
|
|
||||||
}, proc_net_type)
|
|
||||||
# audit access for all these non-core app domains.
|
|
||||||
userdebug_or_eng(`
|
|
||||||
auditallow {
|
|
||||||
appdomain
|
|
||||||
-ephemeral_app
|
|
||||||
-isolated_app
|
|
||||||
-platform_app
|
|
||||||
-priv_app
|
|
||||||
-shell
|
|
||||||
-su
|
|
||||||
-system_app
|
|
||||||
-untrusted_app_all
|
|
||||||
} proc_net_type:{ dir file lnk_file } { getattr open read };
|
|
||||||
')
|
|
||||||
|
|
||||||
# Grant GPU access to all processes started by Zygote.
|
|
||||||
# They need that to render the standard UI.
|
|
||||||
allow { appdomain -isolated_app } gpu_device:chr_file rw_file_perms;
|
|
||||||
|
|
||||||
# Use the Binder.
|
|
||||||
binder_use(appdomain)
|
|
||||||
# Perform binder IPC to binder services.
|
|
||||||
binder_call(appdomain, binderservicedomain)
|
|
||||||
# Perform binder IPC to other apps.
|
|
||||||
binder_call(appdomain, appdomain)
|
|
||||||
# Perform binder IPC to ephemeral apps.
|
|
||||||
binder_call(appdomain, ephemeral_app)
|
|
||||||
# Perform binder IPC to gpuservice.
|
|
||||||
binder_call({ appdomain -isolated_app }, gpuservice)
|
|
||||||
|
|
||||||
# Talk with graphics composer fences
|
|
||||||
allow appdomain hal_graphics_composer:fd use;
|
|
||||||
|
|
||||||
# Already connected, unnamed sockets being passed over some other IPC
|
|
||||||
# hence no sock_file or connectto permission. This appears to be how
|
|
||||||
# Chrome works, may need to be updated as more apps using isolated services
|
|
||||||
# are examined.
|
|
||||||
allow appdomain appdomain:unix_stream_socket { getopt getattr read write shutdown };
|
|
||||||
|
|
||||||
# Backup ability for every app. BMS opens and passes the fd
|
|
||||||
# to any app that has backup ability. Hence, no open permissions here.
|
|
||||||
allow appdomain backup_data_file:file { read write getattr map };
|
|
||||||
allow appdomain cache_backup_file:file { read write getattr map };
|
|
||||||
allow appdomain cache_backup_file:dir getattr;
|
|
||||||
# Backup ability using 'adb backup'
|
|
||||||
allow appdomain system_data_file:lnk_file r_file_perms;
|
|
||||||
allow appdomain system_data_file:file { getattr read map };
|
|
||||||
|
|
||||||
# Allow read/stat of /data/media files passed by Binder or local socket IPC.
|
|
||||||
allow { appdomain -isolated_app } media_rw_data_file:file { read getattr };
|
|
||||||
|
|
||||||
# Read and write /data/data/com.android.providers.telephony files passed over Binder.
|
|
||||||
allow { appdomain -isolated_app } radio_data_file:file { read write getattr };
|
|
||||||
|
|
||||||
# Allow access to external storage; we have several visible mount points under /storage
|
|
||||||
# and symlinks to primary storage at places like /storage/sdcard0 and /mnt/user/0/primary
|
|
||||||
allow { appdomain -isolated_app -ephemeral_app } storage_file:dir r_dir_perms;
|
|
||||||
allow { appdomain -isolated_app -ephemeral_app } storage_file:lnk_file r_file_perms;
|
|
||||||
allow { appdomain -isolated_app -ephemeral_app } mnt_user_file:dir r_dir_perms;
|
|
||||||
allow { appdomain -isolated_app -ephemeral_app } mnt_user_file:lnk_file r_file_perms;
|
|
||||||
|
|
||||||
# Read/write visible storage
|
|
||||||
allow { appdomain -isolated_app -ephemeral_app } { sdcard_type fuse }:dir create_dir_perms;
|
|
||||||
allow { appdomain -isolated_app -ephemeral_app } { sdcard_type fuse }:file create_file_perms;
|
|
||||||
# This should be removed if sdcardfs is modified to alter the secontext for its
|
|
||||||
# accesses to the underlying FS.
|
|
||||||
allow { appdomain -isolated_app -ephemeral_app } media_rw_data_file:dir create_dir_perms;
|
|
||||||
allow { appdomain -isolated_app -ephemeral_app } media_rw_data_file:file create_file_perms;
|
|
||||||
|
|
||||||
# Allow apps to use the USB Accessory interface.
|
|
||||||
# http://developer.android.com/guide/topics/connectivity/usb/accessory.html
|
|
||||||
#
|
|
||||||
# USB devices are first opened by the system server (USBDeviceManagerService)
|
|
||||||
# and the file descriptor is passed to the right Activity via binder.
|
|
||||||
allow { appdomain -isolated_app -ephemeral_app } usb_device:chr_file { read write getattr ioctl };
|
|
||||||
allow { appdomain -isolated_app -ephemeral_app } usbaccessory_device:chr_file { read write getattr };
|
|
||||||
|
|
||||||
# For art.
|
|
||||||
allow appdomain dalvikcache_data_file:file execute;
|
|
||||||
allow appdomain dalvikcache_data_file:lnk_file r_file_perms;
|
|
||||||
|
|
||||||
# Allow any app to read shared RELRO files.
|
|
||||||
allow appdomain shared_relro_file:dir search;
|
|
||||||
allow appdomain shared_relro_file:file r_file_perms;
|
|
||||||
|
|
||||||
# Allow apps to read/execute installed binaries
|
|
||||||
allow appdomain apk_data_file:dir r_dir_perms;
|
|
||||||
allow appdomain apk_data_file:file rx_file_perms;
|
|
||||||
|
|
||||||
# /data/resource-cache
|
|
||||||
allow appdomain resourcecache_data_file:file r_file_perms;
|
|
||||||
allow appdomain resourcecache_data_file:dir r_dir_perms;
|
|
||||||
|
|
||||||
# logd access
|
|
||||||
read_logd(appdomain)
|
|
||||||
control_logd({ appdomain -ephemeral_app })
|
|
||||||
# application inherit logd write socket (urge is to deprecate this long term)
|
|
||||||
allow appdomain zygote:unix_dgram_socket write;
|
|
||||||
|
|
||||||
allow { appdomain -isolated_app -ephemeral_app } keystore:keystore_key { get_state get insert delete exist list sign verify };
|
|
||||||
allow { appdomain -isolated_app -ephemeral_app } keystore:keystore2_key { delete use get_info rebind update };
|
|
||||||
|
|
||||||
allow { appdomain -isolated_app -ephemeral_app } keystore_maintenance_service:service_manager find;
|
|
||||||
allow { appdomain -isolated_app -ephemeral_app } keystore:keystore2 get_state;
|
|
||||||
|
|
||||||
use_keystore({ appdomain -isolated_app -ephemeral_app })
|
|
||||||
|
|
||||||
use_credstore({ appdomain -isolated_app -ephemeral_app })
|
|
||||||
|
|
||||||
allow appdomain console_device:chr_file { read write };
|
|
||||||
|
|
||||||
# only allow unprivileged socket ioctl commands
|
|
||||||
allowxperm { appdomain -bluetooth } self:{ rawip_socket tcp_socket udp_socket }
|
|
||||||
ioctl { unpriv_sock_ioctls unpriv_tty_ioctls };
|
|
||||||
|
|
||||||
allow { appdomain -isolated_app } ion_device:chr_file r_file_perms;
|
|
||||||
allow { appdomain -isolated_app } dmabuf_system_heap_device:chr_file r_file_perms;
|
|
||||||
allow { appdomain -isolated_app } dmabuf_system_secure_heap_device:chr_file r_file_perms;
|
|
||||||
|
|
||||||
# Allow AAudio apps to use shared memory file descriptors from the HAL
|
|
||||||
allow { appdomain -isolated_app } hal_audio:fd use;
|
|
||||||
|
|
||||||
# Allow app to access shared memory created by camera HAL1
|
|
||||||
allow { appdomain -isolated_app } hal_camera:fd use;
|
|
||||||
|
|
||||||
# Allow apps to access shared memory file descriptor from the tuner HAL
|
|
||||||
allow {appdomain -isolated_app} hal_tv_tuner_server:fd use;
|
|
||||||
|
|
||||||
# RenderScript always-passthrough HAL
|
|
||||||
allow { appdomain -isolated_app } hal_renderscript_hwservice:hwservice_manager find;
|
|
||||||
allow appdomain same_process_hal_file:file { execute read open getattr map };
|
|
||||||
|
|
||||||
# TODO: switch to meminfo service
|
|
||||||
allow appdomain proc_meminfo:file r_file_perms;
|
|
||||||
|
|
||||||
# For app fuse.
|
|
||||||
allow appdomain app_fuse_file:file { getattr read append write map };
|
|
||||||
|
|
||||||
pdx_client({ appdomain -isolated_app -ephemeral_app }, display_client)
|
|
||||||
pdx_client({ appdomain -isolated_app -ephemeral_app }, display_manager)
|
|
||||||
pdx_client({ appdomain -isolated_app -ephemeral_app }, display_vsync)
|
|
||||||
pdx_client({ appdomain -isolated_app -ephemeral_app }, performance_client)
|
|
||||||
# Apps do not directly open the IPC socket for bufferhubd.
|
|
||||||
pdx_use({ appdomain -isolated_app -ephemeral_app }, bufferhub_client)
|
|
||||||
|
|
||||||
###
|
|
||||||
### CTS-specific rules
|
|
||||||
###
|
|
||||||
|
|
||||||
# For cts/tests/tests/permission/src/android/permission/cts/FileSystemPermissionTest.java.
|
|
||||||
# testRunAsHasCorrectCapabilities
|
|
||||||
allow appdomain runas_exec:file getattr;
|
|
||||||
# Others are either allowed elsewhere or not desired.
|
|
||||||
|
|
||||||
# Apps receive an open tun fd from the framework for
|
|
||||||
# device traffic. Do not allow untrusted app to directly open tun_device
|
|
||||||
allow { appdomain -isolated_app -ephemeral_app } tun_device:chr_file { read write getattr append ioctl };
|
|
||||||
allowxperm { appdomain -isolated_app -ephemeral_app } tun_device:chr_file ioctl TUNGETIFF;
|
|
||||||
|
|
||||||
# Connect to adbd and use a socket transferred from it.
|
|
||||||
# This is used for e.g. adb backup/restore.
|
|
||||||
allow appdomain adbd:unix_stream_socket connectto;
|
|
||||||
allow appdomain adbd:fd use;
|
|
||||||
allow appdomain adbd:unix_stream_socket { getattr getopt ioctl read write shutdown };
|
|
||||||
|
|
||||||
allow appdomain cache_file:dir getattr;
|
|
||||||
|
|
||||||
# Allow apps to run with asanwrapper.
|
|
||||||
with_asan(`allow appdomain asanwrapper_exec:file rx_file_perms;')
|
|
||||||
|
|
||||||
# Read access to FDs from the DropboxManagerService.
|
|
||||||
allow appdomain dropbox_data_file:file { getattr read };
|
|
||||||
|
|
||||||
# Read tmpfs types from these processes.
|
|
||||||
allow appdomain audioserver_tmpfs:file { getattr map read write };
|
|
||||||
allow appdomain system_server_tmpfs:file { getattr map read write };
|
|
||||||
allow appdomain zygote_tmpfs:file { map read };
|
|
||||||
|
|
||||||
###
|
###
|
||||||
### Neverallow rules
|
### Neverallow rules
|
||||||
###
|
###
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue