From e1389977e00124633c1165d778081afe6b185f92 Mon Sep 17 00:00:00 2001 From: Inseob Kim Date: Mon, 19 Jul 2021 07:48:34 +0000 Subject: [PATCH] Move microdroid sepolicy to system/sepolicy Bug: 190511750 Test: boot microdroid Change-Id: I4aa4a56e9be5103d70469c3508110a973f3e4f12 --- microdroid/Android.bp | 307 ++ microdroid/reqd_mask/access_vectors | 777 +++++ microdroid/reqd_mask/initial_sid_contexts | 1 + microdroid/reqd_mask/initial_sids | 3 + microdroid/reqd_mask/keys.conf | 2 + microdroid/reqd_mask/mac_permissions.xml | 3 + microdroid/reqd_mask/mls | 1 + microdroid/reqd_mask/mls_decl | 10 + microdroid/reqd_mask/mls_macros | 54 + microdroid/reqd_mask/property_contexts | 3 + microdroid/reqd_mask/reqd_mask.te | 1 + microdroid/reqd_mask/roles | 1 + microdroid/reqd_mask/roles_decl | 1 + microdroid/reqd_mask/seapp_contexts | 2 + microdroid/reqd_mask/security_classes | 167 + microdroid/reqd_mask/service_contexts | 3 + microdroid/reqd_mask/users | 1 + microdroid/system/private/access_vectors | 777 +++++ microdroid/system/private/adbd.te | 44 + microdroid/system/private/apexd.te | 87 + microdroid/system/private/apkdmverity.te | 29 + microdroid/system/private/attributes | 12 + .../system/private/binderservicedomain.te | 5 + microdroid/system/private/bug_map | 35 + microdroid/system/private/crash_dump.te | 71 + microdroid/system/private/domain.te | 254 ++ microdroid/system/private/file.te | 12 + microdroid/system/private/file_contexts | 166 + microdroid/system/private/fs_use | 27 + microdroid/system/private/genfs_contexts | 378 +++ microdroid/system/private/halclientdomain.te | 10 + microdroid/system/private/hwservice_contexts | 7 + microdroid/system/private/hwservicemanager.te | 25 + microdroid/system/private/init.te | 446 +++ .../system/private/initial_sid_contexts | 27 + microdroid/system/private/initial_sids | 35 + microdroid/system/private/kernel.te | 83 + microdroid/system/private/keys.conf | 28 + microdroid/system/private/keystore.te | 15 + .../system/private/keystore2_key_contexts | 11 + microdroid/system/private/linkerconfig.te | 21 + microdroid/system/private/logd.te | 43 + microdroid/system/private/mac_permissions.xml | 62 + microdroid/system/private/microdroid_app.te | 51 + .../system/private/microdroid_manager.te | 37 + microdroid/system/private/mls | 89 + microdroid/system/private/mls_decl | 10 + microdroid/system/private/mls_macros | 54 + microdroid/system/private/net.te | 16 + microdroid/system/private/policy_capabilities | 20 + microdroid/system/private/port_contexts | 1 + microdroid/system/private/property.te | 16 + microdroid/system/private/property_contexts | 97 + microdroid/system/private/roles_decl | 1 + microdroid/system/private/seapp_contexts | 1 + microdroid/system/private/security_classes | 167 + microdroid/system/private/service_contexts | 18 + microdroid/system/private/servicemanager.te | 23 + microdroid/system/private/shell.te | 31 + microdroid/system/private/statsd.te | 3 + microdroid/system/private/su.te | 12 + microdroid/system/private/tombstoned.te | 12 + microdroid/system/private/toolbox.te | 3 + microdroid/system/private/ueventd.te | 52 + microdroid/system/private/users | 1 + microdroid/system/private/zipfuse.te | 34 + microdroid/system/public/adbd.te | 2 + microdroid/system/public/apexd.te | 5 + microdroid/system/public/attributes | 395 +++ microdroid/system/public/crash_dump.te | 2 + microdroid/system/public/device.te | 39 + microdroid/system/public/file.te | 204 ++ microdroid/system/public/global_macros | 51 + microdroid/system/public/hal_keymint.te | 4 + microdroid/system/public/hwservicemanager.te | 2 + microdroid/system/public/init.te | 8 + microdroid/system/public/ioctl_defines | 2751 +++++++++++++++++ microdroid/system/public/ioctl_macros | 76 + microdroid/system/public/kernel.te | 2 + microdroid/system/public/keystore.te | 26 + microdroid/system/public/logcat.te | 2 + microdroid/system/public/logd.te | 2 + microdroid/system/public/neverallow_macros | 15 + microdroid/system/public/property.te | 40 + microdroid/system/public/roles | 1 + microdroid/system/public/runas.te | 2 + microdroid/system/public/servicemanager.te | 2 + microdroid/system/public/shell.te | 82 + microdroid/system/public/statsd.te | 31 + microdroid/system/public/su.te | 52 + microdroid/system/public/te_macros | 988 ++++++ microdroid/system/public/tombstoned.te | 2 + microdroid/system/public/toolbox.te | 2 + microdroid/system/public/type.te | 23 + microdroid/system/public/ueventd.te | 4 + microdroid/system/public/vendor_init.te | 150 + microdroid/vendor/file_contexts | 38 + microdroid/vendor/hal_keymint_default.te | 13 + 98 files changed, 9812 insertions(+) create mode 100644 microdroid/Android.bp create mode 100644 microdroid/reqd_mask/access_vectors create mode 100644 microdroid/reqd_mask/initial_sid_contexts create mode 100644 microdroid/reqd_mask/initial_sids create mode 100644 microdroid/reqd_mask/keys.conf create mode 100644 microdroid/reqd_mask/mac_permissions.xml create mode 100644 microdroid/reqd_mask/mls create mode 100644 microdroid/reqd_mask/mls_decl create mode 100644 microdroid/reqd_mask/mls_macros create mode 100644 microdroid/reqd_mask/property_contexts create mode 100644 microdroid/reqd_mask/reqd_mask.te create mode 100644 microdroid/reqd_mask/roles create mode 100644 microdroid/reqd_mask/roles_decl create mode 100644 microdroid/reqd_mask/seapp_contexts create mode 100644 microdroid/reqd_mask/security_classes create mode 100644 microdroid/reqd_mask/service_contexts create mode 100644 microdroid/reqd_mask/users create mode 100644 microdroid/system/private/access_vectors create mode 100644 microdroid/system/private/adbd.te create mode 100644 microdroid/system/private/apexd.te create mode 100644 microdroid/system/private/apkdmverity.te create mode 100644 microdroid/system/private/attributes create mode 100644 microdroid/system/private/binderservicedomain.te create mode 100644 microdroid/system/private/bug_map create mode 100644 microdroid/system/private/crash_dump.te create mode 100644 microdroid/system/private/domain.te create mode 100644 microdroid/system/private/file.te create mode 100644 microdroid/system/private/file_contexts create mode 100644 microdroid/system/private/fs_use create mode 100644 microdroid/system/private/genfs_contexts create mode 100644 microdroid/system/private/halclientdomain.te create mode 100644 microdroid/system/private/hwservice_contexts create mode 100644 microdroid/system/private/hwservicemanager.te create mode 100644 microdroid/system/private/init.te create mode 100644 microdroid/system/private/initial_sid_contexts create mode 100644 microdroid/system/private/initial_sids create mode 100644 microdroid/system/private/kernel.te create mode 100644 microdroid/system/private/keys.conf create mode 100644 microdroid/system/private/keystore.te create mode 100644 microdroid/system/private/keystore2_key_contexts create mode 100644 microdroid/system/private/linkerconfig.te create mode 100644 microdroid/system/private/logd.te create mode 100644 microdroid/system/private/mac_permissions.xml create mode 100644 microdroid/system/private/microdroid_app.te create mode 100644 microdroid/system/private/microdroid_manager.te create mode 100644 microdroid/system/private/mls create mode 100644 microdroid/system/private/mls_decl create mode 100644 microdroid/system/private/mls_macros create mode 100644 microdroid/system/private/net.te create mode 100644 microdroid/system/private/policy_capabilities create mode 100644 microdroid/system/private/port_contexts create mode 100644 microdroid/system/private/property.te create mode 100644 microdroid/system/private/property_contexts create mode 100644 microdroid/system/private/roles_decl create mode 100644 microdroid/system/private/seapp_contexts create mode 100644 microdroid/system/private/security_classes create mode 100644 microdroid/system/private/service_contexts create mode 100644 microdroid/system/private/servicemanager.te create mode 100644 microdroid/system/private/shell.te create mode 100644 microdroid/system/private/statsd.te create mode 100644 microdroid/system/private/su.te create mode 100644 microdroid/system/private/tombstoned.te create mode 100644 microdroid/system/private/toolbox.te create mode 100644 microdroid/system/private/ueventd.te create mode 100644 microdroid/system/private/users create mode 100644 microdroid/system/private/zipfuse.te create mode 100644 microdroid/system/public/adbd.te create mode 100644 microdroid/system/public/apexd.te create mode 100644 microdroid/system/public/attributes create mode 100644 microdroid/system/public/crash_dump.te create mode 100644 microdroid/system/public/device.te create mode 100644 microdroid/system/public/file.te create mode 100644 microdroid/system/public/global_macros create mode 100644 microdroid/system/public/hal_keymint.te create mode 100644 microdroid/system/public/hwservicemanager.te create mode 100644 microdroid/system/public/init.te create mode 100644 microdroid/system/public/ioctl_defines create mode 100644 microdroid/system/public/ioctl_macros create mode 100644 microdroid/system/public/kernel.te create mode 100644 microdroid/system/public/keystore.te create mode 100644 microdroid/system/public/logcat.te create mode 100644 microdroid/system/public/logd.te create mode 100644 microdroid/system/public/neverallow_macros create mode 100644 microdroid/system/public/property.te create mode 100644 microdroid/system/public/roles create mode 100644 microdroid/system/public/runas.te create mode 100644 microdroid/system/public/servicemanager.te create mode 100644 microdroid/system/public/shell.te create mode 100644 microdroid/system/public/statsd.te create mode 100644 microdroid/system/public/su.te create mode 100644 microdroid/system/public/te_macros create mode 100644 microdroid/system/public/tombstoned.te create mode 100644 microdroid/system/public/toolbox.te create mode 100644 microdroid/system/public/type.te create mode 100644 microdroid/system/public/ueventd.te create mode 100644 microdroid/system/public/vendor_init.te create mode 100644 microdroid/vendor/file_contexts create mode 100644 microdroid/vendor/hal_keymint_default.te diff --git a/microdroid/Android.bp b/microdroid/Android.bp new file mode 100644 index 000000000..42909d886 --- /dev/null +++ b/microdroid/Android.bp @@ -0,0 +1,307 @@ +// Copyright (C) 2021 The Android Open Source Project +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package { + // http://go/android-license-faq + // A large-scale-change added 'default_applicable_licenses' to import + // the below license kinds from "system_sepolicy_license": + // SPDX-license-identifier-Apache-2.0 + default_applicable_licenses: ["system_sepolicy_license"], +} + +system_policy_files = [ + "system/private/security_classes", + "system/private/initial_sids", + "system/private/access_vectors", + "system/public/global_macros", + "system/public/neverallow_macros", + "system/private/mls_macros", + "system/private/mls_decl", + "system/private/mls", + "system/private/policy_capabilities", + "system/public/te_macros", + "system/public/attributes", + "system/private/attributes", + "system/public/ioctl_defines", + "system/public/ioctl_macros", + "system/public/*.te", + "system/private/*.te", + "system/private/roles_decl", + "system/public/roles", + "system/private/users", + "system/private/initial_sid_contexts", + "system/private/fs_use", + "system/private/genfs_contexts", + "system/private/port_contexts", +] + +reqd_mask_files = [ + "reqd_mask/security_classes", + "reqd_mask/initial_sids", + "reqd_mask/access_vectors", + "reqd_mask/mls_macros", + "reqd_mask/mls_decl", + "reqd_mask/mls", + "reqd_mask/reqd_mask.te", + "reqd_mask/roles_decl", + "reqd_mask/roles", + "reqd_mask/users", + "reqd_mask/initial_sid_contexts", +] + +system_public_policy_files = [ + "reqd_mask/security_classes", + "reqd_mask/initial_sids", + "reqd_mask/access_vectors", + "system/public/global_macros", + "system/public/neverallow_macros", + "reqd_mask/mls_macros", + "reqd_mask/mls_decl", + "reqd_mask/mls", + "system/public/te_macros", + "system/public/attributes", + "system/public/ioctl_defines", + "system/public/ioctl_macros", + "system/public/*.te", + "reqd_mask/reqd_mask.te", + "reqd_mask/roles_decl", + "reqd_mask/roles", + "system/public/roles", + "reqd_mask/users", + "reqd_mask/initial_sid_contexts", +] + +vendor_policy_files = [ + "reqd_mask/security_classes", + "reqd_mask/initial_sids", + "reqd_mask/access_vectors", + "system/public/global_macros", + "system/public/neverallow_macros", + "reqd_mask/mls_macros", + "reqd_mask/mls_decl", + "reqd_mask/mls", + "system/public/te_macros", + "system/public/attributes", + "system/public/ioctl_defines", + "system/public/ioctl_macros", + "system/public/*.te", + "reqd_mask/reqd_mask.te", + "vendor/*.te", + "reqd_mask/roles_decl", + "reqd_mask/roles", + "system/public/roles", + "reqd_mask/users", + "reqd_mask/initial_sid_contexts", +] + +se_policy_conf { + name: "microdroid_reqd_policy_mask.conf", + srcs: reqd_mask_files, + installable: false, +} + +se_policy_cil { + name: "microdroid_reqd_policy_mask.cil", + src: ":microdroid_reqd_policy_mask.conf", + secilc_check: false, + installable: false, +} + +se_policy_conf { + name: "microdroid_plat_sepolicy.conf", + srcs: system_policy_files, + installable: false, +} + +se_policy_cil { + name: "microdroid_plat_sepolicy.cil", + stem: "plat_sepolicy.cil", + src: ":microdroid_plat_sepolicy.conf", + installable: false, +} + +se_policy_conf { + name: "microdroid_plat_pub_policy.conf", + srcs: system_public_policy_files, + installable: false, +} + +se_policy_cil { + name: "microdroid_plat_pub_policy.cil", + src: ":microdroid_plat_pub_policy.conf", + filter_out: [":microdroid_reqd_policy_mask.cil"], + secilc_check: false, + installable: false, +} + +se_versioned_policy { + name: "microdroid_plat_mapping_file", + base: ":microdroid_plat_pub_policy.cil", + mapping: true, + version: "current", + relative_install_path: "mapping", // install to /system/etc/selinux/mapping + installable: false, +} + +se_versioned_policy { + name: "microdroid_plat_pub_versioned.cil", + stem: "plat_pub_versioned.cil", + base: ":microdroid_plat_pub_policy.cil", + target_policy: ":microdroid_plat_pub_policy.cil", + version: "current", + dependent_cils: [ + ":microdroid_plat_sepolicy.cil", + ":microdroid_plat_mapping_file", + ], + installable: false, +} + +se_policy_conf { + name: "microdroid_vendor_sepolicy.conf", + srcs: vendor_policy_files, + installable: false, +} + +se_policy_cil { + name: "microdroid_vendor_sepolicy.cil.raw", + src: ":microdroid_vendor_sepolicy.conf", + filter_out: [":microdroid_reqd_policy_mask.cil"], + secilc_check: false, // will be done in se_versioned_policy module + installable: false, +} + +se_versioned_policy { + name: "microdroid_vendor_sepolicy.cil", + stem: "vendor_sepolicy.cil", + base: ":microdroid_plat_pub_policy.cil", + target_policy: ":microdroid_vendor_sepolicy.cil.raw", + version: "current", // microdroid is bundled to system + dependent_cils: [ + ":microdroid_plat_sepolicy.cil", + ":microdroid_plat_pub_versioned.cil", + ":microdroid_plat_mapping_file", + ], + filter_out: [":microdroid_plat_pub_versioned.cil"], + installable: false, +} + +sepolicy_vers { + name: "microdroid_plat_sepolicy_vers.txt", + version: "platform", + stem: "plat_sepolicy_vers.txt", + installable: false, +} + +// sepolicy sha256 for vendor +genrule { + name: "microdroid_plat_sepolicy_and_mapping.sha256_gen", + srcs: [":microdroid_plat_sepolicy.cil", ":microdroid_plat_mapping_file"], + out: ["microdroid_plat_sepolicy_and_mapping.sha256"], + cmd: "cat $(in) | sha256sum | cut -d' ' -f1 > $(out)", +} + +prebuilt_etc { + name: "microdroid_plat_sepolicy_and_mapping.sha256", + src: ":microdroid_plat_sepolicy_and_mapping.sha256_gen", + filename: "plat_sepolicy_and_mapping.sha256", + relative_install_path: "selinux", + installable: false, +} + +prebuilt_etc { + name: "microdroid_precompiled_sepolicy.plat_sepolicy_and_mapping.sha256", + src: ":microdroid_plat_sepolicy_and_mapping.sha256_gen", + filename: "precompiled_sepolicy.plat_sepolicy_and_mapping.sha256", + relative_install_path: "selinux", + installable: false, +} + +genrule { + name: "microdroid_precompiled_sepolicy_gen", + tools: ["secilc"], + srcs: [ + ":microdroid_plat_sepolicy.cil", + ":microdroid_plat_mapping_file", + ":microdroid_plat_pub_versioned.cil", + ":microdroid_vendor_sepolicy.cil", + ], + out: ["precompiled_sepolicy"], + cmd: "$(location secilc) -m -M true -G -c 30 $(in) -o $(out) -f /dev/null", +} + +prebuilt_etc { + name: "microdroid_precompiled_sepolicy", + src: ":microdroid_precompiled_sepolicy_gen", + filename: "precompiled_sepolicy", + relative_install_path: "selinux", + installable: false, +} + +genrule { + name: "microdroid_file_contexts.gen", + srcs: ["system/private/file_contexts"], + tools: ["fc_sort"], + out: ["file_contexts"], + cmd: "sed -e 's/#.*$$//' -e '/^$$/d' $(in) > $(out).tmp && " + + "$(location fc_sort) -i $(out).tmp -o $(out)", +} + +prebuilt_etc { + name: "microdroid_file_contexts", + filename: "plat_file_contexts", + src: ":microdroid_file_contexts.gen", + relative_install_path: "selinux", + installable: false, +} + +genrule { + name: "microdroid_vendor_file_contexts.gen", + srcs: ["vendor/file_contexts"], + tools: ["fc_sort"], + out: ["file_contexts"], + cmd: "sed -e 's/#.*$$//' -e '/^$$/d' $(in) > $(out).tmp && " + + "$(location fc_sort) -i $(out).tmp -o $(out)", +} + +prebuilt_etc { + name: "microdroid_hwservice_contexts", + filename: "plat_hwservice_contexts", + src: "system/private/hwservice_contexts", + relative_install_path: "selinux", + installable: false, +} + +prebuilt_etc { + name: "microdroid_property_contexts", + filename: "plat_property_contexts", + src: "system/private/property_contexts", + relative_install_path: "selinux", + installable: false, +} + +prebuilt_etc { + name: "microdroid_service_contexts", + filename: "plat_service_contexts", + src: "system/private/service_contexts", + relative_install_path: "selinux", + installable: false, +} + +prebuilt_etc { + name: "microdroid_keystore2_key_contexts", + filename: "plat_keystore2_key_contexts", + src: "system/private/keystore2_key_contexts", + relative_install_path: "selinux", + installable: false, +} diff --git a/microdroid/reqd_mask/access_vectors b/microdroid/reqd_mask/access_vectors new file mode 100644 index 000000000..22f2ffa1d --- /dev/null +++ b/microdroid/reqd_mask/access_vectors @@ -0,0 +1,777 @@ +# +# Define common prefixes for access vectors +# +# common common_name { permission_name ... } + + +# +# Define a common prefix for file access vectors. +# + +common file +{ + ioctl + read + write + create + getattr + setattr + lock + relabelfrom + relabelto + append + map + unlink + link + rename + execute + quotaon + mounton + audit_access + open + execmod + watch + watch_mount + watch_sb + watch_with_perm + watch_reads +} + + +# +# Define a common prefix for socket access vectors. +# + +common socket +{ +# inherited from file + ioctl + read + write + create + getattr + setattr + lock + relabelfrom + relabelto + append + map +# socket-specific + bind + connect + listen + accept + getopt + setopt + shutdown + recvfrom + sendto + name_bind +} + +# +# Define a common prefix for ipc access vectors. +# + +common ipc +{ + create + destroy + getattr + setattr + read + write + associate + unix_read + unix_write +} + +# +# Define a common for capability access vectors. +# +common cap +{ + # The capabilities are defined in include/linux/capability.h + # Capabilities >= 32 are defined in the cap2 common. + # Care should be taken to ensure that these are consistent with + # those definitions. (Order matters) + + chown + dac_override + dac_read_search + fowner + fsetid + kill + setgid + setuid + setpcap + linux_immutable + net_bind_service + net_broadcast + net_admin + net_raw + ipc_lock + ipc_owner + sys_module + sys_rawio + sys_chroot + sys_ptrace + sys_pacct + sys_admin + sys_boot + sys_nice + sys_resource + sys_time + sys_tty_config + mknod + lease + audit_write + audit_control + setfcap +} + +common cap2 +{ + mac_override # unused by SELinux + mac_admin + syslog + wake_alarm + block_suspend + audit_read + perfmon +} + +# +# Define the access vectors. +# +# class class_name [ inherits common_name ] { permission_name ... } + + +# +# Define the access vector interpretation for file-related objects. +# + +class filesystem +{ + mount + remount + unmount + getattr + relabelfrom + relabelto + associate + quotamod + quotaget + watch +} + +class dir +inherits file +{ + add_name + remove_name + reparent + search + rmdir +} + +class file +inherits file +{ + execute_no_trans + entrypoint +} + +class anon_inode +inherits file + +class lnk_file +inherits file + +class chr_file +inherits file +{ + execute_no_trans + entrypoint +} + +class blk_file +inherits file + +class sock_file +inherits file + +class fifo_file +inherits file + +class fd +{ + use +} + + +# +# Define the access vector interpretation for network-related objects. +# + +class socket +inherits socket + +class tcp_socket +inherits socket +{ + node_bind + name_connect +} + +class udp_socket +inherits socket +{ + node_bind +} + +class rawip_socket +inherits socket +{ + node_bind +} + +class node +{ + recvfrom + sendto +} + +class netif +{ + ingress + egress +} + +class netlink_socket +inherits socket + +class packet_socket +inherits socket + +class key_socket +inherits socket + +class unix_stream_socket +inherits socket +{ + connectto +} + +class unix_dgram_socket +inherits socket + +# +# Define the access vector interpretation for process-related objects +# + +class process +{ + fork + transition + sigchld # commonly granted from child to parent + sigkill # cannot be caught or ignored + sigstop # cannot be caught or ignored + signull # for kill(pid, 0) + signal # all other signals + ptrace + getsched + setsched + getsession + getpgid + setpgid + getcap + setcap + share + getattr + setexec + setfscreate + noatsecure + siginh + setrlimit + rlimitinh + dyntransition + setcurrent + execmem + execstack + execheap + setkeycreate + setsockcreate + getrlimit +} + +class process2 +{ + nnp_transition + nosuid_transition +} + +# +# Define the access vector interpretation for ipc-related objects +# + +class ipc +inherits ipc + +class sem +inherits ipc + +class msgq +inherits ipc +{ + enqueue +} + +class msg +{ + send + receive +} + +class shm +inherits ipc +{ + lock +} + + +# +# Define the access vector interpretation for the security server. +# + +class security +{ + compute_av + compute_create + compute_member + check_context + load_policy + compute_relabel + compute_user + setenforce # was avc_toggle in system class + setbool + setsecparam + setcheckreqprot + read_policy + validate_trans +} + + +# +# Define the access vector interpretation for system operations. +# + +class system +{ + ipc_info + syslog_read + syslog_mod + syslog_console + module_request + module_load +} + +# +# Define the access vector interpretation for controlling capabilities +# + +class capability +inherits cap + +class capability2 +inherits cap2 + +# +# Extended Netlink classes +# +class netlink_route_socket +inherits socket +{ + nlmsg_read + nlmsg_write + nlmsg_readpriv +} + +class netlink_tcpdiag_socket +inherits socket +{ + nlmsg_read + nlmsg_write +} + +class netlink_nflog_socket +inherits socket + +class netlink_xfrm_socket +inherits socket +{ + nlmsg_read + nlmsg_write +} + +class netlink_selinux_socket +inherits socket + +class netlink_audit_socket +inherits socket +{ + nlmsg_read + nlmsg_write + nlmsg_relay + nlmsg_readpriv + nlmsg_tty_audit +} + +class netlink_dnrt_socket +inherits socket + +# Define the access vector interpretation for controlling +# access to IPSec network data by association +# +class association +{ + sendto + recvfrom + setcontext + polmatch +} + +# Updated Netlink class for KOBJECT_UEVENT family. +class netlink_kobject_uevent_socket +inherits socket + +class appletalk_socket +inherits socket + +class packet +{ + send + recv + relabelto + forward_in + forward_out +} + +class key +{ + view + read + write + search + link + setattr + create +} + +class dccp_socket +inherits socket +{ + node_bind + name_connect +} + +class memprotect +{ + mmap_zero +} + +# network peer labels +class peer +{ + recv +} + +class kernel_service +{ + use_as_override + create_files_as +} + +class tun_socket +inherits socket +{ + attach_queue +} + +class binder +{ + impersonate + call + set_context_mgr + transfer +} + +class netlink_iscsi_socket +inherits socket + +class netlink_fib_lookup_socket +inherits socket + +class netlink_connector_socket +inherits socket + +class netlink_netfilter_socket +inherits socket + +class netlink_generic_socket +inherits socket + +class netlink_scsitransport_socket +inherits socket + +class netlink_rdma_socket +inherits socket + +class netlink_crypto_socket +inherits socket + +class infiniband_pkey +{ + access +} + +class infiniband_endport +{ + manage_subnet +} + +# +# Define the access vector interpretation for controlling capabilities +# in user namespaces +# + +class cap_userns +inherits cap + +class cap2_userns +inherits cap2 + + +# +# Define the access vector interpretation for the new socket classes +# enabled by the extended_socket_class policy capability. +# + +# +# The next two classes were previously mapped to rawip_socket and therefore +# have the same definition as rawip_socket (until further permissions +# are defined). +# +class sctp_socket +inherits socket +{ + node_bind + name_connect + association +} + +class icmp_socket +inherits socket +{ + node_bind +} + +# +# The remaining network socket classes were previously +# mapped to the socket class and therefore have the +# same definition as socket. +# + +class ax25_socket +inherits socket + +class ipx_socket +inherits socket + +class netrom_socket +inherits socket + +class atmpvc_socket +inherits socket + +class x25_socket +inherits socket + +class rose_socket +inherits socket + +class decnet_socket +inherits socket + +class atmsvc_socket +inherits socket + +class rds_socket +inherits socket + +class irda_socket +inherits socket + +class pppox_socket +inherits socket + +class llc_socket +inherits socket + +class can_socket +inherits socket + +class tipc_socket +inherits socket + +class bluetooth_socket +inherits socket + +class iucv_socket +inherits socket + +class rxrpc_socket +inherits socket + +class isdn_socket +inherits socket + +class phonet_socket +inherits socket + +class ieee802154_socket +inherits socket + +class caif_socket +inherits socket + +class alg_socket +inherits socket + +class nfc_socket +inherits socket + +class vsock_socket +inherits socket + +class kcm_socket +inherits socket + +class qipcrtr_socket +inherits socket + +class smc_socket +inherits socket + +class bpf +{ + map_create + map_read + map_write + prog_load + prog_run +} + +class property_service +{ + set +} + +class service_manager +{ + add + find + list +} + +class hwservice_manager +{ + add + find + list +} + +class keystore_key +{ + get_state + get + insert + delete + exist + list + reset + password + lock + unlock + is_empty + sign + verify + grant + duplicate + clear_uid + add_auth + user_changed + gen_unique_id +} + +class keystore2 +{ + add_auth + change_password + change_user + clear_ns + clear_uid + early_boot_ended + get_auth_token + get_state + list + lock + report_off_body + reset + unlock +} + +class keystore2_key +{ + convert_storage_key_to_ephemeral + delete + gen_unique_id + get_info + grant + manage_blob + rebind + req_forced_op + update + use + use_dev_id +} + +class drmservice { + consumeRights + setPlaybackStatus + openDecryptSession + closeDecryptSession + initializeDecryptUnit + decrypt + finalizeDecryptUnit + pread +} + +class xdp_socket +inherits socket + +class perf_event +{ + open + cpu + kernel + tracepoint + read + write +} + +class lockdown +{ + integrity + confidentiality +} diff --git a/microdroid/reqd_mask/initial_sid_contexts b/microdroid/reqd_mask/initial_sid_contexts new file mode 100644 index 000000000..aa465cd99 --- /dev/null +++ b/microdroid/reqd_mask/initial_sid_contexts @@ -0,0 +1 @@ +sid reqd_mask u:r:reqd_mask_type:s0 diff --git a/microdroid/reqd_mask/initial_sids b/microdroid/reqd_mask/initial_sids new file mode 100644 index 000000000..366cfb1f4 --- /dev/null +++ b/microdroid/reqd_mask/initial_sids @@ -0,0 +1,3 @@ +sid reqd_mask + +# FLASK diff --git a/microdroid/reqd_mask/keys.conf b/microdroid/reqd_mask/keys.conf new file mode 100644 index 000000000..ce7166bee --- /dev/null +++ b/microdroid/reqd_mask/keys.conf @@ -0,0 +1,2 @@ +# empty keys.conf file - used to generate an empty nonplat_mac_permissions.xml +# on devices without any keys.conf or mac_permissions additions. diff --git a/microdroid/reqd_mask/mac_permissions.xml b/microdroid/reqd_mask/mac_permissions.xml new file mode 100644 index 000000000..ef9c6dd70 --- /dev/null +++ b/microdroid/reqd_mask/mac_permissions.xml @@ -0,0 +1,3 @@ + + + diff --git a/microdroid/reqd_mask/mls b/microdroid/reqd_mask/mls new file mode 100644 index 000000000..d27692412 --- /dev/null +++ b/microdroid/reqd_mask/mls @@ -0,0 +1 @@ +mlsconstrain binder { set_context_mgr } (l1 eq l2); diff --git a/microdroid/reqd_mask/mls_decl b/microdroid/reqd_mask/mls_decl new file mode 100644 index 000000000..dd53bea7e --- /dev/null +++ b/microdroid/reqd_mask/mls_decl @@ -0,0 +1,10 @@ +######################################### +# MLS declarations +# + +# Generate the desired number of sensitivities and categories. +gen_sens(mls_num_sens) +gen_cats(mls_num_cats) + +# Generate level definitions for each sensitivity and category. +gen_levels(mls_num_sens,mls_num_cats) diff --git a/microdroid/reqd_mask/mls_macros b/microdroid/reqd_mask/mls_macros new file mode 100644 index 000000000..83e05425b --- /dev/null +++ b/microdroid/reqd_mask/mls_macros @@ -0,0 +1,54 @@ +######################################## +# +# gen_cats(N) +# +# declares categores c0 to c(N-1) +# +define(`decl_cats',`dnl +category c$1; +ifelse(`$1',`$2',,`decl_cats(incr($1),$2)')dnl +') + +define(`gen_cats',`decl_cats(0,decr($1))') + +######################################## +# +# gen_sens(N) +# +# declares sensitivites s0 to s(N-1) with dominance +# in increasing numeric order with s0 lowest, s(N-1) highest +# +define(`decl_sens',`dnl +sensitivity s$1; +ifelse(`$1',`$2',,`decl_sens(incr($1),$2)')dnl +') + +define(`gen_dominance',`s$1 ifelse(`$1',`$2',,`gen_dominance(incr($1),$2)')') + +define(`gen_sens',` +# Each sensitivity has a name and zero or more aliases. +decl_sens(0,decr($1)) + +# Define the ordering of the sensitivity levels (least to greatest) +dominance { gen_dominance(0,decr($1)) } +') + +######################################## +# +# gen_levels(N,M) +# +# levels from s0 to (N-1) with categories c0 to (M-1) +# +define(`decl_levels',`dnl +level s$1:c0.c$3; +ifelse(`$1',`$2',,`decl_levels(incr($1),$2,$3)')dnl +') + +define(`gen_levels',`decl_levels(0,decr($1),decr($2))') + +######################################## +# +# Basic level names for system low and high +# +define(`mls_systemlow',`s0') +define(`mls_systemhigh',`s`'decr(mls_num_sens):c0.c`'decr(mls_num_cats)') diff --git a/microdroid/reqd_mask/property_contexts b/microdroid/reqd_mask/property_contexts new file mode 100644 index 000000000..8e0bdbbde --- /dev/null +++ b/microdroid/reqd_mask/property_contexts @@ -0,0 +1,3 @@ +# empty property_contexts file - this file is used to generate an empty +# non-platform property context for devices without any property_contexts +# customizations. diff --git a/microdroid/reqd_mask/reqd_mask.te b/microdroid/reqd_mask/reqd_mask.te new file mode 100644 index 000000000..f77eef433 --- /dev/null +++ b/microdroid/reqd_mask/reqd_mask.te @@ -0,0 +1 @@ +type reqd_mask_type; diff --git a/microdroid/reqd_mask/roles b/microdroid/reqd_mask/roles new file mode 100644 index 000000000..926cb7a5f --- /dev/null +++ b/microdroid/reqd_mask/roles @@ -0,0 +1 @@ +role r types reqd_mask_type; diff --git a/microdroid/reqd_mask/roles_decl b/microdroid/reqd_mask/roles_decl new file mode 100644 index 000000000..c84fcba0f --- /dev/null +++ b/microdroid/reqd_mask/roles_decl @@ -0,0 +1 @@ +role r; diff --git a/microdroid/reqd_mask/seapp_contexts b/microdroid/reqd_mask/seapp_contexts new file mode 100644 index 000000000..0f4e0ad0e --- /dev/null +++ b/microdroid/reqd_mask/seapp_contexts @@ -0,0 +1,2 @@ +# empty seapp_contexts file - used to generate an empty seapp_contexts for +# devices without any non-platform seapp_contexts customizations. diff --git a/microdroid/reqd_mask/security_classes b/microdroid/reqd_mask/security_classes new file mode 100644 index 000000000..200b030cc --- /dev/null +++ b/microdroid/reqd_mask/security_classes @@ -0,0 +1,167 @@ +# FLASK + +# +# Define the security object classes +# + +# Classes marked as userspace are classes +# for userspace object managers + +class security +class process +class system +class capability + +# file-related classes +class filesystem +class file +class anon_inode +class dir +class fd +class lnk_file +class chr_file +class blk_file +class sock_file +class fifo_file + +# network-related classes +class socket +class tcp_socket +class udp_socket +class rawip_socket +class node +class netif +class netlink_socket +class packet_socket +class key_socket +class unix_stream_socket +class unix_dgram_socket + +# sysv-ipc-related classes +class sem +class msg +class msgq +class shm +class ipc + +# extended netlink sockets +class netlink_route_socket +class netlink_tcpdiag_socket +class netlink_nflog_socket +class netlink_xfrm_socket +class netlink_selinux_socket +class netlink_audit_socket +class netlink_dnrt_socket + +# IPSec association +class association + +# Updated Netlink class for KOBJECT_UEVENT family. +class netlink_kobject_uevent_socket + +class appletalk_socket + +class packet + +# Kernel access key retention +class key + +class dccp_socket + +class memprotect + +# network peer labels +class peer + +# Capabilities >= 32 +class capability2 + +# kernel services that need to override task security, e.g. cachefiles +class kernel_service + +class tun_socket + +class binder + +# Updated netlink classes for more recent netlink protocols. +class netlink_iscsi_socket +class netlink_fib_lookup_socket +class netlink_connector_socket +class netlink_netfilter_socket +class netlink_generic_socket +class netlink_scsitransport_socket +class netlink_rdma_socket +class netlink_crypto_socket + +# Infiniband +class infiniband_pkey +class infiniband_endport + +# Capability checks when on a non-init user namespace +class cap_userns +class cap2_userns + +# New socket classes introduced by extended_socket_class policy capability. +# These two were previously mapped to rawip_socket. +class sctp_socket +class icmp_socket +# These were previously mapped to socket. +class ax25_socket +class ipx_socket +class netrom_socket +class atmpvc_socket +class x25_socket +class rose_socket +class decnet_socket +class atmsvc_socket +class rds_socket +class irda_socket +class pppox_socket +class llc_socket +class can_socket +class tipc_socket +class bluetooth_socket +class iucv_socket +class rxrpc_socket +class isdn_socket +class phonet_socket +class ieee802154_socket +class caif_socket +class alg_socket +class nfc_socket +class vsock_socket +class kcm_socket +class qipcrtr_socket +class smc_socket + +class process2 + +class bpf + +class xdp_socket + +class perf_event + +# Introduced in https://github.com/torvalds/linux/commit/59438b46471ae6cdfb761afc8c9beaf1e428a331 +class lockdown + +# Property service +class property_service # userspace + +# Service manager +class service_manager # userspace + +# hardware service manager # userspace +class hwservice_manager + +# Legacy Keystore key permissions +class keystore_key # userspace + +# Keystore 2.0 permissions +class keystore2 # userspace + +# Keystore 2.0 key permissions +class keystore2_key # userspace + +class drmservice # userspace +# FLASK diff --git a/microdroid/reqd_mask/service_contexts b/microdroid/reqd_mask/service_contexts new file mode 100644 index 000000000..481967b9a --- /dev/null +++ b/microdroid/reqd_mask/service_contexts @@ -0,0 +1,3 @@ +# empty service_contexts file - this file is used to generate an empty +# non-platform service_context for devices without any service_contexts +# customizations. diff --git a/microdroid/reqd_mask/users b/microdroid/reqd_mask/users new file mode 100644 index 000000000..51b7b57e6 --- /dev/null +++ b/microdroid/reqd_mask/users @@ -0,0 +1 @@ +user u roles { r } level s0 range s0 - mls_systemhigh; diff --git a/microdroid/system/private/access_vectors b/microdroid/system/private/access_vectors new file mode 100644 index 000000000..22f2ffa1d --- /dev/null +++ b/microdroid/system/private/access_vectors @@ -0,0 +1,777 @@ +# +# Define common prefixes for access vectors +# +# common common_name { permission_name ... } + + +# +# Define a common prefix for file access vectors. +# + +common file +{ + ioctl + read + write + create + getattr + setattr + lock + relabelfrom + relabelto + append + map + unlink + link + rename + execute + quotaon + mounton + audit_access + open + execmod + watch + watch_mount + watch_sb + watch_with_perm + watch_reads +} + + +# +# Define a common prefix for socket access vectors. +# + +common socket +{ +# inherited from file + ioctl + read + write + create + getattr + setattr + lock + relabelfrom + relabelto + append + map +# socket-specific + bind + connect + listen + accept + getopt + setopt + shutdown + recvfrom + sendto + name_bind +} + +# +# Define a common prefix for ipc access vectors. +# + +common ipc +{ + create + destroy + getattr + setattr + read + write + associate + unix_read + unix_write +} + +# +# Define a common for capability access vectors. +# +common cap +{ + # The capabilities are defined in include/linux/capability.h + # Capabilities >= 32 are defined in the cap2 common. + # Care should be taken to ensure that these are consistent with + # those definitions. (Order matters) + + chown + dac_override + dac_read_search + fowner + fsetid + kill + setgid + setuid + setpcap + linux_immutable + net_bind_service + net_broadcast + net_admin + net_raw + ipc_lock + ipc_owner + sys_module + sys_rawio + sys_chroot + sys_ptrace + sys_pacct + sys_admin + sys_boot + sys_nice + sys_resource + sys_time + sys_tty_config + mknod + lease + audit_write + audit_control + setfcap +} + +common cap2 +{ + mac_override # unused by SELinux + mac_admin + syslog + wake_alarm + block_suspend + audit_read + perfmon +} + +# +# Define the access vectors. +# +# class class_name [ inherits common_name ] { permission_name ... } + + +# +# Define the access vector interpretation for file-related objects. +# + +class filesystem +{ + mount + remount + unmount + getattr + relabelfrom + relabelto + associate + quotamod + quotaget + watch +} + +class dir +inherits file +{ + add_name + remove_name + reparent + search + rmdir +} + +class file +inherits file +{ + execute_no_trans + entrypoint +} + +class anon_inode +inherits file + +class lnk_file +inherits file + +class chr_file +inherits file +{ + execute_no_trans + entrypoint +} + +class blk_file +inherits file + +class sock_file +inherits file + +class fifo_file +inherits file + +class fd +{ + use +} + + +# +# Define the access vector interpretation for network-related objects. +# + +class socket +inherits socket + +class tcp_socket +inherits socket +{ + node_bind + name_connect +} + +class udp_socket +inherits socket +{ + node_bind +} + +class rawip_socket +inherits socket +{ + node_bind +} + +class node +{ + recvfrom + sendto +} + +class netif +{ + ingress + egress +} + +class netlink_socket +inherits socket + +class packet_socket +inherits socket + +class key_socket +inherits socket + +class unix_stream_socket +inherits socket +{ + connectto +} + +class unix_dgram_socket +inherits socket + +# +# Define the access vector interpretation for process-related objects +# + +class process +{ + fork + transition + sigchld # commonly granted from child to parent + sigkill # cannot be caught or ignored + sigstop # cannot be caught or ignored + signull # for kill(pid, 0) + signal # all other signals + ptrace + getsched + setsched + getsession + getpgid + setpgid + getcap + setcap + share + getattr + setexec + setfscreate + noatsecure + siginh + setrlimit + rlimitinh + dyntransition + setcurrent + execmem + execstack + execheap + setkeycreate + setsockcreate + getrlimit +} + +class process2 +{ + nnp_transition + nosuid_transition +} + +# +# Define the access vector interpretation for ipc-related objects +# + +class ipc +inherits ipc + +class sem +inherits ipc + +class msgq +inherits ipc +{ + enqueue +} + +class msg +{ + send + receive +} + +class shm +inherits ipc +{ + lock +} + + +# +# Define the access vector interpretation for the security server. +# + +class security +{ + compute_av + compute_create + compute_member + check_context + load_policy + compute_relabel + compute_user + setenforce # was avc_toggle in system class + setbool + setsecparam + setcheckreqprot + read_policy + validate_trans +} + + +# +# Define the access vector interpretation for system operations. +# + +class system +{ + ipc_info + syslog_read + syslog_mod + syslog_console + module_request + module_load +} + +# +# Define the access vector interpretation for controlling capabilities +# + +class capability +inherits cap + +class capability2 +inherits cap2 + +# +# Extended Netlink classes +# +class netlink_route_socket +inherits socket +{ + nlmsg_read + nlmsg_write + nlmsg_readpriv +} + +class netlink_tcpdiag_socket +inherits socket +{ + nlmsg_read + nlmsg_write +} + +class netlink_nflog_socket +inherits socket + +class netlink_xfrm_socket +inherits socket +{ + nlmsg_read + nlmsg_write +} + +class netlink_selinux_socket +inherits socket + +class netlink_audit_socket +inherits socket +{ + nlmsg_read + nlmsg_write + nlmsg_relay + nlmsg_readpriv + nlmsg_tty_audit +} + +class netlink_dnrt_socket +inherits socket + +# Define the access vector interpretation for controlling +# access to IPSec network data by association +# +class association +{ + sendto + recvfrom + setcontext + polmatch +} + +# Updated Netlink class for KOBJECT_UEVENT family. +class netlink_kobject_uevent_socket +inherits socket + +class appletalk_socket +inherits socket + +class packet +{ + send + recv + relabelto + forward_in + forward_out +} + +class key +{ + view + read + write + search + link + setattr + create +} + +class dccp_socket +inherits socket +{ + node_bind + name_connect +} + +class memprotect +{ + mmap_zero +} + +# network peer labels +class peer +{ + recv +} + +class kernel_service +{ + use_as_override + create_files_as +} + +class tun_socket +inherits socket +{ + attach_queue +} + +class binder +{ + impersonate + call + set_context_mgr + transfer +} + +class netlink_iscsi_socket +inherits socket + +class netlink_fib_lookup_socket +inherits socket + +class netlink_connector_socket +inherits socket + +class netlink_netfilter_socket +inherits socket + +class netlink_generic_socket +inherits socket + +class netlink_scsitransport_socket +inherits socket + +class netlink_rdma_socket +inherits socket + +class netlink_crypto_socket +inherits socket + +class infiniband_pkey +{ + access +} + +class infiniband_endport +{ + manage_subnet +} + +# +# Define the access vector interpretation for controlling capabilities +# in user namespaces +# + +class cap_userns +inherits cap + +class cap2_userns +inherits cap2 + + +# +# Define the access vector interpretation for the new socket classes +# enabled by the extended_socket_class policy capability. +# + +# +# The next two classes were previously mapped to rawip_socket and therefore +# have the same definition as rawip_socket (until further permissions +# are defined). +# +class sctp_socket +inherits socket +{ + node_bind + name_connect + association +} + +class icmp_socket +inherits socket +{ + node_bind +} + +# +# The remaining network socket classes were previously +# mapped to the socket class and therefore have the +# same definition as socket. +# + +class ax25_socket +inherits socket + +class ipx_socket +inherits socket + +class netrom_socket +inherits socket + +class atmpvc_socket +inherits socket + +class x25_socket +inherits socket + +class rose_socket +inherits socket + +class decnet_socket +inherits socket + +class atmsvc_socket +inherits socket + +class rds_socket +inherits socket + +class irda_socket +inherits socket + +class pppox_socket +inherits socket + +class llc_socket +inherits socket + +class can_socket +inherits socket + +class tipc_socket +inherits socket + +class bluetooth_socket +inherits socket + +class iucv_socket +inherits socket + +class rxrpc_socket +inherits socket + +class isdn_socket +inherits socket + +class phonet_socket +inherits socket + +class ieee802154_socket +inherits socket + +class caif_socket +inherits socket + +class alg_socket +inherits socket + +class nfc_socket +inherits socket + +class vsock_socket +inherits socket + +class kcm_socket +inherits socket + +class qipcrtr_socket +inherits socket + +class smc_socket +inherits socket + +class bpf +{ + map_create + map_read + map_write + prog_load + prog_run +} + +class property_service +{ + set +} + +class service_manager +{ + add + find + list +} + +class hwservice_manager +{ + add + find + list +} + +class keystore_key +{ + get_state + get + insert + delete + exist + list + reset + password + lock + unlock + is_empty + sign + verify + grant + duplicate + clear_uid + add_auth + user_changed + gen_unique_id +} + +class keystore2 +{ + add_auth + change_password + change_user + clear_ns + clear_uid + early_boot_ended + get_auth_token + get_state + list + lock + report_off_body + reset + unlock +} + +class keystore2_key +{ + convert_storage_key_to_ephemeral + delete + gen_unique_id + get_info + grant + manage_blob + rebind + req_forced_op + update + use + use_dev_id +} + +class drmservice { + consumeRights + setPlaybackStatus + openDecryptSession + closeDecryptSession + initializeDecryptUnit + decrypt + finalizeDecryptUnit + pread +} + +class xdp_socket +inherits socket + +class perf_event +{ + open + cpu + kernel + tracepoint + read + write +} + +class lockdown +{ + integrity + confidentiality +} diff --git a/microdroid/system/private/adbd.te b/microdroid/system/private/adbd.te new file mode 100644 index 000000000..2ebf9d812 --- /dev/null +++ b/microdroid/system/private/adbd.te @@ -0,0 +1,44 @@ +typeattribute adbd coredomain; +typeattribute adbd mlstrustedsubject; + +init_daemon_domain(adbd) + +domain_auto_trans(adbd, shell_exec, shell) + +userdebug_or_eng(` + allow adbd self:process setcurrent; + allow adbd su:process dyntransition; +') + +# Do not sanitize the environment or open fds of the shell. Allow signaling +# created processes. +allow adbd shell:process { noatsecure signal }; + +# Set UID and GID to shell. Set supplementary groups. +allow adbd self:global_capability_class_set { setuid setgid }; + +# Drop capabilities from bounding set on user builds. +allow adbd self:global_capability_class_set setpcap; + +# adbd probes for vsock support. Do not generate denials when +# this occurs. (b/123569840) +dontaudit adbd self:{ socket vsock_socket } create; + +# Allow adbd inside vm to forward vm's vsock. +allow adbd self:vsock_socket { create_socket_perms_no_ioctl listen accept }; + +# Use a pseudo tty. +allow adbd devpts:chr_file rw_file_perms; + +# adb push/pull /data/local/tmp. +allow adbd shell_data_file:dir create_dir_perms; +allow adbd shell_data_file:file create_file_perms; + +allow adbd tmpfs:dir search; + +allow adbd rootfs:dir r_dir_perms; + +# Connect to shell and use a socket transferred from it. +# Used for e.g. abb. +allow adbd shell:unix_stream_socket { read write shutdown }; +allow adbd shell:fd use; diff --git a/microdroid/system/private/apexd.te b/microdroid/system/private/apexd.te new file mode 100644 index 000000000..621b1a822 --- /dev/null +++ b/microdroid/system/private/apexd.te @@ -0,0 +1,87 @@ +typeattribute apexd coredomain; + +init_daemon_domain(apexd) + +# allow apexd to create loop devices with /dev/loop-control +allow apexd loop_control_device:chr_file rw_file_perms; +# allow apexd to access loop devices +allow apexd loop_device:blk_file rw_file_perms; +allowxperm apexd loop_device:blk_file ioctl { + LOOP_GET_STATUS64 + LOOP_SET_STATUS64 + LOOP_SET_FD + LOOP_SET_BLOCK_SIZE + LOOP_SET_DIRECT_IO + LOOP_CLR_FD + BLKFLSBUF + LOOP_CONFIGURE +}; +# allow apexd to access /dev/block +allow apexd block_device:dir r_dir_perms; + +#allow apexd to access virtual disks +allow apexd vd_device:blk_file r_file_perms; + +# allow apexd to access /dev/block/dm-* (device-mapper entries) +allow apexd dm_device:chr_file rw_file_perms; +allow apexd dm_device:blk_file rw_file_perms; + +# sys_admin is required to access the device-mapper and mount +# dac_override, chown, and fowner are needed for snapshot and restore +allow apexd self:global_capability_class_set { sys_admin chown dac_override dac_read_search fowner }; + +# Note: fsetid is deliberately not included above. fsetid checks are +# triggered by chmod on a directory or file owned by a group other +# than one of the groups assigned to the current process to see if +# the setgid bit should be cleared, regardless of whether the setgid +# bit was even set. We do not appear to truly need this capability +# for apexd to operate. +dontaudit apexd self:global_capability_class_set fsetid; + +# allow apexd to create a mount point in /apex +allow apexd apex_mnt_dir:dir create_dir_perms; +# allow apexd to mount in /apex +allow apexd apex_mnt_dir:filesystem { mount unmount }; +allow apexd apex_mnt_dir:dir mounton; +# allow apexd to create symlinks in /apex +allow apexd apex_mnt_dir:lnk_file create_file_perms; +# allow apexd to create /apex/apex-info-list.xml and relabel to apex_info_file +allow apexd apex_mnt_dir:file { create_file_perms relabelfrom mounton }; +allow apexd apex_info_file:file relabelto; +# apexd needs to update /apex/apex-info-list.xml after non-staged APEX update. +allow apexd apex_info_file:file rw_file_perms; + +# Unmount and mount filesystems +allow apexd labeledfs:filesystem { mount unmount }; + +# /sys directory tree traversal +allow apexd sysfs_type:dir search; +# Configure read-ahead of dm-verity and loop devices +# for dm-X +allow apexd sysfs_dm:dir r_dir_perms; +allow apexd sysfs_dm:file rw_file_perms; +# for loopX +allow apexd sysfs_loop:dir r_dir_perms; +allow apexd sysfs_loop:file rw_file_perms; + +# Allow apexd to log to the kernel. +allow apexd kmsg_device:chr_file w_file_perms; + +# Apex pre- & post-install permission. + +# Allow self-execute for the fork mount helper. +allow apexd apexd_exec:file execute_no_trans; + +# Unshare and make / private so that hooks cannot influence the +# running system. +allow apexd rootfs:dir mounton; + +# apexd is using bootstrap bionic +allow apexd system_bootstrap_lib_file:dir r_dir_perms; +allow apexd system_bootstrap_lib_file:file { execute read open getattr map }; + +# Allow apexd to read file contexts when performing restorecon +allow apexd file_contexts_file:file r_file_perms; + +#------------------------------------------- +allow apexd kmsg_device:chr_file w_file_perms; diff --git a/microdroid/system/private/apkdmverity.te b/microdroid/system/private/apkdmverity.te new file mode 100644 index 000000000..8974a1d58 --- /dev/null +++ b/microdroid/system/private/apkdmverity.te @@ -0,0 +1,29 @@ +# apkdmverity is a program that protects a signed APK file using dm-verity. + +type apkdmverity, domain, coredomain; +type apkdmverity_exec, exec_type, file_type, system_file_type; + +# allow domain transition from init +init_daemon_domain(apkdmverity) + +# apkdmverity accesses "payload metadata disk" which points to +# a /dev/vd* block device file. +allow apkdmverity block_device:dir r_dir_perms; +allow apkdmverity block_device:lnk_file r_file_perms; +allow apkdmverity vd_device:blk_file r_file_perms; + +# allow apkdmverity to create dm-verity devices +allow apkdmverity dm_device:{chr_file blk_file} rw_file_perms; +# sys_admin is required to access the device-mapper and mount +allow apkdmverity self:global_capability_class_set sys_admin; + +# allow apkdmverity to create loop devices with /dev/loop-control +allow apkdmverity loop_control_device:chr_file rw_file_perms; + +# allow apkdmverity to access loop devices +allow apkdmverity loop_device:blk_file rw_file_perms; +allowxperm apkdmverity loop_device:blk_file ioctl { + LOOP_SET_STATUS64 + LOOP_SET_FD + LOOP_SET_DIRECT_IO +}; diff --git a/microdroid/system/private/attributes b/microdroid/system/private/attributes new file mode 100644 index 000000000..991bac1d6 --- /dev/null +++ b/microdroid/system/private/attributes @@ -0,0 +1,12 @@ +hal_attribute(lazy_test); + +# This is applied to apps on vendor images with SDK <=30 only, +# to exempt them from recent mls changes. It must not be applied +# to any domain on newer system or vendor image. +attribute mlsvendorcompat; + +# Attributes for property types having both system_property_type +# and vendor_property_type. Such types are ill-formed because +# property owner attributes must be exclusive. +attribute system_and_vendor_property_type; +expandattribute system_and_vendor_property_type false; diff --git a/microdroid/system/private/binderservicedomain.te b/microdroid/system/private/binderservicedomain.te new file mode 100644 index 000000000..99006bff8 --- /dev/null +++ b/microdroid/system/private/binderservicedomain.te @@ -0,0 +1,5 @@ +allow binderservicedomain keystore:keystore_key { get_state get insert delete exist list sign verify }; +allow binderservicedomain keystore:keystore2 { get_state }; +allow binderservicedomain keystore:keystore2_key { delete get_info rebind use }; + +use_keystore(binderservicedomain) diff --git a/microdroid/system/private/bug_map b/microdroid/system/private/bug_map new file mode 100644 index 000000000..5b042ae4c --- /dev/null +++ b/microdroid/system/private/bug_map @@ -0,0 +1,35 @@ +dnsmasq netd fifo_file b/77868789 +dnsmasq netd unix_stream_socket b/77868789 +gmscore_app system_data_file dir b/146166941 +init app_data_file file b/77873135 +init cache_file blk_file b/77873135 +init logpersist file b/77873135 +init nativetest_data_file dir b/77873135 +init pstorefs dir b/77873135 +init shell_data_file dir b/77873135 +init shell_data_file file b/77873135 +init shell_data_file lnk_file b/77873135 +init shell_data_file sock_file b/77873135 +init system_data_file chr_file b/77873135 +isolated_app privapp_data_file dir b/119596573 +isolated_app app_data_file dir b/120394782 +mediaextractor app_data_file file b/77923736 +mediaextractor radio_data_file file b/77923736 +mediaprovider cache_file blk_file b/77925342 +mediaprovider mnt_media_rw_file dir b/77925342 +mediaprovider shell_data_file dir b/77925342 +mediaswcodec ashmem_device chr_file b/142679232 +netd priv_app unix_stream_socket b/77870037 +netd untrusted_app unix_stream_socket b/77870037 +netd untrusted_app_25 unix_stream_socket b/77870037 +netd untrusted_app_27 unix_stream_socket b/77870037 +netd untrusted_app_29 unix_stream_socket b/77870037 +platform_app nfc_data_file dir b/74331887 +system_server crash_dump process b/73128755 +system_server overlayfs_file file b/142390309 +system_server sdcardfs file b/77856826 +system_server zygote process b/77856826 +untrusted_app untrusted_app netlink_route_socket b/155595000 +vold system_data_file file b/124108085 +zygote untrusted_app_25 process b/77925912 +zygote labeledfs filesystem b/170748799 diff --git a/microdroid/system/private/crash_dump.te b/microdroid/system/private/crash_dump.te new file mode 100644 index 000000000..90587fa4d --- /dev/null +++ b/microdroid/system/private/crash_dump.te @@ -0,0 +1,71 @@ +# crash_dump might inherit CAP_SYS_PTRACE from a privileged process, +# which will result in an audit log even when it's allowed to trace. +dontaudit crash_dump self:global_capability_class_set { sys_ptrace }; + +allow crash_dump kmsg_debug_device:chr_file { open append }; + +# Use inherited file descriptors +allow crash_dump domain:fd use; + +# Read/write IPC pipes inherited from crashing processes. +allow crash_dump domain:fifo_file { read write }; + +# Append to pipes given to us by processes requesting dumps (e.g. dumpstate) +allow crash_dump domain:fifo_file { append }; + +# Read information from /proc/$PID. +allow crash_dump domain:process getattr; + +r_dir_file(crash_dump, domain) +allow crash_dump exec_type:file r_file_perms; + +# Read all /vendor +r_dir_file(crash_dump, vendor_file) + +# Talk to tombstoned +unix_socket_connect(crash_dump, tombstoned_crash, tombstoned) + +# Append to tombstone files. +allow crash_dump tombstone_data_file:file { append getattr }; + +# crash_dump writes out logcat logs at the bottom of tombstones, +# which is super useful in some cases. +unix_socket_connect(crash_dump, logdr, logd) + +# Crash dump is not intended to access the following files. Since these +# are WAI, suppress the denials to clean up the logs. +dontaudit crash_dump { + core_data_file_type + vendor_file_type +}:dir search; +dontaudit crash_dump system_data_file:{ lnk_file file } read; +dontaudit crash_dump property_type:file read; + +# Suppress denials for files in /proc that are passed +# across exec(). +dontaudit crash_dump proc_type:file rw_file_perms; + +typeattribute crash_dump coredomain; + +# Crash dump does not need to access devices passed across exec(). +dontaudit crash_dump { devpts dev_type }:chr_file { read write }; + +allow crash_dump { + domain + -apexd + -crash_dump + -init + -kernel + -keystore + -logd + -ueventd + -vendor_init +}:process { ptrace signal sigchld sigstop sigkill }; + +userdebug_or_eng(` + allow crash_dump { + apexd + keystore + logd + }:process { ptrace signal sigchld sigstop sigkill }; +') diff --git a/microdroid/system/private/domain.te b/microdroid/system/private/domain.te new file mode 100644 index 000000000..fe4d07289 --- /dev/null +++ b/microdroid/system/private/domain.te @@ -0,0 +1,254 @@ +# Rules for all domains. + +# Allow reaping by init. +allow domain init:process sigchld; + +# Intra-domain accesses. +allow domain self:process { + fork + sigchld + sigkill + sigstop + signull + signal + getsched + setsched + getsession + getpgid + setpgid + getcap + setcap + getattr + setrlimit +}; +allow domain self:fd use; +allow domain proc:dir r_dir_perms; +allow domain proc_net_type:dir search; +r_dir_file(domain, self) +allow domain self:{ fifo_file file } rw_file_perms; +allow domain self:unix_dgram_socket { create_socket_perms sendto }; +allow domain self:unix_stream_socket { create_stream_socket_perms connectto }; + +# Inherit or receive open files from others. +allow domain init:fd use; + +# Root fs. +allow domain tmpfs:dir { getattr search }; +allow domain rootfs:dir search; +allow domain rootfs:lnk_file { read getattr }; + +# Device accesses. +allow domain device:dir search; +allow domain dev_type:lnk_file r_file_perms; +allow domain devpts:dir search; +allow domain socket_device:dir r_dir_perms; +allow domain owntty_device:chr_file rw_file_perms; +allow domain null_device:chr_file rw_file_perms; +allow domain zero_device:chr_file rw_file_perms; + +# /dev/binder can be accessed by ... everyone! :) +allow { domain -hwservicemanager } binder_device:chr_file rw_file_perms; + +# Restrict binder ioctls to an allowlist. Additional ioctl commands may be +# added to individual domains, but this sets safe defaults for all processes. +allowxperm domain binder_device:chr_file ioctl { unpriv_binder_ioctls }; + +# /dev/binderfs needs to be accessed by everyone too! +allow domain binderfs:dir { getattr search }; +allow domain binderfs_logs_proc:dir search; + +allow { domain -servicemanager } hwbinder_device:chr_file rw_file_perms; +allow domain ptmx_device:chr_file rw_file_perms; +allow domain random_device:chr_file rw_file_perms; +allow domain proc_random:dir r_dir_perms; +allow domain proc_random:file r_file_perms; +allow domain properties_device:dir { search getattr }; +allow domain properties_serial:file r_file_perms; +allow domain property_info:file r_file_perms; + +allow domain property_contexts_file:file r_file_perms; + +dontaudit domain property_type:file audit_access; + +allow domain init:key search; + +# logd access +unix_socket_send(domain, logdw, logd) + +# Directory/link file access for path resolution. +allow domain { + system_file + system_lib_file + system_seccomp_policy_file + system_security_cacerts_file +}:dir r_dir_perms; +allow domain system_file:lnk_file { getattr read }; + +# Global access to /system/etc/security/cacerts/*, /system/etc/seccomp_policy/*, /system/lib[64]/*, +# /(system|product|system_ext)/etc/(group|passwd), linker and its config. +allow domain system_seccomp_policy_file:file r_file_perms; +# cacerts are accessible from public Java API. +allow domain system_security_cacerts_file:file r_file_perms; +allow domain system_group_file:file r_file_perms; +allow domain system_passwd_file:file r_file_perms; +allow domain system_linker_exec:file { execute read open getattr map }; +allow domain system_linker_config_file:file r_file_perms; +allow domain system_lib_file:file { execute read open getattr map }; +# To allow following symlinks at /system/bin/linker, /system/lib/libc.so, etc. +allow domain system_linker_exec:lnk_file { read open getattr }; +allow domain system_lib_file:lnk_file { read open getattr }; + +allow domain system_event_log_tags_file:file r_file_perms; + +allow coredomain system_file:file { execute read open getattr map }; + +# All domains get access to /vendor/etc +allow domain vendor_configs_file:dir r_dir_perms; +allow domain vendor_configs_file:file { read open getattr map }; + +# Allow all domains to be able to follow /system/vendor and/or +# /vendor/odm symlinks. +allow domain vendor_file_type:lnk_file { getattr open read }; + +# This is required to be able to search & read /vendor/lib64 +# in order to lookup vendor libraries. The execute permission +# for coredomains is granted *only* for same process HALs +allow domain vendor_file:dir { getattr search }; + +# Allow reading and executing out of /vendor to all vendor domains +allow { domain -coredomain } vendor_file_type:dir r_dir_perms; +allow { domain -coredomain } vendor_file_type:file { read open getattr execute map }; +allow { domain -coredomain } vendor_file_type:lnk_file { getattr read }; + +# read and stat any sysfs symlinks +allow domain sysfs:lnk_file { getattr read }; + +# Lots of processes access current CPU information +r_dir_file(domain, sysfs_devices_system_cpu) + +# If kernel CONFIG_TRANSPARENT_HUGEPAGE is enabled, libjemalloc5 (statically +# included by libc) reads /sys/kernel/mm/transparent_hugepage/enabled. +allow domain sysfs_transparent_hugepage:dir search; +allow domain sysfs_transparent_hugepage:file r_file_perms; + +allow coredomain system_data_file:dir getattr; +# /data has the label system_data_root_file. Vendor components need the search +# permission on system_data_root_file for path traversal to /data/vendor. +allow domain system_data_root_file:dir { search getattr } ; +allow domain system_data_file:dir search; +# TODO restrict this to non-coredomain +allow domain vendor_data_file:dir { getattr search }; + +# required by the dynamic linker +allow domain proc:lnk_file { getattr read }; + +# /proc/cpuinfo +allow domain proc_cpuinfo:file r_file_perms; + +# profiling needs to read /proc/sys/kernel/perf_event_max_sample_rate +allow domain proc_perf:file r_file_perms; + +# toybox loads libselinux which stats /sys/fs/selinux/ +allow domain selinuxfs:dir search; +allow domain selinuxfs:file getattr; +allow domain sysfs:dir search; +allow domain selinuxfs:filesystem getattr; + +# Almost all processes log tracing information to +# /sys/kernel/debug/tracing/trace_marker +# The reason behind this is documented in b/6513400 +allow domain debugfs:dir search; +allow domain debugfs_tracing:dir search; +allow domain debugfs_tracing_debug:dir search; +allow domain debugfs_trace_marker:file w_file_perms; + +# Linux lockdown mode offers coarse-grained definitions for access controls. +# The "confidentiality" level detects access to tracefs or the perf subsystem. +# This overlaps with more precise declarations in Android's policy. The +# debugfs_trace_marker above is an example in which all processes should have +# some access to tracefs. Therefore, allow all domains to access this level. +# The "integrity" level is however enforced. +allow domain self:lockdown confidentiality; + +# Filesystem access. +allow domain fs_type:filesystem getattr; +allow domain fs_type:dir getattr; + +# Restrict all domains to an allowlist for common socket types. Additional +# ioctl commands may be added to individual domains, but this sets safe +# defaults for all processes. Note that granting this allowlist to domain does +# not grant the ioctl permission on these socket types. That must be granted +# separately. +allowxperm domain domain:{ icmp_socket rawip_socket tcp_socket udp_socket } + ioctl { unpriv_sock_ioctls unpriv_tty_ioctls }; +# default allowlist for unix sockets. +allowxperm domain { domain pdx_channel_socket_type }:{ unix_dgram_socket unix_stream_socket } + ioctl unpriv_unix_sock_ioctls; + +# Restrict PTYs to only allowed ioctls. +# Note that granting this allowlist to domain does +# not grant the wider ioctl permission. That must be granted +# separately. +allowxperm domain devpts:chr_file ioctl unpriv_tty_ioctls; + +# All domains must clearly enumerate what ioctls they use +# on filesystem objects (plain files, directories, symbolic links, +# named pipes, and named sockets). We start off with a safe set. +allowxperm domain { file_type fs_type domain dev_type }:{ dir notdevfile_class_set blk_file } ioctl { FIOCLEX FIONCLEX }; + +# If a domain has ioctl access to tun_device, it must clearly enumerate the +# ioctls used. Safe defaults are listed below. +allowxperm domain tun_device:chr_file ioctl { FIOCLEX FIONCLEX }; + +# Allow a process to make a determination whether a file descriptor +# for a plain file or pipe (fifo_file) is a tty. Note that granting +# this allowlist to domain does not grant the ioctl permission to +# these files. That must be granted separately. +allowxperm domain { file_type fs_type }:file ioctl { TCGETS }; +allowxperm domain domain:fifo_file ioctl { TCGETS }; + +# If a domain has access to perform an ioctl on a block device, allow these +# very common, benign ioctls +allowxperm domain dev_type:blk_file ioctl { BLKGETSIZE64 BLKSSZGET }; + +# read APEX dir and stat any symlink pointing to APEXs. +allow domain apex_mnt_dir:dir { getattr search }; +allow domain apex_mnt_dir:lnk_file r_file_perms; + +allow domain self:global_capability_class_set audit_control; +allow domain self:netlink_audit_socket { create_socket_perms_no_ioctl nlmsg_write }; + +# workaround for supressing property accesses. +# TODO: remove these +set_prop(domain, property_type -vmsecret_keymint_prop) +# auditallow { domain -init } property_type:property_service set; +# auditallow { domain -init } property_type:file rw_file_perms; + +allow domain linkerconfig_file:dir search; +allow domain linkerconfig_file:file r_file_perms; + +#----------------------------------------- +# Path resolution access in cgroups. +allow domain cgroup:dir search; +allow { domain } cgroup:dir w_dir_perms; +allow { domain } cgroup:file w_file_perms; + +allow domain cgroup_v2:dir search; +allow { domain } cgroup_v2:dir w_dir_perms; +allow { domain } cgroup_v2:file w_file_perms; + +allow domain cgroup_rc_file:dir search; +allow domain cgroup_rc_file:file r_file_perms; +allow domain task_profiles_file:file r_file_perms; +allow domain task_profiles_api_file:file r_file_perms; + +#----------------------------------------- +# Allow access to fsverity keyring. +allow domain kernel:key search; + +# Transition to crash_dump when /system/bin/crash_dump* is executed. +# This occurs when the process crashes. +# We do not apply this to the su domain to avoid interfering with +# tests (b/114136122) +domain_auto_trans(domain, crash_dump_exec, crash_dump); +allow domain crash_dump:process sigchld; diff --git a/microdroid/system/private/file.te b/microdroid/system/private/file.te new file mode 100644 index 000000000..1989d7e2d --- /dev/null +++ b/microdroid/system/private/file.te @@ -0,0 +1,12 @@ +allow fs_type self:filesystem associate; +allow cgroup tmpfs:filesystem associate; +allow cgroup_v2 tmpfs:filesystem associate; +allow cgroup_rc_file tmpfs:filesystem associate; +allow debugfs_type { debugfs debugfs_tracing debugfs_tracing_debug }:filesystem associate; +allow dev_type tmpfs:filesystem associate; +allow file_type labeledfs:filesystem associate; +allow file_type tmpfs:filesystem associate; +allow file_type rootfs:filesystem associate; +allow proc_net proc:filesystem associate; +allow sysfs_type sysfs:filesystem associate; +allow system_data_file tmpfs:filesystem associate; diff --git a/microdroid/system/private/file_contexts b/microdroid/system/private/file_contexts new file mode 100644 index 000000000..97e756d93 --- /dev/null +++ b/microdroid/system/private/file_contexts @@ -0,0 +1,166 @@ +########################################### +# Root +/ u:object_r:rootfs:s0 + +# Data files +/build\.prop u:object_r:rootfs:s0 +/init\..* u:object_r:rootfs:s0 + +# Executables +/init u:object_r:init_exec:s0 + +# For kernel modules +/lib(/.*)? u:object_r:rootfs:s0 + +# Empty directories +/lost\+found u:object_r:rootfs:s0 +/debug_ramdisk u:object_r:tmpfs:s0 +/mnt u:object_r:tmpfs:s0 +/proc u:object_r:rootfs:s0 +/second_stage_resources u:object_r:tmpfs:s0 +/sys u:object_r:sysfs:s0 +/apex u:object_r:apex_mnt_dir:s0 + +/apex/(\.(bootstrap|default)-)?apex-info-list.xml u:object_r:apex_info_file:s0 + +# Symlinks +/bin u:object_r:rootfs:s0 +/d u:object_r:rootfs:s0 +/etc u:object_r:rootfs:s0 + +########################## +# Devices +# +/dev(/.*)? u:object_r:device:s0 +/dev/ashmem u:object_r:ashmem_device:s0 +/dev/ashmem(.*)? u:object_r:ashmem_libcutils_device:s0 +/dev/binder u:object_r:binder_device:s0 +/dev/block(/.*)? u:object_r:block_device:s0 +/dev/block/dm-[0-9]+ u:object_r:dm_device:s0 +/dev/block/loop[0-9]* u:object_r:loop_device:s0 +/dev/block/vd[a-z][0-9]* u:object_r:vd_device:s0 +/dev/block/ram[0-9]* u:object_r:ram_device:s0 +/dev/block/zram[0-9]* u:object_r:ram_device:s0 +/dev/console u:object_r:console_device:s0 +/dev/dma_heap(/.*)? u:object_r:dmabuf_heap_device:s0 +/dev/dma_heap/system u:object_r:dmabuf_system_heap_device:s0 +/dev/dma_heap/system-uncached u:object_r:dmabuf_system_heap_device:s0 +/dev/dma_heap/system-secure(.*) u:object_r:dmabuf_system_secure_heap_device:s0 +/dev/dm-user(/.*)? u:object_r:dm_user_device:s0 +/dev/device-mapper u:object_r:dm_device:s0 +/dev/event-log-tags u:object_r:runtime_event_log_tags_file:s0 +/dev/cgroup_info(/.*)? u:object_r:cgroup_rc_file:s0 +/dev/fuse u:object_r:fuse_device:s0 +/dev/hw_random u:object_r:hw_random_device:s0 +/dev/hwbinder u:object_r:hwbinder_device:s0 +/dev/loop-control u:object_r:loop_control_device:s0 +/dev/ppp u:object_r:ppp_device:s0 +/dev/ptmx u:object_r:ptmx_device:s0 +/dev/kmsg u:object_r:kmsg_device:s0 +/dev/kmsg_debug u:object_r:kmsg_debug_device:s0 +/dev/kvm u:object_r:kvm_device:s0 +/dev/null u:object_r:null_device:s0 +/dev/random u:object_r:random_device:s0 +/dev/rtc[0-9] u:object_r:rtc_device:s0 +/dev/socket(/.*)? u:object_r:socket_device:s0 +/dev/socket/adbd u:object_r:adbd_socket:s0 +/dev/socket/logd u:object_r:logd_socket:s0 +/dev/socket/logdr u:object_r:logdr_socket:s0 +/dev/socket/logdw u:object_r:logdw_socket:s0 +/dev/socket/property_service u:object_r:property_socket:s0 +/dev/socket/statsdw u:object_r:statsdw_socket:s0 +/dev/socket/tombstoned_crash u:object_r:tombstoned_crash_socket:s0 +/dev/socket/tombstoned_java_trace u:object_r:tombstoned_java_trace_socket:s0 +/dev/socket/tombstoned_intercept u:object_r:tombstoned_intercept_socket:s0 +/dev/sys/block/by-name/userdata(/.*)? u:object_r:userdata_sysdev:s0 +/dev/sys/fs/by-name/userdata(/.*)? u:object_r:userdata_sysdev:s0 +/dev/tty u:object_r:owntty_device:s0 +/dev/tty[0-9]* u:object_r:tty_device:s0 +/dev/ttyS[0-9]* u:object_r:serial_device:s0 +/dev/tun u:object_r:tun_device:s0 +/dev/uhid u:object_r:uhid_device:s0 +/dev/uinput u:object_r:uhid_device:s0 +/dev/uio[0-9]* u:object_r:uio_device:s0 +/dev/urandom u:object_r:random_device:s0 +/dev/vhost-vsock u:object_r:kvm_device:s0 +/dev/vndbinder u:object_r:vndbinder_device:s0 +/dev/zero u:object_r:zero_device:s0 +/dev/__properties__ u:object_r:properties_device:s0 +/dev/__properties__/property_info u:object_r:property_info:s0 +############################# +# Linker configuration +# +/linkerconfig(/.*)? u:object_r:linkerconfig_file:s0 +############################# +# System files +# +/system(/.*)? u:object_r:system_file:s0 +/system/lib(64)?(/.*)? u:object_r:system_lib_file:s0 +/system/lib(64)?/bootstrap(/.*)? u:object_r:system_bootstrap_lib_file:s0 +/system/bin/apexd u:object_r:apexd_exec:s0 +/system/bin/linker(64)? u:object_r:system_linker_exec:s0 +/system/bin/linkerconfig u:object_r:linkerconfig_exec:s0 +/system/bin/bootstrap/linker(64)? u:object_r:system_linker_exec:s0 +/system/bin/bootstrap/linkerconfig u:object_r:linkerconfig_exec:s0 +/system/bin/servicemanager u:object_r:servicemanager_exec:s0 +/system/bin/hwservicemanager u:object_r:hwservicemanager_exec:s0 +/system/bin/init u:object_r:init_exec:s0 +/system/bin/keystore2 u:object_r:keystore_exec:s0 +/system/bin/logcat -- u:object_r:logcat_exec:s0 +/system/bin/logd u:object_r:logd_exec:s0 +/system/bin/run-as -- u:object_r:runas_exec:s0 +/system/bin/sh -- u:object_r:shell_exec:s0 +/system/bin/tombstoned u:object_r:tombstoned_exec:s0 +/system/bin/toolbox -- u:object_r:toolbox_exec:s0 +/system/bin/toybox -- u:object_r:toolbox_exec:s0 +/system/bin/zipfuse u:object_r:zipfuse_exec:s0 +/system/bin/microdroid_launcher u:object_r:microdroid_app_exec:s0 +/system/bin/microdroid_manager u:object_r:microdroid_manager_exec:s0 +/system/bin/apkdmverity u:object_r:apkdmverity_exec:s0 +/system/etc/cgroups\.json u:object_r:cgroup_desc_file:s0 +/system/etc/task_profiles/cgroups_[0-9]+\.json u:object_r:cgroup_desc_api_file:s0 +/system/etc/event-log-tags u:object_r:system_event_log_tags_file:s0 +/system/etc/group u:object_r:system_group_file:s0 +/system/etc/ld\.config.* u:object_r:system_linker_config_file:s0 +/system/etc/passwd u:object_r:system_passwd_file:s0 +/system/etc/seccomp_policy(/.*)? u:object_r:system_seccomp_policy_file:s0 +/system/etc/security/cacerts(/.*)? u:object_r:system_security_cacerts_file:s0 +/system/etc/selinux/mapping/[0-9]+\.[0-9]+\.cil u:object_r:sepolicy_file:s0 +/system/etc/selinux/plat_mac_permissions\.xml u:object_r:mac_perms_file:s0 +/system/etc/selinux/plat_property_contexts u:object_r:property_contexts_file:s0 +/system/etc/selinux/plat_service_contexts u:object_r:service_contexts_file:s0 +/system/etc/selinux/plat_hwservice_contexts u:object_r:hwservice_contexts_file:s0 +/system/etc/selinux/plat_keystore2_key_contexts u:object_r:keystore2_key_contexts_file:s0 +/system/etc/selinux/plat_file_contexts u:object_r:file_contexts_file:s0 +/system/etc/selinux/plat_seapp_contexts u:object_r:seapp_contexts_file:s0 +/system/etc/selinux/plat_sepolicy\.cil u:object_r:sepolicy_file:s0 +/system/etc/selinux/plat_and_mapping_sepolicy\.cil\.sha256 u:object_r:sepolicy_file:s0 +/system/etc/task_profiles\.json u:object_r:task_profiles_file:s0 +/system/etc/task_profiles/task_profiles_[0-9]+\.json u:object_r:task_profiles_api_file:s0 + +############################# +# Vendor files +# +/vendor(/.*)? u:object_r:vendor_file:s0 +/vendor/etc(/.*)? u:object_r:vendor_configs_file:s0 +/vendor/etc/vintf(/.*)? u:object_r:vendor_configs_file:s0 + +############################# +# Data files +# +# NOTE: When modifying existing label rules, changes may also need to +# propagate to the "Expanded data files" section. +# +/data u:object_r:system_data_root_file:s0 +/data/(.*)? u:object_r:system_data_file:s0 +/data/local/tests(/.*)? u:object_r:shell_test_data_file:s0 +/data/local/tmp(/.*)? u:object_r:shell_data_file:s0 +/data/local/tmp/ltp(/.*)? u:object_r:nativetest_data_file:s0 +/data/local/traces(/.*)? u:object_r:trace_data_file:s0 +/data/misc/keystore(/.*)? u:object_r:keystore_data_file:s0 +/data/tombstones(/.*)? u:object_r:tombstone_data_file:s0 +/data/vendor(/.*)? u:object_r:vendor_data_file:s0 + +# microdroid doesn't use anr, but tombstoned tries to read this. +# So marking /data/anr as tombstone_data_file +/data/anr(/.*)? u:object_r:tombstone_data_file:s0 diff --git a/microdroid/system/private/fs_use b/microdroid/system/private/fs_use new file mode 100644 index 000000000..93d7f1b24 --- /dev/null +++ b/microdroid/system/private/fs_use @@ -0,0 +1,27 @@ +# Label inodes via getxattr. +fs_use_xattr yaffs2 u:object_r:labeledfs:s0; +fs_use_xattr jffs2 u:object_r:labeledfs:s0; +fs_use_xattr ext2 u:object_r:labeledfs:s0; +fs_use_xattr ext3 u:object_r:labeledfs:s0; +fs_use_xattr ext4 u:object_r:labeledfs:s0; +fs_use_xattr xfs u:object_r:labeledfs:s0; +fs_use_xattr btrfs u:object_r:labeledfs:s0; +fs_use_xattr f2fs u:object_r:labeledfs:s0; +fs_use_xattr squashfs u:object_r:labeledfs:s0; +fs_use_xattr overlay u:object_r:labeledfs:s0; +fs_use_xattr erofs u:object_r:labeledfs:s0; +fs_use_xattr incremental-fs u:object_r:labeledfs:s0; +fs_use_xattr virtiofs u:object_r:labeledfs:s0; + +# Label inodes from task label. +fs_use_task pipefs u:object_r:pipefs:s0; +fs_use_task sockfs u:object_r:sockfs:s0; + +# Label inodes from combination of task label and fs label. +# Define type_transition rules if you want per-domain types. +fs_use_trans devpts u:object_r:devpts:s0; +fs_use_trans tmpfs u:object_r:tmpfs:s0; +fs_use_trans devtmpfs u:object_r:device:s0; +fs_use_trans shm u:object_r:shm:s0; +fs_use_trans mqueue u:object_r:mqueue:s0; + diff --git a/microdroid/system/private/genfs_contexts b/microdroid/system/private/genfs_contexts new file mode 100644 index 000000000..3499aa03b --- /dev/null +++ b/microdroid/system/private/genfs_contexts @@ -0,0 +1,378 @@ +# Label inodes with the fs label. +genfscon rootfs / u:object_r:rootfs:s0 +# proc labeling can be further refined (longest matching prefix). +genfscon proc / u:object_r:proc:s0 +genfscon proc /asound u:object_r:proc_asound:s0 +genfscon proc /bootconfig u:object_r:proc_bootconfig:s0 +genfscon proc /buddyinfo u:object_r:proc_buddyinfo:s0 +genfscon proc /cmdline u:object_r:proc_cmdline:s0 +genfscon proc /config.gz u:object_r:config_gz:s0 +genfscon proc /diskstats u:object_r:proc_diskstats:s0 +genfscon proc /filesystems u:object_r:proc_filesystems:s0 +genfscon proc /interrupts u:object_r:proc_interrupts:s0 +genfscon proc /iomem u:object_r:proc_iomem:s0 +genfscon proc /kallsyms u:object_r:proc_kallsyms:s0 +genfscon proc /keys u:object_r:proc_keys:s0 +genfscon proc /kmsg u:object_r:proc_kmsg:s0 +genfscon proc /loadavg u:object_r:proc_loadavg:s0 +genfscon proc /locks u:object_r:proc_locks:s0 +genfscon proc /lowmemorykiller u:object_r:proc_lowmemorykiller:s0 +genfscon proc /meminfo u:object_r:proc_meminfo:s0 +genfscon proc /misc u:object_r:proc_misc:s0 +genfscon proc /modules u:object_r:proc_modules:s0 +genfscon proc /mounts u:object_r:proc_mounts:s0 +genfscon proc /net u:object_r:proc_net:s0 +genfscon proc /net/tcp u:object_r:proc_net_tcp_udp:s0 +genfscon proc /net/udp u:object_r:proc_net_tcp_udp:s0 +genfscon proc /net/xt_qtaguid/ctrl u:object_r:proc_qtaguid_ctrl:s0 +genfscon proc /net/xt_qtaguid/ u:object_r:proc_qtaguid_stat:s0 +genfscon proc /cpuinfo u:object_r:proc_cpuinfo:s0 +genfscon proc /pagetypeinfo u:object_r:proc_pagetypeinfo:s0 +genfscon proc /pressure/cpu u:object_r:proc_pressure_cpu:s0 +genfscon proc /pressure/io u:object_r:proc_pressure_io:s0 +genfscon proc /pressure/memory u:object_r:proc_pressure_mem:s0 +genfscon proc /slabinfo u:object_r:proc_slabinfo:s0 +genfscon proc /softirqs u:object_r:proc_timer:s0 +genfscon proc /stat u:object_r:proc_stat:s0 +genfscon proc /swaps u:object_r:proc_swaps:s0 +genfscon proc /sysrq-trigger u:object_r:proc_sysrq:s0 +genfscon proc /kpageflags u:object_r:proc_kpageflags:s0 +genfscon proc /sys/abi/swp u:object_r:proc_abi:s0 +genfscon proc /sys/fs/pipe-max-size u:object_r:proc_pipe_conf:s0 +genfscon proc /sys/fs/protected_hardlinks u:object_r:proc_security:s0 +genfscon proc /sys/fs/protected_symlinks u:object_r:proc_security:s0 +genfscon proc /sys/fs/suid_dumpable u:object_r:proc_security:s0 +genfscon proc /sys/fs/verity/require_signatures u:object_r:proc_fs_verity:s0 +genfscon proc /sys/kernel/core_pattern u:object_r:usermodehelper:s0 +genfscon proc /sys/kernel/core_pipe_limit u:object_r:usermodehelper:s0 +genfscon proc /sys/kernel/domainname u:object_r:proc_hostname:s0 +genfscon proc /sys/kernel/dmesg_restrict u:object_r:proc_security:s0 +genfscon proc /sys/kernel/hostname u:object_r:proc_hostname:s0 +genfscon proc /sys/kernel/hotplug u:object_r:usermodehelper:s0 +genfscon proc /sys/kernel/hung_task_ u:object_r:proc_hung_task:s0 +genfscon proc /sys/kernel/kptr_restrict u:object_r:proc_security:s0 +genfscon proc /sys/kernel/modprobe u:object_r:usermodehelper:s0 +genfscon proc /sys/kernel/modules_disabled u:object_r:proc_security:s0 +genfscon proc /sys/kernel/panic_on_oops u:object_r:proc_panic:s0 +genfscon proc /sys/kernel/perf_event_max_sample_rate u:object_r:proc_perf:s0 +genfscon proc /sys/kernel/perf_event_paranoid u:object_r:proc_perf:s0 +genfscon proc /sys/kernel/perf_cpu_time_max_percent u:object_r:proc_perf:s0 +genfscon proc /sys/kernel/perf_event_mlock_kb u:object_r:proc_perf:s0 +genfscon proc /sys/kernel/pid_max u:object_r:proc_pid_max:s0 +genfscon proc /sys/kernel/poweroff_cmd u:object_r:usermodehelper:s0 +genfscon proc /sys/kernel/random u:object_r:proc_random:s0 +genfscon proc /sys/kernel/randomize_va_space u:object_r:proc_security:s0 +genfscon proc /sys/kernel/sched_child_runs_first u:object_r:proc_sched:s0 +genfscon proc /sys/kernel/sched_latency_ns u:object_r:proc_sched:s0 +genfscon proc /sys/kernel/sched_rt_period_us u:object_r:proc_sched:s0 +genfscon proc /sys/kernel/sched_rt_runtime_us u:object_r:proc_sched:s0 +genfscon proc /sys/kernel/sched_schedstats u:object_r:proc_sched:s0 +genfscon proc /sys/kernel/sched_tunable_scaling u:object_r:proc_sched:s0 +genfscon proc /sys/kernel/sched_util_clamp_max u:object_r:proc_sched:s0 +genfscon proc /sys/kernel/sched_util_clamp_min u:object_r:proc_sched:s0 +genfscon proc /sys/kernel/sched_util_clamp_min_rt_default u:object_r:proc_sched:s0 +genfscon proc /sys/kernel/sched_wakeup_granularity_ns u:object_r:proc_sched:s0 +genfscon proc /sys/kernel/sysrq u:object_r:proc_sysrq:s0 +genfscon proc /sys/kernel/usermodehelper u:object_r:usermodehelper:s0 +genfscon proc /sys/net u:object_r:proc_net:s0 +genfscon proc /sys/vm/dirty_background_ratio u:object_r:proc_dirty:s0 +genfscon proc /sys/vm/dirty_expire_centisecs u:object_r:proc_dirty:s0 +genfscon proc /sys/vm/extra_free_kbytes u:object_r:proc_extra_free_kbytes:s0 +genfscon proc /sys/vm/max_map_count u:object_r:proc_max_map_count:s0 +genfscon proc /sys/vm/mmap_min_addr u:object_r:proc_security:s0 +genfscon proc /sys/vm/mmap_rnd_bits u:object_r:proc_security:s0 +genfscon proc /sys/vm/mmap_rnd_compat_bits u:object_r:proc_security:s0 +genfscon proc /sys/vm/page-cluster u:object_r:proc_page_cluster:s0 +genfscon proc /sys/vm/drop_caches u:object_r:proc_drop_caches:s0 +genfscon proc /sys/vm/overcommit_memory u:object_r:proc_overcommit_memory:s0 +genfscon proc /sys/vm/min_free_order_shift u:object_r:proc_min_free_order_shift:s0 +genfscon proc /timer_list u:object_r:proc_timer:s0 +genfscon proc /timer_stats u:object_r:proc_timer:s0 +genfscon proc /tty/drivers u:object_r:proc_tty_drivers:s0 +genfscon proc /uid/ u:object_r:proc_uid_time_in_state:s0 +genfscon proc /uid_cputime/show_uid_stat u:object_r:proc_uid_cputime_showstat:s0 +genfscon proc /uid_cputime/remove_uid_range u:object_r:proc_uid_cputime_removeuid:s0 +genfscon proc /uid_io/stats u:object_r:proc_uid_io_stats:s0 +genfscon proc /uid_procstat/set u:object_r:proc_uid_procstat_set:s0 +genfscon proc /uid_time_in_state u:object_r:proc_uid_time_in_state:s0 +genfscon proc /uid_concurrent_active_time u:object_r:proc_uid_concurrent_active_time:s0 +genfscon proc /uid_concurrent_policy_time u:object_r:proc_uid_concurrent_policy_time:s0 +genfscon proc /uid_cpupower/ u:object_r:proc_uid_cpupower:s0 +genfscon proc /uptime u:object_r:proc_uptime:s0 +genfscon proc /version u:object_r:proc_version:s0 +genfscon proc /vmallocinfo u:object_r:proc_vmallocinfo:s0 +genfscon proc /vmstat u:object_r:proc_vmstat:s0 +genfscon proc /zoneinfo u:object_r:proc_zoneinfo:s0 + +genfscon fusectl / u:object_r:fusectlfs:s0 + +# selinuxfs booleans can be individually labeled. +genfscon selinuxfs / u:object_r:selinuxfs:s0 +genfscon cgroup / u:object_r:cgroup:s0 +genfscon cgroup2 / u:object_r:cgroup_v2:s0 +# sysfs labels can be set by userspace. +genfscon sysfs / u:object_r:sysfs:s0 +genfscon sysfs /devices/cs_etm u:object_r:sysfs_devices_cs_etm:s0 +genfscon sysfs /devices/system/cpu u:object_r:sysfs_devices_system_cpu:s0 +genfscon sysfs /class/android_usb u:object_r:sysfs_android_usb:s0 +genfscon sysfs /class/extcon u:object_r:sysfs_extcon:s0 +genfscon sysfs /class/leds u:object_r:sysfs_leds:s0 +genfscon sysfs /class/net u:object_r:sysfs_net:s0 +genfscon sysfs /class/rfkill/rfkill0/state u:object_r:sysfs_bluetooth_writable:s0 +genfscon sysfs /class/rfkill/rfkill1/state u:object_r:sysfs_bluetooth_writable:s0 +genfscon sysfs /class/rfkill/rfkill2/state u:object_r:sysfs_bluetooth_writable:s0 +genfscon sysfs /class/rfkill/rfkill3/state u:object_r:sysfs_bluetooth_writable:s0 +genfscon sysfs /class/rtc u:object_r:sysfs_rtc:s0 +genfscon sysfs /class/switch u:object_r:sysfs_switch:s0 +genfscon sysfs /class/wakeup u:object_r:sysfs_wakeup:s0 +genfscon sysfs /devices/platform/nfc-power/nfc_power u:object_r:sysfs_nfc_power_writable:s0 +genfscon sysfs /devices/virtual/android_usb u:object_r:sysfs_android_usb:s0 +genfscon sysfs /devices/virtual/block/ u:object_r:sysfs_devices_block:s0 +genfscon sysfs /devices/virtual/block/dm- u:object_r:sysfs_dm:s0 +genfscon sysfs /devices/virtual/block/loop u:object_r:sysfs_loop:s0 +genfscon sysfs /devices/virtual/block/zram0 u:object_r:sysfs_zram:s0 +genfscon sysfs /devices/virtual/block/zram1 u:object_r:sysfs_zram:s0 +genfscon sysfs /devices/virtual/block/zram0/uevent u:object_r:sysfs_zram_uevent:s0 +genfscon sysfs /devices/virtual/block/zram1/uevent u:object_r:sysfs_zram_uevent:s0 +genfscon sysfs /devices/virtual/misc/hw_random u:object_r:sysfs_hwrandom:s0 +genfscon sysfs /devices/virtual/net u:object_r:sysfs_net:s0 +genfscon sysfs /devices/virtual/switch u:object_r:sysfs_switch:s0 +genfscon sysfs /devices/virtual/wakeup u:object_r:sysfs_wakeup:s0 +genfscon sysfs /firmware/devicetree/base/firmware/android u:object_r:sysfs_dt_firmware_android:s0 +genfscon sysfs /fs/ext4/features u:object_r:sysfs_fs_ext4_features:s0 +genfscon sysfs /fs/f2fs u:object_r:sysfs_fs_f2fs:s0 +genfscon sysfs /fs/incremental-fs/features u:object_r:sysfs_fs_incfs_features:s0 +genfscon sysfs /fs/incremental-fs/instances u:object_r:sysfs_fs_incfs_metrics:s0 +genfscon sysfs /power/autosleep u:object_r:sysfs_power:s0 +genfscon sysfs /power/state u:object_r:sysfs_power:s0 +genfscon sysfs /power/suspend_stats u:object_r:sysfs_suspend_stats:s0 +genfscon sysfs /power/wakeup_count u:object_r:sysfs_power:s0 +genfscon sysfs /power/wake_lock u:object_r:sysfs_wake_lock:s0 +genfscon sysfs /power/wake_unlock u:object_r:sysfs_wake_lock:s0 +genfscon sysfs /kernel/memory_state_time u:object_r:sysfs_power:s0 +genfscon sysfs /kernel/dma_heap u:object_r:sysfs_dma_heap:s0 +genfscon sysfs /kernel/ion u:object_r:sysfs_ion:s0 +genfscon sysfs /kernel/ipv4 u:object_r:sysfs_ipv4:s0 +genfscon sysfs /kernel/mm/transparent_hugepage u:object_r:sysfs_transparent_hugepage:s0 +genfscon sysfs /kernel/notes u:object_r:sysfs_kernel_notes:s0 +genfscon sysfs /kernel/uevent_helper u:object_r:sysfs_usermodehelper:s0 +genfscon sysfs /kernel/wakeup_reasons u:object_r:sysfs_wakeup_reasons:s0 +genfscon sysfs /kernel/dmabuf/buffers u:object_r:sysfs_dmabuf_stats:s0 +genfscon sysfs /module/dm_verity/parameters/prefetch_cluster u:object_r:sysfs_dm_verity:s0 +genfscon sysfs /module/lowmemorykiller u:object_r:sysfs_lowmemorykiller:s0 +genfscon sysfs /module/tcp_cubic/parameters u:object_r:sysfs_net:s0 +genfscon sysfs /module/wlan/parameters/fwpath u:object_r:sysfs_wlan_fwpath:s0 +genfscon sysfs /devices/virtual/timed_output/vibrator/enable u:object_r:sysfs_vibrator:s0 +genfscon sysfs /devices/virtual/misc/uhid u:object_r:sysfs_uhid:s0 + +genfscon debugfs /kprobes u:object_r:debugfs_kprobes:s0 +genfscon debugfs /mmc0 u:object_r:debugfs_mmc:s0 +genfscon debugfs /tracing u:object_r:debugfs_tracing_debug:s0 +genfscon tracefs / u:object_r:debugfs_tracing_debug:s0 +genfscon debugfs /tracing/tracing_on u:object_r:debugfs_tracing:s0 +genfscon tracefs /tracing_on u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/trace u:object_r:debugfs_tracing:s0 +genfscon tracefs /trace u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/per_cpu/cpu u:object_r:debugfs_tracing:s0 +genfscon tracefs /per_cpu/cpu u:object_r:debugfs_tracing:s0 + +genfscon debugfs /tracing/instances u:object_r:debugfs_tracing_instances:s0 +genfscon tracefs /instances u:object_r:debugfs_tracing_instances:s0 +genfscon debugfs /tracing/instances/bootreceiver u:object_r:debugfs_bootreceiver_tracing:s0 +genfscon tracefs /instances/bootreceiver u:object_r:debugfs_bootreceiver_tracing:s0 +genfscon debugfs /tracing/instances/mm_events u:object_r:debugfs_mm_events_tracing:s0 +genfscon tracefs /instances/mm_events u:object_r:debugfs_mm_events_tracing:s0 +genfscon debugfs /tracing/instances/wifi u:object_r:debugfs_wifi_tracing:s0 +genfscon tracefs /instances/wifi u:object_r:debugfs_wifi_tracing:s0 +genfscon debugfs /tracing/trace_marker u:object_r:debugfs_trace_marker:s0 +genfscon tracefs /trace_marker u:object_r:debugfs_trace_marker:s0 +genfscon debugfs /wakeup_sources u:object_r:debugfs_wakeup_sources:s0 +genfscon debugfs /tracing/printk_formats u:object_r:debugfs_tracing_printk_formats:s0 +genfscon tracefs /printk_formats u:object_r:debugfs_tracing_printk_formats:s0 + +genfscon debugfs /tracing/events/header_page u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/f2fs/f2fs_get_data_block/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/f2fs/f2fs_iget/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/f2fs/f2fs_sync_file_enter/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/f2fs/f2fs_sync_file_exit/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/f2fs/f2fs_write_begin/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/f2fs/f2fs_write_end/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/ext4/ext4_da_write_begin/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/ext4/ext4_da_write_end/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/ext4/ext4_es_lookup_extent_enter/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/ext4/ext4_es_lookup_extent_exit/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/ext4/ext4_load_inode/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/ext4/ext4_sync_file_enter/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/ext4/ext4_sync_file_exit/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/block/block_rq_issue/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/block/block_rq_complete/ u:object_r:debugfs_tracing:s0 + +genfscon tracefs /events/header_page u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/f2fs/f2fs_get_data_block/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/f2fs/f2fs_iget/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/f2fs/f2fs_sync_file_enter/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/f2fs/f2fs_sync_file_exit/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/f2fs/f2fs_write_begin/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/f2fs/f2fs_write_end/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/ext4/ext4_da_write_begin/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/ext4/ext4_da_write_end/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/ext4/ext4_es_lookup_extent_enter/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/ext4/ext4_es_lookup_extent_exit/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/ext4/ext4_load_inode/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/ext4/ext4_sync_file_enter/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/ext4/ext4_sync_file_exit/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/block/block_rq_issue/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/block/block_rq_complete/ u:object_r:debugfs_tracing:s0 + +genfscon tracefs /trace_clock u:object_r:debugfs_tracing:s0 +genfscon tracefs /buffer_size_kb u:object_r:debugfs_tracing:s0 +genfscon tracefs /options/overwrite u:object_r:debugfs_tracing:s0 +genfscon tracefs /options/print-tgid u:object_r:debugfs_tracing:s0 +genfscon tracefs /options/record-tgid u:object_r:debugfs_tracing:s0 +genfscon tracefs /saved_cmdlines_size u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/sched/sched_switch/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/sched/sched_wakeup/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/sched/sched_wakeup_new/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/sched/sched_waking/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/sched/sched_blocked_reason/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/sched/sched_cpu_hotplug/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/sched/sched_process_exit/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/sched/sched_process_free/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/sched/sched_pi_setprio/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/cgroup/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/power/cpu_frequency/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/power/cpu_idle/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/power/clock_enable/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/power/clock_disable/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/power/clock_set_rate/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/power/cpu_frequency_limits/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/power/gpu_frequency/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/power/suspend_resume/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/cpufreq_interactive/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/vmscan/mm_vmscan_direct_reclaim_begin/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/vmscan/mm_vmscan_direct_reclaim_end/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/vmscan/mm_vmscan_kswapd_wake/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/vmscan/mm_vmscan_kswapd_sleep/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/binder/binder_transaction/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/binder/binder_transaction_received/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/binder/binder_lock/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/binder/binder_locked/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/binder/binder_unlock/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/binder/binder_transaction_alloc_buf/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/binder/binder_set_priority/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/lowmemorykiller/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/sync/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/fence/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/dma_fence/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/filemap/mm_filemap_add_to_page_cache/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/filemap/mm_filemap_delete_from_page_cache/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/kmem/rss_stat/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/kmem/ion_heap_grow/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/kmem/ion_heap_shrink/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/ion/ion_stat/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/mm_event/mm_event_record/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/oom/oom_score_adj_update/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/oom/mark_victim/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/task/task_rename/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/task/task_newtask/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/ftrace/print/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/gpu_mem/gpu_mem_total u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/thermal/thermal_temperature/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/thermal/cdev_update/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/cpuhp/cpuhp_enter/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/cpuhp/cpuhp_exit/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/cpuhp/cpuhp_pause/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/ipi/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/irq/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/clk/clk_enable/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/clk/clk_disable/ u:object_r:debugfs_tracing:s0 +genfscon tracefs /events/clk/clk_set_rate/ u:object_r:debugfs_tracing:s0 + +genfscon debugfs /tracing/trace_clock u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/buffer_size_kb u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/options/overwrite u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/options/print-tgid u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/options/record-tgid u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/saved_cmdlines_size u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/sched/sched_switch/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/sched/sched_wakeup/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/sched/sched_wakeup_new/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/sched/sched_waking/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/sched/sched_blocked_reason/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/sched/sched_cpu_hotplug/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/sched/sched_process_exit/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/sched/sched_process_free/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/sched/sched_pi_setprio/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/cgroup/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/power/cpu_frequency/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/power/cpu_idle/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/power/clock_enable/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/power/clock_disable/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/power/clock_set_rate/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/power/cpu_frequency_limits/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/power/gpu_frequency/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/power/suspend_resume/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/cpufreq_interactive/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/vmscan/mm_vmscan_direct_reclaim_begin/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/vmscan/mm_vmscan_direct_reclaim_end/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/vmscan/mm_vmscan_kswapd_wake/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/vmscan/mm_vmscan_kswapd_sleep/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/binder/binder_transaction/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/binder/binder_transaction_received/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/binder/binder_lock/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/binder/binder_locked/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/binder/binder_unlock/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/binder/binder_transaction_alloc_buf/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/binder/binder_set_priority/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/lowmemorykiller/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/sync/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/fence/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/dma_fence/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/filemap/mm_filemap_add_to_page_cache/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/filemap/mm_filemap_delete_from_page_cache/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/kmem/rss_stat/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/kmem/ion_heap_grow/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/kmem/ion_heap_shrink/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/ion/ion_stat/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/mm_event/mm_event_record/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/oom/oom_score_adj_update/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/oom/mark_victim/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/task/task_rename/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/task/task_newtask/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/ftrace/print/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/gpu_mem/gpu_mem_total u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/thermal/thermal_temperature/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/thermal/cdev_update/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/cpuhp/cpuhp_enter/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/cpuhp/cpuhp_exit/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/ipi/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/irq/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/clk/clk_enable/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/clk/clk_disable/ u:object_r:debugfs_tracing:s0 +genfscon debugfs /tracing/events/clk/clk_set_rate/ u:object_r:debugfs_tracing:s0 + +genfscon debugfs /kcov u:object_r:debugfs_kcov:s0 + +genfscon securityfs / u:object_r:securityfs:s0 + +genfscon binder /binder u:object_r:binder_device:s0 +genfscon binder /hwbinder u:object_r:hwbinder_device:s0 +genfscon binder /vndbinder u:object_r:vndbinder_device:s0 +genfscon binder /binder_logs u:object_r:binderfs_logs:s0 +genfscon binder /binder_logs/proc u:object_r:binderfs_logs_proc:s0 + +genfscon inotifyfs / u:object_r:inotify:s0 +genfscon vfat / u:object_r:vfat:s0 +genfscon binder / u:object_r:binderfs:s0 +genfscon exfat / u:object_r:exfat:s0 +genfscon debugfs / u:object_r:debugfs:s0 +genfscon fuse / u:object_r:fuse:s0 +genfscon configfs / u:object_r:configfs:s0 +genfscon sdcardfs / u:object_r:sdcardfs:s0 +genfscon esdfs / u:object_r:sdcardfs:s0 +genfscon pstore / u:object_r:pstorefs:s0 +genfscon functionfs / u:object_r:functionfs:s0 +genfscon usbfs / u:object_r:usbfs:s0 +genfscon binfmt_misc / u:object_r:binfmt_miscfs:s0 +genfscon bpf / u:object_r:fs_bpf:s0 +genfscon bpf /tethering u:object_r:fs_bpf_tethering:s0 diff --git a/microdroid/system/private/halclientdomain.te b/microdroid/system/private/halclientdomain.te new file mode 100644 index 000000000..5f2afb3cd --- /dev/null +++ b/microdroid/system/private/halclientdomain.te @@ -0,0 +1,10 @@ +### +### Rules for all domains which are clients of a HAL +### + +# Find out whether a HAL in passthrough/in-process mode or +# binderized/out-of-process mode +hwbinder_use(halclientdomain) + +# Wait for HAL server to be up (used by getService) +allow halclientdomain hidl_manager_hwservice:hwservice_manager find; diff --git a/microdroid/system/private/hwservice_contexts b/microdroid/system/private/hwservice_contexts new file mode 100644 index 000000000..9b47b066f --- /dev/null +++ b/microdroid/system/private/hwservice_contexts @@ -0,0 +1,7 @@ +android.hardware.keymaster::IKeymasterDevice u:object_r:hal_keymaster_hwservice:s0 +android.hidl.allocator::IAllocator u:object_r:hidl_allocator_hwservice:s0 +android.hidl.base::IBase u:object_r:hidl_base_hwservice:s0 +android.hidl.manager::IServiceManager u:object_r:hidl_manager_hwservice:s0 +android.hidl.memory::IMapper u:object_r:hidl_memory_hwservice:s0 +android.hidl.token::ITokenManager u:object_r:hidl_token_hwservice:s0 +* u:object_r:default_android_hwservice:s0 diff --git a/microdroid/system/private/hwservicemanager.te b/microdroid/system/private/hwservicemanager.te new file mode 100644 index 000000000..17456db0a --- /dev/null +++ b/microdroid/system/private/hwservicemanager.te @@ -0,0 +1,25 @@ +typeattribute hwservicemanager coredomain; + +init_daemon_domain(hwservicemanager) + +allow hwservicemanager vendor_configs_file:file { open getattr }; + +# Note that we do not use the binder_* macros here. +# hwservicemanager provides name service (aka context manager) +# for hwbinder. +# Additionally, it initiates binder IPC calls to +# clients who request service notifications. The permission +# to do this is granted in the hwbinder_use macro. +allow hwservicemanager self:binder set_context_mgr; + +# Scan through /system/lib64/hw looking for installed HALs +allow hwservicemanager system_file:dir r_dir_perms; + +# Read hwservice_contexts +allow hwservicemanager hwservice_contexts_file:file r_file_perms; + +# Check SELinux permissions. +selinux_check_access(hwservicemanager) + +add_hwservice(hwservicemanager, hidl_manager_hwservice) +add_hwservice(hwservicemanager, hidl_token_hwservice) diff --git a/microdroid/system/private/init.te b/microdroid/system/private/init.te new file mode 100644 index 000000000..ff3f6f590 --- /dev/null +++ b/microdroid/system/private/init.te @@ -0,0 +1,446 @@ +typeattribute init coredomain; + +tmpfs_domain(init) + +domain_trans(init, shell_exec, shell) +domain_trans(init, init_exec, ueventd) +domain_trans(init, init_exec, vendor_init) + +# Allow init to figure out name of dm-device from it's /dev/block/dm-XX path. +# This is useful in case of remounting ext4 userdata into checkpointing mode, +# since it potentially requires tearing down dm-devices (e.g. dm-bow, dm-crypto) +# that userdata is mounted onto. +allow init sysfs_dm:file read; + +# Second-stage init performs a test for whether the kernel has SELinux hooks +# for the perf_event_open() syscall. This is done by testing for the syscall +# outcomes corresponding to this policy. +allow init self:perf_event { open cpu }; +allow init self:global_capability2_class_set perfmon; +dontaudit init self:perf_event { kernel tracepoint read write }; + +# Allow init to restore contexts of vd_device(/dev/block/vd[..]) when labeling +# /dev/block. +allow init vd_device:blk_file relabelto; + +# chown/chmod on devices. +allow init { + dev_type + -hw_random_device + -kvm_device +}:chr_file setattr; + +# /dev/__null__ node created by init. +allow init tmpfs:chr_file { create setattr unlink rw_file_perms }; + +# /dev/__properties__ +allow init properties_device:dir relabelto; +allow init properties_serial:file { write relabelto }; +allow init property_type:file { append create getattr map open read relabelto rename setattr unlink write }; +# /dev/__properties__/property_info +allow init properties_device:file create_file_perms; +allow init property_info:file relabelto; +# /dev/event-log-tags +allow init device:file relabelfrom; +allow init runtime_event_log_tags_file:file { open write setattr relabelto create }; +# /dev/socket +allow init { device socket_device dm_user_device }:dir relabelto; +# Relabel /dev nodes created in first stage init, /dev/null, /dev/ptmx, /dev/random, /dev/urandom +allow init { null_device ptmx_device random_device } : chr_file relabelto; +# /dev/device-mapper, /dev/block(/.*)? +allow init tmpfs:{ chr_file blk_file } relabelfrom; +allow init tmpfs:blk_file getattr; +allow init block_device:{ dir blk_file lnk_file } relabelto; +allow init dm_device:{ chr_file blk_file } relabelto; +allow init dm_user_device:chr_file relabelto; +allow init kernel:fd use; +# restorecon for early mount device symlinks +allow init tmpfs:lnk_file { getattr read relabelfrom }; + +# setrlimit +allow init self:global_capability_class_set sys_resource; + +# Remove /dev/.booting and load /debug_ramdisk/* files +allow init tmpfs:file { getattr unlink }; + +# Access pty created for fsck. +allow init devpts:chr_file { read write open }; + +# Access /dev/__null__ node created prior to initial policy load. +allow init tmpfs:chr_file write; + +# Access /dev/console. +allow init console_device:chr_file rw_file_perms; + +# Access /dev/tty0. +allow init tty_device:chr_file rw_file_perms; + +# Call mount(2). +allow init self:global_capability_class_set sys_admin; + +# Call setns(2). +allow init self:global_capability_class_set sys_chroot; + +# Create and mount on directories in /. +allow init rootfs:dir create_dir_perms; +allow init { + rootfs + cgroup + linkerconfig_file + system_data_file + system_data_root_file + system_file + vendor_file +}:dir mounton; + +# Mount bpf fs on sys/fs/bpf +allow init fs_bpf:dir mounton; + +# Mount on /dev/usb-ffs/adb. +allow init device:dir mounton; + +# Mount tmpfs on /apex +allow init apex_mnt_dir:dir mounton; + +# Create and remove symlinks in /. +allow init rootfs:lnk_file { create unlink }; + +# Mount debugfs on /sys/kernel/debug. +allow init sysfs:dir mounton; + +# Create cgroups mount points in tmpfs and mount cgroups on them. +allow init tmpfs:dir create_dir_perms; +allow init tmpfs:dir mounton; +allow init cgroup:dir create_dir_perms; +allow init cgroup:file rw_file_perms; +allow init cgroup_rc_file:file rw_file_perms; +allow init cgroup_desc_file:file r_file_perms; +allow init cgroup_desc_api_file:file r_file_perms; +allow init cgroup_v2:dir { mounton create_dir_perms}; +allow init cgroup_v2:file rw_file_perms; + +# Use tmpfs as /data, used for booting when /data is encrypted +allow init tmpfs:dir relabelfrom; + +# Create directories under /dev/cpuctl after chowning it to system. +allow init self:global_capability_class_set { dac_override dac_read_search }; + +allow init self:global_capability_class_set { sys_rawio mknod }; + +# Mounting filesystems from block devices. +allow init dev_type:blk_file r_file_perms; +allowxperm init dev_type:blk_file ioctl BLKROSET; + +# Mounting filesystems. +# Only allow relabelto for types used in context= mount options, +# which should all be assigned the contextmount_type attribute. +# This can be done in device-specific policy via type or typeattribute +# declarations. +allow init { + fs_type +}:filesystem ~relabelto; + +# Allow init to mount tracefs in /sys/kernel/tracing +allow init debugfs_tracing_debug:filesystem mount; + +allow init unlabeled:filesystem ~relabelto; +allow init contextmount_type:filesystem relabelto; + +# Allow read-only access to context= mounted filesystems. +allow init contextmount_type:dir r_dir_perms; +allow init contextmount_type:notdevfile_class_set r_file_perms; + +# restorecon /adb_keys or any other rootfs files and directories to a more +# specific type. +allow init rootfs:{ dir file } relabelfrom; + +# mkdir, symlink, write, rm/rmdir, chown/chmod, restorecon/restorecon_recursive from init.rc files. +# chown/chmod require open+read+setattr required for open()+fchown/fchmod(). +# system/core/init.rc requires at least cache_file and data_file_type. +# init..rc files often include device-specific types, so +# we just allow all file types except /system files here. +allow init self:global_capability_class_set { chown fowner fsetid }; + +allow init { + file_type + -exec_type + -system_file_type + -vendor_file_type +}:dir { create search getattr open read setattr ioctl }; + +allow init { + file_type + -exec_type + -keystore_data_file + -shell_data_file + -system_file_type + -vendor_file_type +}:dir { write add_name remove_name rmdir relabelfrom }; + +allow init { + file_type + -apex_info_file + -exec_type + -keystore_data_file + -runtime_event_log_tags_file + -shell_data_file + -system_file_type + -vendor_file_type +}:file { create getattr open read write setattr relabelfrom unlink map }; + +allow init tracefs_type:file { create_file_perms relabelfrom }; + +allow init { + file_type + -exec_type + -keystore_data_file + -shell_data_file + -system_file_type + -vendor_file_type +}:{ sock_file fifo_file } { create getattr open read setattr relabelfrom unlink }; + +allow init { + file_type + -apex_mnt_dir + -exec_type + -keystore_data_file + -shell_data_file + -system_file_type + -vendor_file_type +}:lnk_file { create getattr setattr relabelfrom unlink }; + +allow init { + file_type + -system_file_type + -vendor_file_type + -exec_type +}:dir_file_class_set relabelto; + +allow init { sysfs debugfs_tracing debugfs_tracing_debug }:{ dir file lnk_file } { getattr relabelfrom }; +allow init { sysfs_type tracefs_type }:{ dir file lnk_file } { relabelto getattr }; +allow init dev_type:dir create_dir_perms; +allow init dev_type:lnk_file create; + +# chown/chmod on pseudo files. +allow init { + fs_type + -contextmount_type + -proc_type + -fusefs_type + -sysfs_type + -rootfs +}:file { open read setattr }; +allow init { fs_type -contextmount_type -fusefs_type -rootfs }:dir { open read setattr search }; + +allow init { + binder_device + console_device + devpts + dm_device + hwbinder_device + kmsg_device + null_device + owntty_device + ptmx_device + random_device + tty_device + zero_device +}:chr_file { read open }; + +# Any operation that can modify the kernel ring buffer, e.g. clear +# or a read that consumes the messages that were read. +allow init kernel:system syslog_mod; +allow init self:global_capability2_class_set syslog; + +# init access to /proc. +r_dir_file(init, proc_net_type) +allow init proc_filesystems:file r_file_perms; + +allow init { + proc # b/67049235 processes /proc//* files are mislabeled. + proc_bootconfig + proc_cmdline + proc_diskstats + proc_kmsg # Open /proc/kmsg for logd service. + proc_meminfo + proc_stat # Read /proc/stat for bootchart. + proc_uptime + proc_version +}:file r_file_perms; + +allow init { + proc_abi + proc_dirty + proc_hostname + proc_hung_task + proc_extra_free_kbytes + proc_net_type + proc_max_map_count + proc_min_free_order_shift + proc_overcommit_memory # /proc/sys/vm/overcommit_memory + proc_panic + proc_page_cluster + proc_perf + proc_sched + proc_sysrq +}:file w_file_perms; + +allow init { + proc_security +}:file rw_file_perms; + +# init chmod/chown access to /proc files. +allow init { + proc_cmdline + proc_bootconfig + proc_kmsg + proc_net + proc_pagetypeinfo + proc_qtaguid_stat + proc_slabinfo + proc_sysrq + proc_qtaguid_ctrl + proc_vmallocinfo +}:file setattr; + +# init access to /sys files. +allow init { + sysfs_android_usb + sysfs_dm_verity + sysfs_leds + sysfs_power + sysfs_fs_f2fs + sysfs_dm +}:file w_file_perms; + +allow init { + sysfs_dt_firmware_android + sysfs_fs_ext4_features +}:file r_file_perms; + +allow init { + sysfs_zram +}:file rw_file_perms; + +# allow init to create loop devices with /dev/loop-control +allow init loop_control_device:chr_file rw_file_perms; +allow init loop_device:blk_file rw_file_perms; +allowxperm init loop_device:blk_file ioctl { + LOOP_SET_FD + LOOP_CLR_FD + LOOP_CTL_GET_FREE + LOOP_SET_BLOCK_SIZE + LOOP_SET_DIRECT_IO + LOOP_GET_STATUS +}; + +# init chmod/chown access to /sys files. +allow init { + sysfs_android_usb + sysfs_devices_system_cpu + sysfs_ipv4 + sysfs_leds + sysfs_lowmemorykiller + sysfs_power + sysfs_vibrator + sysfs_wake_lock + sysfs_zram +}:file setattr; + +allow init self:global_capability_class_set net_admin; + +# Reboot. +allow init self:global_capability_class_set sys_boot; + +# Support "adb shell stop" +allow init self:global_capability_class_set kill; +allow init domain:process { getpgid sigkill signal }; + +# Init creates keystore's directory on boot, and walks through +# the directory as part of a recursive restorecon. +allow init keystore_data_file:dir { open create read getattr setattr search }; +allow init keystore_data_file:file { getattr }; + +# Init creates /data/local/tmp at boot +allow init shell_data_file:dir { open create read getattr setattr search }; +allow init shell_data_file:file { getattr }; + +# Set UID, GID, and adjust capability bounding set for services. +allow init self:global_capability_class_set { setuid setgid setpcap }; + +# For bootchart to read the /proc/$pid/cmdline file of each process, +# we need to have following line to allow init to have access +# to different domains. +r_dir_file(init, domain) + +# Use setexeccon(), setfscreatecon(), and setsockcreatecon(). +# setexec is for services with seclabel options. +# setfscreate is for labeling directories and socket files. +# setsockcreate is for labeling local/unix domain sockets. +allow init self:process { setexec setfscreate setsockcreate }; + +# Get file context +allow init file_contexts_file:file r_file_perms; + +# sepolicy access +allow init sepolicy_file:file r_file_perms; + +# Perform SELinux access checks on setting properties. +selinux_check_access(init) + +# Ask the kernel for the new context on services to label their sockets. +allow init kernel:security compute_create; + +# Create sockets for the services. +allow init domain:unix_stream_socket { create bind setopt }; +allow init domain:unix_dgram_socket { create bind setopt }; + +# Set any property. +allow init property_type:property_service set; + +# Send an SELinux userspace denial to the kernel audit subsystem, +# so it can be picked up and processed by logd. These denials are +# generated when an attempt to set a property is denied by policy. +allow init self:netlink_audit_socket { create_socket_perms_no_ioctl nlmsg_relay }; +allow init self:global_capability_class_set audit_write; + +# Run "ifup lo" to bring up the localhost interface +allow init self:udp_socket { create ioctl }; +# in addition to unpriv ioctls granted to all domains, init also needs: +allowxperm init self:udp_socket ioctl SIOCSIFFLAGS; +allow init self:global_capability_class_set net_raw; + +# Set scheduling info for psi monitor thread. +# TODO: delete or revise this line b/131761776 +allow init kernel:process { getsched setsched }; + +# Create and access /dev files without a specific type, +# e.g. /dev/.coldboot_done, /dev/.booting +# TODO: Move these files into their own type unless they are +# only ever accessed by init. +allow init device:file create_file_perms; + +# Access device mapper for setting up dm-verity +allow init dm_device:chr_file rw_file_perms; +allow init dm_device:blk_file rw_file_perms; + +# linux keyring configuration +allow init init:key { write search setattr }; + +r_dir_file(init, system_file) +r_dir_file(init, vendor_file_type) + +allow init system_data_file:file { getattr read }; +allow init system_data_file:lnk_file r_file_perms; + +# Allow init to touch PSI monitors +allow init proc_pressure_mem:file { rw_file_perms setattr }; + +# init is using bootstrap bionic +allow init system_bootstrap_lib_file:dir r_dir_perms; +allow init system_bootstrap_lib_file:file { execute read open getattr map }; + +# stat the root dir of fuse filesystems (for the mount handler) +allow init fuse:dir { search getattr }; + +set_prop(init, property_type) diff --git a/microdroid/system/private/initial_sid_contexts b/microdroid/system/private/initial_sid_contexts new file mode 100644 index 000000000..98190510f --- /dev/null +++ b/microdroid/system/private/initial_sid_contexts @@ -0,0 +1,27 @@ +sid kernel u:r:kernel:s0 +sid security u:object_r:kernel:s0 +sid unlabeled u:object_r:unlabeled:s0 +sid fs u:object_r:labeledfs:s0 +sid file u:object_r:unlabeled:s0 +sid file_labels u:object_r:unlabeled:s0 +sid init u:object_r:unlabeled:s0 +sid any_socket u:object_r:unlabeled:s0 +sid port u:object_r:port:s0 +sid netif u:object_r:netif:s0 +sid netmsg u:object_r:unlabeled:s0 +sid node u:object_r:node:s0 +sid igmp_packet u:object_r:unlabeled:s0 +sid icmp_socket u:object_r:unlabeled:s0 +sid tcp_socket u:object_r:unlabeled:s0 +sid sysctl_modprobe u:object_r:unlabeled:s0 +sid sysctl u:object_r:proc:s0 +sid sysctl_fs u:object_r:unlabeled:s0 +sid sysctl_kernel u:object_r:unlabeled:s0 +sid sysctl_net u:object_r:unlabeled:s0 +sid sysctl_net_unix u:object_r:unlabeled:s0 +sid sysctl_vm u:object_r:unlabeled:s0 +sid sysctl_dev u:object_r:unlabeled:s0 +sid kmod u:object_r:unlabeled:s0 +sid policy u:object_r:unlabeled:s0 +sid scmp_packet u:object_r:unlabeled:s0 +sid devnull u:object_r:null_device:s0 diff --git a/microdroid/system/private/initial_sids b/microdroid/system/private/initial_sids new file mode 100644 index 000000000..91ac816ba --- /dev/null +++ b/microdroid/system/private/initial_sids @@ -0,0 +1,35 @@ +# FLASK + +# +# Define initial security identifiers +# + +sid kernel +sid security +sid unlabeled +sid fs +sid file +sid file_labels +sid init +sid any_socket +sid port +sid netif +sid netmsg +sid node +sid igmp_packet +sid icmp_socket +sid tcp_socket +sid sysctl_modprobe +sid sysctl +sid sysctl_fs +sid sysctl_kernel +sid sysctl_net +sid sysctl_net_unix +sid sysctl_vm +sid sysctl_dev +sid kmod +sid policy +sid scmp_packet +sid devnull + +# FLASK diff --git a/microdroid/system/private/kernel.te b/microdroid/system/private/kernel.te new file mode 100644 index 000000000..1d03c4a34 --- /dev/null +++ b/microdroid/system/private/kernel.te @@ -0,0 +1,83 @@ +typeattribute kernel coredomain; + +domain_auto_trans(kernel, init_exec, init) + +# The following sections are for the transition period during a Virtual A/B +# OTA. Once sepolicy is loaded, snapuserd must be re-launched in the correct +# context, and with properly labelled devices. This must be done before +# enabling enforcement, eg, in permissive mode while still in the kernel +# context. +allow kernel tmpfs:blk_file { getattr relabelfrom }; +allow kernel tmpfs:chr_file { getattr relabelfrom }; +allow kernel tmpfs:lnk_file { getattr relabelfrom }; +allow kernel tmpfs:dir { open read relabelfrom }; + +allow kernel block_device:blk_file relabelto; +allow kernel block_device:lnk_file relabelto; +allow kernel dm_device:chr_file relabelto; +allow kernel dm_device:blk_file relabelto; +allow kernel dm_user_device:dir { read open search relabelto }; +allow kernel dm_user_device:chr_file relabelto; +allow kernel kmsg_device:chr_file relabelto; +allow kernel null_device:chr_file relabelto; +allow kernel random_device:chr_file relabelto; +allow kernel kmsg_device:chr_file write; +allow kernel vd_device:blk_file read; + +allow kernel self:global_capability_class_set sys_nice; + +# Root fs. +r_dir_file(kernel, rootfs) + +# Used to read androidboot.selinux property +allow kernel { + proc_bootconfig + proc_cmdline +}:file r_file_perms; + +# Get SELinux enforcing status. +allow kernel selinuxfs:dir r_dir_perms; +allow kernel selinuxfs:file r_file_perms; + +# Get file contexts during first stage +allow kernel file_contexts_file:file r_file_perms; + +# Allow init relabel itself. +allow kernel rootfs:file relabelfrom; +allow kernel init_exec:file relabelto; +# TODO: investigate why we need this. +allow kernel init:process share; + +# cgroup filesystem initialization prior to setting the cgroup root directory label. +allow kernel unlabeled:dir search; + +# Initial setenforce by init prior to switching to init domain. +# We use dontaudit instead of allow to prevent a kernel spawned userspace +# process from turning off SELinux once enabled. +dontaudit kernel self:security setenforce; + +# Init reboot before switching selinux domains under certain error +# conditions. Allow it. +# As part of rebooting, init writes "u" to /proc/sysrq-trigger to +# remount filesystems read-only. /data is not mounted at this point, +# so we could ignore this. For now, we allow it. +allow kernel self:global_capability_class_set sys_boot; +allow kernel proc_sysrq:file w_file_perms; + +# Allow writing to /dev/kmsg which was created prior to loading policy. +allow kernel tmpfs:chr_file write; + +# Set checkreqprot by init.rc prior to switching to init domain. +allow kernel selinuxfs:file write; +allow kernel self:security setcheckreqprot; + +# kernel thread "loop0", used by the loop block device, for ASECs (b/17158723) +allow kernel { sdcard_type fuse }:file { read write }; + +# Allow the kernel to read APEX file descriptors and (staged) data files; +# Needed because APEX uses the loopback driver, which issues requests from +# a kernel thread in earlier kernel version. +allow kernel apexd:fd use; + +#----------------------------------------- +allow kernel apkdmverity:fd use; diff --git a/microdroid/system/private/keys.conf b/microdroid/system/private/keys.conf new file mode 100644 index 000000000..362e73df7 --- /dev/null +++ b/microdroid/system/private/keys.conf @@ -0,0 +1,28 @@ +# +# Maps an arbitrary tag [TAGNAME] with the string contents found in +# TARGET_BUILD_VARIANT. Common convention is to start TAGNAME with an @ and +# name it after the base file name of the pem file. +# +# Each tag (section) then allows one to specify any string found in +# TARGET_BUILD_VARIANT. Typcially this is user, eng, and userdebug. Another +# option is to use ALL which will match ANY TARGET_BUILD_VARIANT string. +# + +[@PLATFORM] +ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/platform.x509.pem + +[@MEDIA] +ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/media.x509.pem + +[@NETWORK_STACK] +ALL : $MAINLINE_SEPOLICY_DEV_CERTIFICATES/networkstack.x509.pem + +[@SHARED] +ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/shared.x509.pem + +# Example of ALL TARGET_BUILD_VARIANTS +[@RELEASE] +ENG : $DEFAULT_SYSTEM_DEV_CERTIFICATE/testkey.x509.pem +USER : $DEFAULT_SYSTEM_DEV_CERTIFICATE/testkey.x509.pem +USERDEBUG : $DEFAULT_SYSTEM_DEV_CERTIFICATE/testkey.x509.pem + diff --git a/microdroid/system/private/keystore.te b/microdroid/system/private/keystore.te new file mode 100644 index 000000000..ac3ada184 --- /dev/null +++ b/microdroid/system/private/keystore.te @@ -0,0 +1,15 @@ +typeattribute keystore coredomain; + +init_daemon_domain(keystore) + +# talk to keymint +hal_client_domain(keystore, hal_keymint) + +# Allow keystore to write to statsd. +unix_socket_send(keystore, statsdw, statsd) + +# Keystore need access to the keystore_key context files to load the keystore key backend. +allow keystore keystore2_key_contexts_file:file r_file_perms; + +# microdroid doesn't use keymaster HAL +dontaudit keystore hal_keymaster_hwservice:hwservice_manager find; diff --git a/microdroid/system/private/keystore2_key_contexts b/microdroid/system/private/keystore2_key_contexts new file mode 100644 index 000000000..02cdd5e6c --- /dev/null +++ b/microdroid/system/private/keystore2_key_contexts @@ -0,0 +1,11 @@ +# Keystore 2.0 key contexts. +# This file defines Keystore 2.0 namespaces and maps them to labels. +# Format: +#