Add new untrusted_v2_app domain
untrusted_v2_app is basically a refinement of untrusted_app with legacy capabilities removed and potentially backwards incompatible changes. This is not currently hooked up to anything. Bug: 33350220 Test: builds Change-Id: Ic9fad57476bc2b6022b1eaca8667bf6d844753c2
This commit is contained in:
Chad Brubaker
parent
eebb73b517
commit
a782a81627
6 changed files with 84 additions and 38 deletions
|
|
@ -86,9 +86,9 @@ allow appdomain oemfs:dir r_dir_perms;
|
|||
allow appdomain oemfs:file rx_file_perms;
|
||||
|
||||
# Execute the shell or other system executables.
|
||||
allow appdomain shell_exec:file rx_file_perms;
|
||||
allow appdomain system_file:file rx_file_perms;
|
||||
allow appdomain toolbox_exec:file rx_file_perms;
|
||||
allow { appdomain -ephemeral_app -untrusted_v2_app } shell_exec:file rx_file_perms;
|
||||
allow { appdomain -ephemeral_app -untrusted_v2_app } system_file:file rx_file_perms;
|
||||
allow { appdomain -ephemeral_app -untrusted_v2_app } toolbox_exec:file rx_file_perms;
|
||||
|
||||
# Renderscript needs the ability to read directories on /system
|
||||
r_dir_file(appdomain, system_file)
|
||||
|
|
@ -232,7 +232,7 @@ allow appdomain resourcecache_data_file:dir r_dir_perms;
|
|||
|
||||
# logd access
|
||||
read_logd(appdomain)
|
||||
control_logd(appdomain)
|
||||
control_logd({ appdomain -ephemeral_app untrusted_v2_app })
|
||||
# application inherit logd write socket (urge is to deprecate this long term)
|
||||
allow appdomain zygote:unix_dgram_socket write;
|
||||
|
||||
|
|
|
|||
|
|
@ -5,30 +5,27 @@
|
|||
# Only allow domains in AOSP to use the untrusted_app_all attribute.
|
||||
neverallow { untrusted_app_all -untrusted_app -untrusted_app_25 } domain:process fork;
|
||||
|
||||
define(`all_untrusted_apps',`{ untrusted_app_all untrusted_app_25 untrusted_app ephemeral_app isolated_app }')
|
||||
# Receive or send uevent messages.
|
||||
neverallow { untrusted_app_all ephemeral_app isolated_app } domain:netlink_kobject_uevent_socket *;
|
||||
neverallow all_untrusted_apps domain:netlink_kobject_uevent_socket *;
|
||||
|
||||
# Receive or send generic netlink messages
|
||||
neverallow { untrusted_app_all ephemeral_app isolated_app } domain:netlink_socket *;
|
||||
neverallow all_untrusted_apps domain:netlink_socket *;
|
||||
|
||||
# Too much leaky information in debugfs. It's a security
|
||||
# best practice to ensure these files aren't readable.
|
||||
neverallow { untrusted_app_all ephemeral_app isolated_app } debugfs_type:file read;
|
||||
neverallow all_untrusted_apps debugfs_type:file read;
|
||||
|
||||
# Do not allow untrusted apps to register services.
|
||||
# Only trusted components of Android should be registering
|
||||
# services.
|
||||
neverallow { untrusted_app_all ephemeral_app isolated_app } service_manager_type:service_manager add;
|
||||
neverallow all_untrusted_apps service_manager_type:service_manager add;
|
||||
|
||||
# Do not allow untrusted apps to connect to the property service
|
||||
# or set properties. b/10243159
|
||||
neverallow { untrusted_app_all ephemeral_app isolated_app } property_socket:sock_file write;
|
||||
neverallow { untrusted_app_all ephemeral_app isolated_app } init:unix_stream_socket connectto;
|
||||
neverallow { untrusted_app_all ephemeral_app isolated_app } property_type:property_service set;
|
||||
|
||||
# b/34115651 - net.dns* properties read
|
||||
# This will go away in a future Android release
|
||||
neverallow { appdomain -untrusted_app_25 } net_dns_prop:file r_file_perms;
|
||||
neverallow all_untrusted_apps property_socket:sock_file write;
|
||||
neverallow all_untrusted_apps init:unix_stream_socket connectto;
|
||||
neverallow all_untrusted_apps property_type:property_service set;
|
||||
|
||||
# Do not allow untrusted apps to be assigned mlstrustedsubject.
|
||||
# This would undermine the per-user isolation model being
|
||||
|
|
@ -38,7 +35,7 @@ neverallow { appdomain -untrusted_app_25 } net_dns_prop:file r_file_perms;
|
|||
# permission only makes sense within a domain (hence should
|
||||
# never be granted to any other domain within mlstrustedsubject)
|
||||
# and an untrusted app is allowed fork permission to itself.
|
||||
neverallow { untrusted_app_all ephemeral_app isolated_app } mlstrustedsubject:process fork;
|
||||
neverallow all_untrusted_apps mlstrustedsubject:process fork;
|
||||
|
||||
# Do not allow untrusted apps to hard link to any files.
|
||||
# In particular, if an untrusted app links to other app data
|
||||
|
|
@ -46,16 +43,16 @@ neverallow { untrusted_app_all ephemeral_app isolated_app } mlstrustedsubject:pr
|
|||
# of the linked to file. Hard links also contribute to security
|
||||
# bugs, so we want to ensure untrusted apps never have this
|
||||
# capability.
|
||||
neverallow { untrusted_app_all ephemeral_app isolated_app } file_type:file link;
|
||||
neverallow all_untrusted_apps file_type:file link;
|
||||
|
||||
# Do not allow untrusted apps to access network MAC address file
|
||||
neverallow { untrusted_app_all ephemeral_app isolated_app } sysfs_mac_address:file no_rw_file_perms;
|
||||
neverallow all_untrusted_apps sysfs_mac_address:file no_rw_file_perms;
|
||||
|
||||
# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the
|
||||
# ioctl permission, or 3. disallow the socket class.
|
||||
neverallowxperm { untrusted_app_all ephemeral_app isolated_app } domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
|
||||
neverallow { untrusted_app_all ephemeral_app isolated_app } *:{ netlink_route_socket netlink_selinux_socket } ioctl;
|
||||
neverallow { untrusted_app_all ephemeral_app isolated_app } *:{
|
||||
neverallowxperm all_untrusted_apps domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
|
||||
neverallow all_untrusted_apps *:{ netlink_route_socket netlink_selinux_socket } ioctl;
|
||||
neverallow all_untrusted_apps *:{
|
||||
socket netlink_socket packet_socket key_socket appletalk_socket
|
||||
netlink_tcpdiag_socket netlink_nflog_socket
|
||||
netlink_xfrm_socket netlink_audit_socket
|
||||
|
|
@ -66,15 +63,15 @@ neverallow { untrusted_app_all ephemeral_app isolated_app } *:{
|
|||
} *;
|
||||
|
||||
# Do not allow untrusted apps access to /cache
|
||||
neverallow { untrusted_app_all ephemeral_app isolated_app } { cache_file cache_recovery_file }:dir ~{ r_dir_perms };
|
||||
neverallow { untrusted_app_all ephemeral_app isolated_app } { cache_file cache_recovery_file }:file ~{ read getattr };
|
||||
neverallow all_untrusted_apps { cache_file cache_recovery_file }:dir ~{ r_dir_perms };
|
||||
neverallow all_untrusted_apps { cache_file cache_recovery_file }:file ~{ read getattr };
|
||||
|
||||
# Do not allow untrusted apps to create/unlink files outside of its sandbox,
|
||||
# internal storage or sdcard.
|
||||
# World accessible data locations allow application to fill the device
|
||||
# with unaccounted for data. This data will not get removed during
|
||||
# application un-installation.
|
||||
neverallow { untrusted_app_all ephemeral_app isolated_app } {
|
||||
neverallow all_untrusted_apps {
|
||||
fs_type
|
||||
-fuse # sdcard
|
||||
-sdcardfs # sdcard
|
||||
|
|
@ -92,12 +89,12 @@ neverallow { untrusted_app_all ephemeral_app isolated_app } {
|
|||
}:dir_file_class_set { create unlink };
|
||||
|
||||
# Do not allow untrusted apps to directly open tun_device
|
||||
neverallow { untrusted_app_all ephemeral_app isolated_app } tun_device:chr_file open;
|
||||
neverallow all_untrusted_apps tun_device:chr_file open;
|
||||
|
||||
# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553)
|
||||
neverallow { untrusted_app_all ephemeral_app isolated_app } anr_data_file:file ~{ open append };
|
||||
neverallow { untrusted_app_all ephemeral_app isolated_app } anr_data_file:dir ~search;
|
||||
neverallow all_untrusted_apps anr_data_file:file ~{ open append };
|
||||
neverallow all_untrusted_apps anr_data_file:dir ~search;
|
||||
|
||||
# Avoid reads from generically labeled /proc files
|
||||
# Create a more specific label if needed
|
||||
neverallow { untrusted_app_all ephemeral_app isolated_app } proc:file { no_rw_file_perms no_x_file_perms };
|
||||
neverallow all_untrusted_apps proc:file { no_rw_file_perms no_x_file_perms };
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
# Input selectors:
|
||||
# isSystemServer (boolean)
|
||||
# isEphemeralApp (boolean)
|
||||
# isV2App (boolean)
|
||||
# isOwner (boolean)
|
||||
# user (string)
|
||||
# seinfo (string)
|
||||
|
|
@ -11,6 +12,7 @@
|
|||
# isSystemServer=true can only be used once.
|
||||
# An unspecified isSystemServer defaults to false.
|
||||
# isEphemeralApp=true will match apps marked by PackageManager as Ephemeral
|
||||
# isV2App=true will match apps in the v2 app sandbox.
|
||||
# isOwner=true will only match for the owner/primary user.
|
||||
# isOwner=false will only match for secondary users.
|
||||
# If unspecified, the entry can match either case.
|
||||
|
|
@ -29,16 +31,17 @@
|
|||
# Precedence rules (see external/selinux/libselinux/src/android/android.c seapp_context_cmp()):
|
||||
# (1) isSystemServer=true before isSystemServer=false.
|
||||
# (2) Specified isEphemeralApp= before unspecified isEphemeralApp= boolean.
|
||||
# (3) Specified isOwner= before unspecified isOwner= boolean.
|
||||
# (4) Specified user= string before unspecified user= string.
|
||||
# (5) Fixed user= string before user= prefix (i.e. ending in *).
|
||||
# (6) Longer user= prefix before shorter user= prefix.
|
||||
# (7) Specified seinfo= string before unspecified seinfo= string.
|
||||
# (3) Specified isV2App= before unspecified isV2App= boolean.
|
||||
# (4) Specified isOwner= before unspecified isOwner= boolean.
|
||||
# (5) Specified user= string before unspecified user= string.
|
||||
# (6) Fixed user= string before user= prefix (i.e. ending in *).
|
||||
# (7) Longer user= prefix before shorter user= prefix.
|
||||
# (8) Specified seinfo= string before unspecified seinfo= string.
|
||||
# ':' character is reserved and may not be used.
|
||||
# (8) Specified name= string before unspecified name= string.
|
||||
# (9) Specified path= string before unspecified path= string.
|
||||
# (10) Specified isPrivApp= before unspecified isPrivApp= boolean.
|
||||
# (11) Higher value of minTargetSdkVersion= before lower value of minTargetSdkVersion=
|
||||
# (9) Specified name= string before unspecified name= string.
|
||||
# (10) Specified path= string before unspecified path= string.
|
||||
# (11) Specified isPrivApp= before unspecified isPrivApp= boolean.
|
||||
# (12) Higher value of minTargetSdkVersion= before lower value of minTargetSdkVersion=
|
||||
# integer. Note that minTargetSdkVersion= defaults to 0 if unspecified.
|
||||
#
|
||||
# Outputs:
|
||||
|
|
@ -100,7 +103,8 @@ user=shared_relro domain=shared_relro
|
|||
user=shell seinfo=platform domain=shell type=shell_data_file
|
||||
user=_isolated domain=isolated_app levelFrom=user
|
||||
user=_app seinfo=platform domain=platform_app type=app_data_file levelFrom=user
|
||||
user=_app isEphemeralApp=true domain=ephemeral_app type=app_data_file levelFrom=all
|
||||
user=_app isV2App=true isEphemeralApp=true domain=ephemeral_app type=app_data_file levelFrom=all
|
||||
user=_app isV2App=true domain=untrusted_v2_app type=app_data_file levelFrom=all
|
||||
user=_app isPrivApp=true domain=priv_app type=app_data_file levelFrom=user
|
||||
user=_app minTargetSdkVersion=26 domain=untrusted_app type=app_data_file levelFrom=user
|
||||
user=_app domain=untrusted_app_25 type=app_data_file levelFrom=user
|
||||
|
|
|
|||
39
private/untrusted_v2_app.te
Normal file
39
private/untrusted_v2_app.te
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
###
|
||||
### Untrusted v2 sandbox apps.
|
||||
###
|
||||
app_domain(untrusted_v2_app)
|
||||
net_domain(untrusted_v2_app)
|
||||
bluetooth_domain(untrusted_v2_app)
|
||||
|
||||
# Read and write system app data files passed over Binder.
|
||||
# Motivating case was /data/data/com.android.settings/cache/*.jpg for
|
||||
# cropping or taking user photos.
|
||||
allow untrusted_v2_app system_app_data_file:file { read write getattr };
|
||||
|
||||
# Access to /data/media.
|
||||
allow untrusted_v2_app media_rw_data_file:dir create_dir_perms;
|
||||
allow untrusted_v2_app media_rw_data_file:file create_file_perms;
|
||||
|
||||
# Traverse into /mnt/media_rw for bypassing FUSE daemon
|
||||
# TODO: narrow this to just MediaProvider
|
||||
allow untrusted_v2_app mnt_media_rw_file:dir search;
|
||||
|
||||
# allow cts to query all services
|
||||
allow untrusted_v2_app servicemanager:service_manager list;
|
||||
|
||||
allow untrusted_v2_app audioserver_service:service_manager find;
|
||||
allow untrusted_v2_app cameraserver_service:service_manager find;
|
||||
allow untrusted_v2_app drmserver_service:service_manager find;
|
||||
allow untrusted_v2_app mediaserver_service:service_manager find;
|
||||
allow untrusted_v2_app mediaextractor_service:service_manager find;
|
||||
allow untrusted_v2_app mediacodec_service:service_manager find;
|
||||
allow untrusted_v2_app mediametrics_service:service_manager find;
|
||||
allow untrusted_v2_app mediadrmserver_service:service_manager find;
|
||||
allow untrusted_v2_app nfc_service:service_manager find;
|
||||
allow untrusted_v2_app radio_service:service_manager find;
|
||||
allow untrusted_v2_app surfaceflinger_service:service_manager find;
|
||||
# TODO: potentially provide a tighter list of services here
|
||||
allow untrusted_v2_app app_api_service:service_manager find;
|
||||
|
||||
# gdbserver for ndk-gdb ptrace attaches to app process.
|
||||
allow untrusted_v2_app self:process ptrace;
|
||||
5
public/untrusted_v2_app.te
Normal file
5
public/untrusted_v2_app.te
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
###
|
||||
### Untrusted v2 sandbox apps.
|
||||
###
|
||||
|
||||
type untrusted_v2_app, domain;
|
||||
|
|
@ -204,6 +204,7 @@ key_map rules[] = {
|
|||
/*Inputs*/
|
||||
{ .name = "isSystemServer", .dir = dir_in, .fn_validate = validate_bool },
|
||||
{ .name = "isEphemeralApp", .dir = dir_in, .fn_validate = validate_bool },
|
||||
{ .name = "isV2App", .dir = dir_in, .fn_validate = validate_bool },
|
||||
{ .name = "isOwner", .dir = dir_in, .fn_validate = validate_bool },
|
||||
{ .name = "user", .dir = dir_in, },
|
||||
{ .name = "seinfo", .dir = dir_in, },
|
||||
|
|
|
|||
Loading…
Reference in a new issue