Remove 28.0 compat support
Treble doesn't support U system + P vendor, so removing P (28.0) prebuilts and compat files. Bug: 267692547 Test: build Change-Id: I3734a3d331ba8071d00cc196a2545773ae6a7a60
This commit is contained in:
Inseob Kim
parent
ccbe862858
commit
d16612cd8a
347 changed files with 72 additions and 31599 deletions
|
|
@ -23,13 +23,6 @@ package {
|
|||
default_applicable_licenses: ["system_sepolicy_license"],
|
||||
}
|
||||
|
||||
se_build_files {
|
||||
name: "28.0.board.compat.map",
|
||||
srcs: [
|
||||
"compat/28.0/28.0.cil",
|
||||
],
|
||||
}
|
||||
|
||||
se_build_files {
|
||||
name: "29.0.board.compat.map",
|
||||
srcs: [
|
||||
|
|
@ -65,13 +58,6 @@ se_build_files {
|
|||
],
|
||||
}
|
||||
|
||||
se_build_files {
|
||||
name: "28.0.board.compat.cil",
|
||||
srcs: [
|
||||
"compat/28.0/28.0.compat.cil",
|
||||
],
|
||||
}
|
||||
|
||||
se_build_files {
|
||||
name: "29.0.board.compat.cil",
|
||||
srcs: [
|
||||
|
|
@ -107,13 +93,6 @@ se_build_files {
|
|||
],
|
||||
}
|
||||
|
||||
se_build_files {
|
||||
name: "28.0.board.ignore.map",
|
||||
srcs: [
|
||||
"compat/28.0/28.0.ignore.cil",
|
||||
],
|
||||
}
|
||||
|
||||
se_build_files {
|
||||
name: "29.0.board.ignore.map",
|
||||
srcs: [
|
||||
|
|
@ -149,13 +128,6 @@ se_build_files {
|
|||
],
|
||||
}
|
||||
|
||||
se_cil_compat_map {
|
||||
name: "plat_28.0.cil",
|
||||
stem: "28.0.cil",
|
||||
bottom_half: [":28.0.board.compat.map{.plat_private}"],
|
||||
top_half: "plat_29.0.cil",
|
||||
}
|
||||
|
||||
se_cil_compat_map {
|
||||
name: "plat_29.0.cil",
|
||||
stem: "29.0.cil",
|
||||
|
|
@ -188,14 +160,7 @@ se_cil_compat_map {
|
|||
name: "plat_33.0.cil",
|
||||
stem: "33.0.cil",
|
||||
bottom_half: [":33.0.board.compat.map{.plat_private}"],
|
||||
}
|
||||
|
||||
se_cil_compat_map {
|
||||
name: "system_ext_28.0.cil",
|
||||
stem: "28.0.cil",
|
||||
bottom_half: [":28.0.board.compat.map{.system_ext_private}"],
|
||||
top_half: "system_ext_29.0.cil",
|
||||
system_ext_specific: true,
|
||||
top_half: "plat_34.0.cil",
|
||||
}
|
||||
|
||||
se_cil_compat_map {
|
||||
|
|
@ -235,14 +200,7 @@ se_cil_compat_map {
|
|||
stem: "33.0.cil",
|
||||
bottom_half: [":33.0.board.compat.map{.system_ext_private}"],
|
||||
system_ext_specific: true,
|
||||
}
|
||||
|
||||
se_cil_compat_map {
|
||||
name: "product_28.0.cil",
|
||||
stem: "28.0.cil",
|
||||
bottom_half: [":28.0.board.compat.map{.product_private}"],
|
||||
top_half: "product_29.0.cil",
|
||||
product_specific: true,
|
||||
top_half: "system_ext_34.0.cil",
|
||||
}
|
||||
|
||||
se_cil_compat_map {
|
||||
|
|
@ -282,12 +240,7 @@ se_cil_compat_map {
|
|||
stem: "33.0.cil",
|
||||
bottom_half: [":33.0.board.compat.map{.product_private}"],
|
||||
product_specific: true,
|
||||
}
|
||||
|
||||
se_cil_compat_map {
|
||||
name: "28.0.ignore.cil",
|
||||
bottom_half: [":28.0.board.ignore.map{.plat_private}"],
|
||||
top_half: "29.0.ignore.cil",
|
||||
top_half: "product_34.0.cil",
|
||||
}
|
||||
|
||||
se_cil_compat_map {
|
||||
|
|
@ -317,6 +270,7 @@ se_cil_compat_map {
|
|||
se_cil_compat_map {
|
||||
name: "33.0.ignore.cil",
|
||||
bottom_half: [":33.0.board.ignore.map{.plat_private}"],
|
||||
top_half: "34.0.ignore.cil",
|
||||
}
|
||||
|
||||
se_cil_compat_map {
|
||||
|
|
@ -344,6 +298,7 @@ se_cil_compat_map {
|
|||
name: "system_ext_33.0.ignore.cil",
|
||||
bottom_half: [":33.0.board.ignore.map{.system_ext_private}"],
|
||||
system_ext_specific: true,
|
||||
top_half: "system_ext_34.0.ignore.cil",
|
||||
}
|
||||
|
||||
se_cil_compat_map {
|
||||
|
|
@ -371,11 +326,7 @@ se_cil_compat_map {
|
|||
name: "product_33.0.ignore.cil",
|
||||
bottom_half: [":33.0.board.ignore.map{.product_private}"],
|
||||
product_specific: true,
|
||||
}
|
||||
|
||||
se_compat_cil {
|
||||
name: "28.0.compat.cil",
|
||||
srcs: [":28.0.board.compat.cil{.plat_private}"],
|
||||
top_half: "product_34.0.ignore.cil",
|
||||
}
|
||||
|
||||
se_compat_cil {
|
||||
|
|
@ -403,13 +354,6 @@ se_compat_cil {
|
|||
srcs: [":33.0.board.compat.cil{.plat_private}"],
|
||||
}
|
||||
|
||||
se_compat_cil {
|
||||
name: "system_ext_28.0.compat.cil",
|
||||
srcs: [":28.0.board.compat.cil{.system_ext_private}"],
|
||||
stem: "28.0.compat.cil",
|
||||
system_ext_specific: true,
|
||||
}
|
||||
|
||||
se_compat_cil {
|
||||
name: "system_ext_29.0.compat.cil",
|
||||
srcs: [":29.0.board.compat.cil{.system_ext_private}"],
|
||||
|
|
@ -448,3 +392,69 @@ se_compat_cil {
|
|||
se_compat_test {
|
||||
name: "sepolicy_compat_test",
|
||||
}
|
||||
|
||||
se_build_files {
|
||||
name: "34.0.board.compat.map",
|
||||
srcs: ["compat/34.0/34.0.cil"],
|
||||
}
|
||||
|
||||
se_build_files {
|
||||
name: "34.0.board.compat.cil",
|
||||
srcs: ["compat/34.0/34.0.compat.cil"],
|
||||
}
|
||||
|
||||
se_build_files {
|
||||
name: "34.0.board.ignore.map",
|
||||
srcs: ["compat/34.0/34.0.ignore.cil"],
|
||||
}
|
||||
|
||||
se_cil_compat_map {
|
||||
name: "plat_34.0.cil",
|
||||
stem: "34.0.cil",
|
||||
bottom_half: [":34.0.board.compat.map{.plat_private}"],
|
||||
}
|
||||
|
||||
se_cil_compat_map {
|
||||
name: "system_ext_34.0.cil",
|
||||
stem: "34.0.cil",
|
||||
bottom_half: [":34.0.board.compat.map{.system_ext_private}"],
|
||||
system_ext_specific: true,
|
||||
}
|
||||
|
||||
se_cil_compat_map {
|
||||
name: "product_34.0.cil",
|
||||
stem: "34.0.cil",
|
||||
bottom_half: [":34.0.board.compat.map{.product_private}"],
|
||||
product_specific: true,
|
||||
}
|
||||
|
||||
se_cil_compat_map {
|
||||
name: "34.0.ignore.cil",
|
||||
bottom_half: [":34.0.board.ignore.map{.plat_private}"],
|
||||
}
|
||||
|
||||
se_cil_compat_map {
|
||||
name: "system_ext_34.0.ignore.cil",
|
||||
stem: "34.0.ignore.cil",
|
||||
bottom_half: [":34.0.board.ignore.map{.system_ext_private}"],
|
||||
system_ext_specific: true,
|
||||
}
|
||||
|
||||
se_cil_compat_map {
|
||||
name: "product_34.0.ignore.cil",
|
||||
stem: "34.0.ignore.cil",
|
||||
bottom_half: [":34.0.board.ignore.map{.product_private}"],
|
||||
product_specific: true,
|
||||
}
|
||||
|
||||
se_compat_cil {
|
||||
name: "34.0.compat.cil",
|
||||
srcs: [":34.0.board.compat.cil{.plat_private}"],
|
||||
}
|
||||
|
||||
se_compat_cil {
|
||||
name: "system_ext_34.0.compat.cil",
|
||||
stem: "34.0.compat.cil",
|
||||
srcs: [":34.0.board.compat.cil{.system_ext_private}"],
|
||||
system_ext_specific: true,
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,726 +0,0 @@
|
|||
#
|
||||
# Define common prefixes for access vectors
|
||||
#
|
||||
# common common_name { permission_name ... }
|
||||
|
||||
|
||||
#
|
||||
# Define a common prefix for file access vectors.
|
||||
#
|
||||
|
||||
common file
|
||||
{
|
||||
ioctl
|
||||
read
|
||||
write
|
||||
create
|
||||
getattr
|
||||
setattr
|
||||
lock
|
||||
relabelfrom
|
||||
relabelto
|
||||
append
|
||||
map
|
||||
unlink
|
||||
link
|
||||
rename
|
||||
execute
|
||||
quotaon
|
||||
mounton
|
||||
}
|
||||
|
||||
|
||||
#
|
||||
# Define a common prefix for socket access vectors.
|
||||
#
|
||||
|
||||
common socket
|
||||
{
|
||||
# inherited from file
|
||||
ioctl
|
||||
read
|
||||
write
|
||||
create
|
||||
getattr
|
||||
setattr
|
||||
lock
|
||||
relabelfrom
|
||||
relabelto
|
||||
append
|
||||
map
|
||||
# socket-specific
|
||||
bind
|
||||
connect
|
||||
listen
|
||||
accept
|
||||
getopt
|
||||
setopt
|
||||
shutdown
|
||||
recvfrom
|
||||
sendto
|
||||
name_bind
|
||||
}
|
||||
|
||||
#
|
||||
# Define a common prefix for ipc access vectors.
|
||||
#
|
||||
|
||||
common ipc
|
||||
{
|
||||
create
|
||||
destroy
|
||||
getattr
|
||||
setattr
|
||||
read
|
||||
write
|
||||
associate
|
||||
unix_read
|
||||
unix_write
|
||||
}
|
||||
|
||||
#
|
||||
# Define a common for capability access vectors.
|
||||
#
|
||||
common cap
|
||||
{
|
||||
# The capabilities are defined in include/linux/capability.h
|
||||
# Capabilities >= 32 are defined in the cap2 common.
|
||||
# Care should be taken to ensure that these are consistent with
|
||||
# those definitions. (Order matters)
|
||||
|
||||
chown
|
||||
dac_override
|
||||
dac_read_search
|
||||
fowner
|
||||
fsetid
|
||||
kill
|
||||
setgid
|
||||
setuid
|
||||
setpcap
|
||||
linux_immutable
|
||||
net_bind_service
|
||||
net_broadcast
|
||||
net_admin
|
||||
net_raw
|
||||
ipc_lock
|
||||
ipc_owner
|
||||
sys_module
|
||||
sys_rawio
|
||||
sys_chroot
|
||||
sys_ptrace
|
||||
sys_pacct
|
||||
sys_admin
|
||||
sys_boot
|
||||
sys_nice
|
||||
sys_resource
|
||||
sys_time
|
||||
sys_tty_config
|
||||
mknod
|
||||
lease
|
||||
audit_write
|
||||
audit_control
|
||||
setfcap
|
||||
}
|
||||
|
||||
common cap2
|
||||
{
|
||||
mac_override # unused by SELinux
|
||||
mac_admin # unused by SELinux
|
||||
syslog
|
||||
wake_alarm
|
||||
block_suspend
|
||||
audit_read
|
||||
}
|
||||
|
||||
#
|
||||
# Define the access vectors.
|
||||
#
|
||||
# class class_name [ inherits common_name ] { permission_name ... }
|
||||
|
||||
|
||||
#
|
||||
# Define the access vector interpretation for file-related objects.
|
||||
#
|
||||
|
||||
class filesystem
|
||||
{
|
||||
mount
|
||||
remount
|
||||
unmount
|
||||
getattr
|
||||
relabelfrom
|
||||
relabelto
|
||||
associate
|
||||
quotamod
|
||||
quotaget
|
||||
}
|
||||
|
||||
class dir
|
||||
inherits file
|
||||
{
|
||||
add_name
|
||||
remove_name
|
||||
reparent
|
||||
search
|
||||
rmdir
|
||||
open
|
||||
audit_access
|
||||
execmod
|
||||
}
|
||||
|
||||
class file
|
||||
inherits file
|
||||
{
|
||||
execute_no_trans
|
||||
entrypoint
|
||||
execmod
|
||||
open
|
||||
audit_access
|
||||
}
|
||||
|
||||
class lnk_file
|
||||
inherits file
|
||||
{
|
||||
open
|
||||
audit_access
|
||||
execmod
|
||||
}
|
||||
|
||||
class chr_file
|
||||
inherits file
|
||||
{
|
||||
execute_no_trans
|
||||
entrypoint
|
||||
execmod
|
||||
open
|
||||
audit_access
|
||||
}
|
||||
|
||||
class blk_file
|
||||
inherits file
|
||||
{
|
||||
open
|
||||
audit_access
|
||||
execmod
|
||||
}
|
||||
|
||||
class sock_file
|
||||
inherits file
|
||||
{
|
||||
open
|
||||
audit_access
|
||||
execmod
|
||||
}
|
||||
|
||||
class fifo_file
|
||||
inherits file
|
||||
{
|
||||
open
|
||||
audit_access
|
||||
execmod
|
||||
}
|
||||
|
||||
class fd
|
||||
{
|
||||
use
|
||||
}
|
||||
|
||||
|
||||
#
|
||||
# Define the access vector interpretation for network-related objects.
|
||||
#
|
||||
|
||||
class socket
|
||||
inherits socket
|
||||
|
||||
class tcp_socket
|
||||
inherits socket
|
||||
{
|
||||
node_bind
|
||||
name_connect
|
||||
}
|
||||
|
||||
class udp_socket
|
||||
inherits socket
|
||||
{
|
||||
node_bind
|
||||
}
|
||||
|
||||
class rawip_socket
|
||||
inherits socket
|
||||
{
|
||||
node_bind
|
||||
}
|
||||
|
||||
class node
|
||||
{
|
||||
recvfrom
|
||||
sendto
|
||||
}
|
||||
|
||||
class netif
|
||||
{
|
||||
ingress
|
||||
egress
|
||||
}
|
||||
|
||||
class netlink_socket
|
||||
inherits socket
|
||||
|
||||
class packet_socket
|
||||
inherits socket
|
||||
|
||||
class key_socket
|
||||
inherits socket
|
||||
|
||||
class unix_stream_socket
|
||||
inherits socket
|
||||
{
|
||||
connectto
|
||||
}
|
||||
|
||||
class unix_dgram_socket
|
||||
inherits socket
|
||||
|
||||
class bpf
|
||||
{
|
||||
map_create
|
||||
map_read
|
||||
map_write
|
||||
prog_load
|
||||
prog_run
|
||||
}
|
||||
|
||||
#
|
||||
# Define the access vector interpretation for process-related objects
|
||||
#
|
||||
|
||||
class process
|
||||
{
|
||||
fork
|
||||
transition
|
||||
sigchld # commonly granted from child to parent
|
||||
sigkill # cannot be caught or ignored
|
||||
sigstop # cannot be caught or ignored
|
||||
signull # for kill(pid, 0)
|
||||
signal # all other signals
|
||||
ptrace
|
||||
getsched
|
||||
setsched
|
||||
getsession
|
||||
getpgid
|
||||
setpgid
|
||||
getcap
|
||||
setcap
|
||||
share
|
||||
getattr
|
||||
setexec
|
||||
setfscreate
|
||||
noatsecure
|
||||
siginh
|
||||
setrlimit
|
||||
rlimitinh
|
||||
dyntransition
|
||||
setcurrent
|
||||
execmem
|
||||
execstack
|
||||
execheap
|
||||
setkeycreate
|
||||
setsockcreate
|
||||
getrlimit
|
||||
}
|
||||
|
||||
|
||||
#
|
||||
# Define the access vector interpretation for ipc-related objects
|
||||
#
|
||||
|
||||
class ipc
|
||||
inherits ipc
|
||||
|
||||
class sem
|
||||
inherits ipc
|
||||
|
||||
class msgq
|
||||
inherits ipc
|
||||
{
|
||||
enqueue
|
||||
}
|
||||
|
||||
class msg
|
||||
{
|
||||
send
|
||||
receive
|
||||
}
|
||||
|
||||
class shm
|
||||
inherits ipc
|
||||
{
|
||||
lock
|
||||
}
|
||||
|
||||
|
||||
#
|
||||
# Define the access vector interpretation for the security server.
|
||||
#
|
||||
|
||||
class security
|
||||
{
|
||||
compute_av
|
||||
compute_create
|
||||
compute_member
|
||||
check_context
|
||||
load_policy
|
||||
compute_relabel
|
||||
compute_user
|
||||
setenforce # was avc_toggle in system class
|
||||
setbool
|
||||
setsecparam
|
||||
setcheckreqprot
|
||||
read_policy
|
||||
validate_trans
|
||||
}
|
||||
|
||||
|
||||
#
|
||||
# Define the access vector interpretation for system operations.
|
||||
#
|
||||
|
||||
class system
|
||||
{
|
||||
ipc_info
|
||||
syslog_read
|
||||
syslog_mod
|
||||
syslog_console
|
||||
module_request
|
||||
module_load
|
||||
}
|
||||
|
||||
#
|
||||
# Define the access vector interpretation for controlling capabilities
|
||||
#
|
||||
|
||||
class capability
|
||||
inherits cap
|
||||
|
||||
class capability2
|
||||
inherits cap2
|
||||
|
||||
#
|
||||
# Extended Netlink classes
|
||||
#
|
||||
class netlink_route_socket
|
||||
inherits socket
|
||||
{
|
||||
nlmsg_read
|
||||
nlmsg_write
|
||||
}
|
||||
|
||||
class netlink_tcpdiag_socket
|
||||
inherits socket
|
||||
{
|
||||
nlmsg_read
|
||||
nlmsg_write
|
||||
}
|
||||
|
||||
class netlink_nflog_socket
|
||||
inherits socket
|
||||
|
||||
class netlink_xfrm_socket
|
||||
inherits socket
|
||||
{
|
||||
nlmsg_read
|
||||
nlmsg_write
|
||||
}
|
||||
|
||||
class netlink_selinux_socket
|
||||
inherits socket
|
||||
|
||||
class netlink_audit_socket
|
||||
inherits socket
|
||||
{
|
||||
nlmsg_read
|
||||
nlmsg_write
|
||||
nlmsg_relay
|
||||
nlmsg_readpriv
|
||||
nlmsg_tty_audit
|
||||
}
|
||||
|
||||
class netlink_dnrt_socket
|
||||
inherits socket
|
||||
|
||||
# Define the access vector interpretation for controlling
|
||||
# access to IPSec network data by association
|
||||
#
|
||||
class association
|
||||
{
|
||||
sendto
|
||||
recvfrom
|
||||
setcontext
|
||||
polmatch
|
||||
}
|
||||
|
||||
# Updated Netlink class for KOBJECT_UEVENT family.
|
||||
class netlink_kobject_uevent_socket
|
||||
inherits socket
|
||||
|
||||
class appletalk_socket
|
||||
inherits socket
|
||||
|
||||
class packet
|
||||
{
|
||||
send
|
||||
recv
|
||||
relabelto
|
||||
flow_in # deprecated
|
||||
flow_out # deprecated
|
||||
forward_in
|
||||
forward_out
|
||||
}
|
||||
|
||||
class key
|
||||
{
|
||||
view
|
||||
read
|
||||
write
|
||||
search
|
||||
link
|
||||
setattr
|
||||
create
|
||||
}
|
||||
|
||||
class dccp_socket
|
||||
inherits socket
|
||||
{
|
||||
node_bind
|
||||
name_connect
|
||||
}
|
||||
|
||||
class memprotect
|
||||
{
|
||||
mmap_zero
|
||||
}
|
||||
|
||||
# network peer labels
|
||||
class peer
|
||||
{
|
||||
recv
|
||||
}
|
||||
|
||||
class kernel_service
|
||||
{
|
||||
use_as_override
|
||||
create_files_as
|
||||
}
|
||||
|
||||
class tun_socket
|
||||
inherits socket
|
||||
{
|
||||
attach_queue
|
||||
}
|
||||
|
||||
class binder
|
||||
{
|
||||
impersonate
|
||||
call
|
||||
set_context_mgr
|
||||
transfer
|
||||
}
|
||||
|
||||
class netlink_iscsi_socket
|
||||
inherits socket
|
||||
|
||||
class netlink_fib_lookup_socket
|
||||
inherits socket
|
||||
|
||||
class netlink_connector_socket
|
||||
inherits socket
|
||||
|
||||
class netlink_netfilter_socket
|
||||
inherits socket
|
||||
|
||||
class netlink_generic_socket
|
||||
inherits socket
|
||||
|
||||
class netlink_scsitransport_socket
|
||||
inherits socket
|
||||
|
||||
class netlink_rdma_socket
|
||||
inherits socket
|
||||
|
||||
class netlink_crypto_socket
|
||||
inherits socket
|
||||
|
||||
#
|
||||
# Define the access vector interpretation for controlling capabilities
|
||||
# in user namespaces
|
||||
#
|
||||
|
||||
class cap_userns
|
||||
inherits cap
|
||||
|
||||
class cap2_userns
|
||||
inherits cap2
|
||||
|
||||
|
||||
#
|
||||
# Define the access vector interpretation for the new socket classes
|
||||
# enabled by the extended_socket_class policy capability.
|
||||
#
|
||||
|
||||
#
|
||||
# The next two classes were previously mapped to rawip_socket and therefore
|
||||
# have the same definition as rawip_socket (until further permissions
|
||||
# are defined).
|
||||
#
|
||||
class sctp_socket
|
||||
inherits socket
|
||||
{
|
||||
node_bind
|
||||
}
|
||||
|
||||
class icmp_socket
|
||||
inherits socket
|
||||
{
|
||||
node_bind
|
||||
}
|
||||
|
||||
#
|
||||
# The remaining network socket classes were previously
|
||||
# mapped to the socket class and therefore have the
|
||||
# same definition as socket.
|
||||
#
|
||||
|
||||
class ax25_socket
|
||||
inherits socket
|
||||
|
||||
class ipx_socket
|
||||
inherits socket
|
||||
|
||||
class netrom_socket
|
||||
inherits socket
|
||||
|
||||
class atmpvc_socket
|
||||
inherits socket
|
||||
|
||||
class x25_socket
|
||||
inherits socket
|
||||
|
||||
class rose_socket
|
||||
inherits socket
|
||||
|
||||
class decnet_socket
|
||||
inherits socket
|
||||
|
||||
class atmsvc_socket
|
||||
inherits socket
|
||||
|
||||
class rds_socket
|
||||
inherits socket
|
||||
|
||||
class irda_socket
|
||||
inherits socket
|
||||
|
||||
class pppox_socket
|
||||
inherits socket
|
||||
|
||||
class llc_socket
|
||||
inherits socket
|
||||
|
||||
class can_socket
|
||||
inherits socket
|
||||
|
||||
class tipc_socket
|
||||
inherits socket
|
||||
|
||||
class bluetooth_socket
|
||||
inherits socket
|
||||
|
||||
class iucv_socket
|
||||
inherits socket
|
||||
|
||||
class rxrpc_socket
|
||||
inherits socket
|
||||
|
||||
class isdn_socket
|
||||
inherits socket
|
||||
|
||||
class phonet_socket
|
||||
inherits socket
|
||||
|
||||
class ieee802154_socket
|
||||
inherits socket
|
||||
|
||||
class caif_socket
|
||||
inherits socket
|
||||
|
||||
class alg_socket
|
||||
inherits socket
|
||||
|
||||
class nfc_socket
|
||||
inherits socket
|
||||
|
||||
class vsock_socket
|
||||
inherits socket
|
||||
|
||||
class kcm_socket
|
||||
inherits socket
|
||||
|
||||
class qipcrtr_socket
|
||||
inherits socket
|
||||
|
||||
class smc_socket
|
||||
inherits socket
|
||||
|
||||
class property_service
|
||||
{
|
||||
set
|
||||
}
|
||||
|
||||
class service_manager
|
||||
{
|
||||
add
|
||||
find
|
||||
list
|
||||
}
|
||||
|
||||
class hwservice_manager
|
||||
{
|
||||
add
|
||||
find
|
||||
list
|
||||
}
|
||||
|
||||
class keystore_key
|
||||
{
|
||||
get_state
|
||||
get
|
||||
insert
|
||||
delete
|
||||
exist
|
||||
list
|
||||
reset
|
||||
password
|
||||
lock
|
||||
unlock
|
||||
is_empty
|
||||
sign
|
||||
verify
|
||||
grant
|
||||
duplicate
|
||||
clear_uid
|
||||
add_auth
|
||||
user_changed
|
||||
gen_unique_id
|
||||
}
|
||||
|
||||
class drmservice {
|
||||
consumeRights
|
||||
setPlaybackStatus
|
||||
openDecryptSession
|
||||
closeDecryptSession
|
||||
initializeDecryptUnit
|
||||
decrypt
|
||||
finalizeDecryptUnit
|
||||
pread
|
||||
}
|
||||
|
|
@ -1,148 +0,0 @@
|
|||
### ADB daemon
|
||||
|
||||
typeattribute adbd coredomain;
|
||||
typeattribute adbd mlstrustedsubject;
|
||||
|
||||
init_daemon_domain(adbd)
|
||||
|
||||
domain_auto_trans(adbd, shell_exec, shell)
|
||||
|
||||
userdebug_or_eng(`
|
||||
allow adbd self:process setcurrent;
|
||||
allow adbd su:process dyntransition;
|
||||
')
|
||||
|
||||
# Do not sanitize the environment or open fds of the shell. Allow signaling
|
||||
# created processes.
|
||||
allow adbd shell:process { noatsecure signal };
|
||||
|
||||
# Set UID and GID to shell. Set supplementary groups.
|
||||
allow adbd self:global_capability_class_set { setuid setgid };
|
||||
|
||||
# Drop capabilities from bounding set on user builds.
|
||||
allow adbd self:global_capability_class_set setpcap;
|
||||
|
||||
# Create and use network sockets.
|
||||
net_domain(adbd)
|
||||
|
||||
# Access /dev/usb-ffs/adb/ep0
|
||||
allow adbd functionfs:dir search;
|
||||
allow adbd functionfs:file rw_file_perms;
|
||||
|
||||
# Use a pseudo tty.
|
||||
allow adbd devpts:chr_file rw_file_perms;
|
||||
|
||||
# adb push/pull /data/local/tmp.
|
||||
allow adbd shell_data_file:dir create_dir_perms;
|
||||
allow adbd shell_data_file:file create_file_perms;
|
||||
|
||||
# adb pull /data/local/traces/*
|
||||
allow adbd trace_data_file:dir r_dir_perms;
|
||||
allow adbd trace_data_file:file r_file_perms;
|
||||
|
||||
# adb pull /data/misc/profman.
|
||||
allow adbd profman_dump_data_file:dir r_dir_perms;
|
||||
allow adbd profman_dump_data_file:file r_file_perms;
|
||||
|
||||
# adb push/pull sdcard.
|
||||
allow adbd tmpfs:dir search;
|
||||
allow adbd rootfs:lnk_file r_file_perms; # /sdcard symlink
|
||||
allow adbd tmpfs:lnk_file r_file_perms; # /mnt/sdcard symlink
|
||||
allow adbd sdcard_type:dir create_dir_perms;
|
||||
allow adbd sdcard_type:file create_file_perms;
|
||||
|
||||
# adb pull /data/anr/traces.txt
|
||||
allow adbd anr_data_file:dir r_dir_perms;
|
||||
allow adbd anr_data_file:file r_file_perms;
|
||||
|
||||
# Set service.adb.*, sys.powerctl, and sys.usb.ffs.ready properties.
|
||||
set_prop(adbd, shell_prop)
|
||||
set_prop(adbd, powerctl_prop)
|
||||
set_prop(adbd, ffs_prop)
|
||||
set_prop(adbd, exported_ffs_prop)
|
||||
|
||||
# Access device logging gating property
|
||||
get_prop(adbd, device_logging_prop)
|
||||
|
||||
# Read device's serial number from system properties
|
||||
get_prop(adbd, serialno_prop)
|
||||
|
||||
# Run /system/bin/bu
|
||||
allow adbd system_file:file rx_file_perms;
|
||||
|
||||
# Perform binder IPC to surfaceflinger (screencap)
|
||||
# XXX Run screencap in a separate domain?
|
||||
binder_use(adbd)
|
||||
binder_call(adbd, surfaceflinger)
|
||||
# b/13188914
|
||||
allow adbd gpu_device:chr_file rw_file_perms;
|
||||
allow adbd ion_device:chr_file rw_file_perms;
|
||||
r_dir_file(adbd, system_file)
|
||||
|
||||
# Needed for various screenshots
|
||||
hal_client_domain(adbd, hal_graphics_allocator)
|
||||
|
||||
# Read /data/misc/adb/adb_keys.
|
||||
allow adbd adb_keys_file:dir search;
|
||||
allow adbd adb_keys_file:file r_file_perms;
|
||||
|
||||
userdebug_or_eng(`
|
||||
# Write debugging information to /data/adb
|
||||
# when persist.adb.trace_mask is set
|
||||
# https://code.google.com/p/android/issues/detail?id=72895
|
||||
allow adbd adb_data_file:dir rw_dir_perms;
|
||||
allow adbd adb_data_file:file create_file_perms;
|
||||
')
|
||||
|
||||
# ndk-gdb invokes adb forward to forward the gdbserver socket.
|
||||
allow adbd app_data_file:dir search;
|
||||
allow adbd app_data_file:sock_file write;
|
||||
allow adbd appdomain:unix_stream_socket connectto;
|
||||
|
||||
# ndk-gdb invokes adb pull of app_process, linker, and libc.so.
|
||||
allow adbd zygote_exec:file r_file_perms;
|
||||
allow adbd system_file:file r_file_perms;
|
||||
|
||||
# Allow pulling the SELinux policy for CTS purposes
|
||||
allow adbd selinuxfs:dir r_dir_perms;
|
||||
allow adbd selinuxfs:file r_file_perms;
|
||||
allow adbd kernel:security read_policy;
|
||||
allow adbd service_contexts_file:file r_file_perms;
|
||||
allow adbd file_contexts_file:file r_file_perms;
|
||||
allow adbd seapp_contexts_file:file r_file_perms;
|
||||
allow adbd property_contexts_file:file r_file_perms;
|
||||
allow adbd sepolicy_file:file r_file_perms;
|
||||
|
||||
# Allow pulling config.gz for CTS purposes
|
||||
allow adbd config_gz:file r_file_perms;
|
||||
|
||||
allow adbd surfaceflinger_service:service_manager find;
|
||||
allow adbd bootchart_data_file:dir search;
|
||||
allow adbd bootchart_data_file:file r_file_perms;
|
||||
|
||||
# Allow access to external storage; we have several visible mount points under /storage
|
||||
# and symlinks to primary storage at places like /storage/sdcard0 and /mnt/user/0/primary
|
||||
allow adbd storage_file:dir r_dir_perms;
|
||||
allow adbd storage_file:lnk_file r_file_perms;
|
||||
allow adbd mnt_user_file:dir r_dir_perms;
|
||||
allow adbd mnt_user_file:lnk_file r_file_perms;
|
||||
|
||||
# Access to /data/media.
|
||||
# This should be removed if sdcardfs is modified to alter the secontext for its
|
||||
# accesses to the underlying FS.
|
||||
allow adbd media_rw_data_file:dir create_dir_perms;
|
||||
allow adbd media_rw_data_file:file create_file_perms;
|
||||
|
||||
r_dir_file(adbd, apk_data_file)
|
||||
|
||||
allow adbd rootfs:dir r_dir_perms;
|
||||
|
||||
###
|
||||
### Neverallow rules
|
||||
###
|
||||
|
||||
# No transitions from adbd to non-shell, non-crash_dump domains. adbd only ever
|
||||
# transitions to the shell domain (except when it crashes). In particular, we
|
||||
# never want to see a transition from adbd to su (aka "adb root")
|
||||
neverallow adbd { domain -crash_dump -shell }:process transition;
|
||||
neverallow adbd { domain userdebug_or_eng(`-su') }:process dyntransition;
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
# TODO: deal with tmpfs_domain pub/priv split properly
|
||||
# Read system properties managed by zygote.
|
||||
allow appdomain zygote_tmpfs:file read;
|
||||
|
||||
neverallow appdomain system_server:udp_socket {
|
||||
accept append bind create ioctl listen lock name_bind
|
||||
relabelfrom relabelto setattr shutdown };
|
||||
|
|
@ -1,262 +0,0 @@
|
|||
###
|
||||
### neverallow rules for untrusted app domains
|
||||
###
|
||||
|
||||
define(`all_untrusted_apps',`{
|
||||
ephemeral_app
|
||||
isolated_app
|
||||
mediaprovider
|
||||
untrusted_app
|
||||
untrusted_app_25
|
||||
untrusted_app_27
|
||||
untrusted_app_all
|
||||
untrusted_v2_app
|
||||
}')
|
||||
# Receive or send uevent messages.
|
||||
neverallow all_untrusted_apps domain:netlink_kobject_uevent_socket *;
|
||||
|
||||
# Receive or send generic netlink messages
|
||||
neverallow all_untrusted_apps domain:netlink_socket *;
|
||||
|
||||
# Too much leaky information in debugfs. It's a security
|
||||
# best practice to ensure these files aren't readable.
|
||||
neverallow all_untrusted_apps debugfs_type:file read;
|
||||
|
||||
# Do not allow untrusted apps to register services.
|
||||
# Only trusted components of Android should be registering
|
||||
# services.
|
||||
neverallow all_untrusted_apps service_manager_type:service_manager add;
|
||||
|
||||
# Do not allow untrusted apps to use VendorBinder
|
||||
neverallow all_untrusted_apps vndbinder_device:chr_file *;
|
||||
neverallow all_untrusted_apps vndservice_manager_type:service_manager *;
|
||||
|
||||
# Do not allow untrusted apps to connect to the property service
|
||||
# or set properties. b/10243159
|
||||
neverallow { all_untrusted_apps -mediaprovider } property_socket:sock_file write;
|
||||
neverallow { all_untrusted_apps -mediaprovider } init:unix_stream_socket connectto;
|
||||
neverallow { all_untrusted_apps -mediaprovider } property_type:property_service set;
|
||||
|
||||
# net.dns properties are not a public API. Temporarily exempt pre-Oreo apps,
|
||||
# but otherwise disallow untrusted apps from reading this property.
|
||||
neverallow { all_untrusted_apps -untrusted_app_25 } net_dns_prop:file read;
|
||||
|
||||
# Do not allow untrusted apps to be assigned mlstrustedsubject.
|
||||
# This would undermine the per-user isolation model being
|
||||
# enforced via levelFrom=user in seapp_contexts and the mls
|
||||
# constraints. As there is no direct way to specify a neverallow
|
||||
# on attribute assignment, this relies on the fact that fork
|
||||
# permission only makes sense within a domain (hence should
|
||||
# never be granted to any other domain within mlstrustedsubject)
|
||||
# and an untrusted app is allowed fork permission to itself.
|
||||
neverallow all_untrusted_apps mlstrustedsubject:process fork;
|
||||
|
||||
# Do not allow untrusted apps to hard link to any files.
|
||||
# In particular, if an untrusted app links to other app data
|
||||
# files, installd will not be able to guarantee the deletion
|
||||
# of the linked to file. Hard links also contribute to security
|
||||
# bugs, so we want to ensure untrusted apps never have this
|
||||
# capability.
|
||||
neverallow all_untrusted_apps file_type:file link;
|
||||
|
||||
# Do not allow untrusted apps to access network MAC address file
|
||||
neverallow all_untrusted_apps sysfs_mac_address:file no_rw_file_perms;
|
||||
|
||||
# Do not allow any write access to files in /sys
|
||||
neverallow all_untrusted_apps sysfs_type:file { no_w_file_perms no_x_file_perms };
|
||||
|
||||
# Apps may never access the default sysfs label.
|
||||
neverallow all_untrusted_apps sysfs:file no_rw_file_perms;
|
||||
|
||||
# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the
|
||||
# ioctl permission, or 3. disallow the socket class.
|
||||
neverallowxperm all_untrusted_apps domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
|
||||
neverallow all_untrusted_apps *:{ netlink_route_socket netlink_selinux_socket } ioctl;
|
||||
neverallow all_untrusted_apps *:{
|
||||
socket netlink_socket packet_socket key_socket appletalk_socket
|
||||
netlink_tcpdiag_socket netlink_nflog_socket
|
||||
netlink_xfrm_socket netlink_audit_socket
|
||||
netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
|
||||
netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
|
||||
netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
|
||||
netlink_rdma_socket netlink_crypto_socket
|
||||
} *;
|
||||
|
||||
# Do not allow untrusted apps access to /cache
|
||||
neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:dir ~{ r_dir_perms };
|
||||
neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:file ~{ read getattr };
|
||||
|
||||
# Do not allow untrusted apps to create/unlink files outside of its sandbox,
|
||||
# internal storage or sdcard.
|
||||
# World accessible data locations allow application to fill the device
|
||||
# with unaccounted for data. This data will not get removed during
|
||||
# application un-installation.
|
||||
neverallow { all_untrusted_apps -mediaprovider } {
|
||||
fs_type
|
||||
-sdcard_type
|
||||
file_type
|
||||
-app_data_file # The apps sandbox itself
|
||||
-media_rw_data_file # Internal storage. Known that apps can
|
||||
# leave artfacts here after uninstall.
|
||||
-user_profile_data_file # Access to profile files
|
||||
userdebug_or_eng(`
|
||||
-method_trace_data_file # only on ro.debuggable=1
|
||||
-coredump_file # userdebug/eng only
|
||||
')
|
||||
}:dir_file_class_set { create unlink };
|
||||
|
||||
# No untrusted component should be touching /dev/fuse
|
||||
neverallow all_untrusted_apps fuse_device:chr_file *;
|
||||
|
||||
# Do not allow untrusted apps to directly open tun_device
|
||||
neverallow all_untrusted_apps tun_device:chr_file open;
|
||||
|
||||
# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553)
|
||||
neverallow all_untrusted_apps anr_data_file:file ~{ open append };
|
||||
neverallow all_untrusted_apps anr_data_file:dir ~search;
|
||||
|
||||
# Avoid reads from generically labeled /proc files
|
||||
# Create a more specific label if needed
|
||||
neverallow all_untrusted_apps {
|
||||
proc
|
||||
proc_asound
|
||||
proc_filesystems
|
||||
proc_kmsg
|
||||
proc_loadavg
|
||||
proc_mounts
|
||||
proc_pagetypeinfo
|
||||
proc_stat
|
||||
proc_swaps
|
||||
proc_uptime
|
||||
proc_version
|
||||
proc_vmallocinfo
|
||||
proc_vmstat
|
||||
}:file { no_rw_file_perms no_x_file_perms };
|
||||
|
||||
# Avoid all access to kernel configuration
|
||||
neverallow all_untrusted_apps config_gz:file { no_rw_file_perms no_x_file_perms };
|
||||
|
||||
# Do not allow untrusted apps access to preloads data files
|
||||
neverallow all_untrusted_apps preloads_data_file:file no_rw_file_perms;
|
||||
|
||||
# Locking of files on /system could lead to denial of service attacks
|
||||
# against privileged system components
|
||||
neverallow all_untrusted_apps system_file:file lock;
|
||||
|
||||
# Do not permit untrusted apps to perform actions on HwBinder service_manager
|
||||
# other than find actions for services listed below
|
||||
neverallow all_untrusted_apps *:hwservice_manager ~find;
|
||||
|
||||
# Do not permit access from apps which host arbitrary code to HwBinder services,
|
||||
# except those considered sufficiently safe for access from such apps.
|
||||
# The two main reasons for this are:
|
||||
# 1. HwBinder servers do not perform client authentication because HIDL
|
||||
# currently does not expose caller UID information and, even if it did, many
|
||||
# HwBinder services either operate at a level below that of apps (e.g., HALs)
|
||||
# or must not rely on app identity for authorization. Thus, to be safe, the
|
||||
# default assumption is that every HwBinder service treats all its clients as
|
||||
# equally authorized to perform operations offered by the service.
|
||||
# 2. HAL servers (a subset of HwBinder services) contain code with higher
|
||||
# incidence rate of security issues than system/core components and have
|
||||
# access to lower layes of the stack (all the way down to hardware) thus
|
||||
# increasing opportunities for bypassing the Android security model.
|
||||
#
|
||||
# Safe services include:
|
||||
# - same process services: because they by definition run in the process
|
||||
# of the client and thus have the same access as the client domain in which
|
||||
# the process runs
|
||||
# - coredomain_hwservice: are considered safe because they do not pose risks
|
||||
# associated with reason #2 above.
|
||||
# - hal_configstore_ISurfaceFlingerConfigs: becuase it has specifically been
|
||||
# designed for use by any domain.
|
||||
# - hal_graphics_allocator_hwservice: because these operations are also offered
|
||||
# by surfaceflinger Binder service, which apps are permitted to access
|
||||
# - hal_omx_hwservice: because this is a HwBinder version of the mediacodec
|
||||
# Binder service which apps were permitted to access.
|
||||
# - hal_codec2_hwservice: because this is a newer version of hal_omx_hwservice.
|
||||
neverallow all_untrusted_apps {
|
||||
hwservice_manager_type
|
||||
-same_process_hwservice
|
||||
-coredomain_hwservice
|
||||
-hal_codec2_hwservice
|
||||
-hal_configstore_ISurfaceFlingerConfigs
|
||||
-hal_graphics_allocator_hwservice
|
||||
-hal_omx_hwservice
|
||||
-hal_cas_hwservice
|
||||
-hal_neuralnetworks_hwservice
|
||||
-untrusted_app_visible_hwservice
|
||||
}:hwservice_manager find;
|
||||
|
||||
# Make sure that the following services are never accessible by untrusted_apps
|
||||
neverallow all_untrusted_apps {
|
||||
default_android_hwservice
|
||||
hal_audio_hwservice
|
||||
hal_authsecret_hwservice
|
||||
hal_bluetooth_hwservice
|
||||
hal_bootctl_hwservice
|
||||
hal_camera_hwservice
|
||||
hal_confirmationui_hwservice
|
||||
hal_contexthub_hwservice
|
||||
hal_drm_hwservice
|
||||
hal_dumpstate_hwservice
|
||||
hal_fingerprint_hwservice
|
||||
hal_gatekeeper_hwservice
|
||||
hal_gnss_hwservice
|
||||
hal_graphics_composer_hwservice
|
||||
hal_health_hwservice
|
||||
hal_ir_hwservice
|
||||
hal_keymaster_hwservice
|
||||
hal_light_hwservice
|
||||
hal_memtrack_hwservice
|
||||
hal_nfc_hwservice
|
||||
hal_oemlock_hwservice
|
||||
hal_power_hwservice
|
||||
hal_secure_element_hwservice
|
||||
hal_sensors_hwservice
|
||||
hal_telephony_hwservice
|
||||
hal_thermal_hwservice
|
||||
hal_tv_cec_hwservice
|
||||
hal_tv_input_hwservice
|
||||
hal_usb_hwservice
|
||||
hal_vibrator_hwservice
|
||||
hal_vr_hwservice
|
||||
hal_weaver_hwservice
|
||||
hal_wifi_hwservice
|
||||
hal_wifi_offload_hwservice
|
||||
hal_wifi_supplicant_hwservice
|
||||
hidl_base_hwservice
|
||||
system_net_netd_hwservice
|
||||
thermalcallback_hwservice
|
||||
}:hwservice_manager find;
|
||||
# HwBinder services offered by core components (as opposed to vendor components)
|
||||
# are considered somewhat safer due to point #2 above.
|
||||
neverallow all_untrusted_apps {
|
||||
coredomain_hwservice
|
||||
-same_process_hwservice
|
||||
-hidl_allocator_hwservice # Designed for use by any domain
|
||||
-hidl_manager_hwservice # Designed for use by any domain
|
||||
-hidl_memory_hwservice # Designed for use by any domain
|
||||
-hidl_token_hwservice # Designed for use by any domain
|
||||
}:hwservice_manager find;
|
||||
|
||||
# SELinux is not an API for untrusted apps to use
|
||||
neverallow all_untrusted_apps selinuxfs:file no_rw_file_perms;
|
||||
|
||||
# Restrict *Binder access from apps to HAL domains. We can only do this on full
|
||||
# Treble devices where *Binder communications between apps and HALs are tightly
|
||||
# restricted.
|
||||
full_treble_only(`
|
||||
neverallow all_untrusted_apps {
|
||||
halserverdomain
|
||||
-coredomain
|
||||
-hal_configstore_server
|
||||
-hal_graphics_allocator_server
|
||||
-hal_cas_server
|
||||
-hal_neuralnetworks_server
|
||||
-binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone
|
||||
-untrusted_app_visible_halserver
|
||||
}:binder { call transfer };
|
||||
')
|
||||
|
||||
# Untrusted apps are not allowed to find mediaextractor update service.
|
||||
neverallow all_untrusted_apps mediaextractor_update_service:service_manager find;
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
# type_transition must be private policy the domain_trans rules could stay
|
||||
# public, but conceptually should go with this
|
||||
# Technically not a daemon but we do want the transition from init domain to
|
||||
# asan_extract to occur.
|
||||
with_asan(`
|
||||
typeattribute asan_extract coredomain;
|
||||
init_daemon_domain(asan_extract)
|
||||
')
|
||||
|
|
@ -1,46 +0,0 @@
|
|||
# Domain for atrace process.
|
||||
# It is spawned either by traced_probes or by init for the boottrace service.
|
||||
|
||||
type atrace, domain, coredomain;
|
||||
type atrace_exec, exec_type, file_type;
|
||||
|
||||
# boottrace services uses /data/misc/boottrace/categories
|
||||
allow atrace boottrace_data_file:dir search;
|
||||
allow atrace boottrace_data_file:file r_file_perms;
|
||||
|
||||
# Allow atrace to access tracefs.
|
||||
allow atrace debugfs_tracing:dir r_dir_perms;
|
||||
allow atrace debugfs_tracing:file rw_file_perms;
|
||||
allow atrace debugfs_trace_marker:file getattr;
|
||||
|
||||
# atrace sets debug.atrace.* properties
|
||||
set_prop(atrace, debug_prop)
|
||||
|
||||
# atrace pokes all the binder-enabled processes at startup with a
|
||||
# SYSPROPS_TRANSACTION, to tell them to reload the debug.atrace.* properties.
|
||||
|
||||
binder_use(atrace)
|
||||
allow atrace healthd:binder call;
|
||||
allow atrace surfaceflinger:binder call;
|
||||
get_prop(atrace, hwservicemanager_prop)
|
||||
|
||||
allow atrace {
|
||||
service_manager_type
|
||||
-incident_service
|
||||
-netd_service
|
||||
-stats_service
|
||||
-dumpstate_service
|
||||
-installd_service
|
||||
-vold_service
|
||||
}:service_manager { find };
|
||||
allow atrace servicemanager:service_manager list;
|
||||
|
||||
userdebug_or_eng(`
|
||||
# atrace is generally invoked as a standalone binary from shell or perf
|
||||
# daemons like Perfetto traced_probes. However, in userdebug builds, there is
|
||||
# a further option to run atrace as an init daemon for boot tracing.
|
||||
init_daemon_domain(atrace)
|
||||
|
||||
allow atrace debugfs_tracing_debug:dir r_dir_perms;
|
||||
allow atrace debugfs_tracing_debug:file rw_file_perms;
|
||||
')
|
||||
|
|
@ -1,88 +0,0 @@
|
|||
# audioserver - audio services daemon
|
||||
|
||||
typeattribute audioserver coredomain;
|
||||
|
||||
type audioserver_exec, exec_type, file_type;
|
||||
init_daemon_domain(audioserver)
|
||||
|
||||
r_dir_file(audioserver, sdcard_type)
|
||||
|
||||
binder_use(audioserver)
|
||||
binder_call(audioserver, binderservicedomain)
|
||||
binder_call(audioserver, appdomain)
|
||||
binder_service(audioserver)
|
||||
|
||||
hal_client_domain(audioserver, hal_allocator)
|
||||
# /system/lib64/hw for always-passthrough Allocator HAL ashmem / mapper .so
|
||||
r_dir_file(audioserver, system_file)
|
||||
|
||||
hal_client_domain(audioserver, hal_audio)
|
||||
|
||||
userdebug_or_eng(`
|
||||
# used for TEE sink - pcm capture for debug.
|
||||
allow audioserver media_data_file:dir create_dir_perms;
|
||||
allow audioserver audioserver_data_file:dir create_dir_perms;
|
||||
allow audioserver audioserver_data_file:file create_file_perms;
|
||||
|
||||
# ptrace to processes in the same domain for memory leak detection
|
||||
allow audioserver self:process ptrace;
|
||||
')
|
||||
|
||||
add_service(audioserver, audioserver_service)
|
||||
allow audioserver activity_service:service_manager find;
|
||||
allow audioserver appops_service:service_manager find;
|
||||
allow audioserver batterystats_service:service_manager find;
|
||||
allow audioserver permission_service:service_manager find;
|
||||
allow audioserver power_service:service_manager find;
|
||||
allow audioserver scheduling_policy_service:service_manager find;
|
||||
allow audioserver mediametrics_service:service_manager find;
|
||||
|
||||
# Allow read/write access to bluetooth-specific properties
|
||||
set_prop(audioserver, bluetooth_a2dp_offload_prop)
|
||||
set_prop(audioserver, bluetooth_prop)
|
||||
set_prop(audioserver, exported_bluetooth_prop)
|
||||
|
||||
# Grant access to audio files to audioserver
|
||||
allow audioserver audio_data_file:dir ra_dir_perms;
|
||||
allow audioserver audio_data_file:file create_file_perms;
|
||||
|
||||
# allow access to ALSA MMAP FDs for AAudio API
|
||||
allow audioserver audio_device:chr_file { read write };
|
||||
|
||||
not_full_treble(`allow audioserver audio_device:dir r_dir_perms;')
|
||||
not_full_treble(`allow audioserver audio_device:chr_file rw_file_perms;')
|
||||
|
||||
# For A2DP bridge which is loaded directly into audioserver
|
||||
unix_socket_connect(audioserver, bluetooth, bluetooth)
|
||||
|
||||
# Allow shell commands from ADB and shell for CTS testing/dumping
|
||||
allow audioserver adbd:fd use;
|
||||
allow audioserver adbd:unix_stream_socket { read write };
|
||||
allow audioserver shell:fifo_file { read write };
|
||||
|
||||
# Allow shell commands from ADB for CTS testing/dumping
|
||||
userdebug_or_eng(`
|
||||
allow audioserver su:fd use;
|
||||
allow audioserver su:fifo_file { read write };
|
||||
allow audioserver su:unix_stream_socket { read write };
|
||||
')
|
||||
|
||||
###
|
||||
### neverallow rules
|
||||
###
|
||||
|
||||
# audioserver should never execute any executable without a
|
||||
# domain transition
|
||||
neverallow audioserver { file_type fs_type }:file execute_no_trans;
|
||||
|
||||
# The goal of the mediaserver split is to place media processing code into
|
||||
# restrictive sandboxes with limited responsibilities and thus limited
|
||||
# permissions. Example: Audioserver is only responsible for controlling audio
|
||||
# hardware and processing audio content. Cameraserver does the same for camera
|
||||
# hardware/content. Etc.
|
||||
#
|
||||
# Media processing code is inherently risky and thus should have limited
|
||||
# permissions and be isolated from the rest of the system and network.
|
||||
# Lengthier explanation here:
|
||||
# https://android-developers.googleblog.com/2016/05/hardening-media-stack.html
|
||||
neverallow audioserver domain:{ tcp_socket udp_socket rawip_socket } *;
|
||||
|
|
@ -1 +0,0 @@
|
|||
allow binder_in_vendor_violators binder_device:chr_file rw_file_perms;
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
# Rules common to all binder service domains
|
||||
|
||||
# Allow dumpstate and incidentd to collect information from binder services
|
||||
allow binderservicedomain { dumpstate incidentd }:fd use;
|
||||
allow binderservicedomain { dumpstate incidentd }:unix_stream_socket { read write getopt getattr };
|
||||
allow binderservicedomain { dumpstate incidentd }:fifo_file { getattr write };
|
||||
allow binderservicedomain shell_data_file:file { getattr write };
|
||||
|
||||
# Allow dumpsys to work from adb shell or the serial console
|
||||
allow binderservicedomain devpts:chr_file rw_file_perms;
|
||||
allow binderservicedomain console_device:chr_file rw_file_perms;
|
||||
|
||||
# Receive and write to a pipe received over Binder from an app.
|
||||
allow binderservicedomain appdomain:fd use;
|
||||
allow binderservicedomain appdomain:fifo_file write;
|
||||
|
||||
# allow all services to run permission checks
|
||||
allow binderservicedomain permission_service:service_manager find;
|
||||
|
||||
allow binderservicedomain keystore:keystore_key { get_state get insert delete exist list sign verify };
|
||||
|
||||
use_keystore(binderservicedomain)
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
type blank_screen, domain, coredomain;
|
||||
type blank_screen_exec, exec_type, file_type;
|
||||
|
||||
init_daemon_domain(blank_screen)
|
||||
|
||||
hal_client_domain(blank_screen, hal_light)
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
# blkid called from vold
|
||||
|
||||
typeattribute blkid coredomain;
|
||||
|
||||
type blkid_exec, exec_type, file_type;
|
||||
|
||||
# Allowed read-only access to encrypted devices to extract UUID/label
|
||||
allow blkid block_device:dir search;
|
||||
allow blkid userdata_block_device:blk_file r_file_perms;
|
||||
allow blkid dm_device:blk_file r_file_perms;
|
||||
|
||||
# Allow stdin/out back to vold
|
||||
allow blkid vold:fd use;
|
||||
allow blkid vold:fifo_file { read write getattr };
|
||||
|
||||
# For blkid launched through popen()
|
||||
allow blkid blkid_exec:file rx_file_perms;
|
||||
|
||||
# Only allow entry from vold
|
||||
neverallow { domain -vold } blkid:process transition;
|
||||
neverallow * blkid:process dyntransition;
|
||||
neverallow blkid { file_type fs_type -blkid_exec -shell_exec }:file entrypoint;
|
||||
|
|
@ -1,37 +0,0 @@
|
|||
# blkid for untrusted block devices
|
||||
|
||||
typeattribute blkid_untrusted coredomain;
|
||||
|
||||
# Allowed read-only access to vold block devices to extract UUID/label
|
||||
allow blkid_untrusted block_device:dir search;
|
||||
allow blkid_untrusted vold_device:blk_file r_file_perms;
|
||||
|
||||
# Allow stdin/out back to vold
|
||||
allow blkid_untrusted vold:fd use;
|
||||
allow blkid_untrusted vold:fifo_file { read write getattr };
|
||||
|
||||
# For blkid launched through popen()
|
||||
allow blkid_untrusted blkid_exec:file rx_file_perms;
|
||||
|
||||
###
|
||||
### neverallow rules
|
||||
###
|
||||
|
||||
# Untrusted blkid should never be run on block devices holding sensitive data
|
||||
neverallow blkid_untrusted {
|
||||
boot_block_device
|
||||
frp_block_device
|
||||
metadata_block_device
|
||||
recovery_block_device
|
||||
root_block_device
|
||||
swap_block_device
|
||||
system_block_device
|
||||
userdata_block_device
|
||||
cache_block_device
|
||||
dm_device
|
||||
}:blk_file no_rw_file_perms;
|
||||
|
||||
# Only allow entry from vold via blkid binary
|
||||
neverallow { domain -vold } blkid_untrusted:process transition;
|
||||
neverallow * blkid_untrusted:process dyntransition;
|
||||
neverallow blkid_untrusted { file_type fs_type -blkid_exec -shell_exec }:file entrypoint;
|
||||
|
|
@ -1,80 +0,0 @@
|
|||
# bluetooth app
|
||||
|
||||
typeattribute bluetooth coredomain;
|
||||
|
||||
app_domain(bluetooth)
|
||||
net_domain(bluetooth)
|
||||
|
||||
# Socket creation under /data/misc/bluedroid.
|
||||
type_transition bluetooth bluetooth_data_file:sock_file bluetooth_socket;
|
||||
|
||||
# Allow access to net_admin ioctls
|
||||
allowxperm bluetooth self:udp_socket ioctl priv_sock_ioctls;
|
||||
|
||||
wakelock_use(bluetooth);
|
||||
|
||||
# Data file accesses.
|
||||
allow bluetooth bluetooth_data_file:dir create_dir_perms;
|
||||
allow bluetooth bluetooth_data_file:notdevfile_class_set create_file_perms;
|
||||
allow bluetooth bluetooth_logs_data_file:dir rw_dir_perms;
|
||||
allow bluetooth bluetooth_logs_data_file:file create_file_perms;
|
||||
|
||||
# Socket creation under /data/misc/bluedroid.
|
||||
allow bluetooth bluetooth_socket:sock_file create_file_perms;
|
||||
|
||||
allow bluetooth self:global_capability_class_set net_admin;
|
||||
allow bluetooth self:global_capability2_class_set wake_alarm;
|
||||
|
||||
# tethering
|
||||
allow bluetooth self:packet_socket create_socket_perms_no_ioctl;
|
||||
allow bluetooth self:global_capability_class_set { net_admin net_raw net_bind_service };
|
||||
allow bluetooth self:tun_socket create_socket_perms_no_ioctl;
|
||||
allow bluetooth tun_device:chr_file rw_file_perms;
|
||||
allow bluetooth efs_file:dir search;
|
||||
|
||||
# allow Bluetooth to access uhid device for HID profile
|
||||
allow bluetooth uhid_device:chr_file rw_file_perms;
|
||||
|
||||
# proc access.
|
||||
allow bluetooth proc_bluetooth_writable:file rw_file_perms;
|
||||
|
||||
# Allow write access to bluetooth specific properties
|
||||
set_prop(bluetooth, bluetooth_a2dp_offload_prop)
|
||||
set_prop(bluetooth, bluetooth_prop)
|
||||
set_prop(bluetooth, exported_bluetooth_prop)
|
||||
set_prop(bluetooth, pan_result_prop)
|
||||
|
||||
allow bluetooth audioserver_service:service_manager find;
|
||||
allow bluetooth bluetooth_service:service_manager find;
|
||||
allow bluetooth drmserver_service:service_manager find;
|
||||
allow bluetooth mediaserver_service:service_manager find;
|
||||
allow bluetooth radio_service:service_manager find;
|
||||
allow bluetooth app_api_service:service_manager find;
|
||||
allow bluetooth system_api_service:service_manager find;
|
||||
|
||||
# already open bugreport file descriptors may be shared with
|
||||
# the bluetooth process, from a file in
|
||||
# /data/data/com.android.shell/files/bugreports/bugreport-*.
|
||||
allow bluetooth shell_data_file:file read;
|
||||
|
||||
# Bluetooth audio needs RT scheduling to meet deadlines, allow sys_nice
|
||||
allow bluetooth self:global_capability_class_set sys_nice;
|
||||
|
||||
hal_client_domain(bluetooth, hal_bluetooth)
|
||||
hal_client_domain(bluetooth, hal_telephony)
|
||||
|
||||
# Bluetooth A2DP offload requires binding with audio HAL
|
||||
hal_client_domain(bluetooth, hal_audio)
|
||||
|
||||
read_runtime_log_tags(bluetooth)
|
||||
|
||||
###
|
||||
### Neverallow rules
|
||||
###
|
||||
### These are things that the bluetooth app should NEVER be able to do
|
||||
###
|
||||
|
||||
# Superuser capabilities.
|
||||
# Bluetooth requires net_{admin,raw,bind_service} and wake_alarm and block_suspend and sys_nice.
|
||||
neverallow bluetooth self:global_capability_class_set ~{ net_admin net_raw net_bind_service sys_nice};
|
||||
neverallow bluetooth self:global_capability2_class_set ~{ wake_alarm block_suspend };
|
||||
|
|
@ -1,2 +0,0 @@
|
|||
# Allow clients to use a socket provided by the bluetooth app.
|
||||
allow bluetoothdomain bluetooth:unix_stream_socket { getopt setopt getattr read write ioctl shutdown };
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
typeattribute bootanim coredomain;
|
||||
|
||||
init_daemon_domain(bootanim)
|
||||
|
||||
# b/68864350
|
||||
dontaudit bootanim unlabeled:dir search;
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
typeattribute bootstat coredomain;
|
||||
|
||||
init_daemon_domain(bootstat)
|
||||
|
|
@ -1,30 +0,0 @@
|
|||
# bpf program loader
|
||||
type bpfloader, domain;
|
||||
type bpfloader_exec, exec_type, file_type;
|
||||
typeattribute bpfloader coredomain;
|
||||
|
||||
# Process need CAP_NET_ADMIN to run bpf programs as cgroup filter
|
||||
allow bpfloader self:global_capability_class_set net_admin;
|
||||
|
||||
r_dir_file(bpfloader, cgroup_bpf)
|
||||
|
||||
# These permission is required for pin bpf program for netd.
|
||||
allow bpfloader fs_bpf:dir create_dir_perms;
|
||||
allow bpfloader fs_bpf:file create_file_perms;
|
||||
allow bpfloader devpts:chr_file { read write };
|
||||
|
||||
allow bpfloader netd:fd use;
|
||||
|
||||
# Use pinned bpf map files from netd.
|
||||
allow bpfloader netd:bpf { map_read map_write };
|
||||
allow bpfloader self:bpf { prog_load prog_run };
|
||||
|
||||
# Neverallow rules
|
||||
neverallow { domain -bpfloader } *:bpf prog_load;
|
||||
neverallow { domain -bpfloader -netd -netutils_wrapper} *:bpf prog_run;
|
||||
neverallow { domain -netd -bpfloader } bpfloader_exec:file { execute execute_no_trans };
|
||||
neverallow bpfloader domain:{ tcp_socket udp_socket rawip_socket } *;
|
||||
# only system_server, netd and bpfloader can read/write the bpf maps
|
||||
neverallow { domain -system_server -netd -bpfloader} netd:bpf { map_read map_write };
|
||||
|
||||
dontaudit bpfloader self:capability sys_admin;
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
typeattribute bufferhubd coredomain;
|
||||
|
||||
init_daemon_domain(bufferhubd)
|
||||
|
|
@ -1,45 +0,0 @@
|
|||
cppreopts cppreopts capability 79414024
|
||||
dexoptanalyzer apk_data_file file 77853712
|
||||
dexoptanalyzer app_data_file file 77853712
|
||||
dexoptanalyzer app_data_file lnk_file 77853712
|
||||
dexoptanalyzer system_data_file lnk_file 77853712
|
||||
dnsmasq netd fifo_file 77868789
|
||||
dnsmasq netd unix_stream_socket 77868789
|
||||
init app_data_file file 77873135
|
||||
init cache_file blk_file 77873135
|
||||
init logpersist file 77873135
|
||||
init nativetest_data_file dir 77873135
|
||||
init pstorefs dir 77873135
|
||||
init shell_data_file dir 77873135
|
||||
init shell_data_file file 77873135
|
||||
init shell_data_file lnk_file 77873135
|
||||
init shell_data_file sock_file 77873135
|
||||
init system_data_file chr_file 77873135
|
||||
mediaextractor app_data_file file 77923736
|
||||
mediaextractor radio_data_file file 77923736
|
||||
mediaprovider cache_file blk_file 77925342
|
||||
mediaprovider mnt_media_rw_file dir 77925342
|
||||
mediaprovider shell_data_file dir 77925342
|
||||
netd priv_app unix_stream_socket 77870037
|
||||
netd untrusted_app unix_stream_socket 77870037
|
||||
netd untrusted_app_25 unix_stream_socket 77870037
|
||||
netd untrusted_app_27 unix_stream_socket 77870037
|
||||
otapreopt_chroot postinstall_file lnk_file 75287236
|
||||
platform_app nfc_data_file dir 74331887
|
||||
postinstall postinstall capability 77958490
|
||||
postinstall_dexopt postinstall_dexopt capability 77958490
|
||||
postinstall_dexopt user_profile_data_file file 77958490
|
||||
priv_app system_data_file dir 72811052
|
||||
profman apk_data_file dir 77922323
|
||||
radio statsdw_socket sock_file 78456764
|
||||
statsd hal_health_default binder 77919007
|
||||
storaged storaged capability 77634061
|
||||
surfaceflinger mediacodec binder 77924251
|
||||
system_server crash_dump process 73128755
|
||||
system_server logd_socket sock_file 64734187
|
||||
system_server sdcardfs file 77856826
|
||||
system_server zygote process 77856826
|
||||
untrusted_app_25 system_data_file dir 72550646
|
||||
untrusted_app_27 system_data_file dir 72550646
|
||||
usbd usbd capability 72472544
|
||||
zygote untrusted_app_25 process 77925912
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
typeattribute cameraserver coredomain;
|
||||
|
||||
init_daemon_domain(cameraserver)
|
||||
|
|
@ -1 +0,0 @@
|
|||
typeattribute charger coredomain;
|
||||
|
|
@ -1 +0,0 @@
|
|||
typeattribute clatd coredomain;
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
get_prop(coredomain, pm_prop)
|
||||
get_prop(coredomain, exported_pm_prop)
|
||||
|
||||
full_treble_only(`
|
||||
neverallow {
|
||||
coredomain
|
||||
|
||||
# for chowning
|
||||
-init
|
||||
|
||||
# generic access to sysfs_type
|
||||
-ueventd
|
||||
-vold
|
||||
} sysfs_leds:file *;
|
||||
')
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
typeattribute cppreopts coredomain;
|
||||
|
||||
# Technically not a daemon but we do want the transition from init domain to
|
||||
# cppreopts to occur.
|
||||
init_daemon_domain(cppreopts)
|
||||
domain_auto_trans(cppreopts, preopt2cachename_exec, preopt2cachename);
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
typeattribute crash_dump coredomain;
|
||||
|
||||
allow crash_dump {
|
||||
domain
|
||||
-bpfloader
|
||||
-crash_dump
|
||||
-init
|
||||
-kernel
|
||||
-keystore
|
||||
-logd
|
||||
-ueventd
|
||||
-vendor_init
|
||||
-vold
|
||||
}:process { ptrace signal sigchld sigstop sigkill };
|
||||
|
|
@ -1 +0,0 @@
|
|||
typeattribute dex2oat coredomain;
|
||||
|
|
@ -1,30 +0,0 @@
|
|||
# dexoptanalyzer
|
||||
type dexoptanalyzer, domain, coredomain, mlstrustedsubject;
|
||||
type dexoptanalyzer_exec, exec_type, file_type;
|
||||
|
||||
# Reading an APK opens a ZipArchive, which unpack to tmpfs.
|
||||
# Use tmpfs_domain() which will give tmpfs files created by dexoptanalyzer their
|
||||
# own label, which differs from other labels created by other processes.
|
||||
# This allows to distinguish in policy files created by dexoptanalyzer vs other
|
||||
#processes.
|
||||
tmpfs_domain(dexoptanalyzer)
|
||||
|
||||
# Read symlinks in /data/dalvik-cache. This is required for PIC mode boot
|
||||
# app_data_file the oat file is symlinked to the original file in /system.
|
||||
allow dexoptanalyzer dalvikcache_data_file:dir { getattr search };
|
||||
allow dexoptanalyzer dalvikcache_data_file:file r_file_perms;
|
||||
allow dexoptanalyzer dalvikcache_data_file:lnk_file read;
|
||||
|
||||
allow dexoptanalyzer installd:fd use;
|
||||
|
||||
# Allow reading secondary dex files that were reported by the app to the
|
||||
# package manager.
|
||||
allow dexoptanalyzer app_data_file:dir { getattr search };
|
||||
allow dexoptanalyzer app_data_file:file { getattr read };
|
||||
# dexoptanalyzer calls access(2) with W_OK flag on app data. We can use the
|
||||
# "dontaudit...audit_access" policy line to suppress the audit access without
|
||||
# suppressing denial on actual access.
|
||||
dontaudit dexoptanalyzer app_data_file:dir audit_access;
|
||||
|
||||
# Allow testing /data/user/0 which symlinks to /data/data
|
||||
allow dexoptanalyzer system_data_file:lnk_file { getattr };
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
typeattribute dhcp coredomain;
|
||||
|
||||
init_daemon_domain(dhcp)
|
||||
type_transition dhcp system_data_file:{ dir file } dhcp_data_file;
|
||||
|
|
@ -1 +0,0 @@
|
|||
typeattribute dnsmasq coredomain;
|
||||
|
|
@ -1,118 +0,0 @@
|
|||
# Transition to crash_dump when /system/bin/crash_dump* is executed.
|
||||
# This occurs when the process crashes.
|
||||
domain_auto_trans(domain, crash_dump_exec, crash_dump);
|
||||
allow domain crash_dump:process sigchld;
|
||||
|
||||
# Limit ability to ptrace or read sensitive /proc/pid files of processes
|
||||
# with other UIDs to these allowlisted domains.
|
||||
neverallow {
|
||||
domain
|
||||
-vold
|
||||
-dumpstate
|
||||
userdebug_or_eng(`-incidentd')
|
||||
-storaged
|
||||
-system_server
|
||||
userdebug_or_eng(`-perfprofd')
|
||||
} self:global_capability_class_set sys_ptrace;
|
||||
|
||||
# Limit ability to generate hardware unique device ID attestations to priv_apps
|
||||
neverallow { domain -priv_app } *:keystore_key gen_unique_id;
|
||||
|
||||
neverallow {
|
||||
domain
|
||||
-init
|
||||
-vendor_init
|
||||
userdebug_or_eng(`-domain')
|
||||
} debugfs_tracing_debug:file no_rw_file_perms;
|
||||
|
||||
# Core domains are not permitted to use kernel interfaces which are not
|
||||
# explicitly labeled.
|
||||
# TODO(b/65643247): Apply these neverallow rules to all coredomain.
|
||||
full_treble_only(`
|
||||
# /proc
|
||||
neverallow {
|
||||
coredomain
|
||||
-vold
|
||||
} proc:file no_rw_file_perms;
|
||||
|
||||
# /sys
|
||||
neverallow {
|
||||
coredomain
|
||||
-init
|
||||
-ueventd
|
||||
-vold
|
||||
} sysfs:file no_rw_file_perms;
|
||||
|
||||
# /dev
|
||||
neverallow {
|
||||
coredomain
|
||||
-fsck
|
||||
-init
|
||||
-ueventd
|
||||
} device:{ blk_file file } no_rw_file_perms;
|
||||
|
||||
# debugfs
|
||||
neverallow {
|
||||
coredomain
|
||||
-dumpstate
|
||||
-init
|
||||
-system_server
|
||||
} debugfs:file no_rw_file_perms;
|
||||
|
||||
# tracefs
|
||||
neverallow {
|
||||
coredomain
|
||||
-atrace
|
||||
-dumpstate
|
||||
-init
|
||||
userdebug_or_eng(`-perfprofd')
|
||||
-traced_probes
|
||||
-shell
|
||||
-traceur_app
|
||||
} debugfs_tracing:file no_rw_file_perms;
|
||||
|
||||
# inotifyfs
|
||||
neverallow {
|
||||
coredomain
|
||||
-init
|
||||
} inotify:file no_rw_file_perms;
|
||||
|
||||
# pstorefs
|
||||
neverallow {
|
||||
coredomain
|
||||
-bootstat
|
||||
-charger
|
||||
-dumpstate
|
||||
-healthd
|
||||
userdebug_or_eng(`-incidentd')
|
||||
-init
|
||||
-logd
|
||||
-logpersist
|
||||
-recovery_persist
|
||||
-recovery_refresh
|
||||
-shell
|
||||
-system_server
|
||||
} pstorefs:file no_rw_file_perms;
|
||||
|
||||
# configfs
|
||||
neverallow {
|
||||
coredomain
|
||||
-init
|
||||
-system_server
|
||||
} configfs:file no_rw_file_perms;
|
||||
|
||||
# functionfs
|
||||
neverallow {
|
||||
coredomain
|
||||
-adbd
|
||||
-init
|
||||
-mediaprovider
|
||||
-system_server
|
||||
} functionfs:file no_rw_file_perms;
|
||||
|
||||
# usbfs and binfmt_miscfs
|
||||
neverallow {
|
||||
coredomain
|
||||
-init
|
||||
}{ usbfs binfmt_miscfs }:file no_rw_file_perms;
|
||||
')
|
||||
|
|
@ -1,7 +0,0 @@
|
|||
typeattribute drmserver coredomain;
|
||||
|
||||
init_daemon_domain(drmserver)
|
||||
|
||||
type_transition drmserver apk_data_file:sock_file drmserver_socket;
|
||||
|
||||
typeattribute drmserver_socket coredomain_socket;
|
||||
|
|
@ -1,47 +0,0 @@
|
|||
typeattribute dumpstate coredomain;
|
||||
|
||||
init_daemon_domain(dumpstate)
|
||||
|
||||
# Execute and transition to the vdc domain
|
||||
domain_auto_trans(dumpstate, vdc_exec, vdc)
|
||||
|
||||
# Acquire advisory lock on /system/etc/xtables.lock from ip[6]tables
|
||||
allow dumpstate system_file:file lock;
|
||||
|
||||
# TODO: deal with tmpfs_domain pub/priv split properly
|
||||
allow dumpstate dumpstate_tmpfs:file execute;
|
||||
|
||||
# systrace support - allow atrace to run
|
||||
allow dumpstate debugfs_tracing:dir r_dir_perms;
|
||||
allow dumpstate debugfs_tracing:file rw_file_perms;
|
||||
allow dumpstate debugfs_tracing_debug:dir r_dir_perms;
|
||||
allow dumpstate debugfs_trace_marker:file getattr;
|
||||
allow dumpstate atrace_exec:file rx_file_perms;
|
||||
allow dumpstate storaged_exec:file rx_file_perms;
|
||||
|
||||
# /data/misc/wmtrace for wm traces
|
||||
userdebug_or_eng(`
|
||||
allow dumpstate wm_trace_data_file:dir r_dir_perms;
|
||||
allow dumpstate wm_trace_data_file:file r_file_perms;
|
||||
')
|
||||
|
||||
# Allow dumpstate to make binder calls to storaged service
|
||||
binder_call(dumpstate, storaged)
|
||||
|
||||
# Allow dumpstate to make binder calls to statsd
|
||||
binder_call(dumpstate, statsd)
|
||||
|
||||
# Collect metrics on boot time created by init
|
||||
get_prop(dumpstate, boottime_prop)
|
||||
|
||||
# Signal native processes to dump their stack.
|
||||
allow dumpstate {
|
||||
statsd
|
||||
}:process signal;
|
||||
|
||||
# For collecting bugreports.
|
||||
allow dumpstate debugfs_wakeup_sources:file r_file_perms;
|
||||
allow dumpstate dev_type:blk_file getattr;
|
||||
allow dumpstate webview_zygote:process signal;
|
||||
dontaudit dumpstate perfprofd:binder call;
|
||||
dontaudit dumpstate update_engine:binder call;
|
||||
|
|
@ -1,81 +0,0 @@
|
|||
###
|
||||
### Ephemeral apps.
|
||||
###
|
||||
### This file defines the security policy for apps with the ephemeral
|
||||
### feature.
|
||||
###
|
||||
### The ephemeral_app domain is a reduced permissions sandbox allowing
|
||||
### ephemeral applications to be safely installed and run. Non ephemeral
|
||||
### applications may also opt-in to ephemeral to take advantage of the
|
||||
### additional security features.
|
||||
###
|
||||
### PackageManager flags an app as ephemeral at install time.
|
||||
|
||||
typeattribute ephemeral_app coredomain;
|
||||
|
||||
net_domain(ephemeral_app)
|
||||
app_domain(ephemeral_app)
|
||||
|
||||
# Allow ephemeral apps to read/write files in visible storage if provided fds
|
||||
allow ephemeral_app { sdcard_type media_rw_data_file }:file {read write getattr ioctl lock append};
|
||||
|
||||
# Some apps ship with shared libraries and binaries that they write out
|
||||
# to their sandbox directory and then execute.
|
||||
allow ephemeral_app app_data_file:file {r_file_perms execute};
|
||||
|
||||
# services
|
||||
allow ephemeral_app audioserver_service:service_manager find;
|
||||
allow ephemeral_app cameraserver_service:service_manager find;
|
||||
allow ephemeral_app mediaserver_service:service_manager find;
|
||||
allow ephemeral_app mediaextractor_service:service_manager find;
|
||||
allow ephemeral_app mediacodec_service:service_manager find;
|
||||
allow ephemeral_app mediametrics_service:service_manager find;
|
||||
allow ephemeral_app mediadrmserver_service:service_manager find;
|
||||
allow ephemeral_app drmserver_service:service_manager find;
|
||||
allow ephemeral_app radio_service:service_manager find;
|
||||
allow ephemeral_app ephemeral_app_api_service:service_manager find;
|
||||
|
||||
# Write app-specific trace data to the Perfetto traced damon. This requires
|
||||
# connecting to its producer socket and obtaining a (per-process) tmpfs fd.
|
||||
allow ephemeral_app traced:fd use;
|
||||
allow ephemeral_app traced_tmpfs:file { read write getattr map };
|
||||
unix_socket_connect(ephemeral_app, traced_producer, traced)
|
||||
|
||||
# allow ephemeral apps to use UDP sockets provided by the system server but not
|
||||
# modify them other than to connect
|
||||
allow ephemeral_app system_server:udp_socket {
|
||||
connect getattr read recvfrom sendto write getopt setopt };
|
||||
|
||||
###
|
||||
### neverallow rules
|
||||
###
|
||||
|
||||
neverallow ephemeral_app app_data_file:file execute_no_trans;
|
||||
|
||||
# Receive or send uevent messages.
|
||||
neverallow ephemeral_app domain:netlink_kobject_uevent_socket *;
|
||||
|
||||
# Receive or send generic netlink messages
|
||||
neverallow ephemeral_app domain:netlink_socket *;
|
||||
|
||||
# Too much leaky information in debugfs. It's a security
|
||||
# best practice to ensure these files aren't readable.
|
||||
neverallow ephemeral_app debugfs:file read;
|
||||
|
||||
# execute gpu_device
|
||||
neverallow ephemeral_app gpu_device:chr_file execute;
|
||||
|
||||
# access files in /sys with the default sysfs label
|
||||
neverallow ephemeral_app sysfs:file *;
|
||||
|
||||
# Avoid reads from generically labeled /proc files
|
||||
# Create a more specific label if needed
|
||||
neverallow ephemeral_app proc:file { no_rw_file_perms no_x_file_perms };
|
||||
|
||||
# Directly access external storage
|
||||
neverallow ephemeral_app { sdcard_type media_rw_data_file }:file {open create};
|
||||
neverallow ephemeral_app { sdcard_type media_rw_data_file }:dir search;
|
||||
|
||||
# Avoid reads to proc_net, it contains too much device wide information about
|
||||
# ongoing connections.
|
||||
neverallow ephemeral_app proc_net:file no_rw_file_perms;
|
||||
|
|
@ -1,16 +0,0 @@
|
|||
# /proc/config.gz
|
||||
type config_gz, fs_type, proc_type;
|
||||
|
||||
# /data/misc/stats-data, /data/misc/stats-service
|
||||
type stats_data_file, file_type, data_file_type, core_data_file_type;
|
||||
|
||||
type statsdw_socket, file_type, coredomain_socket, mlstrustedobject;
|
||||
|
||||
# /data/misc/storaged
|
||||
type storaged_data_file, file_type, data_file_type, core_data_file_type;
|
||||
|
||||
# /data/misc/wmtrace for wm traces
|
||||
type wm_trace_data_file, file_type, data_file_type, core_data_file_type;
|
||||
|
||||
# /data/misc/perfetto-traces for perfetto traces
|
||||
type perfetto_traces_data_file, file_type, data_file_type, core_data_file_type;
|
||||
|
|
@ -1,541 +0,0 @@
|
|||
###########################################
|
||||
# Root
|
||||
/ u:object_r:rootfs:s0
|
||||
|
||||
# Data files
|
||||
/adb_keys u:object_r:adb_keys_file:s0
|
||||
/build\.prop u:object_r:rootfs:s0
|
||||
/default\.prop u:object_r:rootfs:s0
|
||||
/fstab\..* u:object_r:rootfs:s0
|
||||
/init\..* u:object_r:rootfs:s0
|
||||
/res(/.*)? u:object_r:rootfs:s0
|
||||
/selinux_version u:object_r:rootfs:s0
|
||||
/ueventd\..* u:object_r:rootfs:s0
|
||||
/verity_key u:object_r:rootfs:s0
|
||||
|
||||
# Executables
|
||||
/charger u:object_r:rootfs:s0
|
||||
/init u:object_r:init_exec:s0
|
||||
/sbin(/.*)? u:object_r:rootfs:s0
|
||||
|
||||
# For kernel modules
|
||||
/lib(/.*)? u:object_r:rootfs:s0
|
||||
|
||||
# Empty directories
|
||||
/lost\+found u:object_r:rootfs:s0
|
||||
/acct u:object_r:cgroup:s0
|
||||
/config u:object_r:rootfs:s0
|
||||
/mnt u:object_r:tmpfs:s0
|
||||
/postinstall u:object_r:postinstall_mnt_dir:s0
|
||||
/proc u:object_r:rootfs:s0
|
||||
/sys u:object_r:sysfs:s0
|
||||
|
||||
# Symlinks
|
||||
/bin u:object_r:rootfs:s0
|
||||
/bugreports u:object_r:rootfs:s0
|
||||
/d u:object_r:rootfs:s0
|
||||
/etc u:object_r:rootfs:s0
|
||||
/sdcard u:object_r:rootfs:s0
|
||||
|
||||
# SELinux policy files
|
||||
/vendor_file_contexts u:object_r:file_contexts_file:s0
|
||||
/nonplat_file_contexts u:object_r:file_contexts_file:s0
|
||||
/plat_file_contexts u:object_r:file_contexts_file:s0
|
||||
/mapping_sepolicy\.cil u:object_r:sepolicy_file:s0
|
||||
/nonplat_sepolicy\.cil u:object_r:sepolicy_file:s0
|
||||
/plat_sepolicy\.cil u:object_r:sepolicy_file:s0
|
||||
/plat_property_contexts u:object_r:property_contexts_file:s0
|
||||
/nonplat_property_contexts u:object_r:property_contexts_file:s0
|
||||
/vendor_property_contexts u:object_r:property_contexts_file:s0
|
||||
/seapp_contexts u:object_r:seapp_contexts_file:s0
|
||||
/nonplat_seapp_contexts u:object_r:seapp_contexts_file:s0
|
||||
/vendor_seapp_contexts u:object_r:seapp_contexts_file:s0
|
||||
/plat_seapp_contexts u:object_r:seapp_contexts_file:s0
|
||||
/sepolicy u:object_r:sepolicy_file:s0
|
||||
/plat_service_contexts u:object_r:service_contexts_file:s0
|
||||
/plat_hwservice_contexts u:object_r:hwservice_contexts_file:s0
|
||||
/nonplat_service_contexts u:object_r:nonplat_service_contexts_file:s0
|
||||
# Use nonplat_service_contexts_file to allow servicemanager to read it
|
||||
# on non full-treble devices.
|
||||
/vendor_service_contexts u:object_r:nonplat_service_contexts_file:s0
|
||||
/nonplat_hwservice_contexts u:object_r:hwservice_contexts_file:s0
|
||||
/vendor_hwservice_contexts u:object_r:hwservice_contexts_file:s0
|
||||
/vndservice_contexts u:object_r:vndservice_contexts_file:s0
|
||||
|
||||
##########################
|
||||
# Devices
|
||||
#
|
||||
/dev(/.*)? u:object_r:device:s0
|
||||
/dev/akm8973.* u:object_r:sensors_device:s0
|
||||
/dev/accelerometer u:object_r:sensors_device:s0
|
||||
/dev/adf[0-9]* u:object_r:graphics_device:s0
|
||||
/dev/adf-interface[0-9]*\.[0-9]* u:object_r:graphics_device:s0
|
||||
/dev/adf-overlay-engine[0-9]*\.[0-9]* u:object_r:graphics_device:s0
|
||||
/dev/alarm u:object_r:alarm_device:s0
|
||||
/dev/ashmem u:object_r:ashmem_device:s0
|
||||
/dev/audio.* u:object_r:audio_device:s0
|
||||
/dev/binder u:object_r:binder_device:s0
|
||||
/dev/block(/.*)? u:object_r:block_device:s0
|
||||
/dev/block/dm-[0-9]+ u:object_r:dm_device:s0
|
||||
/dev/block/loop[0-9]* u:object_r:loop_device:s0
|
||||
/dev/block/vold/.+ u:object_r:vold_device:s0
|
||||
/dev/block/ram[0-9]* u:object_r:ram_device:s0
|
||||
/dev/block/zram[0-9]* u:object_r:ram_device:s0
|
||||
/dev/bus/usb(.*)? u:object_r:usb_device:s0
|
||||
/dev/cam u:object_r:camera_device:s0
|
||||
/dev/console u:object_r:console_device:s0
|
||||
/dev/cpuctl(/.*)? u:object_r:cpuctl_device:s0
|
||||
/dev/memcg(/.*)? u:object_r:cgroup:s0
|
||||
/dev/device-mapper u:object_r:dm_device:s0
|
||||
/dev/eac u:object_r:audio_device:s0
|
||||
/dev/event-log-tags u:object_r:runtime_event_log_tags_file:s0
|
||||
/dev/fscklogs(/.*)? u:object_r:fscklogs:s0
|
||||
/dev/full u:object_r:full_device:s0
|
||||
/dev/fuse u:object_r:fuse_device:s0
|
||||
/dev/graphics(/.*)? u:object_r:graphics_device:s0
|
||||
/dev/hw_random u:object_r:hw_random_device:s0
|
||||
/dev/hwbinder u:object_r:hwbinder_device:s0
|
||||
/dev/i2c-[0-9]+ u:object_r:i2c_device:s0
|
||||
/dev/input(/.*)? u:object_r:input_device:s0
|
||||
/dev/iio:device[0-9]+ u:object_r:iio_device:s0
|
||||
/dev/ion u:object_r:ion_device:s0
|
||||
/dev/keychord u:object_r:keychord_device:s0
|
||||
/dev/kmem u:object_r:kmem_device:s0
|
||||
/dev/loop-control u:object_r:loop_control_device:s0
|
||||
/dev/mem u:object_r:kmem_device:s0
|
||||
/dev/modem.* u:object_r:radio_device:s0
|
||||
/dev/mtd(/.*)? u:object_r:mtd_device:s0
|
||||
/dev/mtp_usb u:object_r:mtp_device:s0
|
||||
/dev/pmsg0 u:object_r:pmsg_device:s0
|
||||
/dev/pn544 u:object_r:nfc_device:s0
|
||||
/dev/port u:object_r:port_device:s0
|
||||
/dev/ppp u:object_r:ppp_device:s0
|
||||
/dev/ptmx u:object_r:ptmx_device:s0
|
||||
/dev/pvrsrvkm u:object_r:gpu_device:s0
|
||||
/dev/kmsg u:object_r:kmsg_device:s0
|
||||
/dev/kmsg_debug u:object_r:kmsg_debug_device:s0
|
||||
/dev/null u:object_r:null_device:s0
|
||||
/dev/nvhdcp1 u:object_r:video_device:s0
|
||||
/dev/random u:object_r:random_device:s0
|
||||
/dev/rpmsg-omx[0-9] u:object_r:rpmsg_device:s0
|
||||
/dev/rproc_user u:object_r:rpmsg_device:s0
|
||||
/dev/rtc[0-9] u:object_r:rtc_device:s0
|
||||
/dev/snd(/.*)? u:object_r:audio_device:s0
|
||||
/dev/snd/audio_timer_device u:object_r:audio_timer_device:s0
|
||||
/dev/snd/audio_seq_device u:object_r:audio_seq_device:s0
|
||||
/dev/socket(/.*)? u:object_r:socket_device:s0
|
||||
/dev/socket/adbd u:object_r:adbd_socket:s0
|
||||
/dev/socket/dnsproxyd u:object_r:dnsproxyd_socket:s0
|
||||
/dev/socket/dumpstate u:object_r:dumpstate_socket:s0
|
||||
/dev/socket/fwmarkd u:object_r:fwmarkd_socket:s0
|
||||
/dev/socket/lmkd u:object_r:lmkd_socket:s0
|
||||
/dev/socket/logd u:object_r:logd_socket:s0
|
||||
/dev/socket/logdr u:object_r:logdr_socket:s0
|
||||
/dev/socket/logdw u:object_r:logdw_socket:s0
|
||||
/dev/socket/statsdw u:object_r:statsdw_socket:s0
|
||||
/dev/socket/mdns u:object_r:mdns_socket:s0
|
||||
/dev/socket/mdnsd u:object_r:mdnsd_socket:s0
|
||||
/dev/socket/mtpd u:object_r:mtpd_socket:s0
|
||||
/dev/socket/netd u:object_r:netd_socket:s0
|
||||
/dev/socket/pdx/system/buffer_hub u:object_r:pdx_bufferhub_dir:s0
|
||||
/dev/socket/pdx/system/buffer_hub/client u:object_r:pdx_bufferhub_client_endpoint_socket:s0
|
||||
/dev/socket/pdx/system/performance u:object_r:pdx_performance_dir:s0
|
||||
/dev/socket/pdx/system/performance/client u:object_r:pdx_performance_client_endpoint_socket:s0
|
||||
/dev/socket/pdx/system/vr/display u:object_r:pdx_display_dir:s0
|
||||
/dev/socket/pdx/system/vr/display/client u:object_r:pdx_display_client_endpoint_socket:s0
|
||||
/dev/socket/pdx/system/vr/display/manager u:object_r:pdx_display_manager_endpoint_socket:s0
|
||||
/dev/socket/pdx/system/vr/display/screenshot u:object_r:pdx_display_screenshot_endpoint_socket:s0
|
||||
/dev/socket/pdx/system/vr/display/vsync u:object_r:pdx_display_vsync_endpoint_socket:s0
|
||||
/dev/socket/property_service u:object_r:property_socket:s0
|
||||
/dev/socket/racoon u:object_r:racoon_socket:s0
|
||||
/dev/socket/rild u:object_r:rild_socket:s0
|
||||
/dev/socket/rild-debug u:object_r:rild_debug_socket:s0
|
||||
/dev/socket/tombstoned_crash u:object_r:tombstoned_crash_socket:s0
|
||||
/dev/socket/tombstoned_java_trace u:object_r:tombstoned_java_trace_socket:s0
|
||||
/dev/socket/tombstoned_intercept u:object_r:tombstoned_intercept_socket:s0
|
||||
/dev/socket/traced_producer u:object_r:traced_producer_socket:s0
|
||||
/dev/socket/traced_consumer u:object_r:traced_consumer_socket:s0
|
||||
/dev/socket/uncrypt u:object_r:uncrypt_socket:s0
|
||||
/dev/socket/wpa_eth[0-9] u:object_r:wpa_socket:s0
|
||||
/dev/socket/wpa_wlan[0-9] u:object_r:wpa_socket:s0
|
||||
/dev/socket/zygote u:object_r:zygote_socket:s0
|
||||
/dev/socket/zygote_secondary u:object_r:zygote_socket:s0
|
||||
/dev/spdif_out.* u:object_r:audio_device:s0
|
||||
/dev/tegra.* u:object_r:video_device:s0
|
||||
/dev/tty u:object_r:owntty_device:s0
|
||||
/dev/tty[0-9]* u:object_r:tty_device:s0
|
||||
/dev/ttyS[0-9]* u:object_r:serial_device:s0
|
||||
/dev/tun u:object_r:tun_device:s0
|
||||
/dev/uhid u:object_r:uhid_device:s0
|
||||
/dev/uinput u:object_r:uhid_device:s0
|
||||
/dev/uio[0-9]* u:object_r:uio_device:s0
|
||||
/dev/urandom u:object_r:random_device:s0
|
||||
/dev/usb_accessory u:object_r:usbaccessory_device:s0
|
||||
/dev/v4l-touch[0-9]* u:object_r:input_device:s0
|
||||
/dev/vcs[0-9a-z]* u:object_r:vcs_device:s0
|
||||
/dev/video[0-9]* u:object_r:video_device:s0
|
||||
/dev/vndbinder u:object_r:vndbinder_device:s0
|
||||
/dev/watchdog u:object_r:watchdog_device:s0
|
||||
/dev/xt_qtaguid u:object_r:qtaguid_device:s0
|
||||
/dev/zero u:object_r:zero_device:s0
|
||||
/dev/__properties__ u:object_r:properties_device:s0
|
||||
/dev/__properties__/property_info u:object_r:property_info:s0
|
||||
#############################
|
||||
# System files
|
||||
#
|
||||
/system(/.*)? u:object_r:system_file:s0
|
||||
/system/bin/atrace u:object_r:atrace_exec:s0
|
||||
/system/bin/blank_screen u:object_r:blank_screen_exec:s0
|
||||
/system/bin/e2fsdroid u:object_r:e2fs_exec:s0
|
||||
/system/bin/mke2fs u:object_r:e2fs_exec:s0
|
||||
/system/bin/e2fsck -- u:object_r:fsck_exec:s0
|
||||
/system/bin/fsck\.f2fs -- u:object_r:fsck_exec:s0
|
||||
/system/bin/sload_f2fs -- u:object_r:e2fs_exec:s0
|
||||
/system/bin/make_f2fs -- u:object_r:e2fs_exec:s0
|
||||
/system/bin/fsck_msdos -- u:object_r:fsck_exec:s0
|
||||
/system/bin/tune2fs -- u:object_r:fsck_exec:s0
|
||||
/system/bin/toolbox -- u:object_r:toolbox_exec:s0
|
||||
/system/bin/toybox -- u:object_r:toolbox_exec:s0
|
||||
/system/bin/logcat -- u:object_r:logcat_exec:s0
|
||||
/system/bin/logcatd -- u:object_r:logcat_exec:s0
|
||||
/system/bin/sh -- u:object_r:shell_exec:s0
|
||||
/system/bin/run-as -- u:object_r:runas_exec:s0
|
||||
/system/bin/bootanimation u:object_r:bootanim_exec:s0
|
||||
/system/bin/bootstat u:object_r:bootstat_exec:s0
|
||||
/system/bin/app_process32 u:object_r:zygote_exec:s0
|
||||
/system/bin/app_process64 u:object_r:zygote_exec:s0
|
||||
/system/bin/servicemanager u:object_r:servicemanager_exec:s0
|
||||
/system/bin/hwservicemanager u:object_r:hwservicemanager_exec:s0
|
||||
/system/bin/surfaceflinger u:object_r:surfaceflinger_exec:s0
|
||||
/system/bin/bufferhubd u:object_r:bufferhubd_exec:s0
|
||||
/system/bin/performanced u:object_r:performanced_exec:s0
|
||||
/system/bin/drmserver u:object_r:drmserver_exec:s0
|
||||
/system/bin/dumpstate u:object_r:dumpstate_exec:s0
|
||||
/system/bin/incident u:object_r:incident_exec:s0
|
||||
/system/bin/incidentd u:object_r:incidentd_exec:s0
|
||||
/system/bin/incident_helper u:object_r:incident_helper_exec:s0
|
||||
/system/bin/netutils-wrapper-1\.0 u:object_r:netutils_wrapper_exec:s0
|
||||
/system/bin/vold u:object_r:vold_exec:s0
|
||||
/system/bin/netd u:object_r:netd_exec:s0
|
||||
/system/bin/wificond u:object_r:wificond_exec:s0
|
||||
/system/bin/audioserver u:object_r:audioserver_exec:s0
|
||||
/system/bin/mediadrmserver u:object_r:mediadrmserver_exec:s0
|
||||
/system/bin/mediaserver u:object_r:mediaserver_exec:s0
|
||||
/system/bin/mediametrics u:object_r:mediametrics_exec:s0
|
||||
/system/bin/cameraserver u:object_r:cameraserver_exec:s0
|
||||
/system/bin/mediaextractor u:object_r:mediaextractor_exec:s0
|
||||
/system/bin/mdnsd u:object_r:mdnsd_exec:s0
|
||||
/system/bin/installd u:object_r:installd_exec:s0
|
||||
/system/bin/otapreopt_chroot u:object_r:otapreopt_chroot_exec:s0
|
||||
/system/bin/otapreopt_slot u:object_r:otapreopt_slot_exec:s0
|
||||
/system/bin/keystore u:object_r:keystore_exec:s0
|
||||
/system/bin/fingerprintd u:object_r:fingerprintd_exec:s0
|
||||
/system/bin/gatekeeperd u:object_r:gatekeeperd_exec:s0
|
||||
/system/bin/crash_dump32 u:object_r:crash_dump_exec:s0
|
||||
/system/bin/crash_dump64 u:object_r:crash_dump_exec:s0
|
||||
/system/bin/tombstoned u:object_r:tombstoned_exec:s0
|
||||
/system/bin/recovery-persist u:object_r:recovery_persist_exec:s0
|
||||
/system/bin/recovery-refresh u:object_r:recovery_refresh_exec:s0
|
||||
/system/bin/sdcard u:object_r:sdcardd_exec:s0
|
||||
/system/bin/dhcpcd u:object_r:dhcp_exec:s0
|
||||
/system/bin/dhcpcd-6.8.2 u:object_r:dhcp_exec:s0
|
||||
/system/bin/mtpd u:object_r:mtp_exec:s0
|
||||
/system/bin/pppd u:object_r:ppp_exec:s0
|
||||
/system/bin/racoon u:object_r:racoon_exec:s0
|
||||
/system/xbin/su u:object_r:su_exec:s0
|
||||
/system/bin/perfprofd u:object_r:perfprofd_exec:s0
|
||||
/system/bin/dnsmasq u:object_r:dnsmasq_exec:s0
|
||||
/system/bin/healthd u:object_r:healthd_exec:s0
|
||||
/system/bin/clatd u:object_r:clatd_exec:s0
|
||||
/system/bin/lmkd u:object_r:lmkd_exec:s0
|
||||
/system/bin/usbd u:object_r:usbd_exec:s0
|
||||
/system/bin/inputflinger u:object_r:inputflinger_exec:s0
|
||||
/system/bin/logd u:object_r:logd_exec:s0
|
||||
/system/bin/perfetto u:object_r:perfetto_exec:s0
|
||||
/system/bin/traced u:object_r:traced_exec:s0
|
||||
/system/bin/traced_probes u:object_r:traced_probes_exec:s0
|
||||
/system/bin/uncrypt u:object_r:uncrypt_exec:s0
|
||||
/system/bin/update_verifier u:object_r:update_verifier_exec:s0
|
||||
/system/bin/logwrapper u:object_r:system_file:s0
|
||||
/system/bin/vdc u:object_r:vdc_exec:s0
|
||||
/system/bin/cppreopts.sh u:object_r:cppreopts_exec:s0
|
||||
/system/bin/preopt2cachename u:object_r:preopt2cachename_exec:s0
|
||||
/system/bin/install-recovery.sh u:object_r:install_recovery_exec:s0
|
||||
/system/bin/dex2oat(d)? u:object_r:dex2oat_exec:s0
|
||||
/system/bin/dexoptanalyzer(d)? u:object_r:dexoptanalyzer_exec:s0
|
||||
# patchoat executable has (essentially) the same requirements as dex2oat.
|
||||
/system/bin/patchoat(d)? u:object_r:dex2oat_exec:s0
|
||||
/system/bin/profman(d)? u:object_r:profman_exec:s0
|
||||
/system/bin/sgdisk u:object_r:sgdisk_exec:s0
|
||||
/system/bin/blkid u:object_r:blkid_exec:s0
|
||||
/system/bin/tzdatacheck u:object_r:tzdatacheck_exec:s0
|
||||
/system/bin/idmap u:object_r:idmap_exec:s0
|
||||
/system/bin/update_engine u:object_r:update_engine_exec:s0
|
||||
/system/bin/bspatch u:object_r:update_engine_exec:s0
|
||||
/system/bin/storaged u:object_r:storaged_exec:s0
|
||||
/system/bin/thermalserviced u:object_r:thermalserviced_exec:s0
|
||||
/system/bin/wpantund u:object_r:wpantund_exec:s0
|
||||
/system/bin/virtual_touchpad u:object_r:virtual_touchpad_exec:s0
|
||||
/system/bin/hw/android\.hidl\.allocator@1\.0-service u:object_r:hal_allocator_default_exec:s0
|
||||
/system/etc/selinux/mapping/[0-9]+\.[0-9]+\.cil u:object_r:sepolicy_file:s0
|
||||
/system/etc/selinux/plat_mac_permissions\.xml u:object_r:mac_perms_file:s0
|
||||
/system/etc/selinux/plat_property_contexts u:object_r:property_contexts_file:s0
|
||||
/system/etc/selinux/plat_service_contexts u:object_r:service_contexts_file:s0
|
||||
/system/etc/selinux/plat_hwservice_contexts u:object_r:hwservice_contexts_file:s0
|
||||
/system/etc/selinux/plat_file_contexts u:object_r:file_contexts_file:s0
|
||||
/system/etc/selinux/plat_seapp_contexts u:object_r:seapp_contexts_file:s0
|
||||
/system/etc/selinux/plat_sepolicy.cil u:object_r:sepolicy_file:s0
|
||||
/system/etc/selinux/plat_and_mapping_sepolicy\.cil\.sha256 u:object_r:sepolicy_file:s0
|
||||
/system/bin/vr_hwc u:object_r:vr_hwc_exec:s0
|
||||
/system/bin/adbd u:object_r:adbd_exec:s0
|
||||
/system/bin/vold_prepare_subdirs u:object_r:vold_prepare_subdirs_exec:s0
|
||||
/system/bin/stats u:object_r:stats_exec:s0
|
||||
/system/bin/statsd u:object_r:statsd_exec:s0
|
||||
/system/bin/bpfloader u:object_r:bpfloader_exec:s0
|
||||
/system/bin/wait_for_keymaster u:object_r:wait_for_keymaster_exec:s0
|
||||
|
||||
#############################
|
||||
# Vendor files
|
||||
#
|
||||
/(vendor|system/vendor)(/.*)? u:object_r:vendor_file:s0
|
||||
/(vendor|system/vendor)/bin/sh u:object_r:vendor_shell_exec:s0
|
||||
/(vendor|system/vendor)/bin/toybox_vendor u:object_r:vendor_toolbox_exec:s0
|
||||
/(vendor|system/vendor)/bin/toolbox u:object_r:vendor_toolbox_exec:s0
|
||||
/(vendor|system/vendor)/etc(/.*)? u:object_r:vendor_configs_file:s0
|
||||
|
||||
/(vendor|system/vendor)/lib(64)?/egl(/.*)? u:object_r:same_process_hal_file:s0
|
||||
|
||||
/(vendor|system/vendor)/lib(64)?/vndk-sp(/.*)? u:object_r:vndk_sp_file:s0
|
||||
|
||||
/(vendor|system/vendor)/manifest.xml u:object_r:vendor_configs_file:s0
|
||||
/(vendor|system/vendor)/compatibility_matrix.xml u:object_r:vendor_configs_file:s0
|
||||
/(vendor|system/vendor)/etc/vintf(/.*)? u:object_r:vendor_configs_file:s0
|
||||
/(vendor|system/vendor)/app(/.*)? u:object_r:vendor_app_file:s0
|
||||
/(vendor|system/vendor)/priv-app(/.*)? u:object_r:vendor_app_file:s0
|
||||
/(vendor|system/vendor)/overlay(/.*)? u:object_r:vendor_overlay_file:s0
|
||||
/(vendor|system/vendor)/framework(/.*)? u:object_r:vendor_framework_file:s0
|
||||
|
||||
# HAL location
|
||||
/(vendor|system/vendor)/lib(64)?/hw u:object_r:vendor_hal_file:s0
|
||||
|
||||
#############################
|
||||
# OEM and ODM files
|
||||
#
|
||||
/(odm|vendor/odm)(/.*)? u:object_r:vendor_file:s0
|
||||
/(odm|vendor/odm)/lib(64)?/egl(/.*)? u:object_r:same_process_hal_file:s0
|
||||
/(odm|vendor/odm)/lib(64)?/hw u:object_r:vendor_hal_file:s0
|
||||
/(odm|vendor/odm)/lib(64)?/vndk-sp(/.*)? u:object_r:vndk_sp_file:s0
|
||||
/(odm|vendor/odm)/bin/sh u:object_r:vendor_shell_exec:s0
|
||||
/(odm|vendor/odm)/etc(/.*)? u:object_r:vendor_configs_file:s0
|
||||
/(odm|vendor/odm)/app(/.*)? u:object_r:vendor_app_file:s0
|
||||
/(odm|vendor/odm)/priv-app(/.*)? u:object_r:vendor_app_file:s0
|
||||
/(odm|vendor/odm)/overlay(/.*)? u:object_r:vendor_overlay_file:s0
|
||||
/(odm|vendor/odm)/framework(/.*)? u:object_r:vendor_framework_file:s0
|
||||
|
||||
/oem(/.*)? u:object_r:oemfs:s0
|
||||
|
||||
# The precompiled monolithic sepolicy will be under /odm only when
|
||||
# BOARD_USES_ODMIMAGE is true: a separate odm.img is built.
|
||||
/odm/etc/selinux/precompiled_sepolicy u:object_r:sepolicy_file:s0
|
||||
/odm/etc/selinux/precompiled_sepolicy\.plat_and_mapping\.sha256 u:object_r:sepolicy_file:s0
|
||||
|
||||
/(odm|vendor/odm)/etc/selinux/odm_sepolicy.cil u:object_r:sepolicy_file:s0
|
||||
/(odm|vendor/odm)/etc/selinux/odm_file_contexts u:object_r:file_contexts_file:s0
|
||||
/(odm|vendor/odm)/etc/selinux/odm_seapp_contexts u:object_r:seapp_contexts_file:s0
|
||||
/(odm|vendor/odm)/etc/selinux/odm_property_contexts u:object_r:property_contexts_file:s0
|
||||
/(odm|vendor/odm)/etc/selinux/odm_hwservice_contexts u:object_r:hwservice_contexts_file:s0
|
||||
/(odm|vendor/odm)/etc/selinux/odm_mac_permissions.xml u:object_r:mac_perms_file:s0
|
||||
|
||||
#############################
|
||||
# Product files
|
||||
#
|
||||
/(product|system/product)(/.*)? u:object_r:system_file:s0
|
||||
|
||||
#############################
|
||||
# Data files
|
||||
#
|
||||
# NOTE: When modifying existing label rules, changes may also need to
|
||||
# propagate to the "Expanded data files" section.
|
||||
#
|
||||
/data(/.*)? u:object_r:system_data_file:s0
|
||||
/data/.layout_version u:object_r:install_data_file:s0
|
||||
/data/unencrypted(/.*)? u:object_r:unencrypted_data_file:s0
|
||||
/data/backup(/.*)? u:object_r:backup_data_file:s0
|
||||
/data/secure/backup(/.*)? u:object_r:backup_data_file:s0
|
||||
/data/system/ndebugsocket u:object_r:system_ndebug_socket:s0
|
||||
/data/drm(/.*)? u:object_r:drm_data_file:s0
|
||||
/data/resource-cache(/.*)? u:object_r:resourcecache_data_file:s0
|
||||
/data/dalvik-cache(/.*)? u:object_r:dalvikcache_data_file:s0
|
||||
/data/ota(/.*)? u:object_r:ota_data_file:s0
|
||||
/data/ota_package(/.*)? u:object_r:ota_package_file:s0
|
||||
/data/adb(/.*)? u:object_r:adb_data_file:s0
|
||||
/data/anr(/.*)? u:object_r:anr_data_file:s0
|
||||
/data/app(/.*)? u:object_r:apk_data_file:s0
|
||||
/data/app/[^/]+/oat(/.*)? u:object_r:dalvikcache_data_file:s0
|
||||
/data/app/vmdl[^/]+\.tmp(/.*)? u:object_r:apk_tmp_file:s0
|
||||
/data/app/vmdl[^/]+\.tmp/oat(/.*)? u:object_r:dalvikcache_data_file:s0
|
||||
/data/app-private(/.*)? u:object_r:apk_private_data_file:s0
|
||||
/data/app-private/vmdl.*\.tmp(/.*)? u:object_r:apk_private_tmp_file:s0
|
||||
/data/tombstones(/.*)? u:object_r:tombstone_data_file:s0
|
||||
/data/vendor/tombstones/wifi(/.*)? u:object_r:tombstone_wifi_data_file:s0
|
||||
/data/local/tmp(/.*)? u:object_r:shell_data_file:s0
|
||||
/data/local/tmp/ltp(/.*)? u:object_r:nativetest_data_file:s0
|
||||
/data/local/traces(/.*)? u:object_r:trace_data_file:s0
|
||||
/data/media(/.*)? u:object_r:media_rw_data_file:s0
|
||||
/data/mediadrm(/.*)? u:object_r:media_data_file:s0
|
||||
/data/nativetest(/.*)? u:object_r:nativetest_data_file:s0
|
||||
/data/nativetest64(/.*)? u:object_r:nativetest_data_file:s0
|
||||
/data/property(/.*)? u:object_r:property_data_file:s0
|
||||
/data/preloads(/.*)? u:object_r:preloads_data_file:s0
|
||||
/data/preloads/media(/.*)? u:object_r:preloads_media_file:s0
|
||||
/data/preloads/demo(/.*)? u:object_r:preloads_media_file:s0
|
||||
|
||||
# Misc data
|
||||
/data/misc/adb(/.*)? u:object_r:adb_keys_file:s0
|
||||
/data/misc/apns(/.*)? u:object_r:radio_data_file:s0
|
||||
/data/misc/audio(/.*)? u:object_r:audio_data_file:s0
|
||||
/data/misc/audioserver(/.*)? u:object_r:audioserver_data_file:s0
|
||||
/data/misc/audiohal(/.*)? u:object_r:audiohal_data_file:s0
|
||||
/data/misc/bootstat(/.*)? u:object_r:bootstat_data_file:s0
|
||||
/data/misc/boottrace(/.*)? u:object_r:boottrace_data_file:s0
|
||||
/data/misc/bluetooth(/.*)? u:object_r:bluetooth_data_file:s0
|
||||
/data/misc/bluetooth/logs(/.*)? u:object_r:bluetooth_logs_data_file:s0
|
||||
/data/misc/bluedroid(/.*)? u:object_r:bluetooth_data_file:s0
|
||||
/data/misc/bluedroid/\.a2dp_ctrl u:object_r:bluetooth_socket:s0
|
||||
/data/misc/bluedroid/\.a2dp_data u:object_r:bluetooth_socket:s0
|
||||
/data/misc/camera(/.*)? u:object_r:camera_data_file:s0
|
||||
/data/misc/carrierid(/.*)? u:object_r:radio_data_file:s0
|
||||
/data/misc/dhcp(/.*)? u:object_r:dhcp_data_file:s0
|
||||
/data/misc/dhcp-6.8.2(/.*)? u:object_r:dhcp_data_file:s0
|
||||
/data/misc/gatekeeper(/.*)? u:object_r:gatekeeper_data_file:s0
|
||||
/data/misc/incidents(/.*)? u:object_r:incident_data_file:s0
|
||||
/data/misc/keychain(/.*)? u:object_r:keychain_data_file:s0
|
||||
/data/misc/keystore(/.*)? u:object_r:keystore_data_file:s0
|
||||
/data/misc/logd(/.*)? u:object_r:misc_logd_file:s0
|
||||
/data/misc/media(/.*)? u:object_r:media_data_file:s0
|
||||
/data/misc/net(/.*)? u:object_r:net_data_file:s0
|
||||
/data/misc/network_watchlist(/.*)? u:object_r:network_watchlist_data_file:s0
|
||||
/data/misc/perfetto-traces(/.*)? u:object_r:perfetto_traces_data_file:s0
|
||||
/data/misc/recovery(/.*)? u:object_r:recovery_data_file:s0
|
||||
/data/misc/shared_relro(/.*)? u:object_r:shared_relro_file:s0
|
||||
/data/misc/sms(/.*)? u:object_r:radio_data_file:s0
|
||||
/data/misc/stats-data(/.*)? u:object_r:stats_data_file:s0
|
||||
/data/misc/stats-service(/.*)? u:object_r:stats_data_file:s0
|
||||
/data/misc/systemkeys(/.*)? u:object_r:systemkeys_data_file:s0
|
||||
/data/misc/textclassifier(/.*)? u:object_r:textclassifier_data_file:s0
|
||||
/data/misc/user(/.*)? u:object_r:misc_user_data_file:s0
|
||||
/data/misc/vpn(/.*)? u:object_r:vpn_data_file:s0
|
||||
/data/misc/wifi(/.*)? u:object_r:wifi_data_file:s0
|
||||
/data/misc/wifi/sockets(/.*)? u:object_r:wpa_socket:s0
|
||||
/data/misc/wifi/sockets/wpa_ctrl.* u:object_r:system_wpa_socket:s0
|
||||
/data/misc/zoneinfo(/.*)? u:object_r:zoneinfo_data_file:s0
|
||||
/data/misc/vold(/.*)? u:object_r:vold_data_file:s0
|
||||
/data/misc/perfprofd(/.*)? u:object_r:perfprofd_data_file:s0
|
||||
/data/misc/update_engine(/.*)? u:object_r:update_engine_data_file:s0
|
||||
/data/misc/update_engine_log(/.*)? u:object_r:update_engine_log_data_file:s0
|
||||
/data/system/heapdump(/.*)? u:object_r:heapdump_data_file:s0
|
||||
/data/misc/trace(/.*)? u:object_r:method_trace_data_file:s0
|
||||
/data/misc/wmtrace(/.*)? u:object_r:wm_trace_data_file:s0
|
||||
# TODO(calin) label profile reference differently so that only
|
||||
# profman run as a special user can write to them
|
||||
/data/misc/profiles/cur(/.*)? u:object_r:user_profile_data_file:s0
|
||||
/data/misc/profiles/ref(/.*)? u:object_r:user_profile_data_file:s0
|
||||
/data/misc/profman(/.*)? u:object_r:profman_dump_data_file:s0
|
||||
/data/vendor(/.*)? u:object_r:vendor_data_file:s0
|
||||
/data/vendor_ce(/.*)? u:object_r:vendor_data_file:s0
|
||||
/data/vendor_de(/.*)? u:object_r:vendor_data_file:s0
|
||||
|
||||
# storaged proto files
|
||||
/data/misc_de/[0-9]+/storaged(/.*)? u:object_r:storaged_data_file:s0
|
||||
/data/misc_ce/[0-9]+/storaged(/.*)? u:object_r:storaged_data_file:s0
|
||||
|
||||
# Fingerprint data
|
||||
/data/system/users/[0-9]+/fpdata(/.*)? u:object_r:fingerprintd_data_file:s0
|
||||
|
||||
# Fingerprint vendor data file
|
||||
/data/vendor_de/[0-9]+/fpdata(/.*)? u:object_r:fingerprint_vendor_data_file:s0
|
||||
|
||||
# Bootchart data
|
||||
/data/bootchart(/.*)? u:object_r:bootchart_data_file:s0
|
||||
|
||||
#############################
|
||||
# Expanded data files
|
||||
#
|
||||
/mnt/expand(/.*)? u:object_r:mnt_expand_file:s0
|
||||
/mnt/expand/[^/]+(/.*)? u:object_r:system_data_file:s0
|
||||
/mnt/expand/[^/]+/app(/.*)? u:object_r:apk_data_file:s0
|
||||
/mnt/expand/[^/]+/app/[^/]+/oat(/.*)? u:object_r:dalvikcache_data_file:s0
|
||||
/mnt/expand/[^/]+/app/vmdl[^/]+\.tmp(/.*)? u:object_r:apk_tmp_file:s0
|
||||
/mnt/expand/[^/]+/app/vmdl[^/]+\.tmp/oat(/.*)? u:object_r:dalvikcache_data_file:s0
|
||||
/mnt/expand/[^/]+/local/tmp(/.*)? u:object_r:shell_data_file:s0
|
||||
/mnt/expand/[^/]+/media(/.*)? u:object_r:media_rw_data_file:s0
|
||||
/mnt/expand/[^/]+/misc/vold(/.*)? u:object_r:vold_data_file:s0
|
||||
|
||||
# coredump directory for userdebug/eng devices
|
||||
/cores(/.*)? u:object_r:coredump_file:s0
|
||||
|
||||
# Wallpaper files
|
||||
/data/system/users/[0-9]+/wallpaper_lock_orig u:object_r:wallpaper_file:s0
|
||||
/data/system/users/[0-9]+/wallpaper_lock u:object_r:wallpaper_file:s0
|
||||
/data/system/users/[0-9]+/wallpaper_orig u:object_r:wallpaper_file:s0
|
||||
/data/system/users/[0-9]+/wallpaper u:object_r:wallpaper_file:s0
|
||||
|
||||
# Ringtone files
|
||||
/data/system_de/[0-9]+/ringtones(/.*)? u:object_r:ringtone_file:s0
|
||||
|
||||
# ShortcutManager icons, e.g.
|
||||
# /data/system_ce/0/shortcut_service/bitmaps/com.example.app/1457472879282.png
|
||||
/data/system_ce/[0-9]+/shortcut_service/bitmaps(/.*)? u:object_r:shortcut_manager_icons:s0
|
||||
|
||||
# User icon files
|
||||
/data/system/users/[0-9]+/photo.png u:object_r:icon_file:s0
|
||||
|
||||
# vold per-user data
|
||||
/data/misc_de/[0-9]+/vold(/.*)? u:object_r:vold_data_file:s0
|
||||
/data/misc_ce/[0-9]+/vold(/.*)? u:object_r:vold_data_file:s0
|
||||
|
||||
#############################
|
||||
# efs files
|
||||
#
|
||||
/efs(/.*)? u:object_r:efs_file:s0
|
||||
|
||||
#############################
|
||||
# Cache files
|
||||
#
|
||||
/cache(/.*)? u:object_r:cache_file:s0
|
||||
/cache/recovery(/.*)? u:object_r:cache_recovery_file:s0
|
||||
# General backup/restore interchange with apps
|
||||
/cache/backup_stage(/.*)? u:object_r:cache_backup_file:s0
|
||||
# LocalTransport (backup) uses this subtree
|
||||
/cache/backup(/.*)? u:object_r:cache_private_backup_file:s0
|
||||
|
||||
/data/cache(/.*)? u:object_r:cache_file:s0
|
||||
/data/cache/recovery(/.*)? u:object_r:cache_recovery_file:s0
|
||||
# General backup/restore interchange with apps
|
||||
/data/cache/backup_stage(/.*)? u:object_r:cache_backup_file:s0
|
||||
# LocalTransport (backup) uses this subtree
|
||||
/data/cache/backup(/.*)? u:object_r:cache_private_backup_file:s0
|
||||
|
||||
#############################
|
||||
# Metadata files
|
||||
#
|
||||
/metadata(/.*)? u:object_r:metadata_file:s0
|
||||
/metadata/vold(/.*)? u:object_r:vold_metadata_file:s0
|
||||
|
||||
#############################
|
||||
# asec containers
|
||||
/mnt/asec(/.*)? u:object_r:asec_apk_file:s0
|
||||
/mnt/asec/[^/]+/[^/]+\.zip u:object_r:asec_public_file:s0
|
||||
/mnt/asec/[^/]+/lib(/.*)? u:object_r:asec_public_file:s0
|
||||
/data/app-asec(/.*)? u:object_r:asec_image_file:s0
|
||||
|
||||
#############################
|
||||
# external storage
|
||||
/mnt/media_rw(/.*)? u:object_r:mnt_media_rw_file:s0
|
||||
/mnt/user(/.*)? u:object_r:mnt_user_file:s0
|
||||
/mnt/runtime(/.*)? u:object_r:storage_file:s0
|
||||
/storage(/.*)? u:object_r:storage_file:s0
|
||||
|
||||
#############################
|
||||
# mount point for read-write vendor partitions
|
||||
/mnt/vendor(/.*)? u:object_r:mnt_vendor_file:s0
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
/data/asan/system/lib(/.*)? u:object_r:system_file:s0
|
||||
/data/asan/system/lib64(/.*)? u:object_r:system_file:s0
|
||||
/data/asan/vendor/lib(/.*)? u:object_r:system_file:s0
|
||||
/data/asan/vendor/lib64(/.*)? u:object_r:system_file:s0
|
||||
/data/asan/odm/lib(/.*)? u:object_r:system_file:s0
|
||||
/data/asan/odm/lib64(/.*)? u:object_r:system_file:s0
|
||||
/system/bin/asan_extract u:object_r:asan_extract_exec:s0
|
||||
/system/bin/asanwrapper u:object_r:asanwrapper_exec:s0
|
||||
/system/bin/asan/app_process u:object_r:zygote_exec:s0
|
||||
/system/bin/asan/app_process32 u:object_r:zygote_exec:s0
|
||||
/system/bin/asan/app_process64 u:object_r:zygote_exec:s0
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
typeattribute fingerprintd coredomain;
|
||||
|
||||
init_daemon_domain(fingerprintd)
|
||||
|
|
@ -1,23 +0,0 @@
|
|||
# Label inodes via getxattr.
|
||||
fs_use_xattr yaffs2 u:object_r:labeledfs:s0;
|
||||
fs_use_xattr jffs2 u:object_r:labeledfs:s0;
|
||||
fs_use_xattr ext2 u:object_r:labeledfs:s0;
|
||||
fs_use_xattr ext3 u:object_r:labeledfs:s0;
|
||||
fs_use_xattr ext4 u:object_r:labeledfs:s0;
|
||||
fs_use_xattr xfs u:object_r:labeledfs:s0;
|
||||
fs_use_xattr btrfs u:object_r:labeledfs:s0;
|
||||
fs_use_xattr f2fs u:object_r:labeledfs:s0;
|
||||
fs_use_xattr squashfs u:object_r:labeledfs:s0;
|
||||
|
||||
# Label inodes from task label.
|
||||
fs_use_task pipefs u:object_r:pipefs:s0;
|
||||
fs_use_task sockfs u:object_r:sockfs:s0;
|
||||
|
||||
# Label inodes from combination of task label and fs label.
|
||||
# Define type_transition rules if you want per-domain types.
|
||||
fs_use_trans devpts u:object_r:devpts:s0;
|
||||
fs_use_trans tmpfs u:object_r:tmpfs:s0;
|
||||
fs_use_trans devtmpfs u:object_r:device:s0;
|
||||
fs_use_trans shm u:object_r:shm:s0;
|
||||
fs_use_trans mqueue u:object_r:mqueue:s0;
|
||||
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
typeattribute fsck coredomain;
|
||||
|
||||
init_daemon_domain(fsck)
|
||||
|
||||
allow fsck metadata_block_device:blk_file rw_file_perms;
|
||||
|
|
@ -1 +0,0 @@
|
|||
typeattribute fsck_untrusted coredomain;
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
typeattribute gatekeeperd coredomain;
|
||||
|
||||
init_daemon_domain(gatekeeperd)
|
||||
|
|
@ -1,244 +0,0 @@
|
|||
# Label inodes with the fs label.
|
||||
genfscon rootfs / u:object_r:rootfs:s0
|
||||
# proc labeling can be further refined (longest matching prefix).
|
||||
genfscon proc / u:object_r:proc:s0
|
||||
genfscon proc /asound u:object_r:proc_asound:s0
|
||||
genfscon proc /buddyinfo u:object_r:proc_buddyinfo:s0
|
||||
genfscon proc /cmdline u:object_r:proc_cmdline:s0
|
||||
genfscon proc /config.gz u:object_r:config_gz:s0
|
||||
genfscon proc /diskstats u:object_r:proc_diskstats:s0
|
||||
genfscon proc /filesystems u:object_r:proc_filesystems:s0
|
||||
genfscon proc /interrupts u:object_r:proc_interrupts:s0
|
||||
genfscon proc /iomem u:object_r:proc_iomem:s0
|
||||
genfscon proc /kmsg u:object_r:proc_kmsg:s0
|
||||
genfscon proc /loadavg u:object_r:proc_loadavg:s0
|
||||
genfscon proc /meminfo u:object_r:proc_meminfo:s0
|
||||
genfscon proc /misc u:object_r:proc_misc:s0
|
||||
genfscon proc /modules u:object_r:proc_modules:s0
|
||||
genfscon proc /mounts u:object_r:proc_mounts:s0
|
||||
genfscon proc /net u:object_r:proc_net:s0
|
||||
genfscon proc /net/xt_qtaguid/ctrl u:object_r:qtaguid_proc:s0
|
||||
genfscon proc /net/xt_qtaguid/ u:object_r:proc_qtaguid_stat:s0
|
||||
genfscon proc /cpuinfo u:object_r:proc_cpuinfo:s0
|
||||
genfscon proc /pagetypeinfo u:object_r:proc_pagetypeinfo:s0
|
||||
genfscon proc /softirqs u:object_r:proc_timer:s0
|
||||
genfscon proc /stat u:object_r:proc_stat:s0
|
||||
genfscon proc /swaps u:object_r:proc_swaps:s0
|
||||
genfscon proc /sysrq-trigger u:object_r:proc_sysrq:s0
|
||||
genfscon proc /sys/abi/swp u:object_r:proc_abi:s0
|
||||
genfscon proc /sys/fs/pipe-max-size u:object_r:proc_pipe_conf:s0
|
||||
genfscon proc /sys/fs/protected_hardlinks u:object_r:proc_security:s0
|
||||
genfscon proc /sys/fs/protected_symlinks u:object_r:proc_security:s0
|
||||
genfscon proc /sys/fs/suid_dumpable u:object_r:proc_security:s0
|
||||
genfscon proc /sys/kernel/core_pattern u:object_r:usermodehelper:s0
|
||||
genfscon proc /sys/kernel/core_pipe_limit u:object_r:usermodehelper:s0
|
||||
genfscon proc /sys/kernel/domainname u:object_r:proc_hostname:s0
|
||||
genfscon proc /sys/kernel/dmesg_restrict u:object_r:proc_security:s0
|
||||
genfscon proc /sys/kernel/hostname u:object_r:proc_hostname:s0
|
||||
genfscon proc /sys/kernel/hotplug u:object_r:usermodehelper:s0
|
||||
genfscon proc /sys/kernel/hung_task_timeout_secs u:object_r:proc_hung_task:s0
|
||||
genfscon proc /sys/kernel/kptr_restrict u:object_r:proc_security:s0
|
||||
genfscon proc /sys/kernel/modprobe u:object_r:usermodehelper:s0
|
||||
genfscon proc /sys/kernel/modules_disabled u:object_r:proc_security:s0
|
||||
genfscon proc /sys/kernel/panic_on_oops u:object_r:proc_panic:s0
|
||||
genfscon proc /sys/kernel/perf_event_max_sample_rate u:object_r:proc_perf:s0
|
||||
genfscon proc /sys/kernel/perf_event_paranoid u:object_r:proc_perf:s0
|
||||
genfscon proc /sys/kernel/pid_max u:object_r:proc_pid_max:s0
|
||||
genfscon proc /sys/kernel/poweroff_cmd u:object_r:usermodehelper:s0
|
||||
genfscon proc /sys/kernel/random u:object_r:proc_random:s0
|
||||
genfscon proc /sys/kernel/randomize_va_space u:object_r:proc_security:s0
|
||||
genfscon proc /sys/kernel/sched_child_runs_first u:object_r:proc_sched:s0
|
||||
genfscon proc /sys/kernel/sched_latency_ns u:object_r:proc_sched:s0
|
||||
genfscon proc /sys/kernel/sched_rt_period_us u:object_r:proc_sched:s0
|
||||
genfscon proc /sys/kernel/sched_rt_runtime_us u:object_r:proc_sched:s0
|
||||
genfscon proc /sys/kernel/sched_schedstats u:object_r:proc_sched:s0
|
||||
genfscon proc /sys/kernel/sched_tunable_scaling u:object_r:proc_sched:s0
|
||||
genfscon proc /sys/kernel/sched_wakeup_granularity_ns u:object_r:proc_sched:s0
|
||||
genfscon proc /sys/kernel/sysrq u:object_r:proc_sysrq:s0
|
||||
genfscon proc /sys/kernel/usermodehelper u:object_r:usermodehelper:s0
|
||||
genfscon proc /sys/net u:object_r:proc_net:s0
|
||||
genfscon proc /sys/vm/dirty_background_ratio u:object_r:proc_dirty:s0
|
||||
genfscon proc /sys/vm/dirty_expire_centisecs u:object_r:proc_dirty:s0
|
||||
genfscon proc /sys/vm/extra_free_kbytes u:object_r:proc_extra_free_kbytes:s0
|
||||
genfscon proc /sys/vm/max_map_count u:object_r:proc_max_map_count:s0
|
||||
genfscon proc /sys/vm/mmap_min_addr u:object_r:proc_security:s0
|
||||
genfscon proc /sys/vm/mmap_rnd_bits u:object_r:proc_security:s0
|
||||
genfscon proc /sys/vm/mmap_rnd_compat_bits u:object_r:proc_security:s0
|
||||
genfscon proc /sys/vm/page-cluster u:object_r:proc_page_cluster:s0
|
||||
genfscon proc /sys/vm/drop_caches u:object_r:proc_drop_caches:s0
|
||||
genfscon proc /sys/vm/overcommit_memory u:object_r:proc_overcommit_memory:s0
|
||||
genfscon proc /sys/vm/min_free_order_shift u:object_r:proc_min_free_order_shift:s0
|
||||
genfscon proc /timer_list u:object_r:proc_timer:s0
|
||||
genfscon proc /timer_stats u:object_r:proc_timer:s0
|
||||
genfscon proc /tty/drivers u:object_r:proc_tty_drivers:s0
|
||||
genfscon proc /uid/ u:object_r:proc_uid_time_in_state:s0
|
||||
genfscon proc /uid_cputime/show_uid_stat u:object_r:proc_uid_cputime_showstat:s0
|
||||
genfscon proc /uid_cputime/remove_uid_range u:object_r:proc_uid_cputime_removeuid:s0
|
||||
genfscon proc /uid_io/stats u:object_r:proc_uid_io_stats:s0
|
||||
genfscon proc /uid_procstat/set u:object_r:proc_uid_procstat_set:s0
|
||||
genfscon proc /uid_time_in_state u:object_r:proc_uid_time_in_state:s0
|
||||
genfscon proc /uid_concurrent_active_time u:object_r:proc_uid_concurrent_active_time:s0
|
||||
genfscon proc /uid_concurrent_policy_time u:object_r:proc_uid_concurrent_policy_time:s0
|
||||
genfscon proc /uid_cpupower/ u:object_r:proc_uid_cpupower:s0
|
||||
genfscon proc /uptime u:object_r:proc_uptime:s0
|
||||
genfscon proc /version u:object_r:proc_version:s0
|
||||
genfscon proc /vmallocinfo u:object_r:proc_vmallocinfo:s0
|
||||
genfscon proc /vmstat u:object_r:proc_vmstat:s0
|
||||
genfscon proc /zoneinfo u:object_r:proc_zoneinfo:s0
|
||||
|
||||
# selinuxfs booleans can be individually labeled.
|
||||
genfscon selinuxfs / u:object_r:selinuxfs:s0
|
||||
genfscon cgroup / u:object_r:cgroup:s0
|
||||
genfscon cgroup2 / u:object_r:cgroup_bpf:s0
|
||||
# sysfs labels can be set by userspace.
|
||||
genfscon sysfs / u:object_r:sysfs:s0
|
||||
genfscon sysfs /devices/system/cpu u:object_r:sysfs_devices_system_cpu:s0
|
||||
genfscon sysfs /class/android_usb u:object_r:sysfs_android_usb:s0
|
||||
genfscon sysfs /class/leds u:object_r:sysfs_leds:s0
|
||||
genfscon sysfs /class/net u:object_r:sysfs_net:s0
|
||||
genfscon sysfs /class/rtc u:object_r:sysfs_rtc:s0
|
||||
genfscon sysfs /class/switch u:object_r:sysfs_switch:s0
|
||||
genfscon sysfs /devices/platform/nfc-power/nfc_power u:object_r:sysfs_nfc_power_writable:s0
|
||||
genfscon sysfs /devices/virtual/android_usb u:object_r:sysfs_android_usb:s0
|
||||
genfscon sysfs /devices/virtual/block/dm- u:object_r:sysfs_dm:s0
|
||||
genfscon sysfs /devices/virtual/block/zram0 u:object_r:sysfs_zram:s0
|
||||
genfscon sysfs /devices/virtual/block/zram1 u:object_r:sysfs_zram:s0
|
||||
genfscon sysfs /devices/virtual/block/zram0/uevent u:object_r:sysfs_zram_uevent:s0
|
||||
genfscon sysfs /devices/virtual/block/zram1/uevent u:object_r:sysfs_zram_uevent:s0
|
||||
genfscon sysfs /devices/virtual/misc/hw_random u:object_r:sysfs_hwrandom:s0
|
||||
genfscon sysfs /devices/virtual/switch u:object_r:sysfs_switch:s0
|
||||
genfscon sysfs /firmware/devicetree/base/firmware/android u:object_r:sysfs_dt_firmware_android:s0
|
||||
genfscon sysfs /fs/ext4/features u:object_r:sysfs_fs_ext4_features:s0
|
||||
genfscon sysfs /power/autosleep u:object_r:sysfs_power:s0
|
||||
genfscon sysfs /power/state u:object_r:sysfs_power:s0
|
||||
genfscon sysfs /power/wakeup_count u:object_r:sysfs_power:s0
|
||||
genfscon sysfs /power/wake_lock u:object_r:sysfs_wake_lock:s0
|
||||
genfscon sysfs /power/wake_unlock u:object_r:sysfs_wake_lock:s0
|
||||
genfscon sysfs /kernel/memory_state_time u:object_r:sysfs_power:s0
|
||||
genfscon sysfs /kernel/ipv4 u:object_r:sysfs_ipv4:s0
|
||||
genfscon sysfs /kernel/notes u:object_r:sysfs_kernel_notes:s0
|
||||
genfscon sysfs /kernel/uevent_helper u:object_r:sysfs_usermodehelper:s0
|
||||
genfscon sysfs /kernel/wakeup_reasons u:object_r:sysfs_wakeup_reasons:s0
|
||||
genfscon sysfs /module/lowmemorykiller u:object_r:sysfs_lowmemorykiller:s0
|
||||
genfscon sysfs /module/wlan/parameters/fwpath u:object_r:sysfs_wlan_fwpath:s0
|
||||
genfscon sysfs /devices/virtual/timed_output/vibrator/enable u:object_r:sysfs_vibrator:s0
|
||||
|
||||
genfscon debugfs /mmc0 u:object_r:debugfs_mmc:s0
|
||||
genfscon debugfs /tracing u:object_r:debugfs_tracing_debug:s0
|
||||
genfscon tracefs / u:object_r:debugfs_tracing_debug:s0
|
||||
genfscon debugfs /tracing/tracing_on u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /tracing_on u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/trace u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /trace u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/per_cpu/cpu u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /per_cpu/cpu u:object_r:debugfs_tracing:s0
|
||||
|
||||
genfscon debugfs /tracing/instances u:object_r:debugfs_tracing_instances:s0
|
||||
genfscon tracefs /instances u:object_r:debugfs_tracing_instances:s0
|
||||
genfscon debugfs /tracing/instances/wifi u:object_r:debugfs_wifi_tracing:s0
|
||||
genfscon tracefs /instances/wifi u:object_r:debugfs_wifi_tracing:s0
|
||||
genfscon debugfs /tracing/trace_marker u:object_r:debugfs_trace_marker:s0
|
||||
genfscon tracefs /trace_marker u:object_r:debugfs_trace_marker:s0
|
||||
genfscon debugfs /wakeup_sources u:object_r:debugfs_wakeup_sources:s0
|
||||
|
||||
genfscon debugfs /tracing/events/workqueue/ u:object_r:debugfs_tracing_debug:s0
|
||||
genfscon debugfs /tracing/events/regulator/ u:object_r:debugfs_tracing_debug:s0
|
||||
genfscon debugfs /tracing/events/pagecache/ u:object_r:debugfs_tracing_debug:s0
|
||||
genfscon debugfs /tracing/events/irq/ u:object_r:debugfs_tracing_debug:s0
|
||||
genfscon debugfs /tracing/events/ipi/ u:object_r:debugfs_tracing_debug:s0
|
||||
genfscon debugfs /tracing/events/f2fs/f2fs_sync_file_enter/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/f2fs/f2fs_sync_file_exit/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/f2fs/f2fs_write_begin/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/f2fs/f2fs_write_end/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/ext4/ext4_da_write_begin/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/ext4/ext4_da_write_end/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/ext4/ext4_sync_file_enter/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/ext4/ext4_sync_file_exit/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/block/block_rq_issue/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/block/block_rq_complete/ u:object_r:debugfs_tracing:s0
|
||||
|
||||
genfscon tracefs /events/workqueue/ u:object_r:debugfs_tracing_debug:s0
|
||||
genfscon tracefs /events/regulator/ u:object_r:debugfs_tracing_debug:s0
|
||||
genfscon tracefs /events/pagecache/ u:object_r:debugfs_tracing_debug:s0
|
||||
genfscon tracefs /events/irq/ u:object_r:debugfs_tracing_debug:s0
|
||||
genfscon tracefs /events/ipi/ u:object_r:debugfs_tracing_debug:s0
|
||||
genfscon tracefs /events/f2fs/f2fs_sync_file_enter/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/f2fs/f2fs_sync_file_exit/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/f2fs/f2fs_write_begin/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/f2fs/f2fs_write_end/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/ext4/ext4_da_write_begin/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/ext4/ext4_da_write_end/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/ext4/ext4_sync_file_enter/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/ext4/ext4_sync_file_exit/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/block/block_rq_issue/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/block/block_rq_complete/ u:object_r:debugfs_tracing:s0
|
||||
|
||||
genfscon tracefs /trace_clock u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /buffer_size_kb u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /options/overwrite u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /options/print-tgid u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /saved_cmdlines_size u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/sched/sched_switch/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/sched/sched_wakeup/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/sched/sched_blocked_reason/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/sched/sched_cpu_hotplug/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/cgroup/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/power/cpu_frequency/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/power/cpu_idle/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/power/clock_set_rate/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/power/cpu_frequency_limits/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/cpufreq_interactive/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/vmscan/mm_vmscan_direct_reclaim_begin/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/vmscan/mm_vmscan_direct_reclaim_end/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/vmscan/mm_vmscan_kswapd_wake/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/vmscan/mm_vmscan_kswapd_sleep/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/binder/binder_transaction/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/binder/binder_transaction_received/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/binder/binder_lock/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/binder/binder_locked/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/binder/binder_unlock/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/lowmemorykiller/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/sync/ u:object_r:debugfs_tracing:s0
|
||||
genfscon tracefs /events/fence/ u:object_r:debugfs_tracing:s0
|
||||
|
||||
genfscon debugfs /tracing/trace_clock u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/buffer_size_kb u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/options/overwrite u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/options/print-tgid u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/saved_cmdlines_size u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/sched/sched_switch/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/sched/sched_wakeup/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/sched/sched_blocked_reason/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/sched/sched_cpu_hotplug/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/cgroup/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/power/cpu_frequency/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/power/cpu_idle/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/power/clock_set_rate/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/power/cpu_frequency_limits/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/cpufreq_interactive/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/vmscan/mm_vmscan_direct_reclaim_begin/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/vmscan/mm_vmscan_direct_reclaim_end/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/vmscan/mm_vmscan_kswapd_wake/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/vmscan/mm_vmscan_kswapd_sleep/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/binder/binder_transaction/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/binder/binder_transaction_received/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/binder/binder_lock/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/binder/binder_locked/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/binder/binder_unlock/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/lowmemorykiller/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/sync/ u:object_r:debugfs_tracing:s0
|
||||
genfscon debugfs /tracing/events/fence/ u:object_r:debugfs_tracing:s0
|
||||
|
||||
genfscon inotifyfs / u:object_r:inotify:s0
|
||||
genfscon vfat / u:object_r:vfat:s0
|
||||
genfscon exfat / u:object_r:exfat:s0
|
||||
genfscon debugfs / u:object_r:debugfs:s0
|
||||
genfscon fuse / u:object_r:fuse:s0
|
||||
genfscon configfs / u:object_r:configfs:s0
|
||||
genfscon sdcardfs / u:object_r:sdcardfs:s0
|
||||
genfscon esdfs / u:object_r:sdcardfs:s0
|
||||
genfscon pstore / u:object_r:pstorefs:s0
|
||||
genfscon functionfs / u:object_r:functionfs:s0
|
||||
genfscon usbfs / u:object_r:usbfs:s0
|
||||
genfscon binfmt_misc / u:object_r:binfmt_miscfs:s0
|
||||
genfscon bpf / u:object_r:fs_bpf:s0
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
type hal_allocator_default, domain, coredomain;
|
||||
hal_server_domain(hal_allocator_default, hal_allocator)
|
||||
|
||||
type hal_allocator_default_exec, exec_type, file_type;
|
||||
init_daemon_domain(hal_allocator_default)
|
||||
|
|
@ -1,13 +0,0 @@
|
|||
###
|
||||
### Rules for all domains which are clients of a HAL
|
||||
###
|
||||
|
||||
# Find out whether a HAL in passthrough/in-process mode or
|
||||
# binderized/out-of-process mode
|
||||
hwbinder_use(halclientdomain)
|
||||
|
||||
# Used to wait for hwservicemanager
|
||||
get_prop(halclientdomain, hwservicemanager_prop)
|
||||
|
||||
# Wait for HAL server to be up (used by getService)
|
||||
allow halclientdomain hidl_manager_hwservice:hwservice_manager find;
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
###
|
||||
### Rules for all domains which offer a HAL service over HwBinder
|
||||
###
|
||||
|
||||
# Register the HAL service with hwservicemanager
|
||||
hwbinder_use(halserverdomain)
|
||||
|
||||
# Find HAL implementations
|
||||
allow halserverdomain system_file:dir r_dir_perms;
|
||||
|
||||
# Used to wait for hwservicemanager
|
||||
get_prop(halserverdomain, hwservicemanager_prop)
|
||||
|
|
@ -1,6 +0,0 @@
|
|||
typeattribute healthd coredomain;
|
||||
|
||||
init_daemon_domain(healthd)
|
||||
|
||||
# Allow healthd to serve health HAL
|
||||
hal_server_domain(healthd, hal_health)
|
||||
|
|
@ -1,71 +0,0 @@
|
|||
android.frameworks.displayservice::IDisplayService u:object_r:fwk_display_hwservice:s0
|
||||
android.frameworks.schedulerservice::ISchedulingPolicyService u:object_r:fwk_scheduler_hwservice:s0
|
||||
android.frameworks.sensorservice::ISensorManager u:object_r:fwk_sensor_hwservice:s0
|
||||
android.hardware.audio.effect::IEffectsFactory u:object_r:hal_audio_hwservice:s0
|
||||
android.hardware.audio::IDevicesFactory u:object_r:hal_audio_hwservice:s0
|
||||
android.hardware.authsecret::IAuthSecret u:object_r:hal_authsecret_hwservice:s0
|
||||
android.hardware.automotive.audiocontrol::IAudioControl u:object_r:hal_audiocontrol_hwservice:s0
|
||||
android.hardware.automotive.evs::IEvsEnumerator u:object_r:hal_evs_hwservice:s0
|
||||
android.hardware.automotive.vehicle::IVehicle u:object_r:hal_vehicle_hwservice:s0
|
||||
android.hardware.biometrics.fingerprint::IBiometricsFingerprint u:object_r:hal_fingerprint_hwservice:s0
|
||||
android.hardware.bluetooth::IBluetoothHci u:object_r:hal_bluetooth_hwservice:s0
|
||||
android.hardware.bluetooth.a2dp::IBluetoothAudioOffload u:object_r:hal_audio_hwservice:s0
|
||||
android.hardware.boot::IBootControl u:object_r:hal_bootctl_hwservice:s0
|
||||
android.hardware.broadcastradio::IBroadcastRadio u:object_r:hal_broadcastradio_hwservice:s0
|
||||
android.hardware.broadcastradio::IBroadcastRadioFactory u:object_r:hal_broadcastradio_hwservice:s0
|
||||
android.hardware.camera.provider::ICameraProvider u:object_r:hal_camera_hwservice:s0
|
||||
android.hardware.configstore::ISurfaceFlingerConfigs u:object_r:hal_configstore_ISurfaceFlingerConfigs:s0
|
||||
android.hardware.confirmationui::IConfirmationUI u:object_r:hal_confirmationui_hwservice:s0
|
||||
android.hardware.contexthub::IContexthub u:object_r:hal_contexthub_hwservice:s0
|
||||
android.hardware.cas::IMediaCasService u:object_r:hal_cas_hwservice:s0
|
||||
android.hardware.drm::ICryptoFactory u:object_r:hal_drm_hwservice:s0
|
||||
android.hardware.drm::IDrmFactory u:object_r:hal_drm_hwservice:s0
|
||||
android.hardware.dumpstate::IDumpstateDevice u:object_r:hal_dumpstate_hwservice:s0
|
||||
android.hardware.gatekeeper::IGatekeeper u:object_r:hal_gatekeeper_hwservice:s0
|
||||
android.hardware.gnss::IGnss u:object_r:hal_gnss_hwservice:s0
|
||||
android.hardware.graphics.allocator::IAllocator u:object_r:hal_graphics_allocator_hwservice:s0
|
||||
android.hardware.graphics.composer::IComposer u:object_r:hal_graphics_composer_hwservice:s0
|
||||
android.hardware.graphics.mapper::IMapper u:object_r:hal_graphics_mapper_hwservice:s0
|
||||
android.hardware.health::IHealth u:object_r:hal_health_hwservice:s0
|
||||
android.hardware.ir::IConsumerIr u:object_r:hal_ir_hwservice:s0
|
||||
android.hardware.keymaster::IKeymasterDevice u:object_r:hal_keymaster_hwservice:s0
|
||||
android.hardware.light::ILight u:object_r:hal_light_hwservice:s0
|
||||
android.hardware.lowpan::ILowpanDevice u:object_r:hal_lowpan_hwservice:s0
|
||||
android.hardware.media.omx::IOmx u:object_r:hal_omx_hwservice:s0
|
||||
android.hardware.media.omx::IOmxStore u:object_r:hal_omx_hwservice:s0
|
||||
android.hardware.memtrack::IMemtrack u:object_r:hal_memtrack_hwservice:s0
|
||||
android.hardware.neuralnetworks::IDevice u:object_r:hal_neuralnetworks_hwservice:s0
|
||||
android.hardware.nfc::INfc u:object_r:hal_nfc_hwservice:s0
|
||||
android.hardware.oemlock::IOemLock u:object_r:hal_oemlock_hwservice:s0
|
||||
android.hardware.power::IPower u:object_r:hal_power_hwservice:s0
|
||||
android.hardware.radio.config::IRadioConfig u:object_r:hal_telephony_hwservice:s0
|
||||
android.hardware.radio.deprecated::IOemHook u:object_r:hal_telephony_hwservice:s0
|
||||
android.hardware.radio::IRadio u:object_r:hal_telephony_hwservice:s0
|
||||
android.hardware.radio::ISap u:object_r:hal_telephony_hwservice:s0
|
||||
android.hardware.renderscript::IDevice u:object_r:hal_renderscript_hwservice:s0
|
||||
android.hardware.secure_element::ISecureElement u:object_r:hal_secure_element_hwservice:s0
|
||||
android.hardware.sensors::ISensors u:object_r:hal_sensors_hwservice:s0
|
||||
android.hardware.soundtrigger::ISoundTriggerHw u:object_r:hal_audio_hwservice:s0
|
||||
android.hardware.tetheroffload.config::IOffloadConfig u:object_r:hal_tetheroffload_hwservice:s0
|
||||
android.hardware.tetheroffload.control::IOffloadControl u:object_r:hal_tetheroffload_hwservice:s0
|
||||
android.hardware.thermal::IThermal u:object_r:hal_thermal_hwservice:s0
|
||||
android.hardware.thermal::IThermalCallback u:object_r:thermalcallback_hwservice:s0
|
||||
android.hardware.tv.cec::IHdmiCec u:object_r:hal_tv_cec_hwservice:s0
|
||||
android.hardware.tv.input::ITvInput u:object_r:hal_tv_input_hwservice:s0
|
||||
android.hardware.usb::IUsb u:object_r:hal_usb_hwservice:s0
|
||||
android.hardware.usb.gadget::IUsbGadget u:object_r:hal_usb_gadget_hwservice:s0
|
||||
android.hardware.vibrator::IVibrator u:object_r:hal_vibrator_hwservice:s0
|
||||
android.hardware.vr::IVr u:object_r:hal_vr_hwservice:s0
|
||||
android.hardware.weaver::IWeaver u:object_r:hal_weaver_hwservice:s0
|
||||
android.hardware.wifi::IWifi u:object_r:hal_wifi_hwservice:s0
|
||||
android.hardware.wifi.hostapd::IHostapd u:object_r:hal_wifi_hostapd_hwservice:s0
|
||||
android.hardware.wifi.offload::IOffload u:object_r:hal_wifi_offload_hwservice:s0
|
||||
android.hardware.wifi.supplicant::ISupplicant u:object_r:hal_wifi_supplicant_hwservice:s0
|
||||
android.hidl.allocator::IAllocator u:object_r:hidl_allocator_hwservice:s0
|
||||
android.hidl.base::IBase u:object_r:hidl_base_hwservice:s0
|
||||
android.hidl.manager::IServiceManager u:object_r:hidl_manager_hwservice:s0
|
||||
android.hidl.memory::IMapper u:object_r:hidl_memory_hwservice:s0
|
||||
android.hidl.token::ITokenManager u:object_r:hidl_token_hwservice:s0
|
||||
android.system.net.netd::INetd u:object_r:system_net_netd_hwservice:s0
|
||||
android.system.wifi.keystore::IKeystore u:object_r:system_wifi_keystore_hwservice:s0
|
||||
* u:object_r:default_android_hwservice:s0
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
typeattribute hwservicemanager coredomain;
|
||||
|
||||
init_daemon_domain(hwservicemanager)
|
||||
|
||||
add_hwservice(hwservicemanager, hidl_manager_hwservice)
|
||||
add_hwservice(hwservicemanager, hidl_token_hwservice)
|
||||
|
||||
set_prop(hwservicemanager, ctl_interface_start_prop)
|
||||
|
|
@ -1 +0,0 @@
|
|||
typeattribute idmap coredomain;
|
||||
|
|
@ -1,30 +0,0 @@
|
|||
typeattribute incident coredomain;
|
||||
|
||||
type incident_exec, exec_type, file_type;
|
||||
|
||||
# switch to incident domain for incident command
|
||||
domain_auto_trans(shell, incident_exec, incident)
|
||||
|
||||
# allow incident access to stdout from its parent shell.
|
||||
allow incident shell:fd use;
|
||||
|
||||
# allow incident be able to output data for CTS to fetch.
|
||||
allow incident devpts:chr_file { read write };
|
||||
|
||||
# allow incident to communicate use, read and write over the adb
|
||||
# connection.
|
||||
allow incident adbd:fd use;
|
||||
allow incident adbd:unix_stream_socket { read write };
|
||||
|
||||
# allow adbd to reap incident
|
||||
allow incident adbd:process { sigchld };
|
||||
|
||||
# Allow the incident command to talk to the incidentd over the binder, and get
|
||||
# back the incident report data from a ParcelFileDescriptor.
|
||||
binder_use(incident)
|
||||
allow incident incident_service:service_manager find;
|
||||
binder_call(incident, incidentd)
|
||||
allow incident incidentd:fifo_file write;
|
||||
|
||||
# only allow incident being called by shell
|
||||
neverallow { domain -su -shell -incident } incident_exec:file { execute execute_no_trans };
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
typeattribute incident_helper coredomain;
|
||||
|
||||
type incident_helper_exec, exec_type, file_type;
|
||||
|
||||
# switch to incident_helper domain for incident_helper command
|
||||
domain_auto_trans(incidentd, incident_helper_exec, incident_helper)
|
||||
|
||||
# use pipe to transmit data from/to incidentd/incident_helper for parsing
|
||||
allow incident_helper { shell incident incidentd }:fd use;
|
||||
allow incident_helper { shell incident incidentd }:fifo_file { getattr read write };
|
||||
allow incident_helper incidentd:unix_stream_socket { read write };
|
||||
|
||||
# only allow incidentd and shell to call incident_helper
|
||||
neverallow { domain -incidentd -incident_helper -shell } incident_helper_exec:file { execute execute_no_trans };
|
||||
|
|
@ -1,166 +0,0 @@
|
|||
typeattribute incidentd coredomain;
|
||||
typeattribute incidentd mlstrustedsubject;
|
||||
|
||||
init_daemon_domain(incidentd)
|
||||
type incidentd_exec, exec_type, file_type;
|
||||
binder_use(incidentd)
|
||||
wakelock_use(incidentd)
|
||||
|
||||
# Allow incidentd to scan through /proc/pid for all processes
|
||||
r_dir_file(incidentd, domain)
|
||||
|
||||
# Allow incidentd to kill incident_helper when timeout
|
||||
allow incidentd incident_helper:process sigkill;
|
||||
|
||||
# Allow executing files on system, such as:
|
||||
# /system/bin/toolbox
|
||||
# /system/bin/logcat
|
||||
# /system/bin/dumpsys
|
||||
allow incidentd system_file:file execute_no_trans;
|
||||
allow incidentd toolbox_exec:file rx_file_perms;
|
||||
|
||||
# section id 2001, allow reading /proc/pagetypeinfo
|
||||
allow incidentd proc_pagetypeinfo:file r_file_perms;
|
||||
|
||||
# section id 2002, allow reading /d/wakeup_sources
|
||||
allow incidentd debugfs_wakeup_sources:file r_file_perms;
|
||||
|
||||
# section id 2003, allow executing top
|
||||
allow incidentd proc_meminfo:file { open read };
|
||||
|
||||
# section id 2004, allow reading /sys/devices/system/cpu/cpufreq/all_time_in_state
|
||||
allow incidentd sysfs_devices_system_cpu:file r_file_perms;
|
||||
|
||||
# section id 2005, allow reading ps dump in full
|
||||
allow incidentd domain:process getattr;
|
||||
|
||||
# section id 2006, allow reading /sys/class/power_supply/bms/battery_type
|
||||
allow incidentd sysfs_batteryinfo:dir { search };
|
||||
allow incidentd sysfs_batteryinfo:file r_file_perms;
|
||||
|
||||
# section id 2007, allow reading LAST_KMSG /sys/fs/pstore/console-ramoops
|
||||
userdebug_or_eng(`allow incidentd pstorefs:dir search');
|
||||
userdebug_or_eng(`allow incidentd pstorefs:file r_file_perms');
|
||||
|
||||
# Create and write into /data/misc/incidents
|
||||
allow incidentd incident_data_file:dir rw_dir_perms;
|
||||
allow incidentd incident_data_file:file create_file_perms;
|
||||
|
||||
# Enable incidentd to get stack traces.
|
||||
binder_use(incidentd)
|
||||
hwbinder_use(incidentd)
|
||||
allow incidentd hwservicemanager:hwservice_manager { list };
|
||||
get_prop(incidentd, hwservicemanager_prop)
|
||||
allow incidentd hidl_manager_hwservice:hwservice_manager { find };
|
||||
|
||||
# Read files in /proc
|
||||
allow incidentd {
|
||||
proc_cmdline
|
||||
proc_pipe_conf
|
||||
proc_stat
|
||||
}:file r_file_perms;
|
||||
|
||||
# Signal java processes to dump their stack and get the results
|
||||
allow incidentd { appdomain ephemeral_app system_server }:process signal;
|
||||
|
||||
# Signal native processes to dump their stack.
|
||||
# This list comes from native_processes_to_dump in incidentd/utils.c
|
||||
allow incidentd {
|
||||
# This list comes from native_processes_to_dump in dumputils/dump_utils.cpp
|
||||
audioserver
|
||||
cameraserver
|
||||
drmserver
|
||||
inputflinger
|
||||
mediadrmserver
|
||||
mediaextractor
|
||||
mediametrics
|
||||
mediaserver
|
||||
sdcardd
|
||||
statsd
|
||||
surfaceflinger
|
||||
|
||||
# This list comes from hal_interfaces_to_dump in dumputils/dump_utils.cpp
|
||||
hal_audio_server
|
||||
hal_bluetooth_server
|
||||
hal_camera_server
|
||||
hal_graphics_composer_server
|
||||
hal_sensors_server
|
||||
hal_vr_server
|
||||
mediacodec # TODO(b/36375899): hal_omx_server
|
||||
}:process signal;
|
||||
|
||||
# Allow incidentd to make binder calls to any binder service
|
||||
binder_call(incidentd, system_server)
|
||||
binder_call(incidentd, appdomain)
|
||||
|
||||
# Reading /proc/PID/maps of other processes
|
||||
userdebug_or_eng(`allow incidentd self:global_capability_class_set { sys_ptrace }');
|
||||
# incidentd has capability sys_ptrace, but should only use that capability for
|
||||
# accessing sensitive /proc/PID files, never for using ptrace attach.
|
||||
neverallow incidentd *:process ptrace;
|
||||
|
||||
allow incidentd self:global_capability_class_set {
|
||||
# Send signals to processes
|
||||
kill
|
||||
};
|
||||
|
||||
# Connect to tombstoned to intercept dumps.
|
||||
unix_socket_connect(incidentd, tombstoned_intercept, tombstoned)
|
||||
|
||||
# Run a shell.
|
||||
allow incidentd shell_exec:file rx_file_perms;
|
||||
|
||||
# logd access - work to be done is a PII safe log (possibly an event log?)
|
||||
userdebug_or_eng(`read_logd(incidentd)')
|
||||
# TODO control_logd(incidentd)
|
||||
|
||||
# Allow incidentd to find these standard groups of services.
|
||||
# Others can be allowlisted individually.
|
||||
allow incidentd {
|
||||
system_server_service
|
||||
app_api_service
|
||||
system_api_service
|
||||
}:service_manager find;
|
||||
|
||||
# Only incidentd can publish the binder service
|
||||
add_service(incidentd, incident_service)
|
||||
|
||||
# Allow pipes from (and only from) incident
|
||||
allow incidentd incident:fd use;
|
||||
allow incidentd incident:fifo_file write;
|
||||
|
||||
# Allow incident to call back to incident with status updates.
|
||||
binder_call(incidentd, incident)
|
||||
|
||||
###
|
||||
### neverallow rules
|
||||
###
|
||||
|
||||
# only system_server, system_app and incident command can find the incident service
|
||||
neverallow {
|
||||
domain
|
||||
-incident
|
||||
-incidentd
|
||||
-statsd
|
||||
-system_app
|
||||
-system_server
|
||||
} incident_service:service_manager find;
|
||||
|
||||
# only incidentd and the other root services in limited circumstances
|
||||
# can get to the files in /data/misc/incidents
|
||||
#
|
||||
# write, execute, append are forbidden almost everywhere
|
||||
neverallow { domain -incidentd -init -vold } incident_data_file:file {
|
||||
w_file_perms
|
||||
x_file_perms
|
||||
create
|
||||
rename
|
||||
setattr
|
||||
unlink
|
||||
append
|
||||
};
|
||||
# read is also allowed by system_server, for when the file is handed to dropbox
|
||||
neverallow { domain -incidentd -init -vold -system_server } incident_data_file:file r_file_perms;
|
||||
# limited access to the directory itself
|
||||
neverallow { domain -incidentd -init -vold } incident_data_file:dir create_dir_perms;
|
||||
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
typeattribute init coredomain;
|
||||
|
||||
tmpfs_domain(init)
|
||||
|
||||
# Transitions to seclabel processes in init.rc
|
||||
domain_trans(init, rootfs, charger)
|
||||
domain_trans(init, rootfs, healthd)
|
||||
domain_trans(init, rootfs, slideshow)
|
||||
domain_auto_trans(init, e2fs_exec, e2fs)
|
||||
recovery_only(`
|
||||
domain_trans(init, rootfs, adbd)
|
||||
domain_trans(init, rootfs, recovery)
|
||||
')
|
||||
domain_trans(init, shell_exec, shell)
|
||||
domain_trans(init, init_exec, ueventd)
|
||||
domain_trans(init, init_exec, watchdogd)
|
||||
domain_trans(init, init_exec, vendor_init)
|
||||
domain_trans(init, { rootfs toolbox_exec }, modprobe)
|
||||
# case where logpersistd is actually logcat -f in logd context (nee: logcatd)
|
||||
userdebug_or_eng(`
|
||||
domain_auto_trans(init, logcat_exec, logpersist)
|
||||
')
|
||||
|
|
@ -1,27 +0,0 @@
|
|||
sid kernel u:r:kernel:s0
|
||||
sid security u:object_r:kernel:s0
|
||||
sid unlabeled u:object_r:unlabeled:s0
|
||||
sid fs u:object_r:labeledfs:s0
|
||||
sid file u:object_r:unlabeled:s0
|
||||
sid file_labels u:object_r:unlabeled:s0
|
||||
sid init u:object_r:unlabeled:s0
|
||||
sid any_socket u:object_r:unlabeled:s0
|
||||
sid port u:object_r:port:s0
|
||||
sid netif u:object_r:netif:s0
|
||||
sid netmsg u:object_r:unlabeled:s0
|
||||
sid node u:object_r:node:s0
|
||||
sid igmp_packet u:object_r:unlabeled:s0
|
||||
sid icmp_socket u:object_r:unlabeled:s0
|
||||
sid tcp_socket u:object_r:unlabeled:s0
|
||||
sid sysctl_modprobe u:object_r:unlabeled:s0
|
||||
sid sysctl u:object_r:proc:s0
|
||||
sid sysctl_fs u:object_r:unlabeled:s0
|
||||
sid sysctl_kernel u:object_r:unlabeled:s0
|
||||
sid sysctl_net u:object_r:unlabeled:s0
|
||||
sid sysctl_net_unix u:object_r:unlabeled:s0
|
||||
sid sysctl_vm u:object_r:unlabeled:s0
|
||||
sid sysctl_dev u:object_r:unlabeled:s0
|
||||
sid kmod u:object_r:unlabeled:s0
|
||||
sid policy u:object_r:unlabeled:s0
|
||||
sid scmp_packet u:object_r:unlabeled:s0
|
||||
sid devnull u:object_r:null_device:s0
|
||||
|
|
@ -1,35 +0,0 @@
|
|||
# FLASK
|
||||
|
||||
#
|
||||
# Define initial security identifiers
|
||||
#
|
||||
|
||||
sid kernel
|
||||
sid security
|
||||
sid unlabeled
|
||||
sid fs
|
||||
sid file
|
||||
sid file_labels
|
||||
sid init
|
||||
sid any_socket
|
||||
sid port
|
||||
sid netif
|
||||
sid netmsg
|
||||
sid node
|
||||
sid igmp_packet
|
||||
sid icmp_socket
|
||||
sid tcp_socket
|
||||
sid sysctl_modprobe
|
||||
sid sysctl
|
||||
sid sysctl_fs
|
||||
sid sysctl_kernel
|
||||
sid sysctl_net
|
||||
sid sysctl_net_unix
|
||||
sid sysctl_vm
|
||||
sid sysctl_dev
|
||||
sid kmod
|
||||
sid policy
|
||||
sid scmp_packet
|
||||
sid devnull
|
||||
|
||||
# FLASK
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
typeattribute inputflinger coredomain;
|
||||
|
||||
init_daemon_domain(inputflinger)
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
typeattribute install_recovery coredomain;
|
||||
|
||||
init_daemon_domain(install_recovery)
|
||||
|
|
@ -1,22 +0,0 @@
|
|||
typeattribute installd coredomain;
|
||||
|
||||
init_daemon_domain(installd)
|
||||
|
||||
# Run dex2oat in its own sandbox.
|
||||
domain_auto_trans(installd, dex2oat_exec, dex2oat)
|
||||
|
||||
# Run dexoptanalyzer in its own sandbox.
|
||||
domain_auto_trans(installd, dexoptanalyzer_exec, dexoptanalyzer)
|
||||
|
||||
# Run profman in its own sandbox.
|
||||
domain_auto_trans(installd, profman_exec, profman)
|
||||
|
||||
# Run idmap in its own sandbox.
|
||||
domain_auto_trans(installd, idmap_exec, idmap)
|
||||
|
||||
# Create /data/.layout_version.* file
|
||||
type_transition installd system_data_file:file install_data_file;
|
||||
|
||||
# For collecting bugreports.
|
||||
allow installd dumpstate:fd use;
|
||||
allow installd dumpstate:fifo_file r_file_perms;
|
||||
|
|
@ -1,119 +0,0 @@
|
|||
###
|
||||
### Services with isolatedProcess=true in their manifest.
|
||||
###
|
||||
### This file defines the rules for isolated apps. An "isolated
|
||||
### app" is an APP with UID between AID_ISOLATED_START (99000)
|
||||
### and AID_ISOLATED_END (99999).
|
||||
###
|
||||
|
||||
typeattribute isolated_app coredomain;
|
||||
|
||||
app_domain(isolated_app)
|
||||
|
||||
# Access already open app data files received over Binder or local socket IPC.
|
||||
allow isolated_app app_data_file:file { append read write getattr lock };
|
||||
|
||||
allow isolated_app activity_service:service_manager find;
|
||||
allow isolated_app display_service:service_manager find;
|
||||
allow isolated_app webviewupdate_service:service_manager find;
|
||||
|
||||
# Google Breakpad (crash reporter for Chrome) relies on ptrace
|
||||
# functionality. Without the ability to ptrace, the crash reporter
|
||||
# tool is broken.
|
||||
# b/20150694
|
||||
# https://code.google.com/p/chromium/issues/detail?id=475270
|
||||
allow isolated_app self:process ptrace;
|
||||
|
||||
# b/32896414: Allow accessing sdcard file descriptors passed to isolated_apps
|
||||
# by other processes. Open should never be allowed, and is blocked by
|
||||
# neverallow rules below.
|
||||
# media_rw_data_file is included for sdcardfs, and can be removed if sdcardfs
|
||||
# is modified to change the secontext when accessing the lower filesystem.
|
||||
allow isolated_app { sdcard_type media_rw_data_file }:file { read write append getattr lock };
|
||||
|
||||
# For webviews, isolated_app processes can be forked from the webview_zygote
|
||||
# in addition to the zygote. Allow access to resources inherited from the
|
||||
# webview_zygote process. These rules are specialized copies of the ones in app.te.
|
||||
# Inherit FDs from the webview_zygote.
|
||||
allow isolated_app webview_zygote:fd use;
|
||||
# Notify webview_zygote of child death.
|
||||
allow isolated_app webview_zygote:process sigchld;
|
||||
# Inherit logd write socket.
|
||||
allow isolated_app webview_zygote:unix_dgram_socket write;
|
||||
# Read system properties managed by webview_zygote.
|
||||
allow isolated_app webview_zygote_tmpfs:file read;
|
||||
|
||||
# TODO (b/63631799) fix this access
|
||||
# suppress denials to /data/local/tmp
|
||||
dontaudit isolated_app shell_data_file:dir search;
|
||||
|
||||
# Write app-specific trace data to the Perfetto traced damon. This requires
|
||||
# connecting to its producer socket and obtaining a (per-process) tmpfs fd.
|
||||
allow isolated_app traced:fd use;
|
||||
allow isolated_app traced_tmpfs:file { read write getattr map };
|
||||
unix_socket_connect(isolated_app, traced_producer, traced)
|
||||
|
||||
#####
|
||||
##### Neverallow
|
||||
#####
|
||||
|
||||
# Do not allow isolated_app to directly open tun_device
|
||||
neverallow isolated_app tun_device:chr_file open;
|
||||
|
||||
# Isolated apps should not directly open app data files themselves.
|
||||
neverallow isolated_app app_data_file:file open;
|
||||
|
||||
# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553)
|
||||
# TODO: are there situations where isolated_apps write to this file?
|
||||
# TODO: should we tighten these restrictions further?
|
||||
neverallow isolated_app anr_data_file:file ~{ open append };
|
||||
neverallow isolated_app anr_data_file:dir ~search;
|
||||
|
||||
# Isolated apps must not be permitted to use HwBinder
|
||||
neverallow isolated_app hwbinder_device:chr_file *;
|
||||
neverallow isolated_app *:hwservice_manager *;
|
||||
|
||||
# Isolated apps must not be permitted to use VndBinder
|
||||
neverallow isolated_app vndbinder_device:chr_file *;
|
||||
|
||||
# Isolated apps must not be permitted to perform actions on Binder and VndBinder service_manager
|
||||
# except the find actions for services allowlisted below.
|
||||
neverallow isolated_app *:service_manager ~find;
|
||||
|
||||
# b/17487348
|
||||
# Isolated apps can only access three services,
|
||||
# activity_service, display_service and webviewupdate_service.
|
||||
neverallow isolated_app {
|
||||
service_manager_type
|
||||
-activity_service
|
||||
-display_service
|
||||
-webviewupdate_service
|
||||
}:service_manager find;
|
||||
|
||||
# Isolated apps shouldn't be able to access the driver directly.
|
||||
neverallow isolated_app gpu_device:chr_file { rw_file_perms execute };
|
||||
|
||||
# Do not allow isolated_app access to /cache
|
||||
neverallow isolated_app cache_file:dir ~{ r_dir_perms };
|
||||
neverallow isolated_app cache_file:file ~{ read getattr };
|
||||
|
||||
# Do not allow isolated_app to access external storage, except for files passed
|
||||
# via file descriptors (b/32896414).
|
||||
neverallow isolated_app { storage_file mnt_user_file sdcard_type }:dir ~getattr;
|
||||
neverallow isolated_app { storage_file mnt_user_file }:file_class_set *;
|
||||
neverallow isolated_app sdcard_type:{ devfile_class_set lnk_file sock_file fifo_file } *;
|
||||
neverallow isolated_app sdcard_type:file ~{ read write append getattr lock };
|
||||
|
||||
# Do not allow USB access
|
||||
neverallow isolated_app { usb_device usbaccessory_device }:chr_file *;
|
||||
|
||||
# Restrict the webview_zygote control socket.
|
||||
neverallow isolated_app webview_zygote:sock_file write;
|
||||
|
||||
# Limit the /sys files which isolated_app can access. This is important
|
||||
# for controlling isolated_app attack surface.
|
||||
neverallow isolated_app {
|
||||
sysfs_type
|
||||
-sysfs_devices_system_cpu
|
||||
-sysfs_usb # TODO: check with audio team if needed for isolated_app (b/28417852)
|
||||
}:file no_rw_file_perms;
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
typeattribute kernel coredomain;
|
||||
|
||||
domain_auto_trans(kernel, init_exec, init)
|
||||
|
|
@ -1,25 +0,0 @@
|
|||
#
|
||||
# Maps an arbitrary tag [TAGNAME] with the string contents found in
|
||||
# TARGET_BUILD_VARIANT. Common convention is to start TAGNAME with an @ and
|
||||
# name it after the base file name of the pem file.
|
||||
#
|
||||
# Each tag (section) then allows one to specify any string found in
|
||||
# TARGET_BUILD_VARIANT. Typcially this is user, eng, and userdebug. Another
|
||||
# option is to use ALL which will match ANY TARGET_BUILD_VARIANT string.
|
||||
#
|
||||
|
||||
[@PLATFORM]
|
||||
ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/platform.x509.pem
|
||||
|
||||
[@MEDIA]
|
||||
ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/media.x509.pem
|
||||
|
||||
[@SHARED]
|
||||
ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/shared.x509.pem
|
||||
|
||||
# Example of ALL TARGET_BUILD_VARIANTS
|
||||
[@RELEASE]
|
||||
ENG : $DEFAULT_SYSTEM_DEV_CERTIFICATE/testkey.x509.pem
|
||||
USER : $DEFAULT_SYSTEM_DEV_CERTIFICATE/testkey.x509.pem
|
||||
USERDEBUG : $DEFAULT_SYSTEM_DEV_CERTIFICATE/testkey.x509.pem
|
||||
|
||||
|
|
@ -1,19 +0,0 @@
|
|||
typeattribute keystore coredomain;
|
||||
|
||||
init_daemon_domain(keystore)
|
||||
|
||||
# talk to keymaster
|
||||
hal_client_domain(keystore, hal_keymaster)
|
||||
|
||||
# talk to confirmationui
|
||||
hal_client_domain(keystore, hal_confirmationui)
|
||||
|
||||
# This is used for the ConfirmationUI async callback.
|
||||
allow keystore platform_app:binder call;
|
||||
|
||||
# Offer the Wifi Keystore HwBinder service
|
||||
typeattribute keystore wifi_keystore_service_server;
|
||||
add_hwservice(keystore, system_wifi_keystore_hwservice)
|
||||
|
||||
# Allow to check whether security logging is enabled.
|
||||
get_prop(keystore, device_logging_prop)
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
typeattribute lmkd coredomain;
|
||||
|
||||
init_daemon_domain(lmkd)
|
||||
|
|
@ -1,39 +0,0 @@
|
|||
typeattribute logd coredomain;
|
||||
|
||||
init_daemon_domain(logd)
|
||||
|
||||
# logd is not allowed to write anywhere other than /data/misc/logd, and then
|
||||
# only on userdebug or eng builds
|
||||
# TODO: deal with tmpfs_domain pub/priv split properly
|
||||
neverallow logd {
|
||||
file_type
|
||||
-logd_tmpfs
|
||||
-runtime_event_log_tags_file
|
||||
userdebug_or_eng(`-coredump_file -misc_logd_file')
|
||||
}:file { create write append };
|
||||
|
||||
# protect the event-log-tags file
|
||||
neverallow {
|
||||
domain
|
||||
-appdomain # covered below
|
||||
-bootstat
|
||||
-dumpstate
|
||||
-init
|
||||
-logd
|
||||
userdebug_or_eng(`-logpersist')
|
||||
-servicemanager
|
||||
-system_server
|
||||
-surfaceflinger
|
||||
-zygote
|
||||
} runtime_event_log_tags_file:file no_rw_file_perms;
|
||||
|
||||
neverallow {
|
||||
appdomain
|
||||
-bluetooth
|
||||
-platform_app
|
||||
-priv_app
|
||||
-radio
|
||||
-shell
|
||||
userdebug_or_eng(`-su')
|
||||
-system_app
|
||||
} runtime_event_log_tags_file:file no_rw_file_perms;
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
typeattribute logpersist coredomain;
|
||||
|
||||
# android debug log storage in logpersist domains (eng and userdebug only)
|
||||
userdebug_or_eng(`
|
||||
|
||||
r_dir_file(logpersist, cgroup)
|
||||
|
||||
allow logpersist misc_logd_file:file create_file_perms;
|
||||
allow logpersist misc_logd_file:dir rw_dir_perms;
|
||||
|
||||
allow logpersist self:global_capability_class_set sys_nice;
|
||||
allow logpersist pstorefs:dir search;
|
||||
allow logpersist pstorefs:file r_file_perms;
|
||||
|
||||
control_logd(logpersist)
|
||||
unix_socket_connect(logpersist, logdr, logd)
|
||||
read_runtime_log_tags(logpersist)
|
||||
|
||||
')
|
||||
|
||||
# logpersist is allowed to write to /data/misc/log for userdebug and eng builds
|
||||
neverallow logpersist { file_type userdebug_or_eng(`-misc_logd_file -coredump_file') }:file { create write append };
|
||||
neverallow { domain -init userdebug_or_eng(`-logpersist -logd -dumpstate') } misc_logd_file:file no_rw_file_perms;
|
||||
neverallow { domain -init userdebug_or_eng(`-logpersist -logd') } misc_logd_file:dir { add_name link relabelfrom remove_name rename reparent rmdir write };
|
||||
|
|
@ -1,59 +0,0 @@
|
|||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<policy>
|
||||
|
||||
<!--
|
||||
|
||||
* A signature is a hex encoded X.509 certificate or a tag defined in
|
||||
keys.conf and is required for each signer tag. The signature can
|
||||
either appear as a set of attached cert child tags or as an attribute.
|
||||
* A signer tag must contain a seinfo tag XOR multiple package stanzas.
|
||||
* Each signer/package tag is allowed to contain one seinfo tag. This tag
|
||||
represents additional info that each app can use in setting a SELinux security
|
||||
context on the eventual process as well as the apps data directory.
|
||||
* seinfo assignments are made according to the following rules:
|
||||
- Stanzas with package name refinements will be checked first.
|
||||
- Stanzas w/o package name refinements will be checked second.
|
||||
- The "default" seinfo label is automatically applied.
|
||||
|
||||
* valid stanzas can take one of the following forms:
|
||||
|
||||
// single cert protecting seinfo
|
||||
<signer signature="@PLATFORM" >
|
||||
<seinfo value="platform" />
|
||||
</signer>
|
||||
|
||||
// multiple certs protecting seinfo (all contained certs must match)
|
||||
<signer>
|
||||
<cert signature="@PLATFORM1"/>
|
||||
<cert signature="@PLATFORM2"/>
|
||||
<seinfo value="platform" />
|
||||
</signer>
|
||||
|
||||
// single cert protecting explicitly named app
|
||||
<signer signature="@PLATFORM" >
|
||||
<package name="com.android.foo">
|
||||
<seinfo value="bar" />
|
||||
</package>
|
||||
</signer>
|
||||
|
||||
// multiple certs protecting explicitly named app (all certs must match)
|
||||
<signer>
|
||||
<cert signature="@PLATFORM1"/>
|
||||
<cert signature="@PLATFORM2"/>
|
||||
<package name="com.android.foo">
|
||||
<seinfo value="bar" />
|
||||
</package>
|
||||
</signer>
|
||||
-->
|
||||
|
||||
<!-- Platform dev key in AOSP -->
|
||||
<signer signature="@PLATFORM" >
|
||||
<seinfo value="platform" />
|
||||
</signer>
|
||||
|
||||
<!-- Media key in AOSP -->
|
||||
<signer signature="@MEDIA" >
|
||||
<seinfo value="media" />
|
||||
</signer>
|
||||
|
||||
</policy>
|
||||
|
|
@ -1,12 +0,0 @@
|
|||
# mdns daemon
|
||||
|
||||
typeattribute mdnsd coredomain;
|
||||
typeattribute mdnsd mlstrustedsubject;
|
||||
|
||||
type mdnsd_exec, exec_type, file_type;
|
||||
init_daemon_domain(mdnsd)
|
||||
|
||||
net_domain(mdnsd)
|
||||
|
||||
# Read from /proc/net
|
||||
r_dir_file(mdnsd, proc_net)
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
typeattribute mediadrmserver coredomain;
|
||||
|
||||
init_daemon_domain(mediadrmserver)
|
||||
|
||||
# allocate and use graphic buffers
|
||||
hal_client_domain(mediadrmserver, hal_graphics_allocator)
|
||||
auditallow mediadrmserver hal_graphics_allocator_server:binder call;
|
||||
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
typeattribute mediaextractor coredomain;
|
||||
|
||||
init_daemon_domain(mediaextractor)
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
typeattribute mediametrics coredomain;
|
||||
|
||||
init_daemon_domain(mediametrics)
|
||||
|
|
@ -1,43 +0,0 @@
|
|||
###
|
||||
### A domain for android.process.media, which contains both
|
||||
### MediaProvider and DownloadProvider and associated services.
|
||||
###
|
||||
|
||||
typeattribute mediaprovider coredomain;
|
||||
app_domain(mediaprovider)
|
||||
|
||||
# DownloadProvider accesses the network.
|
||||
net_domain(mediaprovider)
|
||||
|
||||
# DownloadProvider uses /cache.
|
||||
allow mediaprovider cache_file:dir create_dir_perms;
|
||||
allow mediaprovider cache_file:file create_file_perms;
|
||||
# /cache is a symlink to /data/cache on some devices. Allow reading the link.
|
||||
allow mediaprovider cache_file:lnk_file r_file_perms;
|
||||
# mediaprovider searches through /cache looking for orphans
|
||||
# Ignore denials to /cache/recovery and /cache/backup.
|
||||
dontaudit mediaprovider cache_private_backup_file:dir getattr;
|
||||
dontaudit mediaprovider cache_recovery_file:dir getattr;
|
||||
|
||||
# Access external sdcards through /mnt/media_rw
|
||||
allow mediaprovider { mnt_media_rw_file }:dir search;
|
||||
|
||||
allow mediaprovider app_api_service:service_manager find;
|
||||
allow mediaprovider audioserver_service:service_manager find;
|
||||
allow mediaprovider drmserver_service:service_manager find;
|
||||
allow mediaprovider mediaextractor_service:service_manager find;
|
||||
allow mediaprovider mediaserver_service:service_manager find;
|
||||
|
||||
# Allow MediaProvider to read/write cached ringtones (opened by system).
|
||||
allow mediaprovider ringtone_file:file { getattr read write };
|
||||
|
||||
# MtpServer uses /dev/mtp_usb
|
||||
allow mediaprovider mtp_device:chr_file rw_file_perms;
|
||||
|
||||
# MtpServer uses /dev/usb-ffs/mtp
|
||||
allow mediaprovider functionfs:dir search;
|
||||
allow mediaprovider functionfs:file rw_file_perms;
|
||||
|
||||
# MtpServer sets sys.usb.ffs.mtp.ready
|
||||
set_prop(mediaprovider, ffs_prop)
|
||||
set_prop(mediaprovider, exported_ffs_prop)
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
typeattribute mediaserver coredomain;
|
||||
|
||||
init_daemon_domain(mediaserver)
|
||||
|
||||
# allocate and use graphic buffers
|
||||
hal_client_domain(mediaserver, hal_graphics_allocator)
|
||||
|
||||
# TODO(b/36375899): Remove this once OMX HAL is attributized and mediaserver is marked as a client
|
||||
# of OMX HAL.
|
||||
allow mediaserver hal_codec2_hwservice:hwservice_manager find;
|
||||
allow mediaserver hal_omx_hwservice:hwservice_manager find;
|
||||
|
|
@ -1,100 +0,0 @@
|
|||
#################################################
|
||||
# MLS policy constraints
|
||||
#
|
||||
|
||||
#
|
||||
# Process constraints
|
||||
#
|
||||
|
||||
# Process transition: Require equivalence unless the subject is trusted.
|
||||
mlsconstrain process { transition dyntransition }
|
||||
((h1 eq h2 and l1 eq l2) or t1 == mlstrustedsubject);
|
||||
|
||||
# Process read operations: No read up unless trusted.
|
||||
mlsconstrain process { getsched getsession getpgid getcap getattr ptrace share }
|
||||
(l1 dom l2 or t1 == mlstrustedsubject);
|
||||
|
||||
# Process write operations: Require equivalence unless trusted.
|
||||
mlsconstrain process { sigkill sigstop signal setsched setpgid setcap setrlimit ptrace share }
|
||||
(l1 eq l2 or t1 == mlstrustedsubject);
|
||||
|
||||
#
|
||||
# Socket constraints
|
||||
#
|
||||
|
||||
# Create/relabel operations: Subject must be equivalent to object unless
|
||||
# the subject is trusted. Sockets inherit the range of their creator.
|
||||
mlsconstrain socket_class_set { create relabelfrom relabelto }
|
||||
((h1 eq h2 and l1 eq l2) or t1 == mlstrustedsubject);
|
||||
|
||||
# Datagram send: Sender must be equivalent to the receiver unless one of them
|
||||
# is trusted.
|
||||
mlsconstrain unix_dgram_socket { sendto }
|
||||
(l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject);
|
||||
|
||||
# Stream connect: Client must be equivalent to server unless one of them
|
||||
# is trusted.
|
||||
mlsconstrain unix_stream_socket { connectto }
|
||||
(l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject);
|
||||
|
||||
#
|
||||
# Directory/file constraints
|
||||
#
|
||||
|
||||
# Create/relabel operations: Subject must be equivalent to object unless
|
||||
# the subject is trusted. Also, files should always be single-level.
|
||||
# Do NOT exempt mlstrustedobject types from this constraint.
|
||||
mlsconstrain dir_file_class_set { create relabelfrom relabelto }
|
||||
(l2 eq h2 and (l1 eq l2 or t1 == mlstrustedsubject));
|
||||
|
||||
#
|
||||
# Constraints for app data files only.
|
||||
#
|
||||
|
||||
# Only constrain open, not read/write.
|
||||
# Also constrain other forms of manipulation, e.g. chmod/chown, unlink, rename, etc.
|
||||
# Subject must dominate object unless the subject is trusted.
|
||||
mlsconstrain dir { open search setattr rename add_name remove_name reparent rmdir }
|
||||
(t2 != app_data_file or l1 dom l2 or t1 == mlstrustedsubject);
|
||||
mlsconstrain { file lnk_file sock_file } { open setattr unlink link rename }
|
||||
(t2 != app_data_file or l1 dom l2 or t1 == mlstrustedsubject);
|
||||
|
||||
#
|
||||
# Constraints for file types other than app data files.
|
||||
#
|
||||
|
||||
# Read operations: Subject must dominate object unless the subject
|
||||
# or the object is trusted.
|
||||
mlsconstrain dir { read getattr search }
|
||||
(t2 == app_data_file or l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject);
|
||||
|
||||
mlsconstrain { file lnk_file sock_file chr_file blk_file } { read getattr execute }
|
||||
(t2 == app_data_file or l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject);
|
||||
|
||||
# Write operations: Subject must be equivalent to the object unless the
|
||||
# subject or the object is trusted.
|
||||
mlsconstrain dir { write setattr rename add_name remove_name reparent rmdir }
|
||||
(t2 == app_data_file or l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject);
|
||||
|
||||
mlsconstrain { file lnk_file sock_file chr_file blk_file } { write setattr append unlink link rename }
|
||||
(t2 == app_data_file or l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject);
|
||||
|
||||
# Special case for FIFOs.
|
||||
# These can be unnamed pipes, in which case they will be labeled with the
|
||||
# creating process' label. Thus we also have an exemption when the "object"
|
||||
# is a domain type, so that processes can communicate via unnamed pipes
|
||||
# passed by binder or local socket IPC.
|
||||
mlsconstrain fifo_file { read getattr }
|
||||
(l1 dom l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject or t2 == domain);
|
||||
|
||||
mlsconstrain fifo_file { write setattr append unlink link rename }
|
||||
(l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedobject or t2 == domain);
|
||||
|
||||
#
|
||||
# Binder IPC constraints
|
||||
#
|
||||
# Presently commented out, as apps are expected to call one another.
|
||||
# This would only make sense if apps were assigned categories
|
||||
# based on allowable communications rather than per-app categories.
|
||||
#mlsconstrain binder call
|
||||
# (l1 eq l2 or t1 == mlstrustedsubject or t2 == mlstrustedsubject);
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
#########################################
|
||||
# MLS declarations
|
||||
#
|
||||
|
||||
# Generate the desired number of sensitivities and categories.
|
||||
gen_sens(mls_num_sens)
|
||||
gen_cats(mls_num_cats)
|
||||
|
||||
# Generate level definitions for each sensitivity and category.
|
||||
gen_levels(mls_num_sens,mls_num_cats)
|
||||
|
|
@ -1,54 +0,0 @@
|
|||
########################################
|
||||
#
|
||||
# gen_cats(N)
|
||||
#
|
||||
# declares categores c0 to c(N-1)
|
||||
#
|
||||
define(`decl_cats',`dnl
|
||||
category c$1;
|
||||
ifelse(`$1',`$2',,`decl_cats(incr($1),$2)')dnl
|
||||
')
|
||||
|
||||
define(`gen_cats',`decl_cats(0,decr($1))')
|
||||
|
||||
########################################
|
||||
#
|
||||
# gen_sens(N)
|
||||
#
|
||||
# declares sensitivites s0 to s(N-1) with dominance
|
||||
# in increasing numeric order with s0 lowest, s(N-1) highest
|
||||
#
|
||||
define(`decl_sens',`dnl
|
||||
sensitivity s$1;
|
||||
ifelse(`$1',`$2',,`decl_sens(incr($1),$2)')dnl
|
||||
')
|
||||
|
||||
define(`gen_dominance',`s$1 ifelse(`$1',`$2',,`gen_dominance(incr($1),$2)')')
|
||||
|
||||
define(`gen_sens',`
|
||||
# Each sensitivity has a name and zero or more aliases.
|
||||
decl_sens(0,decr($1))
|
||||
|
||||
# Define the ordering of the sensitivity levels (least to greatest)
|
||||
dominance { gen_dominance(0,decr($1)) }
|
||||
')
|
||||
|
||||
########################################
|
||||
#
|
||||
# gen_levels(N,M)
|
||||
#
|
||||
# levels from s0 to (N-1) with categories c0 to (M-1)
|
||||
#
|
||||
define(`decl_levels',`dnl
|
||||
level s$1:c0.c$3;
|
||||
ifelse(`$1',`$2',,`decl_levels(incr($1),$2,$3)')dnl
|
||||
')
|
||||
|
||||
define(`gen_levels',`decl_levels(0,decr($1),decr($2))')
|
||||
|
||||
########################################
|
||||
#
|
||||
# Basic level names for system low and high
|
||||
#
|
||||
define(`mls_systemlow',`s0')
|
||||
define(`mls_systemhigh',`s`'decr(mls_num_sens):c0.c`'decr(mls_num_cats)')
|
||||
|
|
@ -1 +0,0 @@
|
|||
typeattribute modprobe coredomain;
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
typeattribute mtp coredomain;
|
||||
|
||||
init_daemon_domain(mtp)
|
||||
|
|
@ -1,24 +0,0 @@
|
|||
###
|
||||
### Domain with network access
|
||||
###
|
||||
|
||||
# Use network sockets.
|
||||
allow netdomain self:tcp_socket create_stream_socket_perms;
|
||||
allow netdomain self:{ udp_socket rawip_socket } create_socket_perms;
|
||||
# Connect to ports.
|
||||
allow netdomain port_type:tcp_socket name_connect;
|
||||
# Bind to ports.
|
||||
allow {netdomain -ephemeral_app} node_type:{ tcp_socket udp_socket } node_bind;
|
||||
allow {netdomain -ephemeral_app} port_type:udp_socket name_bind;
|
||||
allow {netdomain -ephemeral_app} port_type:tcp_socket name_bind;
|
||||
# See changes to the routing table.
|
||||
allow netdomain self:netlink_route_socket { create read getattr write setattr lock append bind connect getopt setopt shutdown nlmsg_read };
|
||||
|
||||
# Talks to netd via dnsproxyd socket.
|
||||
unix_socket_connect(netdomain, dnsproxyd, netd)
|
||||
|
||||
# Talks to netd via fwmarkd socket.
|
||||
unix_socket_connect(netdomain, fwmarkd, netd)
|
||||
|
||||
# Connect to mdnsd via mdnsd socket.
|
||||
unix_socket_connect(netdomain, mdnsd, mdnsd)
|
||||
|
|
@ -1,15 +0,0 @@
|
|||
typeattribute netd coredomain;
|
||||
|
||||
init_daemon_domain(netd)
|
||||
|
||||
# Allow netd to spawn dnsmasq in it's own domain
|
||||
domain_auto_trans(netd, dnsmasq_exec, dnsmasq)
|
||||
|
||||
# Allow netd to start clatd in its own domain
|
||||
domain_auto_trans(netd, clatd_exec, clatd)
|
||||
|
||||
# Allow netd to start bpfloader_exec in its own domain
|
||||
domain_auto_trans(netd, bpfloader_exec, bpfloader)
|
||||
|
||||
# give netd permission to setup iptables rule with xt_bpf
|
||||
allow netd bpfloader:bpf prog_run;
|
||||
|
|
@ -1,41 +0,0 @@
|
|||
typeattribute netutils_wrapper coredomain;
|
||||
|
||||
r_dir_file(netutils_wrapper, system_file);
|
||||
|
||||
# For netutils (ip, iptables, tc)
|
||||
allow netutils_wrapper self:global_capability_class_set net_raw;
|
||||
|
||||
allow netutils_wrapper system_file:file { execute execute_no_trans };
|
||||
allow netutils_wrapper proc_net:file { open read getattr };
|
||||
allow netutils_wrapper self:rawip_socket create_socket_perms;
|
||||
allow netutils_wrapper self:udp_socket create_socket_perms;
|
||||
allow netutils_wrapper self:global_capability_class_set net_admin;
|
||||
# ip utils need everything but ioctl
|
||||
allow netutils_wrapper self:netlink_route_socket ~ioctl;
|
||||
allow netutils_wrapper self:netlink_xfrm_socket ~ioctl;
|
||||
|
||||
# For netutils (ndc) to be able to talk to netd
|
||||
allow netutils_wrapper netd_socket:sock_file { open getattr read write append };
|
||||
allow netutils_wrapper netd:unix_stream_socket { read getattr connectto };
|
||||
|
||||
# For vendor code that update the iptables rules at runtime. They need to reload
|
||||
# the whole chain including the xt_bpf rules. They need to access to the pinned
|
||||
# program when reloading the rule.
|
||||
allow netutils_wrapper fs_bpf:dir search;
|
||||
allow netutils_wrapper fs_bpf:file { read write };
|
||||
allow netutils_wrapper bpfloader:bpf prog_run;
|
||||
|
||||
# For /data/misc/net access to ndc and ip
|
||||
r_dir_file(netutils_wrapper, net_data_file)
|
||||
|
||||
domain_auto_trans({
|
||||
domain
|
||||
-coredomain
|
||||
-appdomain
|
||||
}, netutils_wrapper_exec, netutils_wrapper)
|
||||
|
||||
# suppress spurious denials
|
||||
dontaudit netutils_wrapper self:global_capability_class_set sys_resource;
|
||||
|
||||
# netutils wrapper may only use the following capabilities.
|
||||
neverallow netutils_wrapper self:global_capability_class_set ~{ net_admin net_raw };
|
||||
|
|
@ -1,34 +0,0 @@
|
|||
# nfc subsystem
|
||||
typeattribute nfc coredomain;
|
||||
app_domain(nfc)
|
||||
net_domain(nfc)
|
||||
|
||||
binder_service(nfc)
|
||||
add_service(nfc, nfc_service)
|
||||
|
||||
hal_client_domain(nfc, hal_nfc)
|
||||
|
||||
# Data file accesses.
|
||||
allow nfc nfc_data_file:dir create_dir_perms;
|
||||
allow nfc nfc_data_file:notdevfile_class_set create_file_perms;
|
||||
|
||||
# SoundPool loading and playback
|
||||
allow nfc audioserver_service:service_manager find;
|
||||
allow nfc drmserver_service:service_manager find;
|
||||
allow nfc mediacodec_service:service_manager find;
|
||||
allow nfc mediametrics_service:service_manager find;
|
||||
allow nfc mediaextractor_service:service_manager find;
|
||||
allow nfc mediaserver_service:service_manager find;
|
||||
|
||||
allow nfc radio_service:service_manager find;
|
||||
allow nfc app_api_service:service_manager find;
|
||||
allow nfc system_api_service:service_manager find;
|
||||
allow nfc vr_manager_service:service_manager find;
|
||||
allow nfc secure_element_service:service_manager find;
|
||||
|
||||
set_prop(nfc, nfc_prop);
|
||||
|
||||
# already open bugreport file descriptors may be shared with
|
||||
# the nfc process, from a file in
|
||||
# /data/data/com.android.shell/files/bugreports/bugreport-*.
|
||||
allow nfc shell_data_file:file read;
|
||||
|
|
@ -1,4 +0,0 @@
|
|||
typeattribute otapreopt_chroot coredomain;
|
||||
|
||||
# Allow to transition to postinstall_ota, to run otapreopt in its own sandbox.
|
||||
domain_auto_trans(otapreopt_chroot, postinstall_file, postinstall_dexopt)
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
typeattribute otapreopt_slot coredomain;
|
||||
|
||||
# Technically not a daemon but we do want the transition from init domain to
|
||||
# cppreopts to occur.
|
||||
init_daemon_domain(otapreopt_slot)
|
||||
|
|
@ -1,68 +0,0 @@
|
|||
# Perfetto command-line client. Can be used only from the domains that are
|
||||
# explicitly allowlisted with a domain_auto_trans(X, perfetto_exec, perfetto).
|
||||
# This command line client accesses the privileged socket of the traced
|
||||
# daemon.
|
||||
|
||||
type perfetto, domain, coredomain;
|
||||
type perfetto_exec, exec_type, file_type;
|
||||
|
||||
tmpfs_domain(perfetto);
|
||||
|
||||
# Allow to access traced's privileged consumer socket.
|
||||
unix_socket_connect(perfetto, traced_consumer, traced)
|
||||
|
||||
# Allow to write and unlink traces into /data/misc/perfetto-traces.
|
||||
allow perfetto perfetto_traces_data_file:dir rw_dir_perms;
|
||||
allow perfetto perfetto_traces_data_file:file create_file_perms;
|
||||
|
||||
# Allow to access binder to pass the traces to Dropbox.
|
||||
binder_use(perfetto)
|
||||
binder_call(perfetto, system_server)
|
||||
allow perfetto dropbox_service:service_manager find;
|
||||
|
||||
# Allow statsd and shell to pipe the trace config to perfetto on stdin and to
|
||||
# print out on stdout/stderr.
|
||||
allow perfetto statsd:fd use;
|
||||
allow perfetto statsd:fifo_file { getattr read write };
|
||||
allow perfetto shell:fd use;
|
||||
allow perfetto shell:fifo_file { getattr read write };
|
||||
|
||||
# Allow to communicate use, read and write over the adb connection.
|
||||
allow perfetto adbd:fd use;
|
||||
allow perfetto adbd:unix_stream_socket { read write };
|
||||
|
||||
# allow adbd to reap perfetto
|
||||
allow perfetto adbd:process { sigchld };
|
||||
|
||||
# Allow to access /dev/pts when launched in an adb shell.
|
||||
allow perfetto devpts:chr_file rw_file_perms;
|
||||
|
||||
###
|
||||
### Neverallow rules
|
||||
###
|
||||
### perfetto should NEVER do any of this
|
||||
|
||||
# Disallow mapping executable memory (execstack and exec are already disallowed
|
||||
# globally in domain.te).
|
||||
neverallow perfetto self:process execmem;
|
||||
|
||||
# Block device access.
|
||||
neverallow perfetto dev_type:blk_file { read write };
|
||||
|
||||
# ptrace any other process
|
||||
neverallow perfetto domain:process ptrace;
|
||||
|
||||
# Disallows access to other /data files.
|
||||
neverallow perfetto {
|
||||
data_file_type
|
||||
-system_data_file
|
||||
# TODO(b/72998741) Remove exemption. Further restricted in a subsequent
|
||||
# neverallow. Currently only getattr and search are allowed.
|
||||
-vendor_data_file
|
||||
-zoneinfo_data_file
|
||||
-perfetto_traces_data_file
|
||||
}:dir *;
|
||||
neverallow perfetto { system_data_file -perfetto_traces_data_file }:dir ~{ getattr search };
|
||||
neverallow perfetto zoneinfo_data_file:dir ~r_dir_perms;
|
||||
neverallow perfetto { data_file_type -zoneinfo_data_file -perfetto_traces_data_file }:lnk_file *;
|
||||
neverallow perfetto { data_file_type -zoneinfo_data_file -perfetto_traces_data_file }:file ~write;
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
typeattribute performanced coredomain;
|
||||
|
||||
init_daemon_domain(performanced)
|
||||
|
|
@ -1,8 +0,0 @@
|
|||
userdebug_or_eng(`
|
||||
typeattribute perfprofd coredomain;
|
||||
init_daemon_domain(perfprofd)
|
||||
')
|
||||
|
||||
# Only servicemanager, statsd, su and systemserver can communicate.
|
||||
neverallow { domain userdebug_or_eng(`-statsd') } perfprofd:binder call;
|
||||
neverallow perfprofd { domain userdebug_or_eng(`-servicemanager -statsd -su -system_server') }:binder call;
|
||||
|
|
@ -1,85 +0,0 @@
|
|||
###
|
||||
### Apps signed with the platform key.
|
||||
###
|
||||
|
||||
typeattribute platform_app coredomain;
|
||||
|
||||
app_domain(platform_app)
|
||||
|
||||
# Access the network.
|
||||
net_domain(platform_app)
|
||||
# Access bluetooth.
|
||||
bluetooth_domain(platform_app)
|
||||
# Read from /data/local/tmp or /data/data/com.android.shell.
|
||||
allow platform_app shell_data_file:dir search;
|
||||
allow platform_app shell_data_file:file { open getattr read };
|
||||
allow platform_app icon_file:file { open getattr read };
|
||||
# Populate /data/app/vmdl*.tmp, /data/app-private/vmdl*.tmp files
|
||||
# created by system server.
|
||||
allow platform_app { apk_tmp_file apk_private_tmp_file }:dir rw_dir_perms;
|
||||
allow platform_app { apk_tmp_file apk_private_tmp_file }:file rw_file_perms;
|
||||
allow platform_app apk_private_data_file:dir search;
|
||||
# ASEC
|
||||
allow platform_app asec_apk_file:dir create_dir_perms;
|
||||
allow platform_app asec_apk_file:file create_file_perms;
|
||||
|
||||
# Access to /data/media.
|
||||
allow platform_app media_rw_data_file:dir create_dir_perms;
|
||||
allow platform_app media_rw_data_file:file create_file_perms;
|
||||
|
||||
# Write to /cache.
|
||||
allow platform_app cache_file:dir create_dir_perms;
|
||||
allow platform_app cache_file:file create_file_perms;
|
||||
|
||||
# Direct access to vold-mounted storage under /mnt/media_rw
|
||||
# This is a performance optimization that allows platform apps to bypass the FUSE layer
|
||||
allow platform_app mnt_media_rw_file:dir r_dir_perms;
|
||||
allow platform_app sdcard_type:dir create_dir_perms;
|
||||
allow platform_app sdcard_type:file create_file_perms;
|
||||
|
||||
# com.android.systemui
|
||||
allow platform_app rootfs:dir getattr;
|
||||
|
||||
# com.android.captiveportallogin reads /proc/vmstat
|
||||
allow platform_app {
|
||||
proc_vmstat
|
||||
}:file r_file_perms;
|
||||
|
||||
allow platform_app audioserver_service:service_manager find;
|
||||
allow platform_app cameraserver_service:service_manager find;
|
||||
allow platform_app drmserver_service:service_manager find;
|
||||
allow platform_app mediaserver_service:service_manager find;
|
||||
allow platform_app mediametrics_service:service_manager find;
|
||||
allow platform_app mediaextractor_service:service_manager find;
|
||||
allow platform_app mediacodec_service:service_manager find;
|
||||
allow platform_app mediadrmserver_service:service_manager find;
|
||||
allow platform_app persistent_data_block_service:service_manager find;
|
||||
allow platform_app radio_service:service_manager find;
|
||||
allow platform_app thermal_service:service_manager find;
|
||||
allow platform_app timezone_service:service_manager find;
|
||||
allow platform_app app_api_service:service_manager find;
|
||||
allow platform_app system_api_service:service_manager find;
|
||||
allow platform_app vr_manager_service:service_manager find;
|
||||
|
||||
# Access to /data/preloads
|
||||
allow platform_app preloads_data_file:file r_file_perms;
|
||||
allow platform_app preloads_data_file:dir r_dir_perms;
|
||||
allow platform_app preloads_media_file:file r_file_perms;
|
||||
allow platform_app preloads_media_file:dir r_dir_perms;
|
||||
|
||||
read_runtime_log_tags(platform_app)
|
||||
|
||||
# allow platform apps to use UDP sockets provided by the system server but not
|
||||
# modify them other than to connect
|
||||
allow platform_app system_server:udp_socket {
|
||||
connect getattr read recvfrom sendto write getopt setopt };
|
||||
|
||||
# allow platform apps to connect to the property service
|
||||
set_prop(platform_app, test_boot_reason_prop)
|
||||
|
||||
###
|
||||
### Neverallow rules
|
||||
###
|
||||
|
||||
# app domains which access /dev/fuse should not run as platform_app
|
||||
neverallow platform_app fuse_device:chr_file *;
|
||||
|
|
@ -1,13 +0,0 @@
|
|||
# Enable new networking controls.
|
||||
policycap network_peer_controls;
|
||||
|
||||
# Enable open permission check.
|
||||
policycap open_perms;
|
||||
|
||||
# Enable separate security classes for
|
||||
# all network address families previously
|
||||
# mapped to the socket class and for
|
||||
# ICMP and SCTP sockets previously mapped
|
||||
# to the rawip_socket class.
|
||||
policycap extended_socket_class;
|
||||
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
# portcon statements go here, e.g.
|
||||
# portcon tcp 80 u:object_r:http_port:s0
|
||||
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
typeattribute postinstall coredomain;
|
||||
|
||||
domain_auto_trans(postinstall, otapreopt_chroot_exec, otapreopt_chroot)
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
typeattribute postinstall_dexopt coredomain;
|
||||
|
||||
# Run dex2oat/patchoat in its own sandbox.
|
||||
# We have to manually transition, as we don't have an entrypoint.
|
||||
domain_auto_trans(postinstall_dexopt, postinstall_file, dex2oat)
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
typeattribute ppp coredomain;
|
||||
|
||||
domain_auto_trans(mtp, ppp_exec, ppp)
|
||||
|
|
@ -1 +0,0 @@
|
|||
typeattribute preopt2cachename coredomain;
|
||||
|
|
@ -1,206 +0,0 @@
|
|||
###
|
||||
### A domain for further sandboxing privileged apps.
|
||||
###
|
||||
|
||||
typeattribute priv_app coredomain;
|
||||
app_domain(priv_app)
|
||||
|
||||
# Access the network.
|
||||
net_domain(priv_app)
|
||||
# Access bluetooth.
|
||||
bluetooth_domain(priv_app)
|
||||
|
||||
# Allow the allocation and use of ptys
|
||||
# Used by: https://play.privileged.com/store/apps/details?id=jackpal.androidterm
|
||||
create_pty(priv_app)
|
||||
|
||||
# webview crash handling depends on self ptrace (b/27697529, b/20150694, b/19277529#comment7)
|
||||
allow priv_app self:process ptrace;
|
||||
|
||||
# Some apps ship with shared libraries that they write out
|
||||
# to their sandbox directory and then dlopen().
|
||||
allow priv_app app_data_file:file execute;
|
||||
|
||||
allow priv_app app_api_service:service_manager find;
|
||||
allow priv_app audioserver_service:service_manager find;
|
||||
allow priv_app cameraserver_service:service_manager find;
|
||||
allow priv_app drmserver_service:service_manager find;
|
||||
allow priv_app mediacodec_service:service_manager find;
|
||||
allow priv_app mediadrmserver_service:service_manager find;
|
||||
allow priv_app mediaextractor_service:service_manager find;
|
||||
allow priv_app mediametrics_service:service_manager find;
|
||||
allow priv_app mediaserver_service:service_manager find;
|
||||
allow priv_app network_watchlist_service:service_manager find;
|
||||
allow priv_app nfc_service:service_manager find;
|
||||
allow priv_app oem_lock_service:service_manager find;
|
||||
allow priv_app persistent_data_block_service:service_manager find;
|
||||
allow priv_app radio_service:service_manager find;
|
||||
allow priv_app recovery_service:service_manager find;
|
||||
allow priv_app stats_service:service_manager find;
|
||||
allow priv_app system_api_service:service_manager find;
|
||||
|
||||
# Write to /cache.
|
||||
allow priv_app { cache_file cache_recovery_file }:dir create_dir_perms;
|
||||
allow priv_app { cache_file cache_recovery_file }:file create_file_perms;
|
||||
# /cache is a symlink to /data/cache on some devices. Allow reading the link.
|
||||
allow priv_app cache_file:lnk_file r_file_perms;
|
||||
|
||||
# Write to /data/ota_package for OTA packages.
|
||||
allow priv_app ota_package_file:dir rw_dir_perms;
|
||||
allow priv_app ota_package_file:file create_file_perms;
|
||||
|
||||
# Access to /data/media.
|
||||
allow priv_app media_rw_data_file:dir create_dir_perms;
|
||||
allow priv_app media_rw_data_file:file create_file_perms;
|
||||
|
||||
# Used by Finsky / Android "Verify Apps" functionality when
|
||||
# running "adb install foo.apk".
|
||||
allow priv_app shell_data_file:file r_file_perms;
|
||||
allow priv_app shell_data_file:dir r_dir_perms;
|
||||
|
||||
# Allow traceur to pass file descriptors through a content provider to betterbug
|
||||
allow priv_app trace_data_file:file { getattr read };
|
||||
|
||||
# Allow verifier to access staged apks.
|
||||
allow priv_app { apk_tmp_file apk_private_tmp_file }:dir r_dir_perms;
|
||||
allow priv_app { apk_tmp_file apk_private_tmp_file }:file r_file_perms;
|
||||
|
||||
# b/18504118: Allow reads from /data/anr/traces.txt
|
||||
allow priv_app anr_data_file:file r_file_perms;
|
||||
|
||||
# Allow GMS core to access perfprofd output, which is stored
|
||||
# in /data/misc/perfprofd/. GMS core will need to list all
|
||||
# data stored in that directory to process them one by one.
|
||||
userdebug_or_eng(`
|
||||
allow priv_app perfprofd_data_file:file r_file_perms;
|
||||
allow priv_app perfprofd_data_file:dir r_dir_perms;
|
||||
')
|
||||
|
||||
# For AppFuse.
|
||||
allow priv_app vold:fd use;
|
||||
allow priv_app fuse_device:chr_file { read write };
|
||||
|
||||
# /proc access
|
||||
allow priv_app {
|
||||
proc_vmstat
|
||||
}:file r_file_perms;
|
||||
|
||||
allow priv_app sysfs_type:dir search;
|
||||
# Read access to /sys/class/net/wlan*/address
|
||||
r_dir_file(priv_app, sysfs_net)
|
||||
# Read access to /sys/block/zram*/mm_stat
|
||||
r_dir_file(priv_app, sysfs_zram)
|
||||
|
||||
r_dir_file(priv_app, rootfs)
|
||||
|
||||
# Allow GMS core to open kernel config for OTA matching through libvintf
|
||||
allow priv_app config_gz:file { open read getattr };
|
||||
|
||||
# access the mac address
|
||||
allowxperm priv_app self:udp_socket ioctl SIOCGIFHWADDR;
|
||||
|
||||
# Allow GMS core to communicate with update_engine for A/B update.
|
||||
binder_call(priv_app, update_engine)
|
||||
allow priv_app update_engine_service:service_manager find;
|
||||
|
||||
# Allow GMS core to communicate with dumpsys storaged.
|
||||
binder_call(priv_app, storaged)
|
||||
allow priv_app storaged_service:service_manager find;
|
||||
|
||||
# Allow GMS core to access system_update_service (e.g. to publish pending
|
||||
# system update info).
|
||||
allow priv_app system_update_service:service_manager find;
|
||||
|
||||
# Allow GMS core to communicate with statsd.
|
||||
binder_call(priv_app, statsd)
|
||||
|
||||
# Allow Phone to read/write cached ringtones (opened by system).
|
||||
allow priv_app ringtone_file:file { getattr read write };
|
||||
|
||||
# Access to /data/preloads
|
||||
allow priv_app preloads_data_file:file r_file_perms;
|
||||
allow priv_app preloads_data_file:dir r_dir_perms;
|
||||
allow priv_app preloads_media_file:file r_file_perms;
|
||||
allow priv_app preloads_media_file:dir r_dir_perms;
|
||||
|
||||
# Allow privileged apps (e.g. GMS core) to generate unique hardware IDs
|
||||
allow priv_app keystore:keystore_key gen_unique_id;
|
||||
|
||||
# Allow GMS core to access /sys/fs/selinux/policyvers for compatibility check
|
||||
allow priv_app selinuxfs:file r_file_perms;
|
||||
|
||||
read_runtime_log_tags(priv_app)
|
||||
|
||||
# Write app-specific trace data to the Perfetto traced damon. This requires
|
||||
# connecting to its producer socket and obtaining a (per-process) tmpfs fd.
|
||||
allow priv_app traced:fd use;
|
||||
allow priv_app traced_tmpfs:file { read write getattr map };
|
||||
unix_socket_connect(priv_app, traced_producer, traced)
|
||||
|
||||
# suppress denials for non-API accesses.
|
||||
dontaudit priv_app exec_type:file getattr;
|
||||
dontaudit priv_app device:dir read;
|
||||
dontaudit priv_app fs_bpf:dir search;
|
||||
dontaudit priv_app net_dns_prop:file read;
|
||||
dontaudit priv_app proc:file read;
|
||||
dontaudit priv_app proc_interrupts:file read;
|
||||
dontaudit priv_app proc_modules:file read;
|
||||
dontaudit priv_app proc_stat:file read;
|
||||
dontaudit priv_app proc_version:file read;
|
||||
dontaudit priv_app sysfs:dir read;
|
||||
dontaudit priv_app sysfs_android_usb:file read;
|
||||
dontaudit priv_app wifi_prop:file read;
|
||||
dontaudit priv_app { wifi_prop exported_wifi_prop }:file read;
|
||||
|
||||
# allow privileged apps to use UDP sockets provided by the system server but not
|
||||
# modify them other than to connect
|
||||
allow priv_app system_server:udp_socket {
|
||||
connect getattr read recvfrom sendto write getopt setopt };
|
||||
|
||||
###
|
||||
### neverallow rules
|
||||
###
|
||||
|
||||
# Receive or send uevent messages.
|
||||
neverallow priv_app domain:netlink_kobject_uevent_socket *;
|
||||
|
||||
# Receive or send generic netlink messages
|
||||
neverallow priv_app domain:netlink_socket *;
|
||||
|
||||
# Too much leaky information in debugfs. It's a security
|
||||
# best practice to ensure these files aren't readable.
|
||||
neverallow priv_app debugfs:file read;
|
||||
|
||||
# Do not allow privileged apps to register services.
|
||||
# Only trusted components of Android should be registering
|
||||
# services.
|
||||
neverallow priv_app service_manager_type:service_manager add;
|
||||
|
||||
# Do not allow privileged apps to connect to the property service
|
||||
# or set properties. b/10243159
|
||||
neverallow priv_app property_socket:sock_file write;
|
||||
neverallow priv_app init:unix_stream_socket connectto;
|
||||
neverallow priv_app property_type:property_service set;
|
||||
|
||||
# Do not allow priv_app to be assigned mlstrustedsubject.
|
||||
# This would undermine the per-user isolation model being
|
||||
# enforced via levelFrom=user in seapp_contexts and the mls
|
||||
# constraints. As there is no direct way to specify a neverallow
|
||||
# on attribute assignment, this relies on the fact that fork
|
||||
# permission only makes sense within a domain (hence should
|
||||
# never be granted to any other domain within mlstrustedsubject)
|
||||
# and priv_app is allowed fork permission to itself.
|
||||
neverallow priv_app mlstrustedsubject:process fork;
|
||||
|
||||
# Do not allow priv_app to hard link to any files.
|
||||
# In particular, if priv_app links to other app data
|
||||
# files, installd will not be able to guarantee the deletion
|
||||
# of the linked to file. Hard links also contribute to security
|
||||
# bugs, so we want to ensure priv_app never has this
|
||||
# capability.
|
||||
neverallow priv_app file_type:file link;
|
||||
|
||||
# priv apps should not be able to open trace data files, they should depend
|
||||
# upon traceur to pass a file descriptor which they can then read
|
||||
neverallow priv_app trace_data_file:dir *;
|
||||
neverallow priv_app trace_data_file:file { no_w_file_perms open };
|
||||
|
|
@ -1 +0,0 @@
|
|||
typeattribute profman coredomain;
|
||||
|
|
@ -1,147 +0,0 @@
|
|||
##########################
|
||||
# property service keys
|
||||
#
|
||||
#
|
||||
net.rmnet u:object_r:net_radio_prop:s0
|
||||
net.gprs u:object_r:net_radio_prop:s0
|
||||
net.ppp u:object_r:net_radio_prop:s0
|
||||
net.qmi u:object_r:net_radio_prop:s0
|
||||
net.lte u:object_r:net_radio_prop:s0
|
||||
net.cdma u:object_r:net_radio_prop:s0
|
||||
net.dns u:object_r:net_dns_prop:s0
|
||||
sys.usb.config u:object_r:system_radio_prop:s0
|
||||
ril. u:object_r:radio_prop:s0
|
||||
ro.ril. u:object_r:radio_prop:s0
|
||||
gsm. u:object_r:radio_prop:s0
|
||||
persist.radio u:object_r:radio_prop:s0
|
||||
|
||||
net. u:object_r:system_prop:s0
|
||||
dev. u:object_r:system_prop:s0
|
||||
ro.runtime. u:object_r:system_prop:s0
|
||||
ro.runtime.firstboot u:object_r:firstboot_prop:s0
|
||||
hw. u:object_r:system_prop:s0
|
||||
ro.hw. u:object_r:system_prop:s0
|
||||
sys. u:object_r:system_prop:s0
|
||||
sys.cppreopt u:object_r:cppreopt_prop:s0
|
||||
sys.powerctl u:object_r:powerctl_prop:s0
|
||||
sys.usb.ffs. u:object_r:ffs_prop:s0
|
||||
service. u:object_r:system_prop:s0
|
||||
dhcp. u:object_r:dhcp_prop:s0
|
||||
dhcp.bt-pan.result u:object_r:pan_result_prop:s0
|
||||
bluetooth. u:object_r:bluetooth_prop:s0
|
||||
|
||||
debug. u:object_r:debug_prop:s0
|
||||
debug.db. u:object_r:debuggerd_prop:s0
|
||||
dumpstate. u:object_r:dumpstate_prop:s0
|
||||
dumpstate.options u:object_r:dumpstate_options_prop:s0
|
||||
log. u:object_r:log_prop:s0
|
||||
log.tag u:object_r:log_tag_prop:s0
|
||||
log.tag.WifiHAL u:object_r:wifi_log_prop:s0
|
||||
security.perf_harden u:object_r:shell_prop:s0
|
||||
service.adb.root u:object_r:shell_prop:s0
|
||||
service.adb.tcp.port u:object_r:shell_prop:s0
|
||||
|
||||
persist.audio. u:object_r:audio_prop:s0
|
||||
persist.bluetooth. u:object_r:bluetooth_prop:s0
|
||||
persist.debug. u:object_r:persist_debug_prop:s0
|
||||
persist.logd. u:object_r:logd_prop:s0
|
||||
ro.logd. u:object_r:logd_prop:s0
|
||||
persist.logd.security u:object_r:device_logging_prop:s0
|
||||
persist.logd.logpersistd u:object_r:logpersistd_logging_prop:s0
|
||||
logd.logpersistd u:object_r:logpersistd_logging_prop:s0
|
||||
persist.log.tag u:object_r:log_tag_prop:s0
|
||||
persist.mmc. u:object_r:mmc_prop:s0
|
||||
persist.netd.stable_secret u:object_r:netd_stable_secret_prop:s0
|
||||
persist.sys. u:object_r:system_prop:s0
|
||||
persist.sys.safemode u:object_r:safemode_prop:s0
|
||||
ro.sys.safemode u:object_r:safemode_prop:s0
|
||||
persist.sys.audit_safemode u:object_r:safemode_prop:s0
|
||||
persist.service. u:object_r:system_prop:s0
|
||||
persist.service.bdroid. u:object_r:bluetooth_prop:s0
|
||||
persist.security. u:object_r:system_prop:s0
|
||||
persist.traced.enable u:object_r:traced_enabled_prop:s0
|
||||
persist.vendor.overlay. u:object_r:overlay_prop:s0
|
||||
ro.boot.vendor.overlay. u:object_r:overlay_prop:s0
|
||||
ro.boottime. u:object_r:boottime_prop:s0
|
||||
ro.serialno u:object_r:serialno_prop:s0
|
||||
ro.boot.btmacaddr u:object_r:bluetooth_prop:s0
|
||||
ro.boot.serialno u:object_r:serialno_prop:s0
|
||||
ro.bt. u:object_r:bluetooth_prop:s0
|
||||
ro.boot.bootreason u:object_r:bootloader_boot_reason_prop:s0
|
||||
persist.sys.boot.reason u:object_r:last_boot_reason_prop:s0
|
||||
sys.boot.reason u:object_r:system_boot_reason_prop:s0
|
||||
pm. u:object_r:pm_prop:s0
|
||||
test.sys.boot.reason u:object_r:test_boot_reason_prop:s0
|
||||
|
||||
# Boolean property set by system server upon boot indicating
|
||||
# if device owner is provisioned.
|
||||
ro.device_owner u:object_r:device_logging_prop:s0
|
||||
|
||||
# selinux non-persistent properties
|
||||
selinux.restorecon_recursive u:object_r:restorecon_prop:s0
|
||||
|
||||
# default property context
|
||||
* u:object_r:default_prop:s0
|
||||
|
||||
# data partition encryption properties
|
||||
vold. u:object_r:vold_prop:s0
|
||||
ro.crypto. u:object_r:vold_prop:s0
|
||||
|
||||
# ro.build.fingerprint is either set in /system/build.prop, or is
|
||||
# set at runtime by system_server.
|
||||
ro.build.fingerprint u:object_r:fingerprint_prop:s0
|
||||
|
||||
ro.persistent_properties.ready u:object_r:persistent_properties_ready_prop:s0
|
||||
|
||||
# ctl properties
|
||||
ctl.bootanim u:object_r:ctl_bootanim_prop:s0
|
||||
ctl.android.hardware.dumpstate u:object_r:ctl_dumpstate_prop:s0
|
||||
ctl.dumpstate u:object_r:ctl_dumpstate_prop:s0
|
||||
ctl.fuse_ u:object_r:ctl_fuse_prop:s0
|
||||
ctl.mdnsd u:object_r:ctl_mdnsd_prop:s0
|
||||
ctl.ril-daemon u:object_r:ctl_rildaemon_prop:s0
|
||||
ctl.bugreport u:object_r:ctl_bugreport_prop:s0
|
||||
ctl.console u:object_r:ctl_console_prop:s0
|
||||
ctl. u:object_r:ctl_default_prop:s0
|
||||
|
||||
# Don't allow blind access to all services
|
||||
ctl.sigstop_on$ u:object_r:ctl_sigstop_prop:s0
|
||||
ctl.sigstop_off$ u:object_r:ctl_sigstop_prop:s0
|
||||
ctl.start$ u:object_r:ctl_start_prop:s0
|
||||
ctl.stop$ u:object_r:ctl_stop_prop:s0
|
||||
ctl.restart$ u:object_r:ctl_restart_prop:s0
|
||||
ctl.interface_start$ u:object_r:ctl_interface_start_prop:s0
|
||||
ctl.interface_stop$ u:object_r:ctl_interface_stop_prop:s0
|
||||
ctl.interface_restart$ u:object_r:ctl_interface_restart_prop:s0
|
||||
|
||||
# NFC properties
|
||||
nfc. u:object_r:nfc_prop:s0
|
||||
|
||||
# These properties are not normally set by processes other than init.
|
||||
# They are only distinguished here for setting by qemu-props on the
|
||||
# emulator/goldfish.
|
||||
config. u:object_r:config_prop:s0
|
||||
ro.config. u:object_r:config_prop:s0
|
||||
dalvik. u:object_r:dalvik_prop:s0
|
||||
ro.dalvik. u:object_r:dalvik_prop:s0
|
||||
|
||||
# Shared between system server and wificond
|
||||
wlan. u:object_r:wifi_prop:s0
|
||||
|
||||
# Lowpan properties
|
||||
lowpan. u:object_r:lowpan_prop:s0
|
||||
ro.lowpan. u:object_r:lowpan_prop:s0
|
||||
|
||||
# hwservicemanager properties
|
||||
hwservicemanager. u:object_r:hwservicemanager_prop:s0
|
||||
|
||||
# Common default properties for vendor and odm.
|
||||
init.svc.odm. u:object_r:vendor_default_prop:s0
|
||||
init.svc.vendor. u:object_r:vendor_default_prop:s0
|
||||
ro.hardware. u:object_r:vendor_default_prop:s0
|
||||
ro.odm. u:object_r:vendor_default_prop:s0
|
||||
ro.vendor. u:object_r:vendor_default_prop:s0
|
||||
odm. u:object_r:vendor_default_prop:s0
|
||||
persist.odm. u:object_r:vendor_default_prop:s0
|
||||
persist.vendor. u:object_r:vendor_default_prop:s0
|
||||
vendor. u:object_r:vendor_default_prop:s0
|
||||
|
|
@ -1,3 +0,0 @@
|
|||
typeattribute racoon coredomain;
|
||||
|
||||
init_daemon_domain(racoon)
|
||||
|
|
@ -1,5 +0,0 @@
|
|||
typeattribute radio coredomain;
|
||||
|
||||
app_domain(radio)
|
||||
|
||||
read_runtime_log_tags(radio)
|
||||
|
|
@ -1 +0,0 @@
|
|||
typeattribute recovery coredomain;
|
||||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue