From 269e7cfc51b8f06a21b68b8910e1048ee3afd91c Mon Sep 17 00:00:00 2001 From: Nikita Ioffe Date: Thu, 13 Jan 2022 22:56:14 +0000 Subject: [PATCH] Move allow rules from public/app.te to private/app.te Allow rules in public/*.te can only reference types defined in public/*.te files. This can be quite cumbersome in cases a rule needs to be updated to reference a type that is only defined in private/*.te. This change moves all the allow rules from public/app.te to private/app.te to make it possible to reference private types in the allow rules. Bug: 211761016 Test: m Test: presubmit Change-Id: I0c4a3f1ef568bbfdfb2176869fcd92ee648617fa Merged-In: I0c4a3f1ef568bbfdfb2176869fcd92ee648617fa --- private/app.te | 369 +++++++++++++++++++++++++++++++++++++++++++++++++ public/app.te | 369 ------------------------------------------------- 2 files changed, 369 insertions(+), 369 deletions(-) diff --git a/private/app.te b/private/app.te index 7177b923f..856f4831a 100644 --- a/private/app.te +++ b/private/app.te @@ -87,6 +87,375 @@ allow appdomain apex_art_data_file:file rx_file_perms; allow appdomain tombstone_data_file:file { getattr read }; neverallow appdomain tombstone_data_file:file ~{ getattr read }; +# WebView and other application-specific JIT compilers +allow appdomain self:process execmem; + +allow appdomain { ashmem_device ashmem_libcutils_device }:chr_file execute; + +# Receive and use open file descriptors inherited from zygote. +allow appdomain zygote:fd use; + +# Receive and use open file descriptors inherited from app zygote. +allow appdomain app_zygote:fd use; + +# gdbserver for ndk-gdb reads the zygote. +# valgrind needs mmap exec for zygote +allow appdomain zygote_exec:file rx_file_perms; + +# Notify zygote of death; +allow appdomain zygote:process sigchld; + +# Read /data/dalvik-cache. +allow appdomain dalvikcache_data_file:dir { search getattr }; +allow appdomain dalvikcache_data_file:file r_file_perms; + +# Read the /sdcard and /mnt/sdcard symlinks +allow { appdomain -isolated_app } rootfs:lnk_file r_file_perms; +allow { appdomain -isolated_app } tmpfs:lnk_file r_file_perms; + +# Search /storage/emulated tmpfs mount. +allow appdomain tmpfs:dir r_dir_perms; + +# Notify zygote of the wrapped process PID when using --invoke-with. +allow appdomain zygote:fifo_file write; + +userdebug_or_eng(` + # Allow apps to create and write method traces in /data/misc/trace. + allow appdomain method_trace_data_file:dir w_dir_perms; + allow appdomain method_trace_data_file:file { create w_file_perms }; +') + +# Notify shell and adbd of death when spawned via runas for ndk-gdb. +allow appdomain shell:process sigchld; +allow appdomain adbd:process sigchld; + +# child shell or gdbserver pty access for runas. +allow appdomain devpts:chr_file { getattr read write ioctl }; + +# Use pipes and sockets provided by system_server via binder or local socket. +allow appdomain system_server:fd use; +allow appdomain system_server:fifo_file rw_file_perms; +allow appdomain system_server:unix_stream_socket { read write setopt getattr getopt shutdown }; +allow appdomain system_server:tcp_socket { read write getattr getopt shutdown }; + +# For AppFuse. +allow appdomain vold:fd use; + +# Communication with other apps via fifos +allow appdomain appdomain:fifo_file rw_file_perms; + +# Communicate with surfaceflinger. +allow appdomain surfaceflinger:unix_stream_socket { read write setopt getattr getopt shutdown }; + +# App sandbox file accesses. +allow { appdomain -isolated_app -mlstrustedsubject } { app_data_file privapp_data_file }:dir create_dir_perms; +allow { appdomain -isolated_app -mlstrustedsubject } { app_data_file privapp_data_file }:file create_file_perms; + +# Access via already open fds is ok even for mlstrustedsubject. +allow { appdomain -isolated_app } { app_data_file privapp_data_file system_app_data_file }:file { getattr map read write }; + +# Traverse into expanded storage +allow appdomain mnt_expand_file:dir r_dir_perms; + +# Keychain and user-trusted credentials +r_dir_file(appdomain, keychain_data_file) +allow appdomain misc_user_data_file:dir r_dir_perms; +allow appdomain misc_user_data_file:file r_file_perms; + +# TextClassifier +r_dir_file({ appdomain -isolated_app }, textclassifier_data_file) + +# Access to OEM provided data and apps +allow appdomain oemfs:dir r_dir_perms; +allow appdomain oemfs:file rx_file_perms; + +# Execute the shell or other system executables. +allow { appdomain -ephemeral_app } shell_exec:file rx_file_perms; +allow { appdomain -ephemeral_app } toolbox_exec:file rx_file_perms; +allow appdomain system_file:file x_file_perms; +not_full_treble(`allow { appdomain -ephemeral_app } vendor_file:file x_file_perms;') + +# Renderscript needs the ability to read directories on /system +allow appdomain system_file:dir r_dir_perms; +allow appdomain system_file:lnk_file { getattr open read }; +# Renderscript specific permissions to open /system/vendor/lib64. +not_full_treble(` + allow appdomain vendor_file_type:dir r_dir_perms; + allow appdomain vendor_file_type:lnk_file { getattr open read }; +') + +full_treble_only(` + # For looking up Renderscript vendor drivers + allow { appdomain -isolated_app } vendor_file:dir { open read }; +') + +# Allow apps access to /vendor/app except for privileged +# apps which cannot be in /vendor. +r_dir_file({ appdomain -ephemeral_app }, vendor_app_file) +allow { appdomain -ephemeral_app } vendor_app_file:file execute; + +# Allow apps access to /vendor/overlay +r_dir_file(appdomain, vendor_overlay_file) + +# Allow apps access to /vendor/framework +# for vendor provided libraries. +r_dir_file(appdomain, vendor_framework_file) + +# Allow apps read / execute access to vendor public libraries. +allow appdomain {vendor_public_framework_file vendor_public_lib_file}:dir r_dir_perms; +allow appdomain {vendor_public_framework_file vendor_public_lib_file}:file { execute read open getattr map }; + +# Read/write wallpaper file (opened by system). +allow appdomain wallpaper_file:file { getattr read write map }; + +# Read/write cached ringtones (opened by system). +allow appdomain ringtone_file:file { getattr read write map }; + +# Read ShortcutManager icon files (opened by system). +allow appdomain shortcut_manager_icons:file { getattr read map }; + +# Read icon file (opened by system). +allow appdomain icon_file:file { getattr read map }; + +# Old stack dumping scheme : append to a global trace file (/data/anr/traces.txt). +# +# TODO: All of these permissions except for anr_data_file:file append can be +# withdrawn once we've switched to the new stack dumping mechanism, see b/32064548 +# and the rules below. +allow appdomain anr_data_file:dir search; +allow appdomain anr_data_file:file { open append }; + +# New stack dumping scheme : request an output FD from tombstoned via a unix +# domain socket. +# +# Allow apps to connect and write to the tombstoned java trace socket in +# order to dump their traces. Also allow them to append traces to pipes +# created by dumptrace. (Also see the rules below where they are given +# additional permissions to dumpstate pipes for other aspects of bug report +# creation). +unix_socket_connect(appdomain, tombstoned_java_trace, tombstoned) +allow appdomain tombstoned:fd use; +allow appdomain dumpstate:fifo_file append; +allow appdomain incidentd:fifo_file append; + +# Allow apps to send dump information to dumpstate +allow appdomain dumpstate:fd use; +allow appdomain dumpstate:unix_stream_socket { read write getopt getattr shutdown }; +allow appdomain dumpstate:fifo_file { write getattr }; +allow appdomain shell_data_file:file { write getattr }; + +# Allow apps to send dump information to incidentd +allow appdomain incidentd:fd use; +allow appdomain incidentd:fifo_file { write getattr }; + +# Allow apps to send information to statsd socket. +unix_socket_send(appdomain, statsdw, statsd) + +# Write profiles /data/misc/profiles +allow appdomain user_profile_root_file:dir search; +allow appdomain user_profile_data_file:dir { search write add_name }; +allow appdomain user_profile_data_file:file create_file_perms; + +# Send heap dumps to system_server via an already open file descriptor +# % adb shell am set-watch-heap com.android.systemui 1048576 +# % adb shell dumpsys procstats --start-testing +# debuggable builds only. +userdebug_or_eng(` + allow appdomain heapdump_data_file:file append; +') + +# /proc/net access. +# TODO(b/9496886) Audit access for removal. +# proc_net access for the negated domains below is granted (or not) in their +# individual .te files. +r_dir_file({ + appdomain + -ephemeral_app + -isolated_app + -platform_app + -priv_app + -shell + -system_app + -untrusted_app_all +}, proc_net_type) +# audit access for all these non-core app domains. +userdebug_or_eng(` + auditallow { + appdomain + -ephemeral_app + -isolated_app + -platform_app + -priv_app + -shell + -su + -system_app + -untrusted_app_all + } proc_net_type:{ dir file lnk_file } { getattr open read }; +') + +# Grant GPU access to all processes started by Zygote. +# They need that to render the standard UI. +allow { appdomain -isolated_app } gpu_device:chr_file rw_file_perms; + +# Use the Binder. +binder_use(appdomain) +# Perform binder IPC to binder services. +binder_call(appdomain, binderservicedomain) +# Perform binder IPC to other apps. +binder_call(appdomain, appdomain) +# Perform binder IPC to ephemeral apps. +binder_call(appdomain, ephemeral_app) +# Perform binder IPC to gpuservice. +binder_call({ appdomain -isolated_app }, gpuservice) + +# Talk with graphics composer fences +allow appdomain hal_graphics_composer:fd use; + +# Already connected, unnamed sockets being passed over some other IPC +# hence no sock_file or connectto permission. This appears to be how +# Chrome works, may need to be updated as more apps using isolated services +# are examined. +allow appdomain appdomain:unix_stream_socket { getopt getattr read write shutdown }; + +# Backup ability for every app. BMS opens and passes the fd +# to any app that has backup ability. Hence, no open permissions here. +allow appdomain backup_data_file:file { read write getattr map }; +allow appdomain cache_backup_file:file { read write getattr map }; +allow appdomain cache_backup_file:dir getattr; +# Backup ability using 'adb backup' +allow appdomain system_data_file:lnk_file r_file_perms; +allow appdomain system_data_file:file { getattr read map }; + +# Allow read/stat of /data/media files passed by Binder or local socket IPC. +allow { appdomain -isolated_app } media_rw_data_file:file { read getattr }; + +# Read and write /data/data/com.android.providers.telephony files passed over Binder. +allow { appdomain -isolated_app } radio_data_file:file { read write getattr }; + +# Allow access to external storage; we have several visible mount points under /storage +# and symlinks to primary storage at places like /storage/sdcard0 and /mnt/user/0/primary +allow { appdomain -isolated_app -ephemeral_app } storage_file:dir r_dir_perms; +allow { appdomain -isolated_app -ephemeral_app } storage_file:lnk_file r_file_perms; +allow { appdomain -isolated_app -ephemeral_app } mnt_user_file:dir r_dir_perms; +allow { appdomain -isolated_app -ephemeral_app } mnt_user_file:lnk_file r_file_perms; + +# Read/write visible storage +allow { appdomain -isolated_app -ephemeral_app } { sdcard_type fuse }:dir create_dir_perms; +allow { appdomain -isolated_app -ephemeral_app } { sdcard_type fuse }:file create_file_perms; +# This should be removed if sdcardfs is modified to alter the secontext for its +# accesses to the underlying FS. +allow { appdomain -isolated_app -ephemeral_app } media_rw_data_file:dir create_dir_perms; +allow { appdomain -isolated_app -ephemeral_app } media_rw_data_file:file create_file_perms; + +# Allow apps to use the USB Accessory interface. +# http://developer.android.com/guide/topics/connectivity/usb/accessory.html +# +# USB devices are first opened by the system server (USBDeviceManagerService) +# and the file descriptor is passed to the right Activity via binder. +allow { appdomain -isolated_app -ephemeral_app } usb_device:chr_file { read write getattr ioctl }; +allow { appdomain -isolated_app -ephemeral_app } usbaccessory_device:chr_file { read write getattr }; + +# For art. +allow appdomain dalvikcache_data_file:file execute; +allow appdomain dalvikcache_data_file:lnk_file r_file_perms; + +# Allow any app to read shared RELRO files. +allow appdomain shared_relro_file:dir search; +allow appdomain shared_relro_file:file r_file_perms; + +# Allow apps to read/execute installed binaries +allow appdomain apk_data_file:dir r_dir_perms; +allow appdomain apk_data_file:file rx_file_perms; + +# /data/resource-cache +allow appdomain resourcecache_data_file:file r_file_perms; +allow appdomain resourcecache_data_file:dir r_dir_perms; + +# logd access +read_logd(appdomain) +control_logd({ appdomain -ephemeral_app }) +# application inherit logd write socket (urge is to deprecate this long term) +allow appdomain zygote:unix_dgram_socket write; + +allow { appdomain -isolated_app -ephemeral_app } keystore:keystore_key { get_state get insert delete exist list sign verify }; +allow { appdomain -isolated_app -ephemeral_app } keystore:keystore2_key { delete use get_info rebind update }; + +allow { appdomain -isolated_app -ephemeral_app } keystore_maintenance_service:service_manager find; +allow { appdomain -isolated_app -ephemeral_app } keystore:keystore2 get_state; + +use_keystore({ appdomain -isolated_app -ephemeral_app }) + +use_credstore({ appdomain -isolated_app -ephemeral_app }) + +allow appdomain console_device:chr_file { read write }; + +# only allow unprivileged socket ioctl commands +allowxperm { appdomain -bluetooth } self:{ rawip_socket tcp_socket udp_socket } + ioctl { unpriv_sock_ioctls unpriv_tty_ioctls }; + +allow { appdomain -isolated_app } ion_device:chr_file r_file_perms; +allow { appdomain -isolated_app } dmabuf_system_heap_device:chr_file r_file_perms; +allow { appdomain -isolated_app } dmabuf_system_secure_heap_device:chr_file r_file_perms; + +# Allow AAudio apps to use shared memory file descriptors from the HAL +allow { appdomain -isolated_app } hal_audio:fd use; + +# Allow app to access shared memory created by camera HAL1 +allow { appdomain -isolated_app } hal_camera:fd use; + +# Allow apps to access shared memory file descriptor from the tuner HAL +allow {appdomain -isolated_app} hal_tv_tuner_server:fd use; + +# RenderScript always-passthrough HAL +allow { appdomain -isolated_app } hal_renderscript_hwservice:hwservice_manager find; +allow appdomain same_process_hal_file:file { execute read open getattr map }; + +# TODO: switch to meminfo service +allow appdomain proc_meminfo:file r_file_perms; + +# For app fuse. +allow appdomain app_fuse_file:file { getattr read append write map }; + +pdx_client({ appdomain -isolated_app -ephemeral_app }, display_client) +pdx_client({ appdomain -isolated_app -ephemeral_app }, display_manager) +pdx_client({ appdomain -isolated_app -ephemeral_app }, display_vsync) +pdx_client({ appdomain -isolated_app -ephemeral_app }, performance_client) +# Apps do not directly open the IPC socket for bufferhubd. +pdx_use({ appdomain -isolated_app -ephemeral_app }, bufferhub_client) + +### +### CTS-specific rules +### + +# For cts/tests/tests/permission/src/android/permission/cts/FileSystemPermissionTest.java. +# testRunAsHasCorrectCapabilities +allow appdomain runas_exec:file getattr; +# Others are either allowed elsewhere or not desired. + +# Apps receive an open tun fd from the framework for +# device traffic. Do not allow untrusted app to directly open tun_device +allow { appdomain -isolated_app -ephemeral_app } tun_device:chr_file { read write getattr append ioctl }; +allowxperm { appdomain -isolated_app -ephemeral_app } tun_device:chr_file ioctl TUNGETIFF; + +# Connect to adbd and use a socket transferred from it. +# This is used for e.g. adb backup/restore. +allow appdomain adbd:unix_stream_socket connectto; +allow appdomain adbd:fd use; +allow appdomain adbd:unix_stream_socket { getattr getopt ioctl read write shutdown }; + +allow appdomain cache_file:dir getattr; + +# Allow apps to run with asanwrapper. +with_asan(`allow appdomain asanwrapper_exec:file rx_file_perms;') + +# Read access to FDs from the DropboxManagerService. +allow appdomain dropbox_data_file:file { getattr read }; + +# Read tmpfs types from these processes. +allow appdomain audioserver_tmpfs:file { getattr map read write }; +allow appdomain system_server_tmpfs:file { getattr map read write }; +allow appdomain zygote_tmpfs:file { map read }; + # Sensitive app domains are not allowed to execute from /data # to prevent persistence attacks and ensure all code is executed # from read-only locations. diff --git a/public/app.te b/public/app.te index 7de9c00a4..09e30ca36 100644 --- a/public/app.te +++ b/public/app.te @@ -8,375 +8,6 @@ ### type appdomain_tmpfs, file_type; -# WebView and other application-specific JIT compilers -allow appdomain self:process execmem; - -allow appdomain { ashmem_device ashmem_libcutils_device }:chr_file execute; - -# Receive and use open file descriptors inherited from zygote. -allow appdomain zygote:fd use; - -# Receive and use open file descriptors inherited from app zygote. -allow appdomain app_zygote:fd use; - -# gdbserver for ndk-gdb reads the zygote. -# valgrind needs mmap exec for zygote -allow appdomain zygote_exec:file rx_file_perms; - -# Notify zygote of death; -allow appdomain zygote:process sigchld; - -# Read /data/dalvik-cache. -allow appdomain dalvikcache_data_file:dir { search getattr }; -allow appdomain dalvikcache_data_file:file r_file_perms; - -# Read the /sdcard and /mnt/sdcard symlinks -allow { appdomain -isolated_app } rootfs:lnk_file r_file_perms; -allow { appdomain -isolated_app } tmpfs:lnk_file r_file_perms; - -# Search /storage/emulated tmpfs mount. -allow appdomain tmpfs:dir r_dir_perms; - -# Notify zygote of the wrapped process PID when using --invoke-with. -allow appdomain zygote:fifo_file write; - -userdebug_or_eng(` - # Allow apps to create and write method traces in /data/misc/trace. - allow appdomain method_trace_data_file:dir w_dir_perms; - allow appdomain method_trace_data_file:file { create w_file_perms }; -') - -# Notify shell and adbd of death when spawned via runas for ndk-gdb. -allow appdomain shell:process sigchld; -allow appdomain adbd:process sigchld; - -# child shell or gdbserver pty access for runas. -allow appdomain devpts:chr_file { getattr read write ioctl }; - -# Use pipes and sockets provided by system_server via binder or local socket. -allow appdomain system_server:fd use; -allow appdomain system_server:fifo_file rw_file_perms; -allow appdomain system_server:unix_stream_socket { read write setopt getattr getopt shutdown }; -allow appdomain system_server:tcp_socket { read write getattr getopt shutdown }; - -# For AppFuse. -allow appdomain vold:fd use; - -# Communication with other apps via fifos -allow appdomain appdomain:fifo_file rw_file_perms; - -# Communicate with surfaceflinger. -allow appdomain surfaceflinger:unix_stream_socket { read write setopt getattr getopt shutdown }; - -# App sandbox file accesses. -allow { appdomain -isolated_app -mlstrustedsubject } { app_data_file privapp_data_file }:dir create_dir_perms; -allow { appdomain -isolated_app -mlstrustedsubject } { app_data_file privapp_data_file }:file create_file_perms; - -# Access via already open fds is ok even for mlstrustedsubject. -allow { appdomain -isolated_app } { app_data_file privapp_data_file system_app_data_file }:file { getattr map read write }; - -# Traverse into expanded storage -allow appdomain mnt_expand_file:dir r_dir_perms; - -# Keychain and user-trusted credentials -r_dir_file(appdomain, keychain_data_file) -allow appdomain misc_user_data_file:dir r_dir_perms; -allow appdomain misc_user_data_file:file r_file_perms; - -# TextClassifier -r_dir_file({ appdomain -isolated_app }, textclassifier_data_file) - -# Access to OEM provided data and apps -allow appdomain oemfs:dir r_dir_perms; -allow appdomain oemfs:file rx_file_perms; - -# Execute the shell or other system executables. -allow { appdomain -ephemeral_app } shell_exec:file rx_file_perms; -allow { appdomain -ephemeral_app } toolbox_exec:file rx_file_perms; -allow appdomain system_file:file x_file_perms; -not_full_treble(`allow { appdomain -ephemeral_app } vendor_file:file x_file_perms;') - -# Renderscript needs the ability to read directories on /system -allow appdomain system_file:dir r_dir_perms; -allow appdomain system_file:lnk_file { getattr open read }; -# Renderscript specific permissions to open /system/vendor/lib64. -not_full_treble(` - allow appdomain vendor_file_type:dir r_dir_perms; - allow appdomain vendor_file_type:lnk_file { getattr open read }; -') - -full_treble_only(` - # For looking up Renderscript vendor drivers - allow { appdomain -isolated_app } vendor_file:dir { open read }; -') - -# Allow apps access to /vendor/app except for privileged -# apps which cannot be in /vendor. -r_dir_file({ appdomain -ephemeral_app }, vendor_app_file) -allow { appdomain -ephemeral_app } vendor_app_file:file execute; - -# Allow apps access to /vendor/overlay -r_dir_file(appdomain, vendor_overlay_file) - -# Allow apps access to /vendor/framework -# for vendor provided libraries. -r_dir_file(appdomain, vendor_framework_file) - -# Allow apps read / execute access to vendor public libraries. -allow appdomain {vendor_public_framework_file vendor_public_lib_file}:dir r_dir_perms; -allow appdomain {vendor_public_framework_file vendor_public_lib_file}:file { execute read open getattr map }; - -# Read/write wallpaper file (opened by system). -allow appdomain wallpaper_file:file { getattr read write map }; - -# Read/write cached ringtones (opened by system). -allow appdomain ringtone_file:file { getattr read write map }; - -# Read ShortcutManager icon files (opened by system). -allow appdomain shortcut_manager_icons:file { getattr read map }; - -# Read icon file (opened by system). -allow appdomain icon_file:file { getattr read map }; - -# Old stack dumping scheme : append to a global trace file (/data/anr/traces.txt). -# -# TODO: All of these permissions except for anr_data_file:file append can be -# withdrawn once we've switched to the new stack dumping mechanism, see b/32064548 -# and the rules below. -allow appdomain anr_data_file:dir search; -allow appdomain anr_data_file:file { open append }; - -# New stack dumping scheme : request an output FD from tombstoned via a unix -# domain socket. -# -# Allow apps to connect and write to the tombstoned java trace socket in -# order to dump their traces. Also allow them to append traces to pipes -# created by dumptrace. (Also see the rules below where they are given -# additional permissions to dumpstate pipes for other aspects of bug report -# creation). -unix_socket_connect(appdomain, tombstoned_java_trace, tombstoned) -allow appdomain tombstoned:fd use; -allow appdomain dumpstate:fifo_file append; -allow appdomain incidentd:fifo_file append; - -# Allow apps to send dump information to dumpstate -allow appdomain dumpstate:fd use; -allow appdomain dumpstate:unix_stream_socket { read write getopt getattr shutdown }; -allow appdomain dumpstate:fifo_file { write getattr }; -allow appdomain shell_data_file:file { write getattr }; - -# Allow apps to send dump information to incidentd -allow appdomain incidentd:fd use; -allow appdomain incidentd:fifo_file { write getattr }; - -# Allow apps to send information to statsd socket. -unix_socket_send(appdomain, statsdw, statsd) - -# Write profiles /data/misc/profiles -allow appdomain user_profile_root_file:dir search; -allow appdomain user_profile_data_file:dir { search write add_name }; -allow appdomain user_profile_data_file:file create_file_perms; - -# Send heap dumps to system_server via an already open file descriptor -# % adb shell am set-watch-heap com.android.systemui 1048576 -# % adb shell dumpsys procstats --start-testing -# debuggable builds only. -userdebug_or_eng(` - allow appdomain heapdump_data_file:file append; -') - -# /proc/net access. -# TODO(b/9496886) Audit access for removal. -# proc_net access for the negated domains below is granted (or not) in their -# individual .te files. -r_dir_file({ - appdomain - -ephemeral_app - -isolated_app - -platform_app - -priv_app - -shell - -system_app - -untrusted_app_all -}, proc_net_type) -# audit access for all these non-core app domains. -userdebug_or_eng(` - auditallow { - appdomain - -ephemeral_app - -isolated_app - -platform_app - -priv_app - -shell - -su - -system_app - -untrusted_app_all - } proc_net_type:{ dir file lnk_file } { getattr open read }; -') - -# Grant GPU access to all processes started by Zygote. -# They need that to render the standard UI. -allow { appdomain -isolated_app } gpu_device:chr_file rw_file_perms; - -# Use the Binder. -binder_use(appdomain) -# Perform binder IPC to binder services. -binder_call(appdomain, binderservicedomain) -# Perform binder IPC to other apps. -binder_call(appdomain, appdomain) -# Perform binder IPC to ephemeral apps. -binder_call(appdomain, ephemeral_app) -# Perform binder IPC to gpuservice. -binder_call({ appdomain -isolated_app }, gpuservice) - -# Talk with graphics composer fences -allow appdomain hal_graphics_composer:fd use; - -# Already connected, unnamed sockets being passed over some other IPC -# hence no sock_file or connectto permission. This appears to be how -# Chrome works, may need to be updated as more apps using isolated services -# are examined. -allow appdomain appdomain:unix_stream_socket { getopt getattr read write shutdown }; - -# Backup ability for every app. BMS opens and passes the fd -# to any app that has backup ability. Hence, no open permissions here. -allow appdomain backup_data_file:file { read write getattr map }; -allow appdomain cache_backup_file:file { read write getattr map }; -allow appdomain cache_backup_file:dir getattr; -# Backup ability using 'adb backup' -allow appdomain system_data_file:lnk_file r_file_perms; -allow appdomain system_data_file:file { getattr read map }; - -# Allow read/stat of /data/media files passed by Binder or local socket IPC. -allow { appdomain -isolated_app } media_rw_data_file:file { read getattr }; - -# Read and write /data/data/com.android.providers.telephony files passed over Binder. -allow { appdomain -isolated_app } radio_data_file:file { read write getattr }; - -# Allow access to external storage; we have several visible mount points under /storage -# and symlinks to primary storage at places like /storage/sdcard0 and /mnt/user/0/primary -allow { appdomain -isolated_app -ephemeral_app } storage_file:dir r_dir_perms; -allow { appdomain -isolated_app -ephemeral_app } storage_file:lnk_file r_file_perms; -allow { appdomain -isolated_app -ephemeral_app } mnt_user_file:dir r_dir_perms; -allow { appdomain -isolated_app -ephemeral_app } mnt_user_file:lnk_file r_file_perms; - -# Read/write visible storage -allow { appdomain -isolated_app -ephemeral_app } { sdcard_type fuse }:dir create_dir_perms; -allow { appdomain -isolated_app -ephemeral_app } { sdcard_type fuse }:file create_file_perms; -# This should be removed if sdcardfs is modified to alter the secontext for its -# accesses to the underlying FS. -allow { appdomain -isolated_app -ephemeral_app } media_rw_data_file:dir create_dir_perms; -allow { appdomain -isolated_app -ephemeral_app } media_rw_data_file:file create_file_perms; - -# Allow apps to use the USB Accessory interface. -# http://developer.android.com/guide/topics/connectivity/usb/accessory.html -# -# USB devices are first opened by the system server (USBDeviceManagerService) -# and the file descriptor is passed to the right Activity via binder. -allow { appdomain -isolated_app -ephemeral_app } usb_device:chr_file { read write getattr ioctl }; -allow { appdomain -isolated_app -ephemeral_app } usbaccessory_device:chr_file { read write getattr }; - -# For art. -allow appdomain dalvikcache_data_file:file execute; -allow appdomain dalvikcache_data_file:lnk_file r_file_perms; - -# Allow any app to read shared RELRO files. -allow appdomain shared_relro_file:dir search; -allow appdomain shared_relro_file:file r_file_perms; - -# Allow apps to read/execute installed binaries -allow appdomain apk_data_file:dir r_dir_perms; -allow appdomain apk_data_file:file rx_file_perms; - -# /data/resource-cache -allow appdomain resourcecache_data_file:file r_file_perms; -allow appdomain resourcecache_data_file:dir r_dir_perms; - -# logd access -read_logd(appdomain) -control_logd({ appdomain -ephemeral_app }) -# application inherit logd write socket (urge is to deprecate this long term) -allow appdomain zygote:unix_dgram_socket write; - -allow { appdomain -isolated_app -ephemeral_app } keystore:keystore_key { get_state get insert delete exist list sign verify }; -allow { appdomain -isolated_app -ephemeral_app } keystore:keystore2_key { delete use get_info rebind update }; - -allow { appdomain -isolated_app -ephemeral_app } keystore_maintenance_service:service_manager find; -allow { appdomain -isolated_app -ephemeral_app } keystore:keystore2 get_state; - -use_keystore({ appdomain -isolated_app -ephemeral_app }) - -use_credstore({ appdomain -isolated_app -ephemeral_app }) - -allow appdomain console_device:chr_file { read write }; - -# only allow unprivileged socket ioctl commands -allowxperm { appdomain -bluetooth } self:{ rawip_socket tcp_socket udp_socket } - ioctl { unpriv_sock_ioctls unpriv_tty_ioctls }; - -allow { appdomain -isolated_app } ion_device:chr_file r_file_perms; -allow { appdomain -isolated_app } dmabuf_system_heap_device:chr_file r_file_perms; -allow { appdomain -isolated_app } dmabuf_system_secure_heap_device:chr_file r_file_perms; - -# Allow AAudio apps to use shared memory file descriptors from the HAL -allow { appdomain -isolated_app } hal_audio:fd use; - -# Allow app to access shared memory created by camera HAL1 -allow { appdomain -isolated_app } hal_camera:fd use; - -# Allow apps to access shared memory file descriptor from the tuner HAL -allow {appdomain -isolated_app} hal_tv_tuner_server:fd use; - -# RenderScript always-passthrough HAL -allow { appdomain -isolated_app } hal_renderscript_hwservice:hwservice_manager find; -allow appdomain same_process_hal_file:file { execute read open getattr map }; - -# TODO: switch to meminfo service -allow appdomain proc_meminfo:file r_file_perms; - -# For app fuse. -allow appdomain app_fuse_file:file { getattr read append write map }; - -pdx_client({ appdomain -isolated_app -ephemeral_app }, display_client) -pdx_client({ appdomain -isolated_app -ephemeral_app }, display_manager) -pdx_client({ appdomain -isolated_app -ephemeral_app }, display_vsync) -pdx_client({ appdomain -isolated_app -ephemeral_app }, performance_client) -# Apps do not directly open the IPC socket for bufferhubd. -pdx_use({ appdomain -isolated_app -ephemeral_app }, bufferhub_client) - -### -### CTS-specific rules -### - -# For cts/tests/tests/permission/src/android/permission/cts/FileSystemPermissionTest.java. -# testRunAsHasCorrectCapabilities -allow appdomain runas_exec:file getattr; -# Others are either allowed elsewhere or not desired. - -# Apps receive an open tun fd from the framework for -# device traffic. Do not allow untrusted app to directly open tun_device -allow { appdomain -isolated_app -ephemeral_app } tun_device:chr_file { read write getattr append ioctl }; -allowxperm { appdomain -isolated_app -ephemeral_app } tun_device:chr_file ioctl TUNGETIFF; - -# Connect to adbd and use a socket transferred from it. -# This is used for e.g. adb backup/restore. -allow appdomain adbd:unix_stream_socket connectto; -allow appdomain adbd:fd use; -allow appdomain adbd:unix_stream_socket { getattr getopt ioctl read write shutdown }; - -allow appdomain cache_file:dir getattr; - -# Allow apps to run with asanwrapper. -with_asan(`allow appdomain asanwrapper_exec:file rx_file_perms;') - -# Read access to FDs from the DropboxManagerService. -allow appdomain dropbox_data_file:file { getattr read }; - -# Read tmpfs types from these processes. -allow appdomain audioserver_tmpfs:file { getattr map read write }; -allow appdomain system_server_tmpfs:file { getattr map read write }; -allow appdomain zygote_tmpfs:file { map read }; - ### ### Neverallow rules ###