tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Vendor domains must not use Binder

Browse source 
On PRODUCT_FULL_TREBLE devices, non-vendor domains (except vendor
apps) are not permitted to use Binder. This commit thus:
* groups non-vendor domains using the new "coredomain" attribute,
* adds neverallow rules restricting Binder use to coredomain and
  appdomain only, and
* temporarily exempts the domains which are currently violating this
  rule from this restriction. These domains are grouped using the new
  "binder_in_vendor_violators" attribute. The attribute is needed
  because the types corresponding to violators are not exposed to the
  public policy where the neverallow rules are.

Test: mmm system/sepolicy
Test: Device boots, no new denials
Test: In Chrome, navigate to ip6.me, play a YouTube video
Test: YouTube: play a video
Test: Netflix: play a movie
Test: Google Camera: take a photo, take an HDR+ photo, record video with
      sound, record slow motion video with sound. Confirm videos play
      back fine and with sound.
Bug: 35870313
Change-Id: I0cd1a80b60bcbde358ce0f7a47b90f4435a45c95
This commit is contained in:
Alex Klyubin 2017-03-23 14:27:32 -07:00
parent 93f99cb1d9
commit f5446eb148
103 changed files with 216 additions and 104 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
Android.mk
View file

@ -158,6 +158,7 @@ $(reqd_policy_mask.conf): $(call build_policy, $(sepolicy_build_files), $(REQD_M
-D target_with_dexpreopt=$(WITH_DEXPREOPT) \
-D target_arch=$(PRIVATE_TGT_ARCH) \
-D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \
-D target_full_treble=$(PRODUCT_FULL_TREBLE) \
-s $^ > $@
reqd_policy_mask.cil := $(intermediates)/reqd_policy_mask.cil
@ -188,6 +189,7 @@ $(BOARD_SEPOLICY_VERS_DIR) $(REQD_MASK_POLICY))
-D target_with_dexpreopt=$(WITH_DEXPREOPT) \
-D target_arch=$(PRIVATE_TGT_ARCH) \
-D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \
-D target_full_treble=$(PRODUCT_FULL_TREBLE) \
-s $^ > $@
plat_pub_policy.cil := $(intermediates)/plat_pub_policy.cil
@ -243,6 +245,7 @@ $(PLAT_PUBLIC_POLICY) $(PLAT_PRIVATE_POLICY))
-D target_with_dexpreopt=$(WITH_DEXPREOPT) \
-D target_arch=$(PRIVATE_TGT_ARCH) \
-D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \
-D target_full_treble=$(PRODUCT_FULL_TREBLE) \
-s $^ > $@
$(hide) sed '/dontaudit/d' $@ > $@.dontaudit
@ -342,6 +345,7 @@ $(BOARD_SEPOLICY_VERS_DIR) $(REQD_MASK_POLICY) $(PLAT_VENDOR_POLICY) $(BOARD_SEP
-D target_with_dexpreopt=$(WITH_DEXPREOPT) \
-D target_arch=$(PRIVATE_TGT_ARCH) \
-D target_with_asan=$(PRIVATE_TGT_WITH_ASAN) \
-D target_full_treble=$(PRODUCT_FULL_TREBLE) \
-s $^ > $@
$(hide) sed '/dontaudit/d' $@ > $@.dontaudit

1
private/adbd.te
View file

@ -1,5 +1,6 @@
### ADB daemon
typeattribute adbd coredomain;
typeattribute adbd mlstrustedsubject;
domain_auto_trans(adbd, shell_exec, shell)

2
private/atrace.te
View file

@ -3,7 +3,7 @@
type atrace_exec, exec_type, file_type;
userdebug_or_eng(`
type atrace, domain, domain_deprecated;
type atrace, domain, coredomain, domain_deprecated;
init_daemon_domain(atrace)

2
private/audioserver.te
View file

@ -1,5 +1,7 @@
# audioserver - audio services daemon
typeattribute audioserver coredomain;
type audioserver_exec, exec_type, file_type;
init_daemon_domain(audioserver)

1
private/binder_in_vendor_violators.te Normal file
View file

@ -0,0 +1 @@
allow binder_in_vendor_violators binder_device:chr_file rw_file_perms;

2
private/blkid.te
View file

@ -1,5 +1,7 @@
# blkid called from vold
typeattribute blkid coredomain;
type blkid_exec, exec_type, file_type;
# Allowed read-only access to encrypted devices to extract UUID/label

2
private/blkid_untrusted.te
View file

@ -1,5 +1,7 @@
# blkid for untrusted block devices
typeattribute blkid_untrusted coredomain;
# Allowed read-only access to vold block devices to extract UUID/label
allow blkid_untrusted block_device:dir search;
allow blkid_untrusted vold_device:blk_file r_file_perms;

1
private/bluetooth.te
View file

@ -1,5 +1,6 @@
# bluetooth subsystem
typeattribute bluetooth coredomain;
typeattribute bluetooth domain_deprecated;
app_domain(bluetooth)

4
private/bootanim.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute bootanim coredomain;
init_daemon_domain(bootanim)

4
private/bootstat.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute bootstat coredomain;
init_daemon_domain(bootstat)

2
private/bufferhubd.te
View file

@ -1 +1,3 @@
typeattribute bufferhubd coredomain;
init_daemon_domain(bufferhubd)

4
private/cameraserver.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute cameraserver coredomain;
init_daemon_domain(cameraserver)

1
private/charger.te Normal file
View file

@ -0,0 +1 @@
typeattribute charger coredomain;

1
private/clatd.te Normal file
View file

@ -0,0 +1 @@
typeattribute clatd coredomain;

4
private/cppreopts.te
View file

@ -1,5 +1,5 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute cppreopts coredomain;
# Technically not a daemon but we do want the transition from init domain to
# cppreopts to occur.
init_daemon_domain(cppreopts)

1
private/crash_dump.te Normal file
View file

@ -0,0 +1 @@
typeattribute crash_dump coredomain;

1
private/dex2oat.te Normal file
View file

@ -0,0 +1 @@
typeattribute dex2oat coredomain;

2
private/dexoptanalyzer.te
View file

@ -1,5 +1,5 @@
# dexoptanalyzer
type dexoptanalyzer, domain, mlstrustedsubject;
type dexoptanalyzer, domain, coredomain, mlstrustedsubject;
type dexoptanalyzer_exec, exec_type, file_type;
# Reading an APK opens a ZipArchive, which unpack to tmpfs.

4
private/dhcp.te
View file

@ -1,4 +1,4 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute dhcp coredomain;
init_daemon_domain(dhcp)
type_transition dhcp system_data_file:{ dir file } dhcp_data_file;

1
private/dnsmasq.te Normal file
View file

@ -0,0 +1 @@
typeattribute dnsmasq coredomain;

4
private/drmserver.te
View file

@ -1,5 +1,5 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute drmserver coredomain;
init_daemon_domain(drmserver)
type_transition drmserver apk_data_file:sock_file drmserver_socket;

4
private/dumpstate.te
View file

@ -1,5 +1,5 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute dumpstate coredomain;
init_daemon_domain(dumpstate)
# Execute and transition to the vdc domain

2
private/ephemeral_app.te
View file

@ -11,6 +11,8 @@
###
### PackageManager flags an app as ephemeral at install time.
typeattribute ephemeral_app coredomain;
net_domain(ephemeral_app)
app_domain(ephemeral_app)

4
private/fingerprintd.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute fingerprintd coredomain;
init_daemon_domain(fingerprintd)

4
private/fsck.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute fsck coredomain;
init_daemon_domain(fsck)

1
private/fsck_untrusted.te Normal file
View file

@ -0,0 +1 @@
typeattribute fsck_untrusted coredomain;

4
private/gatekeeperd.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute gatekeeperd coredomain;
init_daemon_domain(gatekeeperd)

2
private/hal_allocator_default.te
View file

@ -1,4 +1,4 @@
type hal_allocator_default, domain;
type hal_allocator_default, domain, coredomain;
hal_server_domain(hal_allocator_default, hal_allocator)
type hal_allocator_default_exec, exec_type, file_type;

4
private/healthd.te
View file

@ -1,5 +1,5 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute healthd coredomain;
init_daemon_domain(healthd)
# Allow callback to storaged batteryproperties listener

4
private/hwservicemanager.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute hwservicemanager coredomain;
init_daemon_domain(hwservicemanager)

1
private/idmap.te Normal file
View file

@ -0,0 +1 @@
typeattribute idmap coredomain;

2
private/incident.te
View file

@ -1,3 +1,5 @@
typeattribute incident coredomain;
type incident_exec, exec_type, file_type;
# switch to incident domain for incident command

2
private/incidentd.te
View file

@ -1,3 +1,5 @@
typeattribute incidentd coredomain;
init_daemon_domain(incidentd)
type incidentd_exec, exec_type, file_type;
binder_use(incidentd)

4
private/init.te
View file

@ -1,5 +1,5 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute init coredomain;
tmpfs_domain(init)
# Transitions to seclabel processes in init.rc

4
private/inputflinger.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute inputflinger coredomain;
init_daemon_domain(inputflinger)

4
private/install_recovery.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute install_recovery coredomain;
init_daemon_domain(install_recovery)

4
private/installd.te
View file

@ -1,5 +1,5 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute installd coredomain;
init_daemon_domain(installd)
# Run dex2oat in its own sandbox.

2
private/isolated_app.te
View file

@ -6,6 +6,8 @@
### and AID_ISOLATED_END (99999).
###
typeattribute isolated_app coredomain;
app_domain(isolated_app)
# Access already open app data files received over Binder or local socket IPC.

4
private/kernel.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute kernel coredomain;
domain_auto_trans(kernel, init_exec, init)

4
private/keystore.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute keystore coredomain;
init_daemon_domain(keystore)

4
private/lmkd.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute lmkd coredomain;
init_daemon_domain(lmkd)

4
private/logd.te
View file

@ -1,5 +1,5 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute logd coredomain;
init_daemon_domain(logd)
# logd is not allowed to write anywhere other than /data/misc/logd, and then

2
private/logpersist.te
View file

@ -1,3 +1,5 @@
typeattribute logpersist coredomain;
# android debug log storage in logpersist domains (eng and userdebug only)
userdebug_or_eng(`

1
private/mdnsd.te
View file

@ -1,5 +1,6 @@
# mdns daemon
typeattribute mdnsd coredomain;
typeattribute mdnsd mlstrustedsubject;
type mdnsd_exec, exec_type, file_type;

4
private/mediacodec.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute mediacodec coredomain;
init_daemon_domain(mediacodec)

4
private/mediadrmserver.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute mediadrmserver coredomain;
init_daemon_domain(mediadrmserver)

4
private/mediaextractor.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute mediaextractor coredomain;
init_daemon_domain(mediaextractor)

4
private/mediametrics.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute mediametrics coredomain;
init_daemon_domain(mediametrics)

4
private/mediaserver.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute mediaserver coredomain;
init_daemon_domain(mediaserver)

1
private/modprobe.te Normal file
View file

@ -0,0 +1 @@
typeattribute modprobe coredomain;

4
private/mtp.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute mtp coredomain;
init_daemon_domain(mtp)

4
private/netd.te
View file

@ -1,5 +1,5 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute netd coredomain;
init_daemon_domain(netd)
# Allow netd to spawn dnsmasq in it's own domain

1
private/nfc.te
View file

@ -1,4 +1,5 @@
# nfc subsystem
typeattribute nfc coredomain;
app_domain(nfc)
net_domain(nfc)

4
private/otapreopt_chroot.te
View file

@ -1,4 +1,4 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute otapreopt_chroot coredomain;
# Allow to transition to postinstall_ota, to run otapreopt in its own sandbox.
domain_auto_trans(otapreopt_chroot, postinstall_file, postinstall_dexopt)

4
private/otapreopt_slot.te
View file

@ -1,5 +1,5 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute otapreopt_slot coredomain;
# Technically not a daemon but we do want the transition from init domain to
# cppreopts to occur.
init_daemon_domain(otapreopt_slot)

2
private/performanced.te
View file

@ -1 +1,3 @@
typeattribute performanced coredomain;
init_daemon_domain(performanced)

1
private/platform_app.te
View file

@ -2,6 +2,7 @@
### Apps signed with the platform key.
###
typeattribute platform_app coredomain;
typeattribute platform_app domain_deprecated;
app_domain(platform_app)

4
private/postinstall.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute postinstall coredomain;
domain_auto_trans(postinstall, otapreopt_chroot_exec, otapreopt_chroot)

4
private/postinstall_dexopt.te
View file

@ -1,5 +1,5 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute postinstall_dexopt coredomain;
# Run dex2oat/patchoat in its own sandbox.
# We have to manually transition, as we don't have an entrypoint.
domain_auto_trans(postinstall_dexopt, postinstall_file, dex2oat)

4
private/ppp.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute ppp coredomain;
domain_auto_trans(mtp, ppp_exec, ppp)

1
private/preopt2cachename.te Normal file
View file

@ -0,0 +1 @@
typeattribute preopt2cachename coredomain;

1
private/priv_app.te
View file

@ -2,6 +2,7 @@
### A domain for further sandboxing privileged apps.
###
typeattribute priv_app coredomain;
app_domain(priv_app)
# Access the network.

1
private/profman.te Normal file
View file

@ -0,0 +1 @@
typeattribute profman coredomain;

4
private/racoon.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute racoon coredomain;
init_daemon_domain(racoon)

2
private/radio.te
View file

@ -1,3 +1,5 @@
typeattribute radio coredomain;
app_domain(radio)
read_runtime_log_tags(radio)

1
private/recovery.te Normal file
View file

@ -0,0 +1 @@
typeattribute recovery coredomain;

4
private/recovery_persist.te
View file

@ -1,5 +1,5 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute recovery_persist coredomain;
init_daemon_domain(recovery_persist)
# recovery_persist is not allowed to write anywhere other than recovery_data_file

4
private/recovery_refresh.te
View file

@ -1,5 +1,5 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute recovery_refresh coredomain;
init_daemon_domain(recovery_refresh)
# recovery_refresh is not allowed to write anywhere

4
private/runas.te
View file

@ -1,4 +1,4 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute runas coredomain;
# ndk-gdb invokes adb shell run-as.
domain_auto_trans(shell, runas_exec, runas)

4
private/sdcardd.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute sdcardd coredomain;
type_transition sdcardd system_data_file:{ dir file } media_rw_data_file;

2
private/sensord.te
View file

@ -1 +1,3 @@
typeattribute sensord coredomain;
init_daemon_domain(sensord)

4
private/servicemanager.te
View file

@ -1,5 +1,5 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute servicemanager coredomain;
init_daemon_domain(servicemanager)
read_runtime_log_tags(servicemanager)

1
private/sgdisk.te Normal file
View file

@ -0,0 +1 @@
typeattribute sgdisk coredomain;

2
private/shared_relro.te
View file

@ -1,3 +1,5 @@
typeattribute shared_relro coredomain;
# The shared relro process is a Java program forked from the zygote, so it
# inherits from app to get basic permissions it needs to run.
app_domain(shared_relro)

2
private/shell.te
View file

@ -1,3 +1,5 @@
typeattribute shell coredomain;
# systrace support - allow atrace to run
allow shell debugfs_tracing:dir r_dir_perms;
allow shell debugfs_tracing:file r_file_perms;

1
private/slideshow.te Normal file
View file

@ -0,0 +1 @@
typeattribute slideshow coredomain;

2
private/storaged.te
View file

@ -1,5 +1,5 @@
# storaged daemon
type storaged, domain, mlstrustedsubject;
type storaged, domain, coredomain, mlstrustedsubject;
type storaged_exec, exec_type, file_type;
init_daemon_domain(storaged)

2
private/surfaceflinger.te
View file

@ -1,5 +1,7 @@
# surfaceflinger - display compositor service
typeattribute surfaceflinger coredomain;
type surfaceflinger_exec, exec_type, file_type;
init_daemon_domain(surfaceflinger)

1
private/system_app.te
View file

@ -4,6 +4,7 @@
### server.
###
typeattribute system_app coredomain;
typeattribute system_app domain_deprecated;
app_domain(system_app)

1
private/system_server.te
View file

@ -3,6 +3,7 @@
# Most of the framework services run in this process.
#
typeattribute system_server coredomain;
typeattribute system_server domain_deprecated;
typeattribute system_server mlstrustedsubject;

4
private/tee.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute tee coredomain;
init_daemon_domain(tee)

4
private/tombstoned.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute tombstoned coredomain;
init_daemon_domain(tombstoned)

4
private/toolbox.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute toolbox coredomain;
init_daemon_domain(toolbox)

4
private/tzdatacheck.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute tzdatacheck coredomain;
init_daemon_domain(tzdatacheck)

4
private/ueventd.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute ueventd coredomain;
tmpfs_domain(ueventd)

4
private/uncrypt.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute uncrypt coredomain;
init_daemon_domain(uncrypt)

2
private/untrusted_app.te
View file

@ -17,6 +17,8 @@
### seapp_contexts.
###
typeattribute untrusted_app coredomain;
app_domain(untrusted_app)
untrusted_app_domain(untrusted_app)
net_domain(untrusted_app)

2
private/untrusted_app_25.te
View file

@ -19,6 +19,8 @@
### seapp_contexts.
###
typeattribute untrusted_app_25 coredomain;
app_domain(untrusted_app_25)
untrusted_app_domain(untrusted_app_25)
net_domain(untrusted_app_25)

3
private/untrusted_v2_app.te
View file

@ -1,6 +1,9 @@
###
### Untrusted v2 sandbox apps.
###
typeattribute untrusted_v2_app coredomain;
app_domain(untrusted_v2_app)
net_domain(untrusted_v2_app)
bluetooth_domain(untrusted_v2_app)

4
private/update_engine.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute update_engine coredomain;
init_daemon_domain(update_engine);

4
private/update_verifier.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute update_verifier coredomain;
init_daemon_domain(update_verifier)

4
private/vdc.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute vdc coredomain;
init_daemon_domain(vdc)

2
private/virtual_touchpad.te
View file

@ -1 +1,3 @@
typeattribute virtual_touchpad coredomain;
init_daemon_domain(virtual_touchpad)

4
private/vold.te
View file

@ -1,5 +1,5 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute vold coredomain;
init_daemon_domain(vold)
# Switch to more restrictive domains when executing common tools

1
private/watchdogd.te Normal file
View file

@ -0,0 +1 @@
typeattribute watchdogd coredomain;

2
private/webview_zygote.te
View file

@ -1,6 +1,8 @@
# webview_zygote is an auxiliary zygote process that is used to spawn
# isolated_app processes for rendering untrusted web content.
typeattribute webview_zygote coredomain;
# The webview_zygote needs to be able to transition domains.
typeattribute webview_zygote mlstrustedsubject;

4
private/wificond.te
View file

@ -1,3 +1,3 @@
# type_transition must be private policy the domain_trans rules could stay
# public, but conceptually should go with this
typeattribute wificond coredomain;
init_daemon_domain(wificond)

1
private/zygote.te
View file

@ -1,4 +1,5 @@
# zygote
typeattribute zygote coredomain;
typeattribute zygote domain_deprecated;
typeattribute zygote mlstrustedsubject;

7
public/attributes
View file

@ -115,6 +115,13 @@ attribute binderservicedomain;
# recovery for A/B devices.
attribute update_engine_common;
# All core domains (as opposed to vendor/device-specific domains)
attribute coredomain;
# All vendor domains which violate the requirement of not using Binder
# TODO(b/35870313): Remove this once there are no violations
attribute binder_in_vendor_violators;
# All HAL servers
attribute halserverdomain;
# All HAL clients

23
public/domain.te
View file

@ -66,7 +66,10 @@ allow domain owntty_device:chr_file rw_file_perms;
allow domain null_device:chr_file rw_file_perms;
allow domain zero_device:chr_file rw_file_perms;
allow domain ashmem_device:chr_file rw_file_perms;
allow { domain -hwservicemanager -vndservicemanager } binder_device:chr_file rw_file_perms;
# /dev/binder can be accessed by non-vendor domains and by apps
allow { coredomain appdomain -hwservicemanager } binder_device:chr_file rw_file_perms;
# Devices which are not full TREBLE have fewer restrictions on access to /dev/binder
not_full_treble(`allow { domain -hwservicemanager -vndservicemanager } binder_device:chr_file rw_file_perms;')
allow { domain -servicemanager -vndservicemanager } hwbinder_device:chr_file rw_file_perms;
allow domain ptmx_device:chr_file rw_file_perms;
allow domain alarm_device:chr_file r_file_perms;
@ -420,6 +423,24 @@ neverallow hwservicemanager vndbinder_device:chr_file no_rw_file_perms;
neverallow vndservicemanager binder_device:chr_file no_rw_file_perms;
neverallow vndservicemanager hwbinder_device:chr_file no_rw_file_perms;
# On full TREBLE devices, only core components and apps can use Binder and servicemanager. Non-core
# domain apps need this because Android framework offers many of its services to apps as Binder
# services.
full_treble_only(`
neverallow {
domain
-coredomain
-appdomain
-binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone
} binder_device:chr_file rw_file_perms;
neverallow {
domain
-coredomain
-appdomain
-binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone
} servicemanager:binder { call transfer };
')
# Only authorized processes should be writing to files in /data/dalvik-cache
neverallow {
domain

Some files were not shown because too many files have changed in this diff Show more