# /proc/net access. # TODO(b/9496886) Audit access for removal. # proc_net access for the negated domains below is granted (or not) in their # individual .te files. r_dir_file({ appdomain -ephemeral_app -isolated_app -platform_app -priv_app -shell -sdk_sandbox -system_app -untrusted_app_all }, proc_net_type) # audit access for all these non-core app domains. userdebug_or_eng(` auditallow { appdomain -ephemeral_app -isolated_app -platform_app -priv_app -shell -su -sdk_sandbox -system_app -untrusted_app_all } proc_net_type:{ dir file lnk_file } { getattr open read }; ') # Allow apps to read the Test Harness Mode property. This property is used in # the implementation of ActivityManager.isDeviceInTestHarnessMode() get_prop(appdomain, test_harness_prop) get_prop(appdomain, boot_status_prop) get_prop(appdomain, dalvik_config_prop) get_prop(appdomain, media_config_prop) get_prop(appdomain, packagemanager_config_prop) get_prop(appdomain, radio_control_prop) get_prop(appdomain, surfaceflinger_color_prop) get_prop(appdomain, systemsound_config_prop) get_prop(appdomain, telephony_config_prop) get_prop(appdomain, userspace_reboot_config_prop) get_prop(appdomain, vold_config_prop) get_prop(appdomain, adbd_config_prop) get_prop(appdomain, dck_prop) get_prop(appdomain, persist_wm_debug_prop) # Allow ART to be configurable via device_config properties # (ART "runs" inside the app process) get_prop(appdomain, device_config_runtime_native_prop) get_prop(appdomain, device_config_runtime_native_boot_prop) userdebug_or_eng(`perfetto_producer({ appdomain })') # Prevent apps from causing presubmit failures. # Apps can cause selinux denials by accessing CE storage # and/or external storage. In either case, the selinux denial is # not the cause of the failure, but just a symptom that # storage isn't ready. Many apps handle the failure appropriately. # # Apps cannot access external storage before it becomes available. dontaudit appdomain storage_stub_file:dir getattr; # Attempts to write to system_data_file is generally a sign # that apps are attempting to access encrypted storage before # the ACTION_USER_UNLOCKED intent is delivered. Apps are not # allowed to write to CE storage before it's available. # Attempting to do so will be blocked by both selinux and unix # permissions. dontaudit appdomain system_data_file:dir write; # Apps should not be reading vendor-defined properties. dontaudit appdomain vendor_default_prop:file read; # Access to /mnt/media_rw/ (limited by DAC to apps with external_storage gid) allow { appdomain -sdk_sandbox } mnt_media_rw_file:dir search; neverallow appdomain system_server:udp_socket { accept append bind create ioctl listen lock name_bind relabelfrom relabelto setattr shutdown }; # Transition to a non-app domain. # Exception for the shell and su domains, can transition to runas, etc. # Exception for crash_dump to allow for app crash reporting. # Exception for renderscript binaries (/system/bin/bcc, /system/bin/ld.mc) # to allow renderscript to create privileged executable files. neverallow { appdomain -shell userdebug_or_eng(`-su') } { domain -appdomain -crash_dump -rs }:process { transition }; neverallow { appdomain -shell userdebug_or_eng(`-su') } { domain -appdomain }:process { dyntransition }; # Don't allow regular apps access to storage configuration properties. neverallow { appdomain -mediaprovider_app } storage_config_prop:file no_rw_file_perms; # Allow to read sendbug.preferred.domain get_prop(appdomain, sendbug_config_prop) # Allow to read graphics related properties. get_prop(appdomain, graphics_config_prop) # Allow to read persist.config.calibration_fac get_prop(appdomain, camera_calibration_prop) # Allow to read db.log.detailed, db.log.slow_query_threshold* get_prop(appdomain, sqlite_log_prop) # Allow to read system_user_mode_emulation_prop, which is used by UserManager.java userdebug_or_eng(`get_prop(appdomain, system_user_mode_emulation_prop)') # Allow font file read by apps. allow appdomain font_data_file:file r_file_perms; allow appdomain font_data_file:dir r_dir_perms; # Enter /data/misc/apexdata/ allow appdomain apex_module_data_file:dir search; # Read /data/misc/apexdata/com.android.art, execute signed AOT artifacts. allow appdomain apex_art_data_file:dir r_dir_perms; allow appdomain apex_art_data_file:file rx_file_perms; # Allow access to tombstones if an fd to one is given to you. # This is restricted by unix permissions, so an app must go through system_server to get one. allow appdomain tombstone_data_file:file { getattr read }; neverallow appdomain tombstone_data_file:file ~{ getattr read }; # Execute the shell or other system executables. allow { appdomain -ephemeral_app -sdk_sandbox } shell_exec:file rx_file_perms; allow { appdomain -ephemeral_app -sdk_sandbox } toolbox_exec:file rx_file_perms; not_full_treble(`allow { appdomain -ephemeral_app -sdk_sandbox } vendor_file:file x_file_perms;') # Allow apps access to /vendor/app except for privileged # apps which cannot be in /vendor. r_dir_file({ appdomain -ephemeral_app -sdk_sandbox }, vendor_app_file) allow { appdomain -ephemeral_app -sdk_sandbox } vendor_app_file:file execute; # Perform binder IPC to sdk sandbox. binder_call(appdomain, sdk_sandbox) # Allow access to external storage; we have several visible mount points under /storage # and symlinks to primary storage at places like /storage/sdcard0 and /mnt/user/0/primary allow { appdomain -isolated_app -ephemeral_app -sdk_sandbox } storage_file:dir r_dir_perms; allow { appdomain -isolated_app -ephemeral_app -sdk_sandbox } storage_file:lnk_file r_file_perms; allow { appdomain -isolated_app -ephemeral_app -sdk_sandbox } mnt_user_file:dir r_dir_perms; allow { appdomain -isolated_app -ephemeral_app -sdk_sandbox } mnt_user_file:lnk_file r_file_perms; # Read/write visible storage allow { appdomain -isolated_app -ephemeral_app -sdk_sandbox } { sdcard_type fuse }:dir create_dir_perms; allow { appdomain -isolated_app -ephemeral_app -sdk_sandbox } { sdcard_type fuse }:file create_file_perms; # This should be removed if sdcardfs is modified to alter the secontext for its # accesses to the underlying FS. allow { appdomain -isolated_app -ephemeral_app -sdk_sandbox } media_rw_data_file:dir create_dir_perms; allow { appdomain -isolated_app -ephemeral_app -sdk_sandbox } media_rw_data_file:file create_file_perms; # Allow apps to use the USB Accessory interface. # http://developer.android.com/guide/topics/connectivity/usb/accessory.html # # USB devices are first opened by the system server (USBDeviceManagerService) # and the file descriptor is passed to the right Activity via binder. allow { appdomain -isolated_app -ephemeral_app -sdk_sandbox } usb_device:chr_file { read write getattr ioctl }; allow { appdomain -isolated_app -ephemeral_app -sdk_sandbox } usbaccessory_device:chr_file { read write getattr }; #logd access control_logd({ appdomain -ephemeral_app -sdk_sandbox }) # application inherit logd write socket (urge is to deprecate this long term) allow { appdomain -isolated_app -ephemeral_app -sdk_sandbox } keystore:keystore_key { get_state get insert delete exist list sign verify }; allow { appdomain -isolated_app -ephemeral_app -sdk_sandbox } keystore:keystore2_key { delete use get_info rebind update }; allow { appdomain -isolated_app -ephemeral_app -sdk_sandbox } keystore_maintenance_service:service_manager find; allow { appdomain -isolated_app -ephemeral_app -sdk_sandbox } keystore:keystore2 get_state; use_keystore({ appdomain -isolated_app -ephemeral_app -sdk_sandbox }) use_credstore({ appdomain -isolated_app -ephemeral_app -sdk_sandbox }) # For app fuse. pdx_client({ appdomain -isolated_app -ephemeral_app -sdk_sandbox }, display_client) pdx_client({ appdomain -isolated_app -ephemeral_app -sdk_sandbox }, display_manager) pdx_client({ appdomain -isolated_app -ephemeral_app -sdk_sandbox }, display_vsync) pdx_client({ appdomain -isolated_app -ephemeral_app -sdk_sandbox }, performance_client) # Apps do not directly open the IPC socket for bufferhubd. pdx_use({ appdomain -isolated_app -ephemeral_app -sdk_sandbox }, bufferhub_client) # Apps receive an open tun fd from the framework for # device traffic. Do not allow untrusted app to directly open tun_device allow { appdomain -isolated_app -ephemeral_app -sdk_sandbox } tun_device:chr_file { read write getattr append ioctl }; allowxperm { appdomain -isolated_app -ephemeral_app -sdk_sandbox } tun_device:chr_file ioctl TUNGETIFF; # WebView and other application-specific JIT compilers allow appdomain self:process execmem; allow appdomain { ashmem_device ashmem_libcutils_device }:chr_file execute; # Receive and use open file descriptors inherited from zygote. allow appdomain zygote:fd use; # Receive and use open file descriptors inherited from app zygote. allow appdomain app_zygote:fd use; # gdbserver for ndk-gdb reads the zygote. # valgrind needs mmap exec for zygote allow appdomain zygote_exec:file rx_file_perms; # Notify zygote of death; allow appdomain zygote:process sigchld; # Read /data/dalvik-cache. allow appdomain dalvikcache_data_file:dir { search getattr }; allow appdomain dalvikcache_data_file:file r_file_perms; # Read the /sdcard and /mnt/sdcard symlinks allow { appdomain -isolated_app -sdk_sandbox } rootfs:lnk_file r_file_perms; allow { appdomain -isolated_app -sdk_sandbox } tmpfs:lnk_file r_file_perms; # Search /storage/emulated tmpfs mount. allow { appdomain -sdk_sandbox } tmpfs:dir r_dir_perms; # Notify zygote of the wrapped process PID when using --invoke-with. allow appdomain zygote:fifo_file write; userdebug_or_eng(` # Allow apps to create and write method traces in /data/misc/trace. allow appdomain method_trace_data_file:dir w_dir_perms; allow appdomain method_trace_data_file:file { create w_file_perms }; ') # Notify shell and adbd of death when spawned via runas for ndk-gdb. allow appdomain shell:process sigchld; allow appdomain adbd:process sigchld; # child shell or gdbserver pty access for runas. allow appdomain devpts:chr_file { getattr read write ioctl }; # Use pipes and sockets provided by system_server via binder or local socket. allow appdomain system_server:fd use; allow appdomain system_server:fifo_file rw_file_perms; allow appdomain system_server:unix_stream_socket { read write setopt getattr getopt shutdown }; allow appdomain system_server:tcp_socket { read write getattr getopt shutdown }; # For AppFuse. allow appdomain vold:fd use; # Communication with other apps via fifos allow appdomain appdomain:fifo_file rw_file_perms; # Communicate with surfaceflinger. allow appdomain surfaceflinger:unix_stream_socket { read write setopt getattr getopt shutdown }; # App sandbox file accesses. allow { appdomain -isolated_app -mlstrustedsubject -sdk_sandbox } { app_data_file privapp_data_file }:dir create_dir_perms; allow { appdomain -isolated_app -mlstrustedsubject -sdk_sandbox } { app_data_file privapp_data_file }:file create_file_perms; # Access via already open fds is ok even for mlstrustedsubject. allow { appdomain -isolated_app -sdk_sandbox } { app_data_file privapp_data_file system_app_data_file }:file { getattr map read write }; # Traverse into expanded storage allow appdomain mnt_expand_file:dir r_dir_perms; # Keychain and user-trusted credentials r_dir_file(appdomain, keychain_data_file) allow appdomain misc_user_data_file:dir r_dir_perms; allow appdomain misc_user_data_file:file r_file_perms; # TextClassifier r_dir_file({ appdomain -isolated_app }, textclassifier_data_file) # Access to OEM provided data and apps allow appdomain oemfs:dir r_dir_perms; allow appdomain oemfs:file rx_file_perms; allow appdomain system_file:file x_file_perms; # Renderscript needs the ability to read directories on /system allow appdomain system_file:dir r_dir_perms; allow appdomain system_file:lnk_file { getattr open read }; # Renderscript specific permissions to open /system/vendor/lib64. not_full_treble(` allow appdomain vendor_file_type:dir r_dir_perms; allow appdomain vendor_file_type:lnk_file { getattr open read }; ') full_treble_only(` # For looking up Renderscript vendor drivers allow { appdomain -isolated_app } vendor_file:dir { open read }; ') # Allow apps access to /vendor/overlay r_dir_file(appdomain, vendor_overlay_file) # Allow apps access to /vendor/framework # for vendor provided libraries. r_dir_file(appdomain, vendor_framework_file) # Allow apps read / execute access to vendor public libraries. allow appdomain {vendor_public_framework_file vendor_public_lib_file}:dir r_dir_perms; allow appdomain {vendor_public_framework_file vendor_public_lib_file}:file { execute read open getattr map }; # Read/write wallpaper file (opened by system). allow appdomain wallpaper_file:file { getattr read write map }; # Read/write cached ringtones (opened by system). allow appdomain ringtone_file:file { getattr read write map }; # Read ShortcutManager icon files (opened by system). allow appdomain shortcut_manager_icons:file { getattr read map }; # Read icon file (opened by system). allow appdomain icon_file:file { getattr read map }; # Old stack dumping scheme : append to a global trace file (/data/anr/traces.txt). # # TODO: All of these permissions except for anr_data_file:file append can be # withdrawn once we've switched to the new stack dumping mechanism, see b/32064548 # and the rules below. allow appdomain anr_data_file:dir search; allow appdomain anr_data_file:file { open append }; # New stack dumping scheme : request an output FD from tombstoned via a unix # domain socket. # # Allow apps to connect and write to the tombstoned java trace socket in # order to dump their traces. Also allow them to append traces to pipes # created by dumptrace. (Also see the rules below where they are given # additional permissions to dumpstate pipes for other aspects of bug report # creation). unix_socket_connect(appdomain, tombstoned_java_trace, tombstoned) allow appdomain tombstoned:fd use; allow appdomain dumpstate:fifo_file append; allow appdomain incidentd:fifo_file append; # Allow apps to send dump information to dumpstate allow appdomain dumpstate:fd use; allow appdomain dumpstate:unix_stream_socket { read write getopt getattr shutdown }; allow appdomain dumpstate:fifo_file { write getattr }; allow appdomain shell_data_file:file { write getattr }; # Allow apps to send dump information to incidentd allow appdomain incidentd:fd use; allow appdomain incidentd:fifo_file { write getattr }; # Allow apps to send information to statsd socket. unix_socket_send(appdomain, statsdw, statsd) # Write profiles /data/misc/profiles allow appdomain user_profile_root_file:dir search; allow appdomain user_profile_data_file:dir { search write add_name }; allow appdomain user_profile_data_file:file create_file_perms; # Send heap dumps to system_server via an already open file descriptor # % adb shell am set-watch-heap com.android.systemui 1048576 # % adb shell dumpsys procstats --start-testing # debuggable builds only. userdebug_or_eng(` allow appdomain heapdump_data_file:file append; ') # Grant GPU access to all processes started by Zygote. # They need that to render the standard UI. allow { appdomain -isolated_app } gpu_device:chr_file rw_file_perms; allow { appdomain -isolated_app } gpu_device:dir r_dir_perms; allow { appdomain -isolated_app } sysfs_gpu:file r_file_perms; # Use the Binder. binder_use(appdomain) # Perform binder IPC to binder services. binder_call(appdomain, binderservicedomain) # Perform binder IPC to other apps. binder_call(appdomain, appdomain) # Perform binder IPC to ephemeral apps. binder_call(appdomain, ephemeral_app) # Perform binder IPC to gpuservice. binder_call({ appdomain -isolated_app }, gpuservice) # Talk with graphics composer fences allow appdomain hal_graphics_composer:fd use; # Already connected, unnamed sockets being passed over some other IPC # hence no sock_file or connectto permission. This appears to be how # Chrome works, may need to be updated as more apps using isolated services # are examined. allow appdomain appdomain:unix_stream_socket { getopt getattr read write shutdown }; # Backup ability for every app. BMS opens and passes the fd # to any app that has backup ability. Hence, no open permissions here. allow appdomain backup_data_file:file { read write getattr map }; allow appdomain cache_backup_file:file { read write getattr map }; allow appdomain cache_backup_file:dir getattr; # Backup ability using 'adb backup' allow appdomain system_data_file:lnk_file r_file_perms; allow appdomain system_data_file:file { getattr read map }; # Allow read/stat of /data/media files passed by Binder or local socket IPC. allow { appdomain -isolated_app -sdk_sandbox } media_rw_data_file:file { read getattr }; # Read and write /data/data/com.android.providers.telephony files passed over Binder. allow { appdomain -isolated_app } radio_data_file:file { read write getattr }; # For art. allow appdomain dalvikcache_data_file:file execute; allow appdomain dalvikcache_data_file:lnk_file r_file_perms; # Allow any app to read shared RELRO files. allow appdomain shared_relro_file:dir search; allow appdomain shared_relro_file:file r_file_perms; # Allow apps to read/execute installed binaries allow appdomain apk_data_file:dir r_dir_perms; allow appdomain apk_data_file:file rx_file_perms; # /data/resource-cache allow appdomain resourcecache_data_file:file r_file_perms; allow appdomain resourcecache_data_file:dir r_dir_perms; # logd access read_logd(appdomain) allow appdomain zygote:unix_dgram_socket write; allow appdomain console_device:chr_file { read write }; # only allow unprivileged socket ioctl commands allowxperm { appdomain -bluetooth } self:{ rawip_socket tcp_socket udp_socket } ioctl { unpriv_sock_ioctls unpriv_tty_ioctls }; allow { appdomain -isolated_app } ion_device:chr_file r_file_perms; allow { appdomain -isolated_app } dmabuf_system_heap_device:chr_file r_file_perms; allow { appdomain -isolated_app } dmabuf_system_secure_heap_device:chr_file r_file_perms; # Allow AAudio apps to use shared memory file descriptors from the HAL allow { appdomain -isolated_app } hal_audio:fd use; # Allow app to access shared memory created by camera HAL1 allow { appdomain -isolated_app } hal_camera:fd use; # Allow apps to access shared memory file descriptor from the tuner HAL allow {appdomain -isolated_app} hal_tv_tuner_server:fd use; # RenderScript always-passthrough HAL allow { appdomain -isolated_app } hal_renderscript_hwservice:hwservice_manager find; allow appdomain same_process_hal_file:file { execute read open getattr map }; # TODO: switch to meminfo service allow appdomain proc_meminfo:file r_file_perms; # For app fuse. allow appdomain app_fuse_file:file { getattr read append write map }; ### ### CTS-specific rules ### # For cts/tests/tests/permission/src/android/permission/cts/FileSystemPermissionTest.java. # testRunAsHasCorrectCapabilities allow appdomain runas_exec:file getattr; # Others are either allowed elsewhere or not desired. # Connect to adbd and use a socket transferred from it. # This is used for e.g. adb backup/restore. allow appdomain adbd:unix_stream_socket connectto; allow appdomain adbd:fd use; allow appdomain adbd:unix_stream_socket { getattr getopt ioctl read write shutdown }; allow appdomain cache_file:dir getattr; # Allow apps to run with asanwrapper. with_asan(`allow appdomain asanwrapper_exec:file rx_file_perms;') # Read access to FDs from the DropboxManagerService. allow appdomain dropbox_data_file:file { getattr read }; # Read tmpfs types from these processes. allow appdomain audioserver_tmpfs:file { getattr map read write }; allow appdomain system_server_tmpfs:file { getattr map read write }; allow appdomain zygote_tmpfs:file { map read }; # Sensitive app domains are not allowed to execute from /data # to prevent persistence attacks and ensure all code is executed # from read-only locations. neverallow { bluetooth isolated_app nfc radio shared_relro sdk_sandbox system_app } { data_file_type -apex_art_data_file -dalvikcache_data_file -system_data_file # shared libs in apks -apk_data_file }:file no_x_file_perms; # For now, don't allow apps other than gmscore to access /data/misc_ce//checkin neverallow { appdomain -gmscore_app } checkin_data_file:dir *; neverallow { appdomain -gmscore_app } checkin_data_file:file *;