6e4508e625
This removes access to Bluetooth system properties from arbitrary SELinux domains. Access remains granted to init, bluetooth, and system_app domains. neverallow rules / CTS enforce that access is not granted to Zygote and processes spawned from Zygote expcept for system_app and bluetooth. The reason is that some of these properties may leak persistent identifiers not resettable by the user. Test: Bluetooth pairing and data transfer works Bug: 33700679 Change-Id: Icdcb3927a423c4011a62942340a498cc1b302472
128 lines
4.5 KiB
Text
128 lines
4.5 KiB
Text
# zygote
|
|
type zygote, domain, domain_deprecated;
|
|
type zygote_exec, exec_type, file_type;
|
|
|
|
typeattribute zygote mlstrustedsubject;
|
|
|
|
# Override DAC on files and switch uid/gid.
|
|
allow zygote self:capability { dac_override setgid setuid fowner chown };
|
|
|
|
# Drop capabilities from bounding set.
|
|
allow zygote self:capability setpcap;
|
|
|
|
# Switch SELinux context to app domains.
|
|
allow zygote self:process setcurrent;
|
|
allow zygote system_server:process dyntransition;
|
|
allow zygote { appdomain ephemeral_app }:process dyntransition;
|
|
|
|
# Allow zygote to read app /proc/pid dirs (b/10455872).
|
|
allow zygote { appdomain ephemeral_app }:dir { getattr search };
|
|
allow zygote { appdomain ephemeral_app }:file { r_file_perms };
|
|
|
|
# Move children into the peer process group.
|
|
allow zygote system_server:process { getpgid setpgid };
|
|
allow zygote { appdomain ephemeral_app }:process { getpgid setpgid };
|
|
|
|
# Read system data.
|
|
allow zygote system_data_file:dir r_dir_perms;
|
|
allow zygote system_data_file:file r_file_perms;
|
|
|
|
# Write to /data/dalvik-cache.
|
|
allow zygote dalvikcache_data_file:dir create_dir_perms;
|
|
allow zygote dalvikcache_data_file:file create_file_perms;
|
|
|
|
# Create symlinks in /data/dalvik-cache.
|
|
allow zygote dalvikcache_data_file:lnk_file create_file_perms;
|
|
|
|
# Write to /data/resource-cache.
|
|
allow zygote resourcecache_data_file:dir rw_dir_perms;
|
|
allow zygote resourcecache_data_file:file create_file_perms;
|
|
|
|
# For art.
|
|
allow zygote libart_file:file { execute read open getattr };
|
|
# When WITH_DEXPREOPT is true, the zygote does not load executable content from
|
|
# /data/dalvik-cache.
|
|
allow { zygote with_dexpreopt(`-zygote') } dalvikcache_data_file:file execute;
|
|
|
|
# Execute idmap and dex2oat within zygote's own domain.
|
|
# TODO: Should either of these be transitioned to the same domain
|
|
# used by installd or stay in-domain for zygote?
|
|
allow zygote idmap_exec:file rx_file_perms;
|
|
allow zygote dex2oat_exec:file rx_file_perms;
|
|
|
|
# Control cgroups.
|
|
allow zygote cgroup:dir create_dir_perms;
|
|
allow zygote cgroup:{ file lnk_file } r_file_perms;
|
|
allow zygote self:capability sys_admin;
|
|
|
|
# Allow zygote to stat the files that it opens. The zygote must
|
|
# be able to inspect them so that it can reopen them on fork
|
|
# if necessary: b/30963384.
|
|
allow zygote pmsg_device:chr_file getattr;
|
|
allow zygote debugfs_trace_marker:file getattr;
|
|
|
|
# Check validity of SELinux context before use.
|
|
selinux_check_context(zygote)
|
|
# Check SELinux permissions.
|
|
selinux_check_access(zygote)
|
|
|
|
# Native bridge functionality requires that zygote replaces
|
|
# /proc/cpuinfo with /system/lib/<ISA>/cpuinfo using a bind mount
|
|
allow zygote proc_cpuinfo:file mounton;
|
|
|
|
# Allow remounting rootfs as MS_SLAVE.
|
|
allow zygote rootfs:dir mounton;
|
|
allow zygote tmpfs:filesystem { mount unmount };
|
|
allow zygote fuse:filesystem { unmount };
|
|
allow zygote sdcardfs:filesystem { unmount };
|
|
|
|
# Allow creating user-specific storage source if started before vold.
|
|
allow zygote mnt_user_file:dir create_dir_perms;
|
|
allow zygote mnt_user_file:lnk_file create_file_perms;
|
|
# Allowed to mount user-specific storage into place
|
|
allow zygote storage_file:dir { search mounton };
|
|
|
|
# Handle --invoke-with command when launching Zygote with a wrapper command.
|
|
allow zygote zygote_exec:file rx_file_perms;
|
|
|
|
# Read access to pseudo filesystems.
|
|
r_dir_file(zygote, proc_net)
|
|
|
|
# Root fs.
|
|
r_dir_file(zygote, rootfs)
|
|
|
|
# System file accesses.
|
|
r_dir_file(zygote, system_file)
|
|
|
|
userdebug_or_eng(`
|
|
# Allow zygote to create and write method traces in /data/misc/trace.
|
|
allow zygote method_trace_data_file:dir w_dir_perms;
|
|
allow zygote method_trace_data_file:file { create w_file_perms };
|
|
')
|
|
|
|
allow zygote ion_device:chr_file r_file_perms;
|
|
allow zygote tmpfs:dir r_dir_perms;
|
|
|
|
# Let the zygote access overlays so it can initialize the AssetManager.
|
|
get_prop(zygote, overlay_prop)
|
|
|
|
###
|
|
### neverallow rules
|
|
###
|
|
|
|
# Ensure that all types assigned to app processes are included
|
|
# in the appdomain attribute, so that all allow and neverallow rules
|
|
# written on appdomain are applied to all app processes.
|
|
# This is achieved by ensuring that it is impossible for zygote to
|
|
# setcon (dyntransition) to any types other than those associated
|
|
# with appdomain plus system_server.
|
|
neverallow zygote ~{ appdomain ephemeral_app system_server }:process dyntransition;
|
|
|
|
# Zygote should never execute anything from /data except for /data/dalvik-cache files.
|
|
neverallow zygote {
|
|
data_file_type
|
|
-dalvikcache_data_file # map PROT_EXEC
|
|
}:file no_x_file_perms;
|
|
|
|
# Do not allow access to Bluetooth-related system properties and files
|
|
neverallow zygote bluetooth_prop:file create_file_perms;
|