platform_system_sepolicy/public/attributes
Alex Klyubin 2a7f4fb069 Assert apps can access only approved HwBinder services
App domains which host arbitrary code must not have access to
arbitrary HwBinder services. Such access unnecessarily increases the
attack surface. The reason is twofold:
1. HwBinder servers do not perform client authentication because HIDL
   currently does not expose caller UID information and, even if it
   did, many HwBinder services either operate at a layer below that of
   apps (e.g., HALs) or must not rely on app identity for
   authorization. Thus, to be safe, the default assumption is that
   a HwBinder service treats all its clients as equally authorized to
   perform operations offered by the service.
2. HAL servers (a subset of HwBinder services) contain code with
   higher incidence rate of security issues than system/core
   components and have access to lower layes of the stack (all the way
   down to hardware) thus increasing opportunities for bypassing the
   Android security model.

HwBinder services offered by core components (as opposed to vendor
components) are considered safer because of point #2 above.

Always same-process aka always-passthrough HwBinder services are
considered safe for access by these apps. This is because these HALs
by definition do not offer any additional access beyond what its
client already as, because these services run in the process of the
client.

This commit thus introduces these two categories of HwBinder services
in neverallow rules.

Test: mmm system/sepolicy -- this does not change on-device policy
Bug: 34454312
Change-Id: I4f5f4dd10b3fc3bb9d262dda532d4a23dcdf061d
2017-04-24 10:15:31 -07:00

267 lines
7.7 KiB
Text

######################################
# Attribute declarations
#
# All types used for devices.
# On change, update CHECK_FC_ASSERT_ATTRS
# in tools/checkfc.c
attribute dev_type;
# All types used for processes.
attribute domain;
# Temporary attribute used for migrating permissions out of domain.
# Motivation: Domain is overly permissive. Start removing permissions
# from domain and assign them to the domain_deprecated attribute.
# Domain_deprecated and domain can initially be assigned to all
# domains. The goal is to not assign domain_deprecated to new domains
# and to start removing domain_deprecated where it's not required or
# reassigning the appropriate permissions to the inheriting domain
# when necessary.
attribute domain_deprecated;
# All types used for filesystems.
# On change, update CHECK_FC_ASSERT_ATTRS
# definition in tools/checkfc.c.
attribute fs_type;
# All types used for context= mounts.
attribute contextmount_type;
# All types used for files that can exist on a labeled fs.
# Do not use for pseudo file types.
# On change, update CHECK_FC_ASSERT_ATTRS
# definition in tools/checkfc.c.
attribute file_type;
# All types used for domain entry points.
attribute exec_type;
# All types used for /data files.
attribute data_file_type;
# All types in /data, not in /data/vendor
attribute core_data_file_type;
# All types in /vendor
attribute vendor_file_type;
# All types use for sysfs files.
attribute sysfs_type;
# All types use for debugfs files.
attribute debugfs_type;
# Attribute used for all sdcards
attribute sdcard_type;
# All types used for nodes/hosts.
attribute node_type;
# All types used for network interfaces.
attribute netif_type;
# All types used for network ports.
attribute port_type;
# All types used for property service
# On change, update CHECK_PC_ASSERT_ATTRS
# definition in tools/checkfc.c.
attribute property_type;
# All properties defined in core SELinux policy. Should not be
# used by device specific properties
attribute core_property_type;
# All properties used to configure log filtering.
attribute log_property_type;
# All service_manager types created by system_server
attribute system_server_service;
# services which should be available to all but isolated apps
attribute app_api_service;
# services which should be available to all ephemeral apps
attribute ephemeral_app_api_service;
# services which export only system_api
attribute system_api_service;
# All types used for services managed by servicemanager.
# On change, update CHECK_SC_ASSERT_ATTRS
# definition in tools/checkfc.c.
attribute service_manager_type;
# All types used for services managed by hwservicemanager
attribute hwservice_manager_type;
# All HwBinder services guaranteed to be passthrough. These services always run
# in the process of their clients, and thus operate with the same access as
# their clients.
attribute same_process_hwservice;
# All HwBinder services guaranteed to be offered only by core domain components
attribute coredomain_hwservice;
# All types used for services managed by vndservicemanager
attribute vndservice_manager_type;
# All domains that can override MLS restrictions.
# i.e. processes that can read up and write down.
attribute mlstrustedsubject;
# All types that can override MLS restrictions.
# i.e. files that can be read by lower and written by higher
attribute mlstrustedobject;
# All domains used for apps.
attribute appdomain;
# All third party apps.
attribute untrusted_app_all;
# All domains used for apps with network access.
attribute netdomain;
# All domains used for apps with bluetooth access.
attribute bluetoothdomain;
# All domains used for binder service domains.
attribute binderservicedomain;
# update_engine related domains that need to apply an update and run
# postinstall. This includes the background daemon and the sideload tool from
# recovery for A/B devices.
attribute update_engine_common;
# All core domains (as opposed to vendor/device-specific domains)
attribute coredomain;
# All socket devices owned by core domain components
attribute coredomain_socket;
# All vendor domains which violate the requirement of not using Binder
# TODO(b/35870313): Remove this once there are no violations
attribute binder_in_vendor_violators;
# All vendor domains which violate the requirement of not using sockets for
# communicating with core components
# TODO(b/36577153): Remove this once there are no violations
attribute socket_between_core_and_vendor_violators;
# All vendor domains which violate the requirement of not executing
# system processes
# TODO(b/36463595)
attribute vendor_executes_system_violators;
# All HAL servers
attribute halserverdomain;
# All HAL clients
attribute halclientdomain;
# HALs
attribute hal_allocator;
attribute hal_allocator_client;
attribute hal_allocator_server;
attribute hal_audio;
attribute hal_audio_client;
attribute hal_audio_server;
attribute hal_bluetooth;
attribute hal_bluetooth_client;
attribute hal_bluetooth_server;
attribute hal_bootctl;
attribute hal_bootctl_client;
attribute hal_bootctl_server;
attribute hal_camera;
attribute hal_camera_client;
attribute hal_camera_server;
attribute hal_configstore;
attribute hal_configstore_client;
attribute hal_configstore_server;
attribute hal_contexthub;
attribute hal_contexthub_client;
attribute hal_contexthub_server;
attribute hal_drm;
attribute hal_drm_client;
attribute hal_drm_server;
attribute hal_dumpstate;
attribute hal_dumpstate_client;
attribute hal_dumpstate_server;
attribute hal_fingerprint;
attribute hal_fingerprint_client;
attribute hal_fingerprint_server;
attribute hal_gatekeeper;
attribute hal_gatekeeper_client;
attribute hal_gatekeeper_server;
attribute hal_gnss;
attribute hal_gnss_client;
attribute hal_gnss_server;
attribute hal_graphics_allocator;
attribute hal_graphics_allocator_client;
attribute hal_graphics_allocator_server;
attribute hal_graphics_composer;
attribute hal_graphics_composer_client;
attribute hal_graphics_composer_server;
attribute hal_health;
attribute hal_health_client;
attribute hal_health_server;
attribute hal_ir;
attribute hal_ir_client;
attribute hal_ir_server;
attribute hal_keymaster;
attribute hal_keymaster_client;
attribute hal_keymaster_server;
attribute hal_light;
attribute hal_light_client;
attribute hal_light_server;
attribute hal_memtrack;
attribute hal_memtrack_client;
attribute hal_memtrack_server;
attribute hal_nfc;
attribute hal_nfc_client;
attribute hal_nfc_server;
attribute hal_power;
attribute hal_power_client;
attribute hal_power_server;
attribute hal_sensors;
attribute hal_sensors_client;
attribute hal_sensors_server;
attribute hal_telephony;
attribute hal_telephony_client;
attribute hal_telephony_server;
attribute hal_thermal;
attribute hal_thermal_client;
attribute hal_thermal_server;
attribute hal_tv_cec;
attribute hal_tv_cec_client;
attribute hal_tv_cec_server;
attribute hal_tv_input;
attribute hal_tv_input_client;
attribute hal_tv_input_server;
attribute hal_usb;
attribute hal_usb_client;
attribute hal_usb_server;
attribute hal_vibrator;
attribute hal_vibrator_client;
attribute hal_vibrator_server;
attribute hal_vr;
attribute hal_vr_client;
attribute hal_vr_server;
attribute hal_wifi;
attribute hal_wifi_client;
attribute hal_wifi_server;
attribute hal_wifi_keystore;
attribute hal_wifi_keystore_client;
attribute hal_wifi_keystore_server;
attribute hal_wifi_supplicant;
attribute hal_wifi_supplicant_client;
attribute hal_wifi_supplicant_server;
# HwBinder services offered across the core-vendor boundary
#
# We annotate server domains with x_server to loosen the coupling between
# system and vendor images. For example, it should be possible to move a service
# from one core domain to another, without having to update the vendor image
# which contains clients of this service.
attribute wifi_keystore_service_server;