23c9d91b46
Currently, both untrusted apps and priv-apps use the SELinux file label
"app_data_file" for files in their /data/data directory. This is
problematic, as we really want different rules for such files. For
example, we may want to allow untrusted apps to load executable code
from priv-app directories, but disallow untrusted apps from loading
executable code from their own home directories.
This change adds a new file type "privapp_data_file". For compatibility,
we adjust the policy to support access privapp_data_files almost
everywhere we were previously granting access to app_data_files
(adbd and run-as being exceptions). Additional future tightening is
possible here by removing some of these newly added rules.
This label will start getting used in a followup change to
system/sepolicy/private/seapp_contexts, similar to:
-user=_app isPrivApp=true domain=priv_app type=app_data_file levelFrom=user
+user=_app isPrivApp=true domain=priv_app type=privapp_data_file levelFrom=user
For now, this newly introduced label has no usage, so this change
is essentially a no-op.
Test: Factory reset and boot - no problems on fresh install.
Test: Upgrade to new version and test. No compatibility problems on
filesystem upgrade.
Change-Id: I9618b7d91d1c2bcb5837cdabc949f0cf741a2837
178 lines
3.7 KiB
Text
178 lines
3.7 KiB
Text
# Transition to crash_dump when /system/bin/crash_dump* is executed.
|
|
# This occurs when the process crashes.
|
|
domain_auto_trans(domain, crash_dump_exec, crash_dump);
|
|
allow domain crash_dump:process sigchld;
|
|
|
|
# Limit ability to ptrace or read sensitive /proc/pid files of processes
|
|
# with other UIDs to these whitelisted domains.
|
|
neverallow {
|
|
domain
|
|
-vold
|
|
-dumpstate
|
|
userdebug_or_eng(`-incidentd')
|
|
-storaged
|
|
-system_server
|
|
userdebug_or_eng(`-perfprofd')
|
|
} self:global_capability_class_set sys_ptrace;
|
|
|
|
# Limit ability to generate hardware unique device ID attestations to priv_apps
|
|
neverallow { domain -priv_app } *:keystore_key gen_unique_id;
|
|
|
|
neverallow {
|
|
domain
|
|
-init
|
|
-vendor_init
|
|
userdebug_or_eng(`-domain')
|
|
} debugfs_tracing_debug:file no_rw_file_perms;
|
|
|
|
# Core domains are not permitted to use kernel interfaces which are not
|
|
# explicitly labeled.
|
|
# TODO(b/65643247): Apply these neverallow rules to all coredomain.
|
|
full_treble_only(`
|
|
# /proc
|
|
neverallow {
|
|
coredomain
|
|
-vold
|
|
} proc:file no_rw_file_perms;
|
|
|
|
# /sys
|
|
neverallow {
|
|
coredomain
|
|
-init
|
|
-ueventd
|
|
-vold
|
|
} sysfs:file no_rw_file_perms;
|
|
|
|
# /dev
|
|
neverallow {
|
|
coredomain
|
|
-fsck
|
|
-init
|
|
-ueventd
|
|
} device:{ blk_file file } no_rw_file_perms;
|
|
|
|
# debugfs
|
|
neverallow {
|
|
coredomain
|
|
-dumpstate
|
|
-init
|
|
-system_server
|
|
} debugfs:file no_rw_file_perms;
|
|
|
|
# tracefs
|
|
neverallow {
|
|
coredomain
|
|
-atrace
|
|
-dumpstate
|
|
-init
|
|
userdebug_or_eng(`-perfprofd')
|
|
-traced_probes
|
|
-shell
|
|
-traceur_app
|
|
} debugfs_tracing:file no_rw_file_perms;
|
|
|
|
# inotifyfs
|
|
neverallow {
|
|
coredomain
|
|
-init
|
|
} inotify:file no_rw_file_perms;
|
|
|
|
# pstorefs
|
|
neverallow {
|
|
coredomain
|
|
-bootstat
|
|
-charger
|
|
-dumpstate
|
|
-healthd
|
|
userdebug_or_eng(`-incidentd')
|
|
-init
|
|
-logd
|
|
-logpersist
|
|
-recovery_persist
|
|
-recovery_refresh
|
|
-shell
|
|
-system_server
|
|
} pstorefs:file no_rw_file_perms;
|
|
|
|
# configfs
|
|
neverallow {
|
|
coredomain
|
|
-init
|
|
-system_server
|
|
} configfs:file no_rw_file_perms;
|
|
|
|
# functionfs
|
|
neverallow {
|
|
coredomain
|
|
-adbd
|
|
-init
|
|
-mediaprovider
|
|
-system_server
|
|
} functionfs:file no_rw_file_perms;
|
|
|
|
# usbfs and binfmt_miscfs
|
|
neverallow {
|
|
coredomain
|
|
-init
|
|
}{ usbfs binfmt_miscfs }:file no_rw_file_perms;
|
|
')
|
|
|
|
# System_server owns dropbox data, and init creates/restorecons the directory
|
|
# Disallow direct access by other processes.
|
|
neverallow { domain -init -system_server } dropbox_data_file:dir *;
|
|
neverallow { domain -init -system_server } dropbox_data_file:file ~{ getattr read };
|
|
|
|
###
|
|
# Services should respect app sandboxes
|
|
neverallow {
|
|
domain
|
|
-appdomain
|
|
-installd # creation of sandbox
|
|
} { privapp_data_file app_data_file }:dir_file_class_set { create unlink };
|
|
|
|
# Only the following processes should be directly accessing private app
|
|
# directories.
|
|
neverallow {
|
|
domain
|
|
-adbd
|
|
-appdomain
|
|
-dexoptanalyzer
|
|
-init
|
|
-installd
|
|
-mediaserver # b/80300620
|
|
userdebug_or_eng(`-perfprofd')
|
|
-profman
|
|
-runas
|
|
-system_server
|
|
-vold
|
|
} { privapp_data_file app_data_file }:dir *;
|
|
|
|
# Only apps should be modifying app data. init and installd are exempted for
|
|
# restorecon and package install/uninstall.
|
|
neverallow {
|
|
domain
|
|
-appdomain
|
|
-init
|
|
-installd
|
|
} { privapp_data_file app_data_file }:dir ~r_dir_perms;
|
|
|
|
neverallow {
|
|
domain
|
|
-appdomain
|
|
-installd
|
|
-mediaserver # b/80300620
|
|
userdebug_or_eng(`-perfprofd')
|
|
-vold # b/80418809
|
|
} { privapp_data_file app_data_file }:file_class_set open;
|
|
|
|
neverallow {
|
|
domain
|
|
-appdomain
|
|
-installd # creation of sandbox
|
|
} { privapp_data_file app_data_file }:dir_file_class_set { create unlink };
|
|
|
|
neverallow {
|
|
domain
|
|
-init
|
|
-installd
|
|
} { privapp_data_file app_data_file }:dir_file_class_set { relabelfrom relabelto };
|