99a4cbcee7
The default policy for the "lockdown" access vector on Android was
introduced in commit bcfca1a6. While the "confidentiality" permission
was granted to all processes, the "integrity" was marked as
neverallowed.
Upstream, the support for that access vector was removed from kernel
5.16 onwards.
It was found that the "integrity" permission either does not apply to
Android or duplicates other access control (e.g., capabilities
sys_admin).
Instead of simply removing the neverallow rule, the access is granted to
all processes. This will prevent the proliferation of references to this
access vector in vendors' policies and ultimately facilitate its
removal.
Test: presubmit
Bug: 285443587
Bug: 269377822
Bug: 319390252
Change-Id: If2ad34fbbf2c0d29ac54ab5d1be430623f86f1f7
179 lines
7.8 KiB
Text
179 lines
7.8 KiB
Text
###
|
|
### Untrusted_app_all.
|
|
###
|
|
### This file defines the rules shared by all untrusted app domains except
|
|
### ephemeral_app for instant apps and isolated_app (which has a reduced
|
|
### permission set).
|
|
### Apps are labeled based on mac_permissions.xml (maps signer and
|
|
### optionally package name to seinfo value) and seapp_contexts (maps UID
|
|
### and optionally seinfo value to domain for process and type for data
|
|
### directory). The untrusted_app_all attribute is assigned to all default
|
|
### seapp_contexts for any app with UID between APP_AID (10000)
|
|
### and AID_ISOLATED_START (99000) if the app has no specific seinfo
|
|
### value as determined from mac_permissions.xml. In current AOSP, this
|
|
### attribute is assigned to all non-system apps as well as to any system apps
|
|
### that are not signed by the platform key. To move
|
|
### a system app into a specific domain, add a signer entry for it to
|
|
### mac_permissions.xml and assign it one of the pre-existing seinfo values
|
|
### or define and use a new seinfo value in both mac_permissions.xml and
|
|
### seapp_contexts.
|
|
###
|
|
### Note that rules that should apply to all untrusted apps must be in app.te or also
|
|
### added to ephemeral_app.te.
|
|
|
|
# Some apps ship with shared libraries and binaries that they write out
|
|
# to their sandbox directory and then execute.
|
|
allow untrusted_app_all privapp_data_file:file { r_file_perms execute };
|
|
allow untrusted_app_all app_data_file:file { r_file_perms execute };
|
|
auditallow untrusted_app_all app_data_file:file execute;
|
|
|
|
# Chrome Crashpad uses the the dynamic linker to load native executables
|
|
# from an APK (b/112050209, crbug.com/928422)
|
|
allow untrusted_app_all system_linker_exec:file execute_no_trans;
|
|
|
|
# Follow priv-app symlinks. This is used for dynamite functionality.
|
|
allow untrusted_app_all privapp_data_file:lnk_file r_file_perms;
|
|
|
|
# Allow handling of less common filesystem objects
|
|
allow untrusted_app_all app_data_file:{ lnk_file sock_file fifo_file } create_file_perms;
|
|
|
|
# Allow loading and deleting executable shared libraries
|
|
# within an application home directory. Such shared libraries would be
|
|
# created by things like renderscript or via other mechanisms.
|
|
allow untrusted_app_all app_exec_data_file:file { r_file_perms execute unlink };
|
|
|
|
# ASEC
|
|
allow untrusted_app_all asec_apk_file:file r_file_perms;
|
|
allow untrusted_app_all asec_apk_file:dir r_dir_perms;
|
|
# Execute libs in asec containers.
|
|
allow untrusted_app_all asec_public_file:file { execute };
|
|
|
|
# Used by Finsky / Android "Verify Apps" functionality when
|
|
# running "adb install foo.apk".
|
|
# TODO: Long term, we don't want apps probing into shell data files.
|
|
# Figure out a way to remove these rules.
|
|
allow untrusted_app_all shell_data_file:file r_file_perms;
|
|
allow untrusted_app_all shell_data_file:dir r_dir_perms;
|
|
|
|
# Allow traceur to pass file descriptors through a content provider to untrusted apps
|
|
# for the purpose of sharing files through e.g. gmail
|
|
allow untrusted_app_all trace_data_file:file { getattr read };
|
|
|
|
# untrusted apps should not be able to open trace data files, they should depend
|
|
# upon traceur to pass a file descriptor
|
|
neverallow untrusted_app_all trace_data_file:dir *;
|
|
neverallow untrusted_app_all trace_data_file:file { no_w_file_perms open };
|
|
|
|
# neverallow untrusted apps accessing debugfs_tracing
|
|
neverallow untrusted_app_all debugfs_tracing:file no_rw_file_perms;
|
|
|
|
# Allow to read staged apks.
|
|
allow untrusted_app_all { apk_tmp_file apk_private_tmp_file }:file {read getattr};
|
|
|
|
# Read and write system app data files passed over Binder.
|
|
# Motivating case was /data/data/com.android.settings/cache/*.jpg for
|
|
# cropping or taking user photos.
|
|
allow untrusted_app_all system_app_data_file:file { read write getattr };
|
|
|
|
#
|
|
# Rules migrated from old app domains coalesced into untrusted_app.
|
|
# This includes what used to be media_app, shared_app, and release_app.
|
|
#
|
|
|
|
# Access to /data/media.
|
|
allow untrusted_app_all media_rw_data_file:dir create_dir_perms;
|
|
allow untrusted_app_all media_rw_data_file:file create_file_perms;
|
|
|
|
# allow cts to query all services
|
|
allow untrusted_app_all servicemanager:service_manager list;
|
|
|
|
allow untrusted_app_all audioserver_service:service_manager find;
|
|
allow untrusted_app_all cameraserver_service:service_manager find;
|
|
allow untrusted_app_all drmserver_service:service_manager find;
|
|
allow untrusted_app_all mediaserver_service:service_manager find;
|
|
allow untrusted_app_all mediaextractor_service:service_manager find;
|
|
allow untrusted_app_all mediametrics_service:service_manager find;
|
|
allow untrusted_app_all mediadrmserver_service:service_manager find;
|
|
allow untrusted_app_all nfc_service:service_manager find;
|
|
allow untrusted_app_all radio_service:service_manager find;
|
|
allow untrusted_app_all app_api_service:service_manager find;
|
|
allow untrusted_app_all vr_manager_service:service_manager find;
|
|
|
|
# gdbserver for ndk-gdb ptrace attaches to app process.
|
|
allow untrusted_app_all self:process ptrace;
|
|
|
|
# Android Studio Instant Run has the application connect to a
|
|
# runas_app socket listening in the abstract namespace.
|
|
# https://developer.android.com/studio/run/
|
|
# b/123297648
|
|
allow untrusted_app_all runas_app:unix_stream_socket connectto;
|
|
|
|
# Untrusted apps need to be able to send a SIGCHLD to runas_app
|
|
# when running under a debugger (b/123612207)
|
|
allow untrusted_app_all runas_app:process sigchld;
|
|
|
|
# Cts: HwRngTest
|
|
allow untrusted_app_all sysfs_hwrandom:dir search;
|
|
allow untrusted_app_all sysfs_hwrandom:file r_file_perms;
|
|
|
|
# Allow apps to view preloaded media content
|
|
allow untrusted_app_all preloads_media_file:dir r_dir_perms;
|
|
allow untrusted_app_all preloads_media_file:file r_file_perms;
|
|
allow untrusted_app_all preloads_data_file:dir search;
|
|
|
|
# Allow untrusted apps read / execute access to /vendor/app for there can
|
|
# be pre-installed vendor apps that package a library within themselves.
|
|
# TODO (b/37784178) Consider creating a special type for /vendor/app installed
|
|
# apps.
|
|
allow untrusted_app_all vendor_app_file:dir { open getattr read search };
|
|
allow untrusted_app_all vendor_app_file:file { r_file_perms execute };
|
|
allow untrusted_app_all vendor_app_file:lnk_file { open getattr read };
|
|
|
|
# allow untrusted apps to use UDP sockets provided by the system server but not
|
|
# modify them other than to connect
|
|
allow untrusted_app_all system_server:udp_socket {
|
|
connect getattr read recvfrom sendto write getopt setopt };
|
|
|
|
# Allow the renderscript compiler to be run.
|
|
domain_auto_trans(untrusted_app_all, rs_exec, rs)
|
|
|
|
# suppress denials caused by debugfs_tracing
|
|
dontaudit untrusted_app_all debugfs_tracing:file rw_file_perms;
|
|
|
|
# This is allowed for targetSdkVersion <= 25 but disallowed on newer versions.
|
|
dontaudit untrusted_app_all net_dns_prop:file read;
|
|
|
|
# These have been disallowed since Android O.
|
|
# For P, we assume that apps are safely handling the denial.
|
|
dontaudit untrusted_app_all {
|
|
proc_stat
|
|
proc_uptime
|
|
proc_vmstat
|
|
proc_zoneinfo
|
|
}:file read;
|
|
|
|
# Allow the allocation and use of ptys
|
|
# Used by: https://play.google.com/store/apps/details?id=jackpal.androidterm
|
|
create_pty(untrusted_app_all)
|
|
|
|
# Allow access to kcov via its ioctl interface for coverage
|
|
# guided kernel fuzzing.
|
|
userdebug_or_eng(`
|
|
allow untrusted_app_all debugfs_kcov:file rw_file_perms;
|
|
allowxperm untrusted_app_all debugfs_kcov:file ioctl { KCOV_INIT_TRACE KCOV_ENABLE KCOV_DISABLE };
|
|
')
|
|
|
|
# Allow running a VM for test/demo purposes. Note that access to the
|
|
# service is still guarded with the
|
|
# `android.permission.MANAGE_VIRTUAL_MACHINE` permission. The
|
|
# protection level of the permission is
|
|
# `signature|privileged|development` so that it can only be granted to
|
|
# either platform-key signed apps, privileged apps, or test-only apps
|
|
# having `android:testOnly="true"` in their manifest.
|
|
virtualizationservice_use(untrusted_app_all)
|
|
|
|
with_native_coverage(`
|
|
# Allow writing coverage information to /data/misc/trace
|
|
allow domain method_trace_data_file:dir create_dir_perms;
|
|
allow domain method_trace_data_file:file create_file_perms;
|
|
')
|