4a12d9630a
Prevent defining any process types without the domain attribute so that all allow and neverallow rules written on domain are applied to all processes. Prevent defining any app process types without the appdomain attribute so that all allow and neverallow rules written on appdomain are applied to all app processes. Change-Id: I4cb565314fd40e1e82c4360efb671b175a1ee389 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
78 lines
3.2 KiB
Text
78 lines
3.2 KiB
Text
# zygote
|
|
type zygote, domain;
|
|
type zygote_exec, exec_type, file_type;
|
|
|
|
init_daemon_domain(zygote)
|
|
typeattribute zygote mlstrustedsubject;
|
|
# Override DAC on files and switch uid/gid.
|
|
allow zygote self:capability { dac_override setgid setuid fowner chown };
|
|
# Drop capabilities from bounding set.
|
|
allow zygote self:capability setpcap;
|
|
# Switch SELinux context to app domains.
|
|
allow zygote self:process setcurrent;
|
|
allow zygote system_server:process dyntransition;
|
|
allow zygote appdomain:process dyntransition;
|
|
# Allow zygote to read app /proc/pid dirs (b/10455872)
|
|
allow zygote appdomain:dir { getattr search };
|
|
allow zygote appdomain:file { r_file_perms };
|
|
# Move children into the peer process group.
|
|
allow zygote system_server:process { getpgid setpgid };
|
|
allow zygote appdomain:process { getpgid setpgid };
|
|
# Read system data.
|
|
allow zygote system_data_file:dir r_dir_perms;
|
|
allow zygote system_data_file:file r_file_perms;
|
|
# Write to /data/dalvik-cache.
|
|
allow zygote dalvikcache_data_file:dir create_dir_perms;
|
|
allow zygote dalvikcache_data_file:file create_file_perms;
|
|
# Create symlinks in /data/dalvik-cache
|
|
allow zygote dalvikcache_data_file:lnk_file create_file_perms;
|
|
# Write to /data/resource-cache
|
|
allow zygote resourcecache_data_file:dir rw_dir_perms;
|
|
allow zygote resourcecache_data_file:file create_file_perms;
|
|
# For art.
|
|
allow zygote dalvikcache_data_file:file execute;
|
|
# Execute dexopt.
|
|
allow zygote system_file:file x_file_perms;
|
|
allow zygote dex2oat_exec:file rx_file_perms;
|
|
# Control cgroups.
|
|
allow zygote cgroup:dir create_dir_perms;
|
|
allow zygote self:capability sys_admin;
|
|
# Check validity of SELinux context before use.
|
|
selinux_check_context(zygote)
|
|
# Check SELinux permissions.
|
|
selinux_check_access(zygote)
|
|
# Read /seapp_contexts and /data/security/seapp_contexts
|
|
security_access_policy(zygote)
|
|
|
|
# Native bridge functionality requires that zygote replaces
|
|
# /proc/cpuinfo with /system/lib/<ISA>/cpuinfo using a bind mount
|
|
allow zygote proc_cpuinfo:file mounton;
|
|
|
|
# Allow remounting rootfs as MS_SLAVE
|
|
allow zygote rootfs:dir mounton;
|
|
allow zygote sdcard_type:dir { write search setattr create add_name mounton }; # TODO: deprecated in M
|
|
dontaudit zygote self:capability fsetid; # TODO: deprecated in M
|
|
allow zygote tmpfs:dir { write create add_name setattr mounton search }; # TODO: deprecated in M
|
|
allow zygote tmpfs:filesystem mount; # TODO: deprecated in M
|
|
allow zygote labeledfs:filesystem remount; # TODO: deprecated in M
|
|
|
|
# Allowed to create user-specific storage source if started before vold
|
|
allow zygote mnt_user_file:dir create_dir_perms;
|
|
allow zygote mnt_user_file:lnk_file create_file_perms;
|
|
# Allowed to mount user-specific storage into place
|
|
allow zygote storage_file:dir { search mounton };
|
|
|
|
# Handle --invoke-with command when launching Zygote with a wrapper command.
|
|
allow zygote zygote_exec:file rx_file_perms;
|
|
|
|
###
|
|
### neverallow rules
|
|
###
|
|
|
|
# Ensure that all types assigned to app processes are included
|
|
# in the appdomain attribute, so that all allow and neverallow rules
|
|
# written on appdomain are applied to all app processes.
|
|
# This is achieved by ensuring that it is impossible for zygote to
|
|
# setcon (dyntransition) to any types other than those associated
|
|
# with appdomain plus system_server.
|
|
neverallow zygote ~{ appdomain system_server }:process dyntransition;
|