3233353603
(cherry picked from commit 6ba383c575)
Restrict unix_dgram_socket and unix_stream_socket to a whitelist.
Disallow all ioctls for netlink_selinux_socket and netlink_route_socket.
Neverallow third party app use of all ioctls other than
unix_dgram_socket, unix_stream_socket, netlink_selinux_socket,
netlink_route_socket, tcp_socket, udp_socket and rawip_socket.
Bug: 28171804
Change-Id: Icfe3486a62fc2fc2d2abd8d4030a5fbdd0ab30ab
359 lines
11 KiB
Text
359 lines
11 KiB
Text
#####################################
|
|
# domain_trans(olddomain, type, newdomain)
|
|
# Allow a transition from olddomain to newdomain
|
|
# upon executing a file labeled with type.
|
|
# This only allows the transition; it does not
|
|
# cause it to occur automatically - use domain_auto_trans
|
|
# if that is what you want.
|
|
#
|
|
define(`domain_trans', `
|
|
# Old domain may exec the file and transition to the new domain.
|
|
allow $1 $2:file { getattr open read execute };
|
|
allow $1 $3:process transition;
|
|
# New domain is entered by executing the file.
|
|
allow $3 $2:file { entrypoint open read execute getattr };
|
|
# New domain can send SIGCHLD to its caller.
|
|
allow $3 $1:process sigchld;
|
|
# Enable AT_SECURE, i.e. libc secure mode.
|
|
dontaudit $1 $3:process noatsecure;
|
|
# XXX dontaudit candidate but requires further study.
|
|
allow $1 $3:process { siginh rlimitinh };
|
|
')
|
|
|
|
#####################################
|
|
# domain_auto_trans(olddomain, type, newdomain)
|
|
# Automatically transition from olddomain to newdomain
|
|
# upon executing a file labeled with type.
|
|
#
|
|
define(`domain_auto_trans', `
|
|
# Allow the necessary permissions.
|
|
domain_trans($1,$2,$3)
|
|
# Make the transition occur by default.
|
|
type_transition $1 $2:process $3;
|
|
')
|
|
|
|
#####################################
|
|
# file_type_trans(domain, dir_type, file_type)
|
|
# Allow domain to create a file labeled file_type in a
|
|
# directory labeled dir_type.
|
|
# This only allows the transition; it does not
|
|
# cause it to occur automatically - use file_type_auto_trans
|
|
# if that is what you want.
|
|
#
|
|
define(`file_type_trans', `
|
|
# Allow the domain to add entries to the directory.
|
|
allow $1 $2:dir ra_dir_perms;
|
|
# Allow the domain to create the file.
|
|
allow $1 $3:notdevfile_class_set create_file_perms;
|
|
allow $1 $3:dir create_dir_perms;
|
|
')
|
|
|
|
#####################################
|
|
# file_type_auto_trans(domain, dir_type, file_type)
|
|
# Automatically label new files with file_type when
|
|
# they are created by domain in directories labeled dir_type.
|
|
#
|
|
define(`file_type_auto_trans', `
|
|
# Allow the necessary permissions.
|
|
file_type_trans($1, $2, $3)
|
|
# Make the transition occur by default.
|
|
type_transition $1 $2:dir $3;
|
|
type_transition $1 $2:notdevfile_class_set $3;
|
|
')
|
|
|
|
#####################################
|
|
# r_dir_file(domain, type)
|
|
# Allow the specified domain to read directories, files
|
|
# and symbolic links of the specified type.
|
|
define(`r_dir_file', `
|
|
allow $1 $2:dir r_dir_perms;
|
|
allow $1 $2:{ file lnk_file } r_file_perms;
|
|
')
|
|
|
|
#####################################
|
|
# tmpfs_domain(domain)
|
|
# Define and allow access to a unique type for
|
|
# this domain when creating tmpfs / shmem / ashmem files.
|
|
define(`tmpfs_domain', `
|
|
type $1_tmpfs, file_type;
|
|
type_transition $1 tmpfs:file $1_tmpfs;
|
|
allow $1 $1_tmpfs:file { read write };
|
|
')
|
|
|
|
#####################################
|
|
# init_daemon_domain(domain)
|
|
# Set up a transition from init to the daemon domain
|
|
# upon executing its binary.
|
|
define(`init_daemon_domain', `
|
|
domain_auto_trans(init, $1_exec, $1)
|
|
tmpfs_domain($1)
|
|
')
|
|
|
|
#####################################
|
|
# app_domain(domain)
|
|
# Allow a base set of permissions required for all apps.
|
|
define(`app_domain', `
|
|
typeattribute $1 appdomain;
|
|
# Label ashmem objects with our own unique type.
|
|
tmpfs_domain($1)
|
|
# Map with PROT_EXEC.
|
|
allow $1 $1_tmpfs:file execute;
|
|
')
|
|
|
|
#####################################
|
|
# net_domain(domain)
|
|
# Allow a base set of permissions required for network access.
|
|
define(`net_domain', `
|
|
typeattribute $1 netdomain;
|
|
')
|
|
|
|
#####################################
|
|
# bluetooth_domain(domain)
|
|
# Allow a base set of permissions required for bluetooth access.
|
|
define(`bluetooth_domain', `
|
|
typeattribute $1 bluetoothdomain;
|
|
')
|
|
|
|
#####################################
|
|
# unix_socket_connect(clientdomain, socket, serverdomain)
|
|
# Allow a local socket connection from clientdomain via
|
|
# socket to serverdomain.
|
|
#
|
|
# Note: If you see denial records that distill to the
|
|
# following allow rules:
|
|
# allow clientdomain property_socket:sock_file write;
|
|
# allow clientdomain init:unix_stream_socket connectto;
|
|
# allow clientdomain something_prop:property_service set;
|
|
#
|
|
# This sequence is indicative of attempting to set a property.
|
|
# use set_prop(sourcedomain, targetproperty)
|
|
#
|
|
define(`unix_socket_connect', `
|
|
ifelse($2, `property', `
|
|
ifelse($3,`init', `
|
|
print(`deprecated: unix_socket_connect($1, $2, $3) Please use set_prop($1, <property name>) instead.')
|
|
')
|
|
')
|
|
__unix_socket_connect__($1, $2, $3)
|
|
')
|
|
|
|
define(`__unix_socket_connect__', `
|
|
allow $1 $2_socket:sock_file write;
|
|
allow $1 $3:unix_stream_socket connectto;
|
|
')
|
|
|
|
#####################################
|
|
# set_prop(sourcedomain, targetproperty)
|
|
# Allows source domain to set the
|
|
# targetproperty.
|
|
#
|
|
define(`set_prop', `
|
|
__unix_socket_connect__($1, property, init)
|
|
allow $1 $2:property_service set;
|
|
get_prop($1, $2)
|
|
')
|
|
|
|
#####################################
|
|
# get_prop(sourcedomain, targetproperty)
|
|
# Allows source domain to read the
|
|
# targetproperty.
|
|
#
|
|
define(`get_prop', `
|
|
allow $1 $2:file r_file_perms;
|
|
')
|
|
|
|
#####################################
|
|
# unix_socket_send(clientdomain, socket, serverdomain)
|
|
# Allow a local socket send from clientdomain via
|
|
# socket to serverdomain.
|
|
define(`unix_socket_send', `
|
|
allow $1 $2_socket:sock_file write;
|
|
allow $1 $3:unix_dgram_socket sendto;
|
|
')
|
|
|
|
#####################################
|
|
# binder_use(domain)
|
|
# Allow domain to use Binder IPC.
|
|
define(`binder_use', `
|
|
# Call the servicemanager and transfer references to it.
|
|
allow $1 servicemanager:binder { call transfer };
|
|
# servicemanager performs getpidcon on clients.
|
|
allow servicemanager $1:dir search;
|
|
allow servicemanager $1:file { read open };
|
|
allow servicemanager $1:process getattr;
|
|
# rw access to /dev/binder and /dev/ashmem is presently granted to
|
|
# all domains in domain.te.
|
|
')
|
|
|
|
#####################################
|
|
# binder_call(clientdomain, serverdomain)
|
|
# Allow clientdomain to perform binder IPC to serverdomain.
|
|
define(`binder_call', `
|
|
# Call the server domain and optionally transfer references to it.
|
|
allow $1 $2:binder { call transfer };
|
|
# Allow the serverdomain to transfer references to the client on the reply.
|
|
allow $2 $1:binder transfer;
|
|
# Receive and use open files from the server.
|
|
allow $1 $2:fd use;
|
|
')
|
|
|
|
#####################################
|
|
# binder_service(domain)
|
|
# Mark a domain as being a Binder service domain.
|
|
# Used to allow binder IPC to the various system services.
|
|
define(`binder_service', `
|
|
typeattribute $1 binderservicedomain;
|
|
')
|
|
|
|
#####################################
|
|
# wakelock_use(domain)
|
|
# Allow domain to manage wake locks
|
|
define(`wakelock_use', `
|
|
# Access /sys/power/wake_lock and /sys/power/wake_unlock
|
|
allow $1 sysfs_wake_lock:file rw_file_perms;
|
|
# Accessing these files requires CAP_BLOCK_SUSPEND
|
|
allow $1 self:capability2 block_suspend;
|
|
')
|
|
|
|
#####################################
|
|
# selinux_check_access(domain)
|
|
# Allow domain to check SELinux permissions via selinuxfs.
|
|
define(`selinux_check_access', `
|
|
allow $1 selinuxfs:file rw_file_perms;
|
|
allow $1 kernel:security compute_av;
|
|
allow $1 self:netlink_selinux_socket { read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto recv_msg send_msg name_bind };
|
|
')
|
|
|
|
#####################################
|
|
# selinux_check_context(domain)
|
|
# Allow domain to check SELinux contexts via selinuxfs.
|
|
define(`selinux_check_context', `
|
|
allow $1 selinuxfs:file rw_file_perms;
|
|
allow $1 kernel:security check_context;
|
|
')
|
|
|
|
#####################################
|
|
# selinux_setenforce(domain)
|
|
# Allow domain to set SELinux to enforcing.
|
|
define(`selinux_setenforce', `
|
|
allow $1 selinuxfs:file rw_file_perms;
|
|
allow $1 kernel:security setenforce;
|
|
')
|
|
|
|
#####################################
|
|
# selinux_setbool(domain)
|
|
# Allow domain to set SELinux booleans.
|
|
define(`selinux_setbool', `
|
|
allow $1 selinuxfs:file rw_file_perms;
|
|
allow $1 kernel:security setbool;
|
|
')
|
|
|
|
#####################################
|
|
# security_access_policy(domain)
|
|
# Read only access to all policy files and
|
|
# selinuxfs
|
|
define(`security_access_policy', `
|
|
allow $1 security_file:dir r_dir_perms;
|
|
allow $1 security_file:file r_file_perms;
|
|
')
|
|
|
|
#####################################
|
|
# mmac_manage_policy(domain)
|
|
# Ability to manage mmac policy files,
|
|
# trigger runtime reload, change
|
|
# mmac enforcing mode and access logcat.
|
|
define(`mmac_manage_policy', `
|
|
allow $1 security_file:dir create_dir_perms;
|
|
allow $1 security_file:file create_file_perms;
|
|
allow $1 security_file:lnk_file { create rename unlink };
|
|
set_prop($1, security_prop)
|
|
')
|
|
|
|
#####################################
|
|
# create_pty(domain)
|
|
# Allow domain to create and use a pty, isolated from any other domain ptys.
|
|
define(`create_pty', `
|
|
# Each domain gets a unique devpts type.
|
|
type $1_devpts, fs_type;
|
|
# Label the pty with the unique type when created.
|
|
type_transition $1 devpts:chr_file $1_devpts;
|
|
# Allow use of the pty after creation.
|
|
allow $1 $1_devpts:chr_file { open getattr read write ioctl };
|
|
# Note: devpts:dir search and ptmx_device:chr_file rw_file_perms
|
|
# allowed to everyone via domain.te.
|
|
')
|
|
|
|
#####################################
|
|
# Non system_app application set
|
|
#
|
|
define(`non_system_app_set', `{ appdomain -system_app }')
|
|
|
|
#####################################
|
|
# Recovery only
|
|
# SELinux rules which apply only to recovery mode
|
|
#
|
|
define(`recovery_only', ifelse(target_recovery, `true', $1, ))
|
|
|
|
#####################################
|
|
# Userdebug or eng builds
|
|
# SELinux rules which apply only to userdebug or eng builds
|
|
#
|
|
define(`userdebug_or_eng', ifelse(target_build_variant, `eng', $1, ifelse(target_build_variant, `userdebug', $1)))
|
|
define(`eng', ifelse(target_build_variant, `eng', $1))
|
|
|
|
#####################################
|
|
# write_logd(domain)
|
|
# Ability to write to android log
|
|
# daemon via sockets
|
|
define(`write_logd', `
|
|
unix_socket_send($1, logdw, logd)
|
|
allow $1 pmsg_device:chr_file w_file_perms;
|
|
')
|
|
|
|
#####################################
|
|
# read_logd(domain)
|
|
# Ability to run logcat and read from android
|
|
# log daemon via sockets
|
|
define(`read_logd', `
|
|
allow $1 logcat_exec:file rx_file_perms;
|
|
unix_socket_connect($1, logdr, logd)
|
|
')
|
|
|
|
#####################################
|
|
# control_logd(domain)
|
|
# Ability to control
|
|
# android log daemon via sockets
|
|
define(`control_logd', `
|
|
# Group AID_LOG checked by filesystem & logd
|
|
# to permit control commands
|
|
unix_socket_connect($1, logd, logd)
|
|
')
|
|
|
|
#####################################
|
|
# use_keystore(domain)
|
|
# Ability to use keystore.
|
|
# Keystore is requires the following permissions
|
|
# to call getpidcon.
|
|
define(`use_keystore', `
|
|
allow keystore $1:dir search;
|
|
allow keystore $1:file { read open };
|
|
allow keystore $1:process getattr;
|
|
allow $1 keystore_service:service_manager find;
|
|
binder_call($1, keystore)
|
|
')
|
|
|
|
###########################################
|
|
# use_drmservice(domain)
|
|
# Ability to use DrmService which requires
|
|
# DrmService to call getpidcon.
|
|
define(`use_drmservice', `
|
|
allow drmserver $1:dir search;
|
|
allow drmserver $1:file { read open };
|
|
allow drmserver $1:process getattr;
|
|
')
|
|
|
|
##########################################
|
|
# print a message with a trailing newline
|
|
# print(`args')
|
|
define(`print', `errprint(`m4: '__file__: __line__`: $*
|
|
')')
|