ca0690e8eb
This patch extends the current debug-specific rules to cover user
builds. As a reminder, on user, the target process fork-execs a private
heapprofd process, which then performs stack unwinding & talking to the
central tracing daemon while staying in the target's domain. The central
heapprofd daemon is only responsible for identifying targets & sending
the activation signal. On the other hand, on debug, the central
heapprofd can handle all processes directly, so the necessary SELinux
capabilities depend on the build type.
These rules are necessary but not sufficient for profiling. For zygote
children, the libc triggering logic will also check for the app to
either be debuggable, or go/profileable.
For more context, see go/heapprofd-security & go/heapprofd-design.
Note that I've had to split this into two separate macros, as
exec_no_trans - which is necessary on user, but nice-to-have on debug -
conflicts with a lot of neverallows (e.g. HALs and system_server) for
the wider whitelisting that we do on debug builds.
Test: built & flashed on {blueline-userdebug, blueline-user}, activated profiling of whitelisted/not domains & checked for lack of denials in logcat.
Bug: 120409382
Change-Id: Id0defc3105b99f777bcee2046d9894a2b39c6a29
162 lines
7.3 KiB
Text
162 lines
7.3 KiB
Text
###
|
|
### Untrusted_app_all.
|
|
###
|
|
### This file defines the rules shared by all untrusted app domains except
|
|
### ephemeral_app for instant apps.
|
|
### Apps are labeled based on mac_permissions.xml (maps signer and
|
|
### optionally package name to seinfo value) and seapp_contexts (maps UID
|
|
### and optionally seinfo value to domain for process and type for data
|
|
### directory). The untrusted_app_all attribute is assigned to all default
|
|
### seapp_contexts for any app with UID between APP_AID (10000)
|
|
### and AID_ISOLATED_START (99000) if the app has no specific seinfo
|
|
### value as determined from mac_permissions.xml. In current AOSP, this
|
|
### attribute is assigned to all non-system apps as well as to any system apps
|
|
### that are not signed by the platform key. To move
|
|
### a system app into a specific domain, add a signer entry for it to
|
|
### mac_permissions.xml and assign it one of the pre-existing seinfo values
|
|
### or define and use a new seinfo value in both mac_permissions.xml and
|
|
### seapp_contexts.
|
|
###
|
|
### Note that rules that should apply to all untrusted apps must be in app.te or also
|
|
### added to ephemeral_app.te.
|
|
|
|
# Some apps ship with shared libraries and binaries that they write out
|
|
# to their sandbox directory and then execute.
|
|
allow untrusted_app_all privapp_data_file:file { r_file_perms execute };
|
|
allow untrusted_app_all app_data_file:file { r_file_perms execute };
|
|
|
|
# Allow loading and deleting executable shared libraries
|
|
# within an application home directory. Such shared libraries would be
|
|
# created by things like renderscript or via other mechanisms.
|
|
allow untrusted_app_all app_exec_data_file:file { r_file_perms execute unlink };
|
|
|
|
# ASEC
|
|
allow untrusted_app_all asec_apk_file:file r_file_perms;
|
|
allow untrusted_app_all asec_apk_file:dir r_dir_perms;
|
|
# Execute libs in asec containers.
|
|
allow untrusted_app_all asec_public_file:file { execute };
|
|
|
|
# Used by Finsky / Android "Verify Apps" functionality when
|
|
# running "adb install foo.apk".
|
|
# TODO: Long term, we don't want apps probing into shell data files.
|
|
# Figure out a way to remove these rules.
|
|
allow untrusted_app_all shell_data_file:file r_file_perms;
|
|
allow untrusted_app_all shell_data_file:dir r_dir_perms;
|
|
|
|
# Allow traceur to pass file descriptors through a content provider to untrusted apps
|
|
# for the purpose of sharing files through e.g. gmail
|
|
allow untrusted_app_all trace_data_file:file { getattr read };
|
|
|
|
# untrusted apps should not be able to open trace data files, they should depend
|
|
# upon traceur to pass a file descriptor
|
|
neverallow untrusted_app_all trace_data_file:dir *;
|
|
neverallow untrusted_app_all trace_data_file:file { no_w_file_perms open };
|
|
|
|
# Allow to read staged apks.
|
|
allow untrusted_app_all { apk_tmp_file apk_private_tmp_file }:file {read getattr};
|
|
|
|
# Read and write system app data files passed over Binder.
|
|
# Motivating case was /data/data/com.android.settings/cache/*.jpg for
|
|
# cropping or taking user photos.
|
|
allow untrusted_app_all system_app_data_file:file { read write getattr };
|
|
|
|
#
|
|
# Rules migrated from old app domains coalesced into untrusted_app.
|
|
# This includes what used to be media_app, shared_app, and release_app.
|
|
#
|
|
|
|
# Access to /data/media.
|
|
allow untrusted_app_all media_rw_data_file:dir create_dir_perms;
|
|
allow untrusted_app_all media_rw_data_file:file create_file_perms;
|
|
|
|
# Traverse into /mnt/media_rw for bypassing FUSE daemon
|
|
# TODO: narrow this to just MediaProvider
|
|
allow untrusted_app_all mnt_media_rw_file:dir search;
|
|
|
|
# allow cts to query all services
|
|
allow untrusted_app_all servicemanager:service_manager list;
|
|
|
|
allow untrusted_app_all audioserver_service:service_manager find;
|
|
allow untrusted_app_all cameraserver_service:service_manager find;
|
|
allow untrusted_app_all drmserver_service:service_manager find;
|
|
allow untrusted_app_all mediaserver_service:service_manager find;
|
|
allow untrusted_app_all mediaextractor_service:service_manager find;
|
|
allow untrusted_app_all mediacodec_service:service_manager find;
|
|
allow untrusted_app_all mediametrics_service:service_manager find;
|
|
allow untrusted_app_all mediadrmserver_service:service_manager find;
|
|
allow untrusted_app_all nfc_service:service_manager find;
|
|
allow untrusted_app_all radio_service:service_manager find;
|
|
allow untrusted_app_all app_api_service:service_manager find;
|
|
allow untrusted_app_all vr_manager_service:service_manager find;
|
|
|
|
# Allow GMS core to access perfprofd output, which is stored
|
|
# in /data/misc/perfprofd/. GMS core will need to list all
|
|
# data stored in that directory to process them one by one.
|
|
userdebug_or_eng(`
|
|
allow untrusted_app_all perfprofd_data_file:file r_file_perms;
|
|
allow untrusted_app_all perfprofd_data_file:dir r_dir_perms;
|
|
')
|
|
|
|
# gdbserver for ndk-gdb ptrace attaches to app process.
|
|
allow untrusted_app_all self:process ptrace;
|
|
|
|
# Cts: HwRngTest
|
|
allow untrusted_app_all sysfs_hwrandom:dir search;
|
|
allow untrusted_app_all sysfs_hwrandom:file r_file_perms;
|
|
|
|
# Allow apps to view preloaded media content
|
|
allow untrusted_app_all preloads_media_file:dir r_dir_perms;
|
|
allow untrusted_app_all preloads_media_file:file r_file_perms;
|
|
allow untrusted_app_all preloads_data_file:dir search;
|
|
|
|
# Allow untrusted apps read / execute access to /vendor/app for there can
|
|
# be pre-installed vendor apps that package a library within themselves.
|
|
# TODO (b/37784178) Consider creating a special type for /vendor/app installed
|
|
# apps.
|
|
allow untrusted_app_all vendor_app_file:dir { open getattr read search };
|
|
allow untrusted_app_all vendor_app_file:file { r_file_perms execute };
|
|
allow untrusted_app_all vendor_app_file:lnk_file { open getattr read };
|
|
|
|
# Write app-specific trace data to the Perfetto traced damon. This requires
|
|
# connecting to its producer socket and obtaining a (per-process) tmpfs fd.
|
|
allow untrusted_app_all traced:fd use;
|
|
allow untrusted_app_all traced_tmpfs:file { read write getattr map };
|
|
unix_socket_connect(untrusted_app_all, traced_producer, traced)
|
|
|
|
# Allow heap profiling if the app opts in by being marked
|
|
# profileable/debuggable.
|
|
can_profile_heap(untrusted_app_all)
|
|
|
|
# allow untrusted apps to use UDP sockets provided by the system server but not
|
|
# modify them other than to connect
|
|
allow untrusted_app_all system_server:udp_socket {
|
|
connect getattr read recvfrom sendto write getopt setopt };
|
|
|
|
# Allow the renderscript compiler to be run.
|
|
domain_auto_trans(untrusted_app_all, rs_exec, rs)
|
|
|
|
# This is allowed for targetSdkVersion <= 25 but disallowed on newer versions.
|
|
dontaudit untrusted_app_all net_dns_prop:file read;
|
|
|
|
# These have been disallowed since Android O.
|
|
# For P, we assume that apps are safely handling the denial.
|
|
dontaudit untrusted_app_all proc_stat:file read;
|
|
dontaudit untrusted_app_all proc_vmstat:file read;
|
|
dontaudit untrusted_app_all proc_uptime:file read;
|
|
|
|
# Allow the allocation and use of ptys
|
|
# Used by: https://play.google.com/store/apps/details?id=jackpal.androidterm
|
|
create_pty(untrusted_app_all)
|
|
|
|
# Attempts to write to system_data_file is generally a sign
|
|
# that apps are attempting to access encrypted storage before
|
|
# the ACTION_USER_UNLOCKED intent is delivered. Suppress this
|
|
# denial to prevent third party apps from spamming the logs.
|
|
dontaudit untrusted_app_all system_data_file:dir write;
|
|
|
|
# Allow access to kcov via its ioctl interface for coverage
|
|
# guided kernel fuzzing.
|
|
userdebug_or_eng(`
|
|
allow untrusted_app_all debugfs_kcov:file rw_file_perms;
|
|
allowxperm untrusted_app_all debugfs_kcov:file ioctl { KCOV_INIT_TRACE KCOV_ENABLE KCOV_DISABLE };
|
|
')
|