87143bd904
This reverts commit 304962477a.
Reason for revert: b/279565840
Change-Id: I6fc3a102994157ea3da751364f80730f4d0e87f0
304 lines
11 KiB
Text
304 lines
11 KiB
Text
###
|
|
### SDK Sandbox process.
|
|
###
|
|
### This file defines the security policy for the sdk sandbox processes.
|
|
|
|
type sdk_sandbox, domain;
|
|
|
|
typeattribute sdk_sandbox coredomain;
|
|
|
|
net_domain(sdk_sandbox)
|
|
app_domain(sdk_sandbox)
|
|
|
|
# TODO(b/252967582): remove this rule if it generates too much logs traffic.
|
|
auditallow sdk_sandbox {
|
|
property_type
|
|
# remove expected properties to reduce noise.
|
|
-servicemanager_prop
|
|
-hwservicemanager_prop
|
|
-use_memfd_prop
|
|
-binder_cache_system_server_prop
|
|
-graphics_config_prop
|
|
-persist_wm_debug_prop
|
|
-aaudio_config_prop
|
|
-adbd_config_prop
|
|
-apex_ready_prop
|
|
-apexd_select_prop
|
|
-arm64_memtag_prop
|
|
-audio_prop
|
|
-binder_cache_bluetooth_server_prop
|
|
-binder_cache_telephony_server_prop
|
|
-bluetooth_config_prop
|
|
-boot_status_prop
|
|
-bootloader_prop
|
|
-bq_config_prop
|
|
-build_odm_prop
|
|
-build_prop
|
|
-build_vendor_prop
|
|
-camera2_extensions_prop
|
|
-camera_calibration_prop
|
|
-camera_config_prop
|
|
-camerax_extensions_prop
|
|
-codec2_config_prop
|
|
-config_prop
|
|
-cppreopt_prop
|
|
-dalvik_config_prop_type
|
|
-dalvik_prop
|
|
-dalvik_runtime_prop
|
|
-dck_prop
|
|
-debug_prop
|
|
-debuggerd_prop
|
|
-default_prop
|
|
-device_config_memory_safety_native_boot_prop
|
|
-device_config_memory_safety_native_prop
|
|
-device_config_nnapi_native_prop
|
|
-device_config_runtime_native_boot_prop
|
|
-device_config_runtime_native_prop
|
|
-dhcp_prop
|
|
-dumpstate_prop
|
|
-exported3_system_prop
|
|
-exported_config_prop
|
|
-exported_default_prop
|
|
-exported_dumpstate_prop
|
|
-exported_pm_prop
|
|
-exported_system_prop
|
|
-ffs_config_prop
|
|
-fingerprint_prop
|
|
-framework_status_prop
|
|
-gwp_asan_prop
|
|
-hal_instrumentation_prop
|
|
-hdmi_config_prop
|
|
-heapprofd_prop
|
|
-hw_timeout_multiplier_prop
|
|
-init_service_status_private_prop
|
|
-init_service_status_prop
|
|
-libc_debug_prop
|
|
-lmkd_config_prop
|
|
-locale_prop
|
|
-localization_prop
|
|
-log_file_logger_prop
|
|
-log_prop
|
|
-log_tag_prop
|
|
-logd_prop
|
|
-media_config_prop
|
|
-media_variant_prop
|
|
-mediadrm_config_prop
|
|
-module_sdkextensions_prop
|
|
-net_radio_prop
|
|
-nfc_prop
|
|
-nnapi_ext_deny_product_prop
|
|
-ota_prop
|
|
-packagemanager_config_prop
|
|
-pan_result_prop
|
|
-permissive_mte_prop
|
|
-persist_debug_prop
|
|
-persist_sysui_builder_extras_prop
|
|
-pm_prop
|
|
-powerctl_prop
|
|
-property_service_version_prop
|
|
-radio_control_prop
|
|
-radio_prop
|
|
-restorecon_prop
|
|
-rollback_test_prop
|
|
-sendbug_config_prop
|
|
-setupwizard_prop
|
|
-shell_prop
|
|
-soc_prop
|
|
-socket_hook_prop
|
|
-sqlite_log_prop
|
|
-storagemanager_config_prop
|
|
-surfaceflinger_color_prop
|
|
-surfaceflinger_prop
|
|
-system_prop
|
|
-system_user_mode_emulation_prop
|
|
-systemsound_config_prop
|
|
-telephony_config_prop
|
|
-telephony_status_prop
|
|
-test_harness_prop
|
|
-timezone_prop
|
|
-usb_config_prop
|
|
-usb_control_prop
|
|
-usb_prop
|
|
-userdebug_or_eng_prop
|
|
-userspace_reboot_config_prop
|
|
-userspace_reboot_exported_prop
|
|
-userspace_reboot_log_prop
|
|
-userspace_reboot_test_prop
|
|
-vendor_socket_hook_prop
|
|
-vndk_prop
|
|
-vold_config_prop
|
|
-vold_prop
|
|
-vold_status_prop
|
|
-vts_config_prop
|
|
-vts_status_prop
|
|
-wifi_log_prop
|
|
-zygote_config_prop
|
|
-zygote_wrap_prop
|
|
-init_service_status_prop
|
|
}:file { getattr open read map };
|
|
|
|
# Allow finding services. This is different from ephemeral_app policy.
|
|
# Adding services manually to the allowlist is preferred hence app_api_service is not used.
|
|
|
|
allow sdk_sandbox activity_service:service_manager find;
|
|
allow sdk_sandbox activity_task_service:service_manager find;
|
|
allow sdk_sandbox appops_service:service_manager find;
|
|
allow sdk_sandbox audio_service:service_manager find;
|
|
allow sdk_sandbox audioserver_service:service_manager find;
|
|
allow sdk_sandbox batteryproperties_service:service_manager find;
|
|
allow sdk_sandbox batterystats_service:service_manager find;
|
|
allow sdk_sandbox connectivity_service:service_manager find;
|
|
allow sdk_sandbox connmetrics_service:service_manager find;
|
|
allow sdk_sandbox deviceidle_service:service_manager find;
|
|
allow sdk_sandbox display_service:service_manager find;
|
|
allow sdk_sandbox dropbox_service:service_manager find;
|
|
allow sdk_sandbox font_service:service_manager find;
|
|
allow sdk_sandbox game_service:service_manager find;
|
|
allow sdk_sandbox gpu_service:service_manager find;
|
|
allow sdk_sandbox graphicsstats_service:service_manager find;
|
|
allow sdk_sandbox hardware_properties_service:service_manager find;
|
|
allow sdk_sandbox hint_service:service_manager find;
|
|
allow sdk_sandbox imms_service:service_manager find;
|
|
allow sdk_sandbox input_method_service:service_manager find;
|
|
allow sdk_sandbox input_service:service_manager find;
|
|
allow sdk_sandbox IProxyService_service:service_manager find;
|
|
allow sdk_sandbox ipsec_service:service_manager find;
|
|
allow sdk_sandbox launcherapps_service:service_manager find;
|
|
allow sdk_sandbox legacy_permission_service:service_manager find;
|
|
allow sdk_sandbox light_service:service_manager find;
|
|
allow sdk_sandbox locale_service:service_manager find;
|
|
allow sdk_sandbox media_communication_service:service_manager find;
|
|
allow sdk_sandbox mediaextractor_service:service_manager find;
|
|
allow sdk_sandbox mediametrics_service:service_manager find;
|
|
allow sdk_sandbox media_projection_service:service_manager find;
|
|
allow sdk_sandbox media_router_service:service_manager find;
|
|
allow sdk_sandbox mediaserver_service:service_manager find;
|
|
allow sdk_sandbox media_session_service:service_manager find;
|
|
allow sdk_sandbox memtrackproxy_service:service_manager find;
|
|
allow sdk_sandbox midi_service:service_manager find;
|
|
allow sdk_sandbox netpolicy_service:service_manager find;
|
|
allow sdk_sandbox netstats_service:service_manager find;
|
|
allow sdk_sandbox network_management_service:service_manager find;
|
|
allow sdk_sandbox notification_service:service_manager find;
|
|
allow sdk_sandbox package_service:service_manager find;
|
|
allow sdk_sandbox permission_checker_service:service_manager find;
|
|
allow sdk_sandbox permission_service:service_manager find;
|
|
allow sdk_sandbox permissionmgr_service:service_manager find;
|
|
allow sdk_sandbox platform_compat_service:service_manager find;
|
|
allow sdk_sandbox power_service:service_manager find;
|
|
allow sdk_sandbox procstats_service:service_manager find;
|
|
allow sdk_sandbox registry_service:service_manager find;
|
|
allow sdk_sandbox restrictions_service:service_manager find;
|
|
allow sdk_sandbox rttmanager_service:service_manager find;
|
|
allow sdk_sandbox search_service:service_manager find;
|
|
allow sdk_sandbox selection_toolbar_service:service_manager find;
|
|
allow sdk_sandbox sensor_privacy_service:service_manager find;
|
|
allow sdk_sandbox sensorservice_service:service_manager find;
|
|
allow sdk_sandbox servicediscovery_service:service_manager find;
|
|
allow sdk_sandbox settings_service:service_manager find;
|
|
allow sdk_sandbox speech_recognition_service:service_manager find;
|
|
allow sdk_sandbox statusbar_service:service_manager find;
|
|
allow sdk_sandbox storagestats_service:service_manager find;
|
|
allow sdk_sandbox surfaceflinger_service:service_manager find;
|
|
allow sdk_sandbox telecom_service:service_manager find;
|
|
allow sdk_sandbox tethering_service:service_manager find;
|
|
allow sdk_sandbox textclassification_service:service_manager find;
|
|
allow sdk_sandbox textservices_service:service_manager find;
|
|
allow sdk_sandbox texttospeech_service:service_manager find;
|
|
allow sdk_sandbox thermal_service:service_manager find;
|
|
allow sdk_sandbox translation_service:service_manager find;
|
|
allow sdk_sandbox tv_iapp_service:service_manager find;
|
|
allow sdk_sandbox tv_input_service:service_manager find;
|
|
allow sdk_sandbox uimode_service:service_manager find;
|
|
allow sdk_sandbox vcn_management_service:service_manager find;
|
|
allow sdk_sandbox webviewupdate_service:service_manager find;
|
|
|
|
allow sdk_sandbox system_linker_exec:file execute_no_trans;
|
|
|
|
# Required to read CTS tests data from the shell_data_file location.
|
|
allow sdk_sandbox shell_data_file:file r_file_perms;
|
|
allow sdk_sandbox shell_data_file:dir r_dir_perms;
|
|
|
|
# allow sdk sandbox to use UDP sockets provided by the system server but not
|
|
# modify them other than to connect
|
|
allow sdk_sandbox system_server:udp_socket {
|
|
connect getattr read recvfrom sendto write getopt setopt };
|
|
|
|
# allow sandbox to search in sdk system server directory
|
|
# additionally, for webview to work, getattr has been permitted
|
|
allow sdk_sandbox sdk_sandbox_system_data_file:dir { getattr search };
|
|
# allow sandbox to create files and dirs in sdk data directory
|
|
allow sdk_sandbox sdk_sandbox_data_file:dir create_dir_perms;
|
|
allow sdk_sandbox sdk_sandbox_data_file:file create_file_perms;
|
|
|
|
###
|
|
### neverallow rules
|
|
###
|
|
|
|
neverallow sdk_sandbox { app_data_file privapp_data_file sdk_sandbox_data_file }:file { execute execute_no_trans };
|
|
|
|
# Receive or send uevent messages.
|
|
neverallow sdk_sandbox domain:netlink_kobject_uevent_socket *;
|
|
|
|
# Receive or send generic netlink messages
|
|
neverallow sdk_sandbox domain:netlink_socket *;
|
|
|
|
# Too much leaky information in debugfs. It's a security
|
|
# best practice to ensure these files aren't readable.
|
|
neverallow sdk_sandbox debugfs:file read;
|
|
|
|
# execute gpu_device
|
|
neverallow sdk_sandbox gpu_device:chr_file execute;
|
|
|
|
# access files in /sys with the default sysfs label
|
|
neverallow sdk_sandbox sysfs:file *;
|
|
|
|
# Avoid reads from generically labeled /proc files
|
|
# Create a more specific label if needed
|
|
neverallow sdk_sandbox proc:file { no_rw_file_perms no_x_file_perms };
|
|
|
|
# Directly access external storage
|
|
neverallow sdk_sandbox { sdcard_type media_rw_data_file }:file {open create};
|
|
neverallow sdk_sandbox { sdcard_type media_rw_data_file }:dir search;
|
|
|
|
# Avoid reads to proc_net, it contains too much device wide information about
|
|
# ongoing connections.
|
|
neverallow sdk_sandbox proc_net:file no_rw_file_perms;
|
|
|
|
# SDK sandbox processes have their own storage not related to app_data_file or privapp_data_file
|
|
neverallow sdk_sandbox { app_data_file privapp_data_file }:dir no_rw_file_perms;
|
|
neverallow sdk_sandbox { app_data_file privapp_data_file }:file no_rw_file_perms;
|
|
|
|
# SDK sandbox processes don't have any access to external storage
|
|
neverallow sdk_sandbox { media_rw_data_file }:dir no_rw_file_perms;
|
|
neverallow sdk_sandbox { media_rw_data_file }:file no_rw_file_perms;
|
|
|
|
neverallow { sdk_sandbox } tmpfs:dir no_rw_file_perms;
|
|
|
|
neverallow sdk_sandbox hal_drm_service:service_manager find;
|
|
|
|
# Only certain system components should have access to sdk_sandbox_system_data_file
|
|
# sdk_sandbox only needs search. Restricted in follow up neverallow rule.
|
|
neverallow {
|
|
domain
|
|
-init
|
|
-installd
|
|
-system_server
|
|
-vold_prepare_subdirs
|
|
} sdk_sandbox_system_data_file:dir { relabelfrom };
|
|
|
|
neverallow {
|
|
domain
|
|
-init
|
|
-installd
|
|
-sdk_sandbox
|
|
-system_server
|
|
-vold_prepare_subdirs
|
|
-zygote
|
|
} sdk_sandbox_system_data_file:dir { create_dir_perms relabelto };
|
|
|
|
# sdk_sandbox only needs to traverse through the sdk_sandbox_system_data_file
|
|
neverallow sdk_sandbox sdk_sandbox_system_data_file:dir ~{ getattr search };
|
|
|
|
# Only dirs should be created at sdk_sandbox_system_data_file level
|
|
neverallow { domain -init } sdk_sandbox_system_data_file:file *;
|