b2fecc3954
This is a reduced backport of aosp/2419280, as the full change adds
domain-wide allow rules as well as neverallows, and we want to avoid
conflicts against pre-existing TM vendor policies.
This backport is downscoped to:
* system_server.te: allow profiling system_server, runs as "system".
* system_app.te: allow profiling all other apps running as "system",
e.g. com.android.settings.
* platform_app.te: for platform-signed apps running in the normal app
UID range, e.g. com.android.systemui.
Merging logistics:
* AOSP and udc-dev have the full change, so prevent automerged conflicts
via Merged-In.
* api=33 sepolicy prebuilts are in a stacked patch as those should flow
into downstream branches, and afaiu will need to be CP'd to AOSP.
Bug: 272719059
Ignore-AOSP-First: tm-qpr-dev backport
Merged-In: I792ec1812d94b4fa9a8688ed74f2f62f6a7f33a6
Change-Id: I5de4a39b002baabad7ef9e5a21c10dc6d87295eb
198 lines
5.6 KiB
Text
198 lines
5.6 KiB
Text
###
|
|
### Apps that run with the system UID, e.g. com.android.system.ui,
|
|
### com.android.settings. These are not as privileged as the system
|
|
### server.
|
|
###
|
|
|
|
typeattribute system_app coredomain, mlstrustedsubject;
|
|
|
|
app_domain(system_app)
|
|
net_domain(system_app)
|
|
binder_service(system_app)
|
|
|
|
# android.ui and system.ui
|
|
allow system_app rootfs:dir getattr;
|
|
|
|
# Read and write /data/data subdirectory.
|
|
allow system_app system_app_data_file:dir create_dir_perms;
|
|
allow system_app system_app_data_file:{ file lnk_file } create_file_perms;
|
|
|
|
# Read and write to /data/misc/user.
|
|
allow system_app misc_user_data_file:dir create_dir_perms;
|
|
allow system_app misc_user_data_file:file create_file_perms;
|
|
|
|
# Access to apex files stored on /data (b/136063500)
|
|
# Needed so that Settings can access NOTICE files inside apex
|
|
# files located in the assets/ directory.
|
|
allow system_app apex_data_file:dir search;
|
|
allow system_app staging_data_file:file r_file_perms;
|
|
|
|
# Read wallpaper file.
|
|
allow system_app wallpaper_file:file r_file_perms;
|
|
|
|
# Read icon file.
|
|
allow system_app icon_file:file r_file_perms;
|
|
|
|
# Write to properties
|
|
set_prop(system_app, adaptive_haptics_prop)
|
|
set_prop(system_app, arm64_memtag_prop)
|
|
set_prop(system_app, bluetooth_a2dp_offload_prop)
|
|
set_prop(system_app, bluetooth_audio_hal_prop)
|
|
set_prop(system_app, bluetooth_prop)
|
|
set_prop(system_app, debug_prop)
|
|
set_prop(system_app, system_prop)
|
|
set_prop(system_app, exported_bluetooth_prop)
|
|
set_prop(system_app, exported_system_prop)
|
|
set_prop(system_app, exported3_system_prop)
|
|
set_prop(system_app, gesture_prop)
|
|
set_prop(system_app, locale_prop)
|
|
set_prop(system_app, logd_prop)
|
|
set_prop(system_app, net_radio_prop)
|
|
set_prop(system_app, timezone_prop)
|
|
set_prop(system_app, usb_control_prop)
|
|
set_prop(system_app, usb_prop)
|
|
set_prop(system_app, log_tag_prop)
|
|
userdebug_or_eng(`set_prop(system_app, logpersistd_logging_prop)')
|
|
auditallow system_app net_radio_prop:property_service set;
|
|
auditallow system_app usb_control_prop:property_service set;
|
|
auditallow system_app usb_prop:property_service set;
|
|
# Allow Settings to enable Dynamic System Update
|
|
set_prop(system_app, dynamic_system_prop)
|
|
|
|
# ctl interface
|
|
set_prop(system_app, ctl_default_prop)
|
|
set_prop(system_app, ctl_bugreport_prop)
|
|
|
|
# Allow developer settings to query gsid status
|
|
get_prop(system_app, gsid_prop)
|
|
|
|
# Create /data/anr/traces.txt.
|
|
allow system_app anr_data_file:dir ra_dir_perms;
|
|
allow system_app anr_data_file:file create_file_perms;
|
|
|
|
# Settings need to access app name and icon from asec
|
|
allow system_app asec_apk_file:file r_file_perms;
|
|
|
|
# Allow system apps (like Settings) to interact with statsd
|
|
binder_call(system_app, statsd)
|
|
|
|
# Allow system apps to interact with incidentd
|
|
binder_call(system_app, incidentd)
|
|
|
|
# Allow system app to interact with Dumpstate HAL
|
|
hal_client_domain(system_app, hal_dumpstate)
|
|
|
|
allow system_app servicemanager:service_manager list;
|
|
# TODO: scope this down? Too broad?
|
|
allow system_app {
|
|
service_manager_type
|
|
-apex_service
|
|
-dnsresolver_service
|
|
-dumpstate_service
|
|
-installd_service
|
|
-lpdump_service
|
|
-mdns_service
|
|
-netd_service
|
|
-system_suspend_control_internal_service
|
|
-system_suspend_control_service
|
|
-tracingproxy_service
|
|
-virtual_touchpad_service
|
|
-vold_service
|
|
-default_android_service
|
|
}:service_manager find;
|
|
# suppress denials for services system_app should not be accessing.
|
|
dontaudit system_app {
|
|
dnsresolver_service
|
|
dumpstate_service
|
|
installd_service
|
|
mdns_service
|
|
netd_service
|
|
virtual_touchpad_service
|
|
vold_service
|
|
}:service_manager find;
|
|
|
|
# suppress denials caused by debugfs_tracing
|
|
dontaudit system_app debugfs_tracing:file rw_file_perms;
|
|
|
|
# Ignore access to zram when Debug.getMemInfo is called.
|
|
dontaudit system_app sysfs_zram:dir search;
|
|
|
|
allow system_app keystore:keystore_key {
|
|
get_state
|
|
get
|
|
insert
|
|
delete
|
|
exist
|
|
list
|
|
reset
|
|
password
|
|
lock
|
|
unlock
|
|
is_empty
|
|
sign
|
|
verify
|
|
grant
|
|
duplicate
|
|
clear_uid
|
|
user_changed
|
|
};
|
|
|
|
allow system_app keystore:keystore2_key {
|
|
delete
|
|
get_info
|
|
grant
|
|
rebind
|
|
update
|
|
use
|
|
};
|
|
|
|
# Allow Settings to manage WI-FI keys.
|
|
allow system_app wifi_key:keystore2_key {
|
|
delete
|
|
get_info
|
|
rebind
|
|
update
|
|
use
|
|
};
|
|
|
|
# settings app reads /proc/version
|
|
allow system_app {
|
|
proc_version
|
|
}:file r_file_perms;
|
|
|
|
# Settings app writes to /dev/stune/foreground/tasks.
|
|
allow system_app cgroup:file w_file_perms;
|
|
allow system_app cgroup_v2:file w_file_perms;
|
|
allow system_app cgroup_v2:dir w_dir_perms;
|
|
|
|
control_logd(system_app)
|
|
read_runtime_log_tags(system_app)
|
|
get_prop(system_app, device_logging_prop)
|
|
|
|
# allow system apps to use UDP sockets provided by the system server but not
|
|
# modify them other than to connect
|
|
allow system_app system_server:udp_socket {
|
|
connect getattr read recvfrom sendto write getopt setopt };
|
|
|
|
# Settings app reads ro.oem_unlock_supported
|
|
get_prop(system_app, oem_unlock_prop)
|
|
|
|
# Settings app reads ro.usb.uvc.enabled
|
|
get_prop(system_app, usb_uvc_enabled_prop)
|
|
|
|
###
|
|
### Neverallow rules
|
|
###
|
|
|
|
# app domains which access /dev/fuse should not run as system_app
|
|
neverallow system_app fuse_device:chr_file *;
|
|
|
|
# Apps which run as UID=system should not rely on any attacker controlled
|
|
# filesystem locations, such as /data/local/tmp. For /data/local/tmp, we
|
|
# allow writes to files passed by file descriptor to support dumpstate and
|
|
# bug reports, but not reads.
|
|
neverallow system_app shell_data_file:dir { no_w_dir_perms open search read };
|
|
neverallow system_app shell_data_file:file { open read ioctl lock };
|
|
|
|
# system_app should be the only domain writing the adaptive haptics prop
|
|
neverallow { domain -init -system_app } adaptive_haptics_prop:property_service set;
|