1748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich###
2748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### Domain for all zygote spawned apps
3748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich###
4748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### This file is the base policy for all zygote spawned apps.
5748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### Other policy files, such as isolated_app.te, untrusted_app.te, etc
6748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### extend from this policy. Only policies which should apply to ALL
7748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### zygote spawned apps should be added here.
8748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich###
9748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich
10ad7df7bb76ce00cdef711ad1f96a9a7243981f4eStephen Smalley# Dalvik Compiler JIT Mapping.
11ad7df7bb76ce00cdef711ad1f96a9a7243981f4eStephen Smalleyallow appdomain self:process execmem;
12e7ec2f5258550a2cc0cb8c76ef24fc100a6b2cf1Stephen Smalleyallow appdomain ashmem_device:chr_file execute;
13ad7df7bb76ce00cdef711ad1f96a9a7243981f4eStephen Smalley
146634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Receive and use open file descriptors inherited from zygote.
156634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain zygote:fd use;
166634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich
1748759ca2054fa742724cd81debed51208b69e758Stephen Smalley# gdbserver for ndk-gdb reads the zygote.
184fce0ef97c2a4cb6e0ce2adf17c012c8be6252bfNick Kralevich# valgrind needs mmap exec for zygote
194fce0ef97c2a4cb6e0ce2adf17c012c8be6252bfNick Kralevichallow appdomain zygote_exec:file rx_file_perms;
2048759ca2054fa742724cd81debed51208b69e758Stephen Smalley
2148759ca2054fa742724cd81debed51208b69e758Stephen Smalley# gdbserver for ndk-gdb ptrace attaches to app process.
2248759ca2054fa742724cd81debed51208b69e758Stephen Smalleyallow appdomain self:process ptrace;
2348759ca2054fa742724cd81debed51208b69e758Stephen Smalley
246634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Read system properties managed by zygote.
256634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain zygote_tmpfs:file read;
266634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich
276634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Notify zygote of death;
286634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain zygote:process sigchld;
296634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich
3048759ca2054fa742724cd81debed51208b69e758Stephen Smalley# Notify shell and adbd of death when spawned via runas for ndk-gdb.
3148759ca2054fa742724cd81debed51208b69e758Stephen Smalleyallow appdomain shell:process sigchld;
3248759ca2054fa742724cd81debed51208b69e758Stephen Smalleyallow appdomain adbd:process sigchld;
3348759ca2054fa742724cd81debed51208b69e758Stephen Smalley
3448759ca2054fa742724cd81debed51208b69e758Stephen Smalley# child shell or gdbserver pty access for runas.
3548759ca2054fa742724cd81debed51208b69e758Stephen Smalleyallow appdomain devpts:chr_file { getattr read write ioctl };
3648759ca2054fa742724cd81debed51208b69e758Stephen Smalley
373dad7b611a448fa43a678ff760c23a00f387947eStephen Smalley# Use pipes and sockets provided by system_server via binder or local socket.
381fdee11df2552e29da0c48e3432f26f7a93e3bffAlex Klyubinallow appdomain system_server:fifo_file rw_file_perms;
393dad7b611a448fa43a678ff760c23a00f387947eStephen Smalleyallow appdomain system_server:unix_stream_socket { read write setopt getattr getopt shutdown };
403dad7b611a448fa43a678ff760c23a00f387947eStephen Smalleyallow appdomain system_server:tcp_socket { read write getattr getopt shutdown };
416634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich
4282fc3b524164588388aa3595bd2158020d93d28aNick Kralevich# Communication with other apps via fifos
4382fc3b524164588388aa3595bd2158020d93d28aNick Kralevichallow appdomain appdomain:fifo_file rw_file_perms;
4482fc3b524164588388aa3595bd2158020d93d28aNick Kralevich
456634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Communicate with surfaceflinger.
46b0db712bf048dc634363b658a647b1f1897d8433Stephen Smalleyallow appdomain surfaceflinger:unix_stream_socket { read write setopt getattr getopt shutdown };
476634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich
486634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# App sandbox file accesses.
496634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain app_data_file:dir create_dir_perms;
5065317124a0bb7db4829f78e74c7bfe18e27f1c43Stephen Smalleyallow appdomain app_data_file:notdevfile_class_set create_file_perms;
516634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich
526634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# lib subdirectory of /data/data dir is system-owned.
536634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain system_data_file:dir r_dir_perms;
5478706f9ef6d917fe2ec85ecb6b0f47fbc5efde57Nick Kralevichallow appdomain system_data_file:file { execute execute_no_trans open execmod };
556634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich
5651bfecf49d50982f64aba1fa73bbbdd2e40a444fRobin Lee# Keychain and user-trusted credentials
5751bfecf49d50982f64aba1fa73bbbdd2e40a444fRobin Leeallow appdomain keychain_data_file:dir r_dir_perms;
5851bfecf49d50982f64aba1fa73bbbdd2e40a444fRobin Leeallow appdomain keychain_data_file:file r_file_perms;
5951bfecf49d50982f64aba1fa73bbbdd2e40a444fRobin Leeallow appdomain misc_user_data_file:dir r_dir_perms;
6051bfecf49d50982f64aba1fa73bbbdd2e40a444fRobin Leeallow appdomain misc_user_data_file:file r_file_perms;
6151bfecf49d50982f64aba1fa73bbbdd2e40a444fRobin Lee
626736bac21870bdc8bb6098ddffdb70103f7bc2a3Jeff Sharkey# Access to OEM provided data and apps
636736bac21870bdc8bb6098ddffdb70103f7bc2a3Jeff Sharkeyallow appdomain oemfs:dir r_dir_perms;
646736bac21870bdc8bb6098ddffdb70103f7bc2a3Jeff Sharkeyallow appdomain oemfs:file rx_file_perms;
656736bac21870bdc8bb6098ddffdb70103f7bc2a3Jeff Sharkey
666634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Execute the shell or other system executables.
676634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain shell_exec:file rx_file_perms;
686634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain system_file:file rx_file_perms;
696634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich
708ee37b4f1c58e1dcd00b198a9bbfeafb4221fdc9Ed Heyl# Execute dex2oat when apps call dexclassloader
718ee37b4f1c58e1dcd00b198a9bbfeafb4221fdc9Ed Heylallow appdomain dex2oat_exec:file rx_file_perms;
728ee37b4f1c58e1dcd00b198a9bbfeafb4221fdc9Ed Heyl
736634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Read/write wallpaper file (opened by system).
74fc4c6b798a0c8ff38b4b943209ba1653a0276dfaRobert Craigallow appdomain wallpaper_file:file { getattr read write };
756634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich
766634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Write to /data/anr/traces.txt.
776634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain anr_data_file:dir search;
786634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain anr_data_file:file { open append };
796634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich
8009e6abd91b3aaaa11a44d032e095360c64a97b3aNick Kralevich# Allow apps to send dump information to dumpstate
8109e6abd91b3aaaa11a44d032e095360c64a97b3aNick Kralevichallow appdomain dumpstate:fd use;
82b0db712bf048dc634363b658a647b1f1897d8433Stephen Smalleyallow appdomain dumpstate:unix_stream_socket { read write getopt getattr shutdown };
832e7a301fad5b6065e2d364170a80bc58bc41aab0Nick Kralevichallow appdomain shell_data_file:file { write getattr };
8409e6abd91b3aaaa11a44d032e095360c64a97b3aNick Kralevich
856634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Write to /proc/net/xt_qtaguid/ctrl file.
866634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain qtaguid_proc:file rw_file_perms;
876634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Everybody can read the xt_qtaguid resource tracking misc dev.
886634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# So allow all apps to read from /dev/xt_qtaguid.
896634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain qtaguid_device:chr_file r_file_perms;
906634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich
913ba9012535d8412d94db4ae9a5ce928b806e26d8Stephen Smalley# Grant GPU access to all processes started by Zygote.
923ba9012535d8412d94db4ae9a5ce928b806e26d8Stephen Smalley# They need that to render the standard UI.
937ef348b1bac77418862f7c22ecefb51ec3517808Nick Kralevichallow appdomain gpu_device:chr_file { rw_file_perms execute };
943ba9012535d8412d94db4ae9a5ce928b806e26d8Stephen Smalley
956634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Use the Binder.
966634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichbinder_use(appdomain)
976634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Perform binder IPC to binder services.
986634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichbinder_call(appdomain, binderservicedomain)
996634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Perform binder IPC to other apps.
1006634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichbinder_call(appdomain, appdomain)
1016634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich
1026634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Already connected, unnamed sockets being passed over some other IPC
1036634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# hence no sock_file or connectto permission. This appears to be how
1046634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Chrome works, may need to be updated as more apps using isolated services
1056634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# are examined.
106b0db712bf048dc634363b658a647b1f1897d8433Stephen Smalleyallow appdomain appdomain:unix_stream_socket { getopt getattr read write shutdown };
1076634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich
1086634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Backup ability for every app. BMS opens and passes the fd
1096634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# to any app that has backup ability. Hence, no open permissions here.
11081560733a47633036133ce548bf638bc3d91f5cfGeremy Condraallow appdomain backup_data_file:file { read write getattr };
11181560733a47633036133ce548bf638bc3d91f5cfGeremy Condraallow appdomain cache_backup_file:file { read write getattr };
1129ba844fea12a0b08770e870d63f3d3c375c7c9b5Stephen Smalleyallow appdomain cache_backup_file:dir getattr;
1136634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Backup ability using 'adb backup'
1146634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain system_data_file:lnk_file getattr;
1156634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich
1162737ceff233a32be67ebc6e3dba6e80b8df6df0aStephen Smalley# Allow read/stat of /data/media files passed by Binder or local socket IPC.
1172737ceff233a32be67ebc6e3dba6e80b8df6df0aStephen Smalleyallow appdomain media_rw_data_file:file { read getattr };
1182737ceff233a32be67ebc6e3dba6e80b8df6df0aStephen Smalley
1191545b6061518bac473cf93af576cbea12a992298Nick Kralevich# Read and write /data/data/com.android.providers.telephony files passed over Binder.
1201545b6061518bac473cf93af576cbea12a992298Nick Kralevichallow appdomain radio_data_file:file { read write getattr };
1213fbc536dfd5afbce5ef45f18d0afb3516089ed88Stephen Smalley
12291a4f8d4fdab7df8474c2ffaa996c879166d8a4cStephen Smalley# Read and write system app data files passed over Binder.
12391a4f8d4fdab7df8474c2ffaa996c879166d8a4cStephen Smalley# Motivating case was /data/data/com.android.settings/cache/*.jpg for
12491a4f8d4fdab7df8474c2ffaa996c879166d8a4cStephen Smalley# cropping or taking user photos.
12591a4f8d4fdab7df8474c2ffaa996c879166d8a4cStephen Smalleyallow untrusted_app system_app_data_file:file { read write getattr };
12691a4f8d4fdab7df8474c2ffaa996c879166d8a4cStephen Smalley
127cf610692252b4df30b42f2bce3de464ac1804f97Stephen Smalley# Access SDcard via the fuse mount.
128e9c90bddcea8d3d466fbc34361a7feea3eea4ad3Ed Heylallow appdomain fuse:dir create_dir_perms;
129e9c90bddcea8d3d466fbc34361a7feea3eea4ad3Ed Heylallow appdomain fuse:file create_file_perms;
130b0db712bf048dc634363b658a647b1f1897d8433Stephen Smalley
13162083414a4cc2b9fd7eb22c3bc4ffa4d9285d4beNick Kralevich# Access OBBs (vfat images) mounted by vold (b/17633509)
13262083414a4cc2b9fd7eb22c3bc4ffa4d9285d4beNick Kralevichallow appdomain vfat:dir r_dir_perms;
13362083414a4cc2b9fd7eb22c3bc4ffa4d9285d4beNick Kralevichallow appdomain vfat:file r_file_perms;
13462083414a4cc2b9fd7eb22c3bc4ffa4d9285d4beNick Kralevich
1350b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich# Allow apps to use the USB Accessory interface.
1360b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich# http://developer.android.com/guide/topics/connectivity/usb/accessory.html
1370b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich#
1380b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich# USB devices are first opened by the system server (USBDeviceManagerService)
1390b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich# and the file descriptor is passed to the right Activity via binder.
1400b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevichallow appdomain usb_device:chr_file { read write getattr ioctl };
1410b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevichallow appdomain usbaccessory_device:chr_file { read write getattr };
1420b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich
143527316a21b80c2a70d8ed23351299a4dce0c77bfStephen Smalley# For art.
144527316a21b80c2a70d8ed23351299a4dce0c77bfStephen Smalleyallow appdomain dalvikcache_data_file:file execute;
1456f201ddc79f5badfbe0e0a6c5d9d9c4a94f4e8a4Jeff Haoallow appdomain dalvikcache_data_file:lnk_file r_file_perms;
146527316a21b80c2a70d8ed23351299a4dce0c77bfStephen Smalley
14719c509034ee309c60c958637841c151d3c273421Stephen Smalley# /data/dalvik-cache/profiles
148867030517724036b64fcaf39deaba1b27f3ca77eNick Kralevichallow appdomain dalvikcache_profiles_data_file:dir { search getattr };
149867030517724036b64fcaf39deaba1b27f3ca77eNick Kralevichallow appdomain dalvikcache_profiles_data_file:file rw_file_perms;
15019c509034ee309c60c958637841c151d3c273421Stephen Smalley
1519786af2bcaaf0ba25c0a50c81c748a05793ec847Torne (Richard Coles)# Allow any app to read shared RELRO files.
1529786af2bcaaf0ba25c0a50c81c748a05793ec847Torne (Richard Coles)allow appdomain shared_relro_file:dir search;
1539786af2bcaaf0ba25c0a50c81c748a05793ec847Torne (Richard Coles)allow appdomain shared_relro_file:file r_file_perms;
1549786af2bcaaf0ba25c0a50c81c748a05793ec847Torne (Richard Coles)
1556f6c425563f4faa4e1e12bf430c32d0b81a78f64Christopher Tate# Allow apps to read/execute installed binaries
156711895db2897bc5d001899eb5e0f931c79a1ad3fdcashmanallow appdomain apk_data_file:dir r_dir_perms;
1576f6c425563f4faa4e1e12bf430c32d0b81a78f64Christopher Tateallow appdomain apk_data_file:file { rx_file_perms execmod };
1586f6c425563f4faa4e1e12bf430c32d0b81a78f64Christopher Tate
159fad4d5fb00ddb1f61c22c003429e10f10b046d0dNick Kralevich# /data/resource-cache
160fad4d5fb00ddb1f61c22c003429e10f10b046d0dNick Kralevichallow appdomain resourcecache_data_file:file r_file_perms;
161fad4d5fb00ddb1f61c22c003429e10f10b046d0dNick Kralevichallow appdomain resourcecache_data_file:dir r_dir_perms;
162fad4d5fb00ddb1f61c22c003429e10f10b046d0dNick Kralevich
1636634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich###
164594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley### CTS-specific rules
165594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley###
166594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley
167594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# For cts/tools/device-setup/TestDeviceSetup/src/android/tests/getinfo/RootProcessScanner.java.
168594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# Reads /proc/pid/status and statm entries to check that
169594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# no unexpected root processes are running.
170594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# Also for cts/tests/tests/security/src/android/security/cts/VoldExploitTest.java
171594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# Reads /proc/pid/cmdline of vold.
172594693705f0d5768db3c3212037da5fd5d5653beStephen Smalleyallow appdomain domain:dir { open read search getattr };
173594693705f0d5768db3c3212037da5fd5d5653beStephen Smalleyallow appdomain domain:{ file lnk_file } { open read getattr };
174594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley
175594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# For cts/tests/tests/permission/src/android/permission/cts/FileSystemPermissionTest.java.
176594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# testRunAsHasCorrectCapabilities
177594693705f0d5768db3c3212037da5fd5d5653beStephen Smalleyallow appdomain runas_exec:file getattr;
178594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# Others are either allowed elsewhere or not desired.
179594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley
180594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# For cts/tests/tests/security/src/android/security/cts/SELinuxTest.java
181594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# Check SELinux policy and contexts.
182594693705f0d5768db3c3212037da5fd5d5653beStephen Smalleyselinux_check_access(appdomain)
183594693705f0d5768db3c3212037da5fd5d5653beStephen Smalleyselinux_check_context(appdomain)
184594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# Validate that each process is running in the correct security context.
185594693705f0d5768db3c3212037da5fd5d5653beStephen Smalleyallow appdomain domain:process getattr;
186594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley
1878ed750e9731e6e3a21785e91e9b1cf7390c16738Mark Salyzyn# logd access
1888ed750e9731e6e3a21785e91e9b1cf7390c16738Mark Salyzynread_logd(appdomain)
189bcdff890304e694c09bf0a4a90fb76a82434fa57Mark Salyzyncontrol_logd(appdomain)
1908ed750e9731e6e3a21785e91e9b1cf7390c16738Mark Salyzyn# application inherit logd write socket (urge is to deprecate this long term)
1918ed750e9731e6e3a21785e91e9b1cf7390c16738Mark Salyzynallow appdomain zygote:unix_dgram_socket write;
1928ed750e9731e6e3a21785e91e9b1cf7390c16738Mark Salyzyn
1931196d2a5763c9a99be99ba81a4a29d938a83cc06Riley Spahnallow appdomain keystore:keystore_key { test get insert delete exist saw sign verify };
1941196d2a5763c9a99be99ba81a4a29d938a83cc06Riley Spahn
1951196d2a5763c9a99be99ba81a4a29d938a83cc06Riley Spahnuse_keystore(appdomain)
1961196d2a5763c9a99be99ba81a4a29d938a83cc06Riley Spahn
197594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley###
1986634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich### Neverallow rules
1996634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich###
2006634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich### These are things that Android apps should NEVER be able to do
2016634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich###
2026634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich
2036634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Superuser capabilities.
20477eb35263f40607e36fdcd85d95050a4ecedb6b8Sharvil Nanavati# bluetooth requires net_admin and wake_alarm.
205be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -bluetooth } self:capability *;
206be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -bluetooth } self:capability2 *;
2076634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich
2086634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Block device access.
209be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain dev_type:blk_file { read write };
2106634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich
2112a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Access to any of the following character devices.
212be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain {
2132a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    audio_device
2142a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    camera_device
2152a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    dm_device
2162a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    radio_device
2172a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    gps_device
2182a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    rpmsg_device
2192a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley}:chr_file { read write };
2202a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley
2212a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Note: Try expanding list of app domains in the future.
222be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { untrusted_app isolated_app shell } graphics_device:chr_file { read write };
2232a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley
224be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -nfc } nfc_device:chr_file
2252a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    { read write };
226be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -bluetooth } hci_attach_dev:chr_file
2272a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    { read write };
228be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain tee_device:chr_file { read write };
2292a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley
2306634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Privileged netlink socket interfaces.
231be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain
232bf626ce94452813e44433c40fb3d80f8b4b00ff5Nick Kralevich    domain:{
2336634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich        netlink_firewall_socket
2346634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich        netlink_tcpdiag_socket
2356634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich        netlink_nflog_socket
2366634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich        netlink_xfrm_socket
2376634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich        netlink_audit_socket
2386634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich        netlink_ip6fw_socket
2396634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich        netlink_dnrt_socket
2406634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich    } *;
2416634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich
24236fb1f1bf3fa29a639e4c9d793b36cbbceae2ec7Nick Kralevich# These messages are broadcast messages from the kernel to userspace.
24336fb1f1bf3fa29a639e4c9d793b36cbbceae2ec7Nick Kralevich# Do not allow the writing of netlink messages, which has been a source
24436fb1f1bf3fa29a639e4c9d793b36cbbceae2ec7Nick Kralevich# of rooting vulns in the past.
245bf626ce94452813e44433c40fb3d80f8b4b00ff5Nick Kralevichneverallow appdomain domain:netlink_kobject_uevent_socket { write append };
24636fb1f1bf3fa29a639e4c9d793b36cbbceae2ec7Nick Kralevich
2472a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Sockets under /dev/socket that are not specifically typed.
248be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain socket_device:sock_file write;
2492a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley
2502a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Unix domain sockets.
251be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain adbd_socket:sock_file write;
252be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain installd_socket:sock_file write;
25305383ebfb439bed8436912ed28db550e8842b343Martijn Coenenneverallow { appdomain -bluetooth -radio -shell -system_app -nfc }
2542a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    property_socket:sock_file write;
255be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -radio } rild_socket:sock_file write;
256be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain vold_socket:sock_file write;
257be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain zygote_socket:sock_file write;
2582a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley
2596634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# ptrace access to non-app domains.
260be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain { domain -appdomain }:process ptrace;
2616634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich
2622a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Write access to /proc/pid entries for any non-app domain.
263be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain { domain -appdomain }:file write;
2642a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley
2652a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# signal access to non-app domains.
2662a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# sigchld allowed for parent death notification.
2672a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# signull allowed for kill(pid, 0) existence test.
2682a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# All others prohibited.
269be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain { domain -appdomain }:process
2702a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    { sigkill sigstop signal };
2712a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley
2726634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Transition to a non-app domain.
273396015c3952bcbd5678dc20d5e5e4407cf6a4d4aStephen Smalley# Exception for the shell domain, can transition to runas, etc.
274d990a78f8ef398488d6c0ce0a2d18b3d3a5183c4Stephen Smalleyneverallow { appdomain -shell } { domain -appdomain }:process
2752a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    { transition dyntransition };
2762a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley
2772a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Write to rootfs.
278be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain rootfs:dir_file_class_set
2792a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    { create write setattr relabelfrom relabelto append unlink link rename };
2806634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich
2816634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Write to /system.
282be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain system_file:dir_file_class_set
2832a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    { create write setattr relabelfrom relabelto append unlink link rename };
2842a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley
2852a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Write to entrypoint executables.
286be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain exec_type:file
2872a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    { create write setattr relabelfrom relabelto append unlink link rename };
2886634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich
2896634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Write to system-owned parts of /data.
2906634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# This is the default type for anything under /data not otherwise
2916634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# specified in file_contexts.  Define a different type for portions
2926634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# that should be writable by apps.
2936634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Exception for system_app for Settings.
294be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -system_app }
2952a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    system_data_file:dir_file_class_set
2962a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    { create write setattr relabelfrom relabelto append unlink link rename };
2972a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley
2982a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Write to various other parts of /data.
299be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain drm_data_file:dir_file_class_set
3002a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    { create write setattr relabelfrom relabelto append unlink link rename };
301480374e4d082238a71773f29483c5d24ad8b3f6dNick Kralevichneverallow { appdomain -system_app }
302480374e4d082238a71773f29483c5d24ad8b3f6dNick Kralevich    gps_data_file:dir_file_class_set
3032a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    { create write setattr relabelfrom relabelto append unlink link rename };
304be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -platform_app }
3052a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    apk_data_file:dir_file_class_set
3062a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    { create write setattr relabelfrom relabelto append unlink link rename };
307be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -platform_app }
3082a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    apk_tmp_file:dir_file_class_set
3092a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    { create write setattr relabelfrom relabelto append unlink link rename };
310be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -platform_app }
3112a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    apk_private_data_file:dir_file_class_set
3122a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    { create write setattr relabelfrom relabelto append unlink link rename };
313be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -platform_app }
3142a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    apk_private_tmp_file:dir_file_class_set
3152a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    { create write setattr relabelfrom relabelto append unlink link rename };
316be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -shell }
3172a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    shell_data_file:dir_file_class_set
3182e7a301fad5b6065e2d364170a80bc58bc41aab0Nick Kralevich    { create setattr relabelfrom relabelto append unlink link rename };
319be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -bluetooth }
3202a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    bluetooth_data_file:dir_file_class_set
3212a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    { create write setattr relabelfrom relabelto append unlink link rename };
322be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain
3232a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    keystore_data_file:dir_file_class_set
3242a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    { create write setattr relabelfrom relabelto append unlink link rename };
325be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain
3262a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    systemkeys_data_file:dir_file_class_set
3272a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    { create write setattr relabelfrom relabelto append unlink link rename };
328be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain
3292a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    wifi_data_file:dir_file_class_set
3302a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    { create write setattr relabelfrom relabelto append unlink link rename };
331be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain
3322a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    dhcp_data_file:dir_file_class_set
3332a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    { create write setattr relabelfrom relabelto append unlink link rename };
3342a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley
3352a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Access to factory files.
336a8b651bfba433ab91b565fea5276ceb7743ad15aNick Kralevichneverallow appdomain efs_file:dir_file_class_set write;
337a8b651bfba433ab91b565fea5276ceb7743ad15aNick Kralevichneverallow { appdomain -shell } efs_file:dir_file_class_set read;
3382a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley
3392a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Write to various pseudo file systems.
340be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -bluetooth -nfc }
3412a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    sysfs:dir_file_class_set write;
342be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain
3432a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    proc:dir_file_class_set write;
3442a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley
3452a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Access to syslog(2) or /proc/kmsg.
346685e2f9d9c0d3f64e9eabb789adb0b34f5f11836Nick Kralevichneverallow { appdomain -system_app }
347f821b5a7977102a417b32f358bf87d1e0cdeb06dNick Kralevich    kernel:system { syslog_mod syslog_console };
34842fb824ca9f3e46b4419f05083f2694ac67a8229Stephen Smalleyneverallow { appdomain -system_app -shell }
349f821b5a7977102a417b32f358bf87d1e0cdeb06dNick Kralevich    kernel:system syslog_read;
3502a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley
3512a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Ability to perform any filesystem operation other than statfs(2).
3522a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# i.e. no mount(2), unmount(2), etc.
353be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain fs_type:filesystem ~getattr;
3542a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley
3552a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Ability to set system properties.
35605383ebfb439bed8436912ed28db550e8842b343Martijn Coenenneverallow { appdomain -system_app -radio -shell -bluetooth -nfc }
3572a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley    property_type:property_service set;
358