app.te revision 19c509034ee309c60c958637841c151d3c273421
1748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### 2748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### Domain for all zygote spawned apps 3748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### 4748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### This file is the base policy for all zygote spawned apps. 5748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### Other policy files, such as isolated_app.te, untrusted_app.te, etc 6748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### extend from this policy. Only policies which should apply to ALL 7748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### zygote spawned apps should be added here. 8748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### 9748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich 10ad7df7bb76ce00cdef711ad1f96a9a7243981f4eStephen Smalley# Dalvik Compiler JIT Mapping. 11ad7df7bb76ce00cdef711ad1f96a9a7243981f4eStephen Smalleyallow appdomain self:process execmem; 12e7ec2f5258550a2cc0cb8c76ef24fc100a6b2cf1Stephen Smalleyallow appdomain ashmem_device:chr_file execute; 13ad7df7bb76ce00cdef711ad1f96a9a7243981f4eStephen Smalley 146634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Receive and use open file descriptors inherited from zygote. 156634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain zygote:fd use; 166634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1748759ca2054fa742724cd81debed51208b69e758Stephen Smalley# gdbserver for ndk-gdb reads the zygote. 1848759ca2054fa742724cd81debed51208b69e758Stephen Smalleyallow appdomain zygote_exec:file r_file_perms; 1948759ca2054fa742724cd81debed51208b69e758Stephen Smalley 2048759ca2054fa742724cd81debed51208b69e758Stephen Smalley# gdbserver for ndk-gdb ptrace attaches to app process. 2148759ca2054fa742724cd81debed51208b69e758Stephen Smalleyallow appdomain self:process ptrace; 2248759ca2054fa742724cd81debed51208b69e758Stephen Smalley 236634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Read system properties managed by zygote. 246634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain zygote_tmpfs:file read; 256634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 266634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Notify zygote of death; 276634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain zygote:process sigchld; 286634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 2948759ca2054fa742724cd81debed51208b69e758Stephen Smalley# Notify shell and adbd of death when spawned via runas for ndk-gdb. 3048759ca2054fa742724cd81debed51208b69e758Stephen Smalleyallow appdomain shell:process sigchld; 3148759ca2054fa742724cd81debed51208b69e758Stephen Smalleyallow appdomain adbd:process sigchld; 3248759ca2054fa742724cd81debed51208b69e758Stephen Smalley 3348759ca2054fa742724cd81debed51208b69e758Stephen Smalley# child shell or gdbserver pty access for runas. 3448759ca2054fa742724cd81debed51208b69e758Stephen Smalleyallow appdomain devpts:chr_file { getattr read write ioctl }; 3548759ca2054fa742724cd81debed51208b69e758Stephen Smalley 363dad7b611a448fa43a678ff760c23a00f387947eStephen Smalley# Use pipes and sockets provided by system_server via binder or local socket. 371fdee11df2552e29da0c48e3432f26f7a93e3bffAlex Klyubinallow appdomain system_server:fifo_file rw_file_perms; 383dad7b611a448fa43a678ff760c23a00f387947eStephen Smalleyallow appdomain system_server:unix_stream_socket { read write setopt getattr getopt shutdown }; 393dad7b611a448fa43a678ff760c23a00f387947eStephen Smalleyallow appdomain system_server:tcp_socket { read write getattr getopt shutdown }; 406634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 4182fc3b524164588388aa3595bd2158020d93d28aNick Kralevich# Communication with other apps via fifos 4282fc3b524164588388aa3595bd2158020d93d28aNick Kralevichallow appdomain appdomain:fifo_file rw_file_perms; 4382fc3b524164588388aa3595bd2158020d93d28aNick Kralevich 446634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Communicate with surfaceflinger. 45b0db712bf048dc634363b658a647b1f1897d8433Stephen Smalleyallow appdomain surfaceflinger:unix_stream_socket { read write setopt getattr getopt shutdown }; 466634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 476634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# App sandbox file accesses. 486634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain app_data_file:dir create_dir_perms; 4965317124a0bb7db4829f78e74c7bfe18e27f1c43Stephen Smalleyallow appdomain app_data_file:notdevfile_class_set create_file_perms; 506634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 516634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# lib subdirectory of /data/data dir is system-owned. 526634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain system_data_file:dir r_dir_perms; 5348759ca2054fa742724cd81debed51208b69e758Stephen Smalleyallow appdomain system_data_file:file { execute execute_no_trans open }; 546634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 556634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Execute the shell or other system executables. 566634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain shell_exec:file rx_file_perms; 576634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain system_file:file rx_file_perms; 586634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 596634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Read/write wallpaper file (opened by system). 60fc4c6b798a0c8ff38b4b943209ba1653a0276dfaRobert Craigallow appdomain wallpaper_file:file { getattr read write }; 616634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 626634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Write to /data/anr/traces.txt. 636634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain anr_data_file:dir search; 646634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain anr_data_file:file { open append }; 656634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 6609e6abd91b3aaaa11a44d032e095360c64a97b3aNick Kralevich# Allow apps to send dump information to dumpstate 6709e6abd91b3aaaa11a44d032e095360c64a97b3aNick Kralevichallow appdomain dumpstate:fd use; 68b0db712bf048dc634363b658a647b1f1897d8433Stephen Smalleyallow appdomain dumpstate:unix_stream_socket { read write getopt getattr shutdown }; 692e7a301fad5b6065e2d364170a80bc58bc41aab0Nick Kralevichallow appdomain shell_data_file:file { write getattr }; 7009e6abd91b3aaaa11a44d032e095360c64a97b3aNick Kralevich 716634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Write to /proc/net/xt_qtaguid/ctrl file. 726634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain qtaguid_proc:file rw_file_perms; 736634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Everybody can read the xt_qtaguid resource tracking misc dev. 746634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# So allow all apps to read from /dev/xt_qtaguid. 756634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain qtaguid_device:chr_file r_file_perms; 766634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 773ba9012535d8412d94db4ae9a5ce928b806e26d8Stephen Smalley# Grant GPU access to all processes started by Zygote. 783ba9012535d8412d94db4ae9a5ce928b806e26d8Stephen Smalley# They need that to render the standard UI. 793ba9012535d8412d94db4ae9a5ce928b806e26d8Stephen Smalleyallow appdomain gpu_device:chr_file { rw_file_perms execute }; 803ba9012535d8412d94db4ae9a5ce928b806e26d8Stephen Smalley 816634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Use the Binder. 826634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichbinder_use(appdomain) 836634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Perform binder IPC to binder services. 846634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichbinder_call(appdomain, binderservicedomain) 856634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Perform binder IPC to other apps. 866634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichbinder_call(appdomain, appdomain) 876634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 886634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Already connected, unnamed sockets being passed over some other IPC 896634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# hence no sock_file or connectto permission. This appears to be how 906634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Chrome works, may need to be updated as more apps using isolated services 916634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# are examined. 92b0db712bf048dc634363b658a647b1f1897d8433Stephen Smalleyallow appdomain appdomain:unix_stream_socket { getopt getattr read write shutdown }; 936634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 946634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Backup ability for every app. BMS opens and passes the fd 956634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# to any app that has backup ability. Hence, no open permissions here. 9681560733a47633036133ce548bf638bc3d91f5cfGeremy Condraallow appdomain backup_data_file:file { read write getattr }; 9781560733a47633036133ce548bf638bc3d91f5cfGeremy Condraallow appdomain cache_backup_file:file { read write getattr }; 989ba844fea12a0b08770e870d63f3d3c375c7c9b5Stephen Smalleyallow appdomain cache_backup_file:dir getattr; 996634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Backup ability using 'adb backup' 1006634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain system_data_file:lnk_file getattr; 1016634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1022737ceff233a32be67ebc6e3dba6e80b8df6df0aStephen Smalley# Allow read/stat of /data/media files passed by Binder or local socket IPC. 1032737ceff233a32be67ebc6e3dba6e80b8df6df0aStephen Smalleyallow appdomain media_rw_data_file:file { read getattr }; 1042737ceff233a32be67ebc6e3dba6e80b8df6df0aStephen Smalley 1053fbc536dfd5afbce5ef45f18d0afb3516089ed88Stephen Smalley# Read /data/data/com.android.providers.telephony files passed over Binder. 1063fbc536dfd5afbce5ef45f18d0afb3516089ed88Stephen Smalleyallow appdomain radio_data_file:file { read getattr }; 1073fbc536dfd5afbce5ef45f18d0afb3516089ed88Stephen Smalley 108b0db712bf048dc634363b658a647b1f1897d8433Stephen Smalley# Access SDcard. 109b0db712bf048dc634363b658a647b1f1897d8433Stephen Smalleyallow appdomain sdcard_type:dir create_dir_perms; 110b0db712bf048dc634363b658a647b1f1897d8433Stephen Smalleyallow appdomain sdcard_type:file create_file_perms; 111b0db712bf048dc634363b658a647b1f1897d8433Stephen Smalley 1120b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich# Allow apps to use the USB Accessory interface. 1130b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich# http://developer.android.com/guide/topics/connectivity/usb/accessory.html 1140b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich# 1150b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich# USB devices are first opened by the system server (USBDeviceManagerService) 1160b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich# and the file descriptor is passed to the right Activity via binder. 1170b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevichallow appdomain usb_device:chr_file { read write getattr ioctl }; 1180b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevichallow appdomain usbaccessory_device:chr_file { read write getattr }; 1190b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich 120527316a21b80c2a70d8ed23351299a4dce0c77bfStephen Smalley# For art. 121527316a21b80c2a70d8ed23351299a4dce0c77bfStephen Smalleyallow appdomain dalvikcache_data_file:file execute; 122527316a21b80c2a70d8ed23351299a4dce0c77bfStephen Smalley 12319c509034ee309c60c958637841c151d3c273421Stephen Smalley# /data/dalvik-cache/profiles 12419c509034ee309c60c958637841c151d3c273421Stephen Smalleyallow appdomain dalvikcache_profiles_data_file:file write; 12519c509034ee309c60c958637841c151d3c273421Stephen Smalley 126959fdaaa25d7dbfad8a1900dfe9575f873cea649Stephen Smalley# For legacy unlabeled userdata on existing devices. 127959fdaaa25d7dbfad8a1900dfe9575f873cea649Stephen Smalley# See discussion of Unlabeled files in domain.te for more information. 128959fdaaa25d7dbfad8a1900dfe9575f873cea649Stephen Smalleyallow appdomain unlabeled:file x_file_perms; 129959fdaaa25d7dbfad8a1900dfe9575f873cea649Stephen Smalley 1306634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich### 131594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley### CTS-specific rules 132594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley### 133594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley 134594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# For cts/tools/device-setup/TestDeviceSetup/src/android/tests/getinfo/RootProcessScanner.java. 135594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# Reads /proc/pid/status and statm entries to check that 136594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# no unexpected root processes are running. 137594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# Also for cts/tests/tests/security/src/android/security/cts/VoldExploitTest.java 138594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# Reads /proc/pid/cmdline of vold. 139594693705f0d5768db3c3212037da5fd5d5653beStephen Smalleyallow appdomain domain:dir { open read search getattr }; 140594693705f0d5768db3c3212037da5fd5d5653beStephen Smalleyallow appdomain domain:{ file lnk_file } { open read getattr }; 141594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley 142594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# For cts/tests/tests/permission/src/android/permission/cts/FileSystemPermissionTest.java. 143594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# testRunAsHasCorrectCapabilities 144594693705f0d5768db3c3212037da5fd5d5653beStephen Smalleyallow appdomain runas_exec:file getattr; 145594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# Others are either allowed elsewhere or not desired. 146594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley 147594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# For cts/tests/tests/security/src/android/security/cts/SELinuxTest.java 148594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# Check SELinux policy and contexts. 149594693705f0d5768db3c3212037da5fd5d5653beStephen Smalleyselinux_check_access(appdomain) 150594693705f0d5768db3c3212037da5fd5d5653beStephen Smalleyselinux_check_context(appdomain) 151594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# Validate that each process is running in the correct security context. 152594693705f0d5768db3c3212037da5fd5d5653beStephen Smalleyallow appdomain domain:process getattr; 153594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley 1548ed750e9731e6e3a21785e91e9b1cf7390c16738Mark Salyzyn# logd access 1558ed750e9731e6e3a21785e91e9b1cf7390c16738Mark Salyzynread_logd(appdomain) 1568ed750e9731e6e3a21785e91e9b1cf7390c16738Mark Salyzyn# application inherit logd write socket (urge is to deprecate this long term) 1578ed750e9731e6e3a21785e91e9b1cf7390c16738Mark Salyzynallow appdomain zygote:unix_dgram_socket write; 1588ed750e9731e6e3a21785e91e9b1cf7390c16738Mark Salyzyn 159594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley### 1606634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich### Neverallow rules 1616634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich### 1626634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich### These are things that Android apps should NEVER be able to do 1636634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich### 1646634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1656634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Superuser capabilities. 1662a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# bluetooth requires net_admin. 1672a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain -bluetooth } self:capability *; 1686634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichneverallow { appdomain -unconfineddomain } self:capability2 *; 1696634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1706634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Block device access. 1716634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichneverallow { appdomain -unconfineddomain } dev_type:blk_file { read write }; 1726634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1732a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Access to any of the following character devices. 1742a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } { 1752a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley audio_device 1762a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley camera_device 1772a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley dm_device 1782a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley radio_device 1792a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley gps_device 1802a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley rpmsg_device 1812a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley}:chr_file { read write }; 1822a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 1832a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Note: Try expanding list of app domains in the future. 1842a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { untrusted_app isolated_app shell -unconfineddomain } 1852a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley graphics_device:chr_file { read write }; 1862a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 1872a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -nfc -unconfineddomain } nfc_device:chr_file 1882a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { read write }; 1892a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -bluetooth -unconfineddomain } hci_attach_dev:chr_file 1902a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { read write }; 1912a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } tee_device:chr_file { read write }; 1922a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 1936634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Privileged netlink socket interfaces. 1946634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichneverallow { appdomain -unconfineddomain } 1956634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich self:{ 1966634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_socket 1976634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_firewall_socket 1986634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_tcpdiag_socket 1996634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_nflog_socket 2006634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_xfrm_socket 2016634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_audit_socket 2026634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_ip6fw_socket 2036634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_dnrt_socket 2046634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_kobject_uevent_socket 2056634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich } *; 2066634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 2072a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Sockets under /dev/socket that are not specifically typed. 2082a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } socket_device:sock_file write; 2092a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2102a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Unix domain sockets. 2112a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } adbd_socket:sock_file write; 2122a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } installd_socket:sock_file write; 2132a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -bluetooth -radio -shell -system_app -unconfineddomain } 2142a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley property_socket:sock_file write; 2152a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -radio -unconfineddomain } rild_socket:sock_file write; 2162a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } vold_socket:sock_file write; 2172a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } zygote_socket:sock_file write; 2182a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2196634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# ptrace access to non-app domains. 2206634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichneverallow { appdomain -unconfineddomain } { domain -appdomain }:process ptrace; 2216634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 2222a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Write access to /proc/pid entries for any non-app domain. 22373c5ea722c7ee328f0d10179601afd9d5a054b94Nick Kralevichneverallow { appdomain -unconfineddomain } { domain -appdomain }:file write; 2242a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2252a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# signal access to non-app domains. 2262a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# sigchld allowed for parent death notification. 2272a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# signull allowed for kill(pid, 0) existence test. 2282a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# All others prohibited. 2292a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } { domain -appdomain }:process 2302a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { sigkill sigstop signal }; 2312a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2326634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Transition to a non-app domain. 233396015c3952bcbd5678dc20d5e5e4407cf6a4d4aStephen Smalley# Exception for the shell domain, can transition to runas, etc. 23457085446eb49777189123a994884f76b8491ed26Stephen Smalleyneverallow { appdomain -shell -unconfineddomain } ~appdomain:process 2352a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { transition dyntransition }; 2362a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2372a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Map low memory. 2382a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Note: Take to domain.te and apply to all domains in the future. 2392a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } self:memprotect mmap_zero; 2402a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2412a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Write to rootfs. 2422a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } rootfs:dir_file_class_set 2432a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2446634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 2456634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Write to /system. 2462a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } system_file:dir_file_class_set 2472a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2482a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2492a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Write to entrypoint executables. 2502a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } exec_type:file 2512a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2526634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 2536634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Write to system-owned parts of /data. 2546634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# This is the default type for anything under /data not otherwise 2556634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# specified in file_contexts. Define a different type for portions 2566634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# that should be writable by apps. 2576634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Exception for system_app for Settings. 2582a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain -system_app } 2592a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley system_data_file:dir_file_class_set 2602a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2612a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2622a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Write to various other parts of /data. 2632a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -system_app -unconfineddomain } 2642a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley security_file:dir_file_class_set 2652a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2662a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } drm_data_file:dir_file_class_set 2672a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2682a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } gps_data_file:dir_file_class_set 2692a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2702a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -platform_app -unconfineddomain } 2712a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley apk_data_file:dir_file_class_set 2722a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2732a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -platform_app -unconfineddomain } 2742a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley apk_tmp_file:dir_file_class_set 2752a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2762a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -platform_app -unconfineddomain } 2772a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley apk_private_data_file:dir_file_class_set 2782a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2792a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -platform_app -unconfineddomain } 2802a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley apk_private_tmp_file:dir_file_class_set 2812a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2822a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -shell -unconfineddomain } 2832a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley shell_data_file:dir_file_class_set 2842e7a301fad5b6065e2d364170a80bc58bc41aab0Nick Kralevich { create setattr relabelfrom relabelto append unlink link rename }; 2852a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -bluetooth -unconfineddomain } 2862a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley bluetooth_data_file:dir_file_class_set 2872a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2882a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } 2892a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley keystore_data_file:dir_file_class_set 2902a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2912a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } 2922a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley systemkeys_data_file:dir_file_class_set 2932a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2942a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } 2952a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley wifi_data_file:dir_file_class_set 2962a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2972a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } 2982a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley dhcp_data_file:dir_file_class_set 2992a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 3002a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 3012a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Access to factory files. 3022a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } 3032a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley efs_file:dir_file_class_set { read write }; 3042a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 3052a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Write to various pseudo file systems. 306df8af76f2678e3ea63e83701ac4b5afec24adf9fStephen Smalleyneverallow { appdomain -bluetooth -nfc -unconfineddomain } 3072a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley sysfs:dir_file_class_set write; 3082a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } 3092a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley proc:dir_file_class_set write; 3102a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 3112a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Access to syslog(2) or /proc/kmsg. 3122a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -system_app -unconfineddomain } 3132a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley kernel:system { syslog_read syslog_mod syslog_console }; 3142a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 3152a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Ability to perform any filesystem operation other than statfs(2). 3162a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# i.e. no mount(2), unmount(2), etc. 3172a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } fs_type:filesystem ~getattr; 3182a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 3192a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Ability to set system properties. 3202a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -system_app -radio -shell -bluetooth -unconfineddomain } 3212a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley property_type:property_service set; 322