app.te revision 65317124a0bb7db4829f78e74c7bfe18e27f1c43
1748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### 2748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### Domain for all zygote spawned apps 3748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### 4748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### This file is the base policy for all zygote spawned apps. 5748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### Other policy files, such as isolated_app.te, untrusted_app.te, etc 6748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### extend from this policy. Only policies which should apply to ALL 7748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### zygote spawned apps should be added here. 8748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### 9748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich 106634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Allow apps to connect to the keystore 116634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichunix_socket_connect(appdomain, keystore, keystore) 126634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 136634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Receive and use open file descriptors inherited from zygote. 146634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain zygote:fd use; 156634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1648759ca2054fa742724cd81debed51208b69e758Stephen Smalley# gdbserver for ndk-gdb reads the zygote. 1748759ca2054fa742724cd81debed51208b69e758Stephen Smalleyallow appdomain zygote_exec:file r_file_perms; 1848759ca2054fa742724cd81debed51208b69e758Stephen Smalley 1948759ca2054fa742724cd81debed51208b69e758Stephen Smalley# gdbserver for ndk-gdb ptrace attaches to app process. 2048759ca2054fa742724cd81debed51208b69e758Stephen Smalleyallow appdomain self:process ptrace; 2148759ca2054fa742724cd81debed51208b69e758Stephen Smalley 226634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Read system properties managed by zygote. 236634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain zygote_tmpfs:file read; 246634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 256634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Notify zygote of death; 266634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain zygote:process sigchld; 276634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 2848759ca2054fa742724cd81debed51208b69e758Stephen Smalley# Notify shell and adbd of death when spawned via runas for ndk-gdb. 2948759ca2054fa742724cd81debed51208b69e758Stephen Smalleyallow appdomain shell:process sigchld; 3048759ca2054fa742724cd81debed51208b69e758Stephen Smalleyallow appdomain adbd:process sigchld; 3148759ca2054fa742724cd81debed51208b69e758Stephen Smalley 3248759ca2054fa742724cd81debed51208b69e758Stephen Smalley# child shell or gdbserver pty access for runas. 3348759ca2054fa742724cd81debed51208b69e758Stephen Smalleyallow appdomain devpts:chr_file { getattr read write ioctl }; 3448759ca2054fa742724cd81debed51208b69e758Stephen Smalley 356634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Communicate with system_server. 361fdee11df2552e29da0c48e3432f26f7a93e3bffAlex Klyubinallow appdomain system_server:fifo_file rw_file_perms; 371fdee11df2552e29da0c48e3432f26f7a93e3bffAlex Klyubinallow appdomain system_server:unix_stream_socket { read write setopt }; 381fdee11df2552e29da0c48e3432f26f7a93e3bffAlex Klyubinbinder_call(appdomain, system_server) 396634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 4082fc3b524164588388aa3595bd2158020d93d28aNick Kralevich# Communication with other apps via fifos 4182fc3b524164588388aa3595bd2158020d93d28aNick Kralevichallow appdomain appdomain:fifo_file rw_file_perms; 4282fc3b524164588388aa3595bd2158020d93d28aNick Kralevich 436634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Communicate with surfaceflinger. 446634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain surfaceflinger:unix_stream_socket { read write setopt }; 456634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichbinder_call(appdomain, surfaceflinger) 466634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 476634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# App sandbox file accesses. 486634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain app_data_file:dir create_dir_perms; 4965317124a0bb7db4829f78e74c7bfe18e27f1c43Stephen Smalleyallow appdomain app_data_file:notdevfile_class_set create_file_perms; 506634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 516634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Read/write data files created by the platform apps if they 526634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# were passed to the app via binder or local IPC. Do not allow open. 536634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain platform_app_data_file:file { getattr read write }; 546634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 556634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# lib subdirectory of /data/data dir is system-owned. 566634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain system_data_file:dir r_dir_perms; 5748759ca2054fa742724cd81debed51208b69e758Stephen Smalleyallow appdomain system_data_file:file { execute execute_no_trans open }; 586634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 596634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Execute the shell or other system executables. 606634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain shell_exec:file rx_file_perms; 616634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain system_file:file rx_file_perms; 626634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 636634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Read/write wallpaper file (opened by system). 646634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain wallpaper_file:file { read write }; 656634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 666634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Write to /data/anr/traces.txt. 676634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain anr_data_file:dir search; 686634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain anr_data_file:file { open append }; 696634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 706634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Write to /proc/net/xt_qtaguid/ctrl file. 716634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain qtaguid_proc:file rw_file_perms; 726634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Everybody can read the xt_qtaguid resource tracking misc dev. 736634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# So allow all apps to read from /dev/xt_qtaguid. 746634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain qtaguid_device:chr_file r_file_perms; 756634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 766634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Use the Binder. 776634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichbinder_use(appdomain) 786634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Perform binder IPC to binder services. 796634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichbinder_call(appdomain, binderservicedomain) 806634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Perform binder IPC to other apps. 816634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichbinder_call(appdomain, appdomain) 826634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 836634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Appdomain interaction with isolated apps 846634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichr_dir_file(appdomain, isolated_app) 856634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 866634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Already connected, unnamed sockets being passed over some other IPC 876634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# hence no sock_file or connectto permission. This appears to be how 886634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Chrome works, may need to be updated as more apps using isolated services 896634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# are examined. 906634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain isolated_app:unix_stream_socket { read write }; 916634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 926634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Backup ability for every app. BMS opens and passes the fd 936634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# to any app that has backup ability. Hence, no open permissions here. 9481560733a47633036133ce548bf638bc3d91f5cfGeremy Condraallow appdomain backup_data_file:file { read write getattr }; 9581560733a47633036133ce548bf638bc3d91f5cfGeremy Condraallow appdomain cache_backup_file:file { read write getattr }; 966634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Backup ability using 'adb backup' 976634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain system_data_file:lnk_file getattr; 986634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 996634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Allow all applications to read downloaded files 10017454cf805748a8792608a44bbfddb00fb918841Stephen Smalleyallow appdomain download_file:dir search; 1016634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain download_file:file r_file_perms; 1026634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1036634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Allow applications to communicate with netd via /dev/socket/dnsproxyd 1046634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# to do DNS resolution 1056634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichunix_socket_connect(appdomain, dnsproxyd, netd) 1066634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1076634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Allow applications to communicate with drmserver over binder 1086634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichbinder_call(appdomain, drmserver) 1096634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1106634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Allow applications to communicate with mediaserver over binder 1116634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichbinder_call(appdomain, mediaserver) 1126634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1136634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Allow applications to make outbound tcp connections to any port 1146634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain port_type:tcp_socket name_connect; 1156634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1166634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Allow apps to see changes to the routing table. 1176634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain self:netlink_route_socket { 1186634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich read 1196634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich bind 1206634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich create 1216634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich nlmsg_read 1226634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich ioctl 1236634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich getattr 1246634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich setattr 1256634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich getopt 1266634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich setopt 1276634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich shutdown 1286634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich}; 1296634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1306634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Allow apps to use rawip sockets. This is needed for apps which execute 1316634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# /system/bin/ping, for example. 1326634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain self:rawip_socket create_socket_perms; 1336634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1340b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich# Allow apps to use the USB Accessory interface. 1350b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich# http://developer.android.com/guide/topics/connectivity/usb/accessory.html 1360b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich# 1370b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich# USB devices are first opened by the system server (USBDeviceManagerService) 1380b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich# and the file descriptor is passed to the right Activity via binder. 1390b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevichallow appdomain usb_device:chr_file { read write getattr ioctl }; 1400b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevichallow appdomain usbaccessory_device:chr_file { read write getattr }; 1410b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich 1426634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich### 1436634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich### Neverallow rules 1446634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich### 1456634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich### These are things that Android apps should NEVER be able to do 1466634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich### 1476634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1486634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Superuser capabilities. 1492a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# bluetooth requires net_admin. 1502a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain -bluetooth } self:capability *; 1516634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichneverallow { appdomain -unconfineddomain } self:capability2 *; 1526634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1536634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Block device access. 1546634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichneverallow { appdomain -unconfineddomain } dev_type:blk_file { read write }; 1556634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1562a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Access to any character device that is not specifically typed. 1572a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } device:chr_file { read write }; 1582a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 1592a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Access to any of the following character devices. 1602a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } { 1612a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley audio_device 1622a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley camera_device 1632a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley dm_device 1642a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley radio_device 1652a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley gps_device 1662a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley rpmsg_device 1672a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley}:chr_file { read write }; 1682a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 1692a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Note: Try expanding list of app domains in the future. 1702a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { untrusted_app isolated_app shell -unconfineddomain } 1712a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley graphics_device:chr_file { read write }; 1722a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 1732a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -nfc -unconfineddomain } nfc_device:chr_file 1742a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { read write }; 1752a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -bluetooth -unconfineddomain } hci_attach_dev:chr_file 1762a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { read write }; 1772a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } tee_device:chr_file { read write }; 1782a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 1792a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Set SELinux enforcing mode, booleans or any other SELinux settings. 1802a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } kernel:security 1812a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { setenforce setbool setsecparam setcheckreqprot }; 1826634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1836634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Load security policy. 1842637198f92d5d9c65262e42d78123d216889d546Nick Kralevichneverallow appdomain kernel:security load_policy; 1856634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1866634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Privileged netlink socket interfaces. 1876634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichneverallow { appdomain -unconfineddomain } 1886634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich self:{ 1896634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_socket 1906634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_firewall_socket 1916634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_tcpdiag_socket 1926634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_nflog_socket 1936634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_xfrm_socket 1946634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_selinux_socket 1956634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_audit_socket 1966634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_ip6fw_socket 1976634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_dnrt_socket 1986634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_kobject_uevent_socket 1996634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich } *; 2006634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 2012a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Sockets under /dev/socket that are not specifically typed. 2022a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } socket_device:sock_file write; 2032a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2042a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Unix domain sockets. 2052a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } adbd_socket:sock_file write; 2062a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } bluetooth_socket:sock_file write; 2072a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } installd_socket:sock_file write; 2082a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -bluetooth -radio -shell -system_app -unconfineddomain } 2092a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley property_socket:sock_file write; 2102a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -radio -unconfineddomain } rild_socket:sock_file write; 2112a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } vold_socket:sock_file write; 2122a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } zygote_socket:sock_file write; 2132a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2146634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# ptrace access to non-app domains. 2156634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichneverallow { appdomain -unconfineddomain } { domain -appdomain }:process ptrace; 2166634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 2172a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Write access to /proc/pid entries for any non-app domain. 21873c5ea722c7ee328f0d10179601afd9d5a054b94Nick Kralevichneverallow { appdomain -unconfineddomain } { domain -appdomain }:file write; 2192a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2202a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# signal access to non-app domains. 2212a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# sigchld allowed for parent death notification. 2222a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# signull allowed for kill(pid, 0) existence test. 2232a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# All others prohibited. 2242a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } { domain -appdomain }:process 2252a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { sigkill sigstop signal }; 2262a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2276634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Transition to a non-app domain. 22857085446eb49777189123a994884f76b8491ed26Stephen Smalley# Exception for the shell domain, can transition to runas, ping, etc. 22957085446eb49777189123a994884f76b8491ed26Stephen Smalleyneverallow { appdomain -shell -unconfineddomain } ~appdomain:process 2302a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { transition dyntransition }; 2312a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2322a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Map low memory. 2332a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Note: Take to domain.te and apply to all domains in the future. 2342a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } self:memprotect mmap_zero; 2352a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2362a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Write to rootfs. 2372a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } rootfs:dir_file_class_set 2382a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2396634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 2406634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Write to /system. 2412a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } system_file:dir_file_class_set 2422a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2432a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2442a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Write to entrypoint executables. 2452a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } exec_type:file 2462a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2476634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 2486634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Write to system-owned parts of /data. 2496634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# This is the default type for anything under /data not otherwise 2506634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# specified in file_contexts. Define a different type for portions 2516634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# that should be writable by apps. 2526634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Exception for system_app for Settings. 2532a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain -system_app } 2542a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley system_data_file:dir_file_class_set 2552a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2562a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2572a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Write to various other parts of /data. 2582a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -system_app -unconfineddomain } 2592a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley security_file:dir_file_class_set 2602a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2612a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } drm_data_file:dir_file_class_set 2622a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2632a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } gps_data_file:dir_file_class_set 2642a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2652a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -platform_app -unconfineddomain } 2662a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley apk_data_file:dir_file_class_set 2672a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2682a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -platform_app -unconfineddomain } 2692a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley apk_tmp_file:dir_file_class_set 2702a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2712a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -platform_app -unconfineddomain } 2722a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley apk_private_data_file:dir_file_class_set 2732a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2742a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -platform_app -unconfineddomain } 2752a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley apk_private_tmp_file:dir_file_class_set 2762a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2772a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -shell -unconfineddomain } 2782a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley shell_data_file:dir_file_class_set 2792a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2802a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -bluetooth -unconfineddomain } 2812a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley bluetooth_data_file:dir_file_class_set 2822a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2832a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } 2842a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley keystore_data_file:dir_file_class_set 2852a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2862a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } 2872a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley systemkeys_data_file:dir_file_class_set 2882a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2892a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } 2902a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley wifi_data_file:dir_file_class_set 2912a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2922a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } 2932a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley dhcp_data_file:dir_file_class_set 2942a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2952a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2962a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Access to factory files. 2972a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } 2982a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley efs_file:dir_file_class_set { read write }; 2992a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 3002a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Write to various pseudo file systems. 3012a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -nfc -unconfineddomain } 3022a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley sysfs:dir_file_class_set write; 3032a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -system_app -unconfineddomain } 3042a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley selinuxfs:dir_file_class_set write; 3052a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } 3062a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley proc:dir_file_class_set write; 3072a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 3082a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Access to syslog(2) or /proc/kmsg. 3092a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -system_app -unconfineddomain } 3102a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley kernel:system { syslog_read syslog_mod syslog_console }; 3112a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 3122a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Ability to perform any filesystem operation other than statfs(2). 3132a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# i.e. no mount(2), unmount(2), etc. 3142a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -unconfineddomain } fs_type:filesystem ~getattr; 3152a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 3162a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Ability to set system properties. 3172a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalleyneverallow { appdomain -system_app -radio -shell -bluetooth -unconfineddomain } 3182a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley property_type:property_service set; 319