app.te revision bf626ce94452813e44433c40fb3d80f8b4b00ff5
1748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### 2748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### Domain for all zygote spawned apps 3748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### 4748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### This file is the base policy for all zygote spawned apps. 5748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### Other policy files, such as isolated_app.te, untrusted_app.te, etc 6748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### extend from this policy. Only policies which should apply to ALL 7748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### zygote spawned apps should be added here. 8748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich### 9748fdef626d1dda2a0a727ea35d85d04363f5307Nick Kralevich 10ad7df7bb76ce00cdef711ad1f96a9a7243981f4eStephen Smalley# Dalvik Compiler JIT Mapping. 11ad7df7bb76ce00cdef711ad1f96a9a7243981f4eStephen Smalleyallow appdomain self:process execmem; 12e7ec2f5258550a2cc0cb8c76ef24fc100a6b2cf1Stephen Smalleyallow appdomain ashmem_device:chr_file execute; 13ad7df7bb76ce00cdef711ad1f96a9a7243981f4eStephen Smalley 146634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Receive and use open file descriptors inherited from zygote. 156634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain zygote:fd use; 166634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1748759ca2054fa742724cd81debed51208b69e758Stephen Smalley# gdbserver for ndk-gdb reads the zygote. 184fce0ef97c2a4cb6e0ce2adf17c012c8be6252bfNick Kralevich# valgrind needs mmap exec for zygote 194fce0ef97c2a4cb6e0ce2adf17c012c8be6252bfNick Kralevichallow appdomain zygote_exec:file rx_file_perms; 2048759ca2054fa742724cd81debed51208b69e758Stephen Smalley 2148759ca2054fa742724cd81debed51208b69e758Stephen Smalley# gdbserver for ndk-gdb ptrace attaches to app process. 2248759ca2054fa742724cd81debed51208b69e758Stephen Smalleyallow appdomain self:process ptrace; 2348759ca2054fa742724cd81debed51208b69e758Stephen Smalley 246634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Read system properties managed by zygote. 256634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain zygote_tmpfs:file read; 266634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 276634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Notify zygote of death; 286634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain zygote:process sigchld; 296634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 3048759ca2054fa742724cd81debed51208b69e758Stephen Smalley# Notify shell and adbd of death when spawned via runas for ndk-gdb. 3148759ca2054fa742724cd81debed51208b69e758Stephen Smalleyallow appdomain shell:process sigchld; 3248759ca2054fa742724cd81debed51208b69e758Stephen Smalleyallow appdomain adbd:process sigchld; 3348759ca2054fa742724cd81debed51208b69e758Stephen Smalley 3448759ca2054fa742724cd81debed51208b69e758Stephen Smalley# child shell or gdbserver pty access for runas. 3548759ca2054fa742724cd81debed51208b69e758Stephen Smalleyallow appdomain devpts:chr_file { getattr read write ioctl }; 3648759ca2054fa742724cd81debed51208b69e758Stephen Smalley 373dad7b611a448fa43a678ff760c23a00f387947eStephen Smalley# Use pipes and sockets provided by system_server via binder or local socket. 381fdee11df2552e29da0c48e3432f26f7a93e3bffAlex Klyubinallow appdomain system_server:fifo_file rw_file_perms; 393dad7b611a448fa43a678ff760c23a00f387947eStephen Smalleyallow appdomain system_server:unix_stream_socket { read write setopt getattr getopt shutdown }; 403dad7b611a448fa43a678ff760c23a00f387947eStephen Smalleyallow appdomain system_server:tcp_socket { read write getattr getopt shutdown }; 416634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 4282fc3b524164588388aa3595bd2158020d93d28aNick Kralevich# Communication with other apps via fifos 4382fc3b524164588388aa3595bd2158020d93d28aNick Kralevichallow appdomain appdomain:fifo_file rw_file_perms; 4482fc3b524164588388aa3595bd2158020d93d28aNick Kralevich 456634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Communicate with surfaceflinger. 46b0db712bf048dc634363b658a647b1f1897d8433Stephen Smalleyallow appdomain surfaceflinger:unix_stream_socket { read write setopt getattr getopt shutdown }; 476634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 486634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# App sandbox file accesses. 496634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain app_data_file:dir create_dir_perms; 5065317124a0bb7db4829f78e74c7bfe18e27f1c43Stephen Smalleyallow appdomain app_data_file:notdevfile_class_set create_file_perms; 516634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 526634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# lib subdirectory of /data/data dir is system-owned. 536634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain system_data_file:dir r_dir_perms; 5478706f9ef6d917fe2ec85ecb6b0f47fbc5efde57Nick Kralevichallow appdomain system_data_file:file { execute execute_no_trans open execmod }; 556634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 5651bfecf49d50982f64aba1fa73bbbdd2e40a444fRobin Lee# Keychain and user-trusted credentials 5751bfecf49d50982f64aba1fa73bbbdd2e40a444fRobin Leeallow appdomain keychain_data_file:dir r_dir_perms; 5851bfecf49d50982f64aba1fa73bbbdd2e40a444fRobin Leeallow appdomain keychain_data_file:file r_file_perms; 5951bfecf49d50982f64aba1fa73bbbdd2e40a444fRobin Leeallow appdomain misc_user_data_file:dir r_dir_perms; 6051bfecf49d50982f64aba1fa73bbbdd2e40a444fRobin Leeallow appdomain misc_user_data_file:file r_file_perms; 6151bfecf49d50982f64aba1fa73bbbdd2e40a444fRobin Lee 626736bac21870bdc8bb6098ddffdb70103f7bc2a3Jeff Sharkey# Access to OEM provided data and apps 636736bac21870bdc8bb6098ddffdb70103f7bc2a3Jeff Sharkeyallow appdomain oemfs:dir r_dir_perms; 646736bac21870bdc8bb6098ddffdb70103f7bc2a3Jeff Sharkeyallow appdomain oemfs:file rx_file_perms; 656736bac21870bdc8bb6098ddffdb70103f7bc2a3Jeff Sharkey 666634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Execute the shell or other system executables. 676634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain shell_exec:file rx_file_perms; 686634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain system_file:file rx_file_perms; 696634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 708ee37b4f1c58e1dcd00b198a9bbfeafb4221fdc9Ed Heyl# Execute dex2oat when apps call dexclassloader 718ee37b4f1c58e1dcd00b198a9bbfeafb4221fdc9Ed Heylallow appdomain dex2oat_exec:file rx_file_perms; 728ee37b4f1c58e1dcd00b198a9bbfeafb4221fdc9Ed Heyl 736634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Read/write wallpaper file (opened by system). 74fc4c6b798a0c8ff38b4b943209ba1653a0276dfaRobert Craigallow appdomain wallpaper_file:file { getattr read write }; 756634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 766634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Write to /data/anr/traces.txt. 776634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain anr_data_file:dir search; 786634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain anr_data_file:file { open append }; 796634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 8009e6abd91b3aaaa11a44d032e095360c64a97b3aNick Kralevich# Allow apps to send dump information to dumpstate 8109e6abd91b3aaaa11a44d032e095360c64a97b3aNick Kralevichallow appdomain dumpstate:fd use; 82b0db712bf048dc634363b658a647b1f1897d8433Stephen Smalleyallow appdomain dumpstate:unix_stream_socket { read write getopt getattr shutdown }; 832e7a301fad5b6065e2d364170a80bc58bc41aab0Nick Kralevichallow appdomain shell_data_file:file { write getattr }; 8409e6abd91b3aaaa11a44d032e095360c64a97b3aNick Kralevich 856634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Write to /proc/net/xt_qtaguid/ctrl file. 866634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain qtaguid_proc:file rw_file_perms; 876634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Everybody can read the xt_qtaguid resource tracking misc dev. 886634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# So allow all apps to read from /dev/xt_qtaguid. 896634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain qtaguid_device:chr_file r_file_perms; 906634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 913ba9012535d8412d94db4ae9a5ce928b806e26d8Stephen Smalley# Grant GPU access to all processes started by Zygote. 923ba9012535d8412d94db4ae9a5ce928b806e26d8Stephen Smalley# They need that to render the standard UI. 937ef348b1bac77418862f7c22ecefb51ec3517808Nick Kralevichallow appdomain gpu_device:chr_file { rw_file_perms execute }; 943ba9012535d8412d94db4ae9a5ce928b806e26d8Stephen Smalley 956634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Use the Binder. 966634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichbinder_use(appdomain) 976634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Perform binder IPC to binder services. 986634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichbinder_call(appdomain, binderservicedomain) 996634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Perform binder IPC to other apps. 1006634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichbinder_call(appdomain, appdomain) 1016634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1026634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Already connected, unnamed sockets being passed over some other IPC 1036634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# hence no sock_file or connectto permission. This appears to be how 1046634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Chrome works, may need to be updated as more apps using isolated services 1056634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# are examined. 106b0db712bf048dc634363b658a647b1f1897d8433Stephen Smalleyallow appdomain appdomain:unix_stream_socket { getopt getattr read write shutdown }; 1076634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1086634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Backup ability for every app. BMS opens and passes the fd 1096634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# to any app that has backup ability. Hence, no open permissions here. 11081560733a47633036133ce548bf638bc3d91f5cfGeremy Condraallow appdomain backup_data_file:file { read write getattr }; 11181560733a47633036133ce548bf638bc3d91f5cfGeremy Condraallow appdomain cache_backup_file:file { read write getattr }; 1129ba844fea12a0b08770e870d63f3d3c375c7c9b5Stephen Smalleyallow appdomain cache_backup_file:dir getattr; 1136634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Backup ability using 'adb backup' 1146634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow appdomain system_data_file:lnk_file getattr; 1156634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 1162737ceff233a32be67ebc6e3dba6e80b8df6df0aStephen Smalley# Allow read/stat of /data/media files passed by Binder or local socket IPC. 1172737ceff233a32be67ebc6e3dba6e80b8df6df0aStephen Smalleyallow appdomain media_rw_data_file:file { read getattr }; 1182737ceff233a32be67ebc6e3dba6e80b8df6df0aStephen Smalley 1191545b6061518bac473cf93af576cbea12a992298Nick Kralevich# Read and write /data/data/com.android.providers.telephony files passed over Binder. 1201545b6061518bac473cf93af576cbea12a992298Nick Kralevichallow appdomain radio_data_file:file { read write getattr }; 1213fbc536dfd5afbce5ef45f18d0afb3516089ed88Stephen Smalley 12291a4f8d4fdab7df8474c2ffaa996c879166d8a4cStephen Smalley# Read and write system app data files passed over Binder. 12391a4f8d4fdab7df8474c2ffaa996c879166d8a4cStephen Smalley# Motivating case was /data/data/com.android.settings/cache/*.jpg for 12491a4f8d4fdab7df8474c2ffaa996c879166d8a4cStephen Smalley# cropping or taking user photos. 12591a4f8d4fdab7df8474c2ffaa996c879166d8a4cStephen Smalleyallow untrusted_app system_app_data_file:file { read write getattr }; 12691a4f8d4fdab7df8474c2ffaa996c879166d8a4cStephen Smalley 127cf610692252b4df30b42f2bce3de464ac1804f97Stephen Smalley# Access SDcard via the fuse mount. 128e9c90bddcea8d3d466fbc34361a7feea3eea4ad3Ed Heylallow appdomain fuse:dir create_dir_perms; 129e9c90bddcea8d3d466fbc34361a7feea3eea4ad3Ed Heylallow appdomain fuse:file create_file_perms; 130b0db712bf048dc634363b658a647b1f1897d8433Stephen Smalley 13162083414a4cc2b9fd7eb22c3bc4ffa4d9285d4beNick Kralevich# Access OBBs (vfat images) mounted by vold (b/17633509) 13262083414a4cc2b9fd7eb22c3bc4ffa4d9285d4beNick Kralevichallow appdomain vfat:dir r_dir_perms; 13362083414a4cc2b9fd7eb22c3bc4ffa4d9285d4beNick Kralevichallow appdomain vfat:file r_file_perms; 13462083414a4cc2b9fd7eb22c3bc4ffa4d9285d4beNick Kralevich 1350b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich# Allow apps to use the USB Accessory interface. 1360b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich# http://developer.android.com/guide/topics/connectivity/usb/accessory.html 1370b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich# 1380b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich# USB devices are first opened by the system server (USBDeviceManagerService) 1390b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich# and the file descriptor is passed to the right Activity via binder. 1400b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevichallow appdomain usb_device:chr_file { read write getattr ioctl }; 1410b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevichallow appdomain usbaccessory_device:chr_file { read write getattr }; 1420b8c20e7ddce7cf791447f15be540ee2d0a6bfb2Nick Kralevich 143527316a21b80c2a70d8ed23351299a4dce0c77bfStephen Smalley# For art. 144527316a21b80c2a70d8ed23351299a4dce0c77bfStephen Smalleyallow appdomain dalvikcache_data_file:file execute; 1456f201ddc79f5badfbe0e0a6c5d9d9c4a94f4e8a4Jeff Haoallow appdomain dalvikcache_data_file:lnk_file r_file_perms; 146527316a21b80c2a70d8ed23351299a4dce0c77bfStephen Smalley 14719c509034ee309c60c958637841c151d3c273421Stephen Smalley# /data/dalvik-cache/profiles 148867030517724036b64fcaf39deaba1b27f3ca77eNick Kralevichallow appdomain dalvikcache_profiles_data_file:dir { search getattr }; 149867030517724036b64fcaf39deaba1b27f3ca77eNick Kralevichallow appdomain dalvikcache_profiles_data_file:file rw_file_perms; 15019c509034ee309c60c958637841c151d3c273421Stephen Smalley 1519786af2bcaaf0ba25c0a50c81c748a05793ec847Torne (Richard Coles)# Allow any app to read shared RELRO files. 1529786af2bcaaf0ba25c0a50c81c748a05793ec847Torne (Richard Coles)allow appdomain shared_relro_file:dir search; 1539786af2bcaaf0ba25c0a50c81c748a05793ec847Torne (Richard Coles)allow appdomain shared_relro_file:file r_file_perms; 1549786af2bcaaf0ba25c0a50c81c748a05793ec847Torne (Richard Coles) 1556f6c425563f4faa4e1e12bf430c32d0b81a78f64Christopher Tate# Allow apps to read/execute installed binaries 156711895db2897bc5d001899eb5e0f931c79a1ad3fdcashmanallow appdomain apk_data_file:dir r_dir_perms; 1576f6c425563f4faa4e1e12bf430c32d0b81a78f64Christopher Tateallow appdomain apk_data_file:file { rx_file_perms execmod }; 1586f6c425563f4faa4e1e12bf430c32d0b81a78f64Christopher Tate 159fad4d5fb00ddb1f61c22c003429e10f10b046d0dNick Kralevich# /data/resource-cache 160fad4d5fb00ddb1f61c22c003429e10f10b046d0dNick Kralevichallow appdomain resourcecache_data_file:file r_file_perms; 161fad4d5fb00ddb1f61c22c003429e10f10b046d0dNick Kralevichallow appdomain resourcecache_data_file:dir r_dir_perms; 162fad4d5fb00ddb1f61c22c003429e10f10b046d0dNick Kralevich 1636634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich### 164594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley### CTS-specific rules 165594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley### 166594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley 167594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# For cts/tools/device-setup/TestDeviceSetup/src/android/tests/getinfo/RootProcessScanner.java. 168594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# Reads /proc/pid/status and statm entries to check that 169594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# no unexpected root processes are running. 170594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# Also for cts/tests/tests/security/src/android/security/cts/VoldExploitTest.java 171594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# Reads /proc/pid/cmdline of vold. 172594693705f0d5768db3c3212037da5fd5d5653beStephen Smalleyallow appdomain domain:dir { open read search getattr }; 173594693705f0d5768db3c3212037da5fd5d5653beStephen Smalleyallow appdomain domain:{ file lnk_file } { open read getattr }; 174594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley 175594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# For cts/tests/tests/permission/src/android/permission/cts/FileSystemPermissionTest.java. 176594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# testRunAsHasCorrectCapabilities 177594693705f0d5768db3c3212037da5fd5d5653beStephen Smalleyallow appdomain runas_exec:file getattr; 178594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# Others are either allowed elsewhere or not desired. 179594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley 180594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# For cts/tests/tests/security/src/android/security/cts/SELinuxTest.java 181594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# Check SELinux policy and contexts. 182594693705f0d5768db3c3212037da5fd5d5653beStephen Smalleyselinux_check_access(appdomain) 183594693705f0d5768db3c3212037da5fd5d5653beStephen Smalleyselinux_check_context(appdomain) 184594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley# Validate that each process is running in the correct security context. 185594693705f0d5768db3c3212037da5fd5d5653beStephen Smalleyallow appdomain domain:process getattr; 186594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley 1878ed750e9731e6e3a21785e91e9b1cf7390c16738Mark Salyzyn# logd access 1888ed750e9731e6e3a21785e91e9b1cf7390c16738Mark Salyzynread_logd(appdomain) 189bcdff890304e694c09bf0a4a90fb76a82434fa57Mark Salyzyncontrol_logd(appdomain) 1908ed750e9731e6e3a21785e91e9b1cf7390c16738Mark Salyzyn# application inherit logd write socket (urge is to deprecate this long term) 1918ed750e9731e6e3a21785e91e9b1cf7390c16738Mark Salyzynallow appdomain zygote:unix_dgram_socket write; 1928ed750e9731e6e3a21785e91e9b1cf7390c16738Mark Salyzyn 1931196d2a5763c9a99be99ba81a4a29d938a83cc06Riley Spahnallow appdomain keystore:keystore_key { test get insert delete exist saw sign verify }; 1941196d2a5763c9a99be99ba81a4a29d938a83cc06Riley Spahn 1951196d2a5763c9a99be99ba81a4a29d938a83cc06Riley Spahnuse_keystore(appdomain) 1961196d2a5763c9a99be99ba81a4a29d938a83cc06Riley Spahn 197594693705f0d5768db3c3212037da5fd5d5653beStephen Smalley### 1986634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich### Neverallow rules 1996634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich### 2006634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich### These are things that Android apps should NEVER be able to do 2016634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich### 2026634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 2036634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Superuser capabilities. 20477eb35263f40607e36fdcd85d95050a4ecedb6b8Sharvil Nanavati# bluetooth requires net_admin and wake_alarm. 205be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -bluetooth } self:capability *; 206be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -bluetooth } self:capability2 *; 2076634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 2086634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Block device access. 209be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain dev_type:blk_file { read write }; 2106634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 2112a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Access to any of the following character devices. 212be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain { 2132a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley audio_device 2142a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley camera_device 2152a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley dm_device 2162a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley radio_device 2172a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley gps_device 2182a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley rpmsg_device 2192a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley}:chr_file { read write }; 2202a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2212a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Note: Try expanding list of app domains in the future. 222be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { untrusted_app isolated_app shell } graphics_device:chr_file { read write }; 2232a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 224be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -nfc } nfc_device:chr_file 2252a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { read write }; 226be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -bluetooth } hci_attach_dev:chr_file 2272a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { read write }; 228be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain tee_device:chr_file { read write }; 2292a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2306634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Privileged netlink socket interfaces. 231be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain 232bf626ce94452813e44433c40fb3d80f8b4b00ff5Nick Kralevich domain:{ 2336634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_firewall_socket 2346634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_tcpdiag_socket 2356634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_nflog_socket 2366634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_xfrm_socket 2376634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_audit_socket 2386634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_ip6fw_socket 2396634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich netlink_dnrt_socket 2406634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich } *; 2416634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 24236fb1f1bf3fa29a639e4c9d793b36cbbceae2ec7Nick Kralevich# These messages are broadcast messages from the kernel to userspace. 24336fb1f1bf3fa29a639e4c9d793b36cbbceae2ec7Nick Kralevich# Do not allow the writing of netlink messages, which has been a source 24436fb1f1bf3fa29a639e4c9d793b36cbbceae2ec7Nick Kralevich# of rooting vulns in the past. 245bf626ce94452813e44433c40fb3d80f8b4b00ff5Nick Kralevichneverallow appdomain domain:netlink_kobject_uevent_socket { write append }; 24636fb1f1bf3fa29a639e4c9d793b36cbbceae2ec7Nick Kralevich 2472a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Sockets under /dev/socket that are not specifically typed. 248be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain socket_device:sock_file write; 2492a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2502a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Unix domain sockets. 251be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain adbd_socket:sock_file write; 252be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain installd_socket:sock_file write; 25305383ebfb439bed8436912ed28db550e8842b343Martijn Coenenneverallow { appdomain -bluetooth -radio -shell -system_app -nfc } 2542a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley property_socket:sock_file write; 255be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -radio } rild_socket:sock_file write; 256be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain vold_socket:sock_file write; 257be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain zygote_socket:sock_file write; 2582a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2596634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# ptrace access to non-app domains. 260be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain { domain -appdomain }:process ptrace; 2616634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 2622a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Write access to /proc/pid entries for any non-app domain. 263be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain { domain -appdomain }:file write; 2642a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2652a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# signal access to non-app domains. 2662a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# sigchld allowed for parent death notification. 2672a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# signull allowed for kill(pid, 0) existence test. 2682a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# All others prohibited. 269be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain { domain -appdomain }:process 2702a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { sigkill sigstop signal }; 2712a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2726634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Transition to a non-app domain. 273396015c3952bcbd5678dc20d5e5e4407cf6a4d4aStephen Smalley# Exception for the shell domain, can transition to runas, etc. 274d990a78f8ef398488d6c0ce0a2d18b3d3a5183c4Stephen Smalleyneverallow { appdomain -shell } { domain -appdomain }:process 2752a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { transition dyntransition }; 2762a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2772a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Write to rootfs. 278be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain rootfs:dir_file_class_set 2792a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2806634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 2816634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Write to /system. 282be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain system_file:dir_file_class_set 2832a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2842a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2852a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Write to entrypoint executables. 286be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain exec_type:file 2872a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2886634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich 2896634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Write to system-owned parts of /data. 2906634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# This is the default type for anything under /data not otherwise 2916634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# specified in file_contexts. Define a different type for portions 2926634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# that should be writable by apps. 2936634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevich# Exception for system_app for Settings. 294be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -system_app } 2952a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley system_data_file:dir_file_class_set 2962a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 2972a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 2982a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Write to various other parts of /data. 299be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain drm_data_file:dir_file_class_set 3002a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 301480374e4d082238a71773f29483c5d24ad8b3f6dNick Kralevichneverallow { appdomain -system_app } 302480374e4d082238a71773f29483c5d24ad8b3f6dNick Kralevich gps_data_file:dir_file_class_set 3032a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 304be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -platform_app } 3052a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley apk_data_file:dir_file_class_set 3062a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 307be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -platform_app } 3082a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley apk_tmp_file:dir_file_class_set 3092a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 310be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -platform_app } 3112a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley apk_private_data_file:dir_file_class_set 3122a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 313be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -platform_app } 3142a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley apk_private_tmp_file:dir_file_class_set 3152a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 316be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -shell } 3172a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley shell_data_file:dir_file_class_set 3182e7a301fad5b6065e2d364170a80bc58bc41aab0Nick Kralevich { create setattr relabelfrom relabelto append unlink link rename }; 319be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -bluetooth } 3202a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley bluetooth_data_file:dir_file_class_set 3212a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 322be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain 3232a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley keystore_data_file:dir_file_class_set 3242a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 325be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain 3262a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley systemkeys_data_file:dir_file_class_set 3272a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 328be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain 3292a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley wifi_data_file:dir_file_class_set 3302a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 331be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain 3322a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley dhcp_data_file:dir_file_class_set 3332a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley { create write setattr relabelfrom relabelto append unlink link rename }; 3342a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 3352a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Access to factory files. 336a8b651bfba433ab91b565fea5276ceb7743ad15aNick Kralevichneverallow appdomain efs_file:dir_file_class_set write; 337a8b651bfba433ab91b565fea5276ceb7743ad15aNick Kralevichneverallow { appdomain -shell } efs_file:dir_file_class_set read; 3382a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 3392a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Write to various pseudo file systems. 340be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow { appdomain -bluetooth -nfc } 3412a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley sysfs:dir_file_class_set write; 342be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain 3432a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley proc:dir_file_class_set write; 3442a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 3452a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Access to syslog(2) or /proc/kmsg. 346685e2f9d9c0d3f64e9eabb789adb0b34f5f11836Nick Kralevichneverallow { appdomain -system_app } 347f821b5a7977102a417b32f358bf87d1e0cdeb06dNick Kralevich kernel:system { syslog_mod syslog_console }; 34842fb824ca9f3e46b4419f05083f2694ac67a8229Stephen Smalleyneverallow { appdomain -system_app -shell } 349f821b5a7977102a417b32f358bf87d1e0cdeb06dNick Kralevich kernel:system syslog_read; 3502a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 3512a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Ability to perform any filesystem operation other than statfs(2). 3522a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# i.e. no mount(2), unmount(2), etc. 353be66069765b019257ed3bf1ca1285e643360a998Nick Kralevichneverallow appdomain fs_type:filesystem ~getattr; 3542a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley 3552a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley# Ability to set system properties. 35605383ebfb439bed8436912ed28db550e8842b343Martijn Coenenneverallow { appdomain -system_app -radio -shell -bluetooth -nfc } 3572a273ad2c50b255985a71e92898ac9224a9d2bd7Stephen Smalley property_type:property_service set; 358