app_neverallows.te revision bd64d7fba884160efc00956730b9d7a8e2e268b6 
1###
2### neverallow rules for untrusted app domains
3###
4
5# Only allow domains in AOSP to use the untrusted_app_all attribute.
6neverallow { untrusted_app_all -untrusted_app -untrusted_app_25 } domain:process fork;
7
8define(`all_untrusted_apps',`{
9  ephemeral_app
10  isolated_app
11  mediaprovider
12  untrusted_app
13  untrusted_app_25
14  untrusted_app_all
15  untrusted_v2_app
16}')
17# Receive or send uevent messages.
18neverallow all_untrusted_apps domain:netlink_kobject_uevent_socket *;
19
20# Receive or send generic netlink messages
21neverallow all_untrusted_apps domain:netlink_socket *;
22
23# Too much leaky information in debugfs. It's a security
24# best practice to ensure these files aren't readable.
25neverallow all_untrusted_apps debugfs_type:file read;
26
27# Do not allow untrusted apps to register services.
28# Only trusted components of Android should be registering
29# services.
30neverallow all_untrusted_apps service_manager_type:service_manager add;
31
32# Do not allow untrusted apps to use VendorBinder
33neverallow all_untrusted_apps vndbinder_device:chr_file *;
34neverallow all_untrusted_apps vndservice_manager_type:service_manager *;
35
36# Do not allow untrusted apps to connect to the property service
37# or set properties. b/10243159
38neverallow { all_untrusted_apps -mediaprovider } property_socket:sock_file write;
39neverallow { all_untrusted_apps -mediaprovider } init:unix_stream_socket connectto;
40neverallow { all_untrusted_apps -mediaprovider } property_type:property_service set;
41
42# Do not allow untrusted apps to be assigned mlstrustedsubject.
43# This would undermine the per-user isolation model being
44# enforced via levelFrom=user in seapp_contexts and the mls
45# constraints.  As there is no direct way to specify a neverallow
46# on attribute assignment, this relies on the fact that fork
47# permission only makes sense within a domain (hence should
48# never be granted to any other domain within mlstrustedsubject)
49# and an untrusted app is allowed fork permission to itself.
50neverallow all_untrusted_apps mlstrustedsubject:process fork;
51
52# Do not allow untrusted apps to hard link to any files.
53# In particular, if an untrusted app links to other app data
54# files, installd will not be able to guarantee the deletion
55# of the linked to file. Hard links also contribute to security
56# bugs, so we want to ensure untrusted apps never have this
57# capability.
58neverallow all_untrusted_apps file_type:file link;
59
60# Do not allow untrusted apps to access network MAC address file
61neverallow all_untrusted_apps sysfs_mac_address:file no_rw_file_perms;
62
63# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the
64# ioctl permission, or 3. disallow the socket class.
65neverallowxperm all_untrusted_apps domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
66neverallow all_untrusted_apps *:{ netlink_route_socket netlink_selinux_socket } ioctl;
67neverallow all_untrusted_apps *:{
68  socket netlink_socket packet_socket key_socket appletalk_socket
69  netlink_tcpdiag_socket netlink_nflog_socket
70  netlink_xfrm_socket netlink_audit_socket
71  netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
72  netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
73  netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
74  netlink_rdma_socket netlink_crypto_socket
75} *;
76
77# Do not allow untrusted apps access to /cache
78neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:dir ~{ r_dir_perms };
79neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:file ~{ read getattr };
80
81# Do not allow untrusted apps to create/unlink files outside of its sandbox,
82# internal storage or sdcard.
83# World accessible data locations allow application to fill the device
84# with unaccounted for data. This data will not get removed during
85# application un-installation.
86neverallow { all_untrusted_apps -mediaprovider } {
87  fs_type
88  -fuse                     # sdcard
89  -sdcardfs                 # sdcard
90  -vfat
91  file_type
92  -app_data_file            # The apps sandbox itself
93  -media_rw_data_file       # Internal storage. Known that apps can
94                            # leave artfacts here after uninstall.
95  -user_profile_data_file   # Access to profile files
96  userdebug_or_eng(`
97    -method_trace_data_file # only on ro.debuggable=1
98    -coredump_file          # userdebug/eng only
99  ')
100}:dir_file_class_set { create unlink };
101
102# No untrusted component should be touching /dev/fuse
103neverallow all_untrusted_apps fuse_device:chr_file *;
104
105# Do not allow untrusted apps to directly open tun_device
106neverallow all_untrusted_apps tun_device:chr_file open;
107
108# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553)
109neverallow all_untrusted_apps anr_data_file:file ~{ open append };
110neverallow all_untrusted_apps anr_data_file:dir ~search;
111
112# Avoid reads from generically labeled /proc files
113# Create a more specific label if needed
114neverallow all_untrusted_apps proc:file { no_rw_file_perms no_x_file_perms };
115
116# Avoid all access to kernel configuration
117neverallow all_untrusted_apps config_gz:file { no_rw_file_perms no_x_file_perms };
118
119# Do not allow untrusted apps access to preloads data files
120neverallow all_untrusted_apps preloads_data_file:file no_rw_file_perms;
121
122# Locking of files on /system could lead to denial of service attacks
123# against privileged system components
124neverallow all_untrusted_apps system_file:file lock;
125
126# Do not permit untrusted apps to perform actions on HwBinder service_manager
127# other than find actions for services listed below
128neverallow all_untrusted_apps *:hwservice_manager ~find;
129
130# Do not permit access from apps which host arbitrary code to HwBinder services,
131# except those considered sufficiently safe for access from such apps.
132# The two main reasons for this are:
133# 1. HwBinder servers do not perform client authentication because HIDL
134#    currently does not expose caller UID information and, even if it did, many
135#    HwBinder services either operate at a level below that of apps (e.g., HALs)
136#    or must not rely on app identity for authorization. Thus, to be safe, the
137#    default assumption is that every HwBinder service treats all its clients as
138#    equally authorized to perform operations offered by the service.
139# 2. HAL servers (a subset of HwBinder services) contain code with higher
140#    incidence rate of security issues than system/core components and have
141#    access to lower layes of the stack (all the way down to hardware) thus
142#    increasing opportunities for bypassing the Android security model.
143neverallow all_untrusted_apps {
144  hwservice_manager_type
145  # Same process services are safe because they by definition run in the process
146  # of the client and thus have the same access as the client domain in which
147  # the process runs
148  -same_process_hwservice
149  -coredomain_hwservice # neverallows for coredomain HwBinder services are below
150  -hal_configstore_ISurfaceFlingerConfigs # Designed for use by any domain
151  # These operations are also offered by surfaceflinger Binder service which
152  # apps are permitted to access
153  -hal_graphics_allocator_hwservice
154  # HwBinder version of mediacodec Binder service which apps were permitted to
155  # access
156  -hal_omx_hwservice
157}:hwservice_manager find;
158# HwBinder services offered by core components (as opposed to vendor components)
159# are considered somewhat safer due to point #2 above.
160neverallow all_untrusted_apps {
161  coredomain_hwservice
162  -same_process_hwservice
163  -hidl_allocator_hwservice # Designed for use by any domain
164  -hidl_manager_hwservice # Designed for use by any domain
165  -hidl_memory_hwservice # Designed for use by any domain
166  -hidl_token_hwservice # Designed for use by any domain
167}:hwservice_manager find;
168
169# Restrict *Binder access from apps to HAL domains. We can only do this on full
170# Treble devices where *Binder communications between apps and HALs are tightly
171# restricted.
172full_treble_only(`
173  neverallow all_untrusted_apps {
174    halserverdomain
175    -coredomain
176    -hal_configstore_server
177    -hal_graphics_allocator_server
178    -binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone
179  }:binder { call transfer };
180')
181