app_neverallows.te revision c9d4a86d0ab87ab3ba3849ffc0baafc046518b0f 
1###
2### neverallow rules for untrusted app domains
3###
4
5define(`all_untrusted_apps',`{
6  ephemeral_app
7  isolated_app
8  mediaprovider
9  untrusted_app
10  untrusted_app_25
11  untrusted_app_all
12  untrusted_v2_app
13}')
14# Receive or send uevent messages.
15neverallow all_untrusted_apps domain:netlink_kobject_uevent_socket *;
16
17# Receive or send generic netlink messages
18neverallow all_untrusted_apps domain:netlink_socket *;
19
20# Too much leaky information in debugfs. It's a security
21# best practice to ensure these files aren't readable.
22neverallow all_untrusted_apps debugfs_type:file read;
23
24# Do not allow untrusted apps to register services.
25# Only trusted components of Android should be registering
26# services.
27neverallow all_untrusted_apps service_manager_type:service_manager add;
28
29# Do not allow untrusted apps to use VendorBinder
30neverallow all_untrusted_apps vndbinder_device:chr_file *;
31neverallow all_untrusted_apps vndservice_manager_type:service_manager *;
32
33# Do not allow untrusted apps to connect to the property service
34# or set properties. b/10243159
35neverallow { all_untrusted_apps -mediaprovider } property_socket:sock_file write;
36neverallow { all_untrusted_apps -mediaprovider } init:unix_stream_socket connectto;
37neverallow { all_untrusted_apps -mediaprovider } property_type:property_service set;
38
39# Do not allow untrusted apps to be assigned mlstrustedsubject.
40# This would undermine the per-user isolation model being
41# enforced via levelFrom=user in seapp_contexts and the mls
42# constraints.  As there is no direct way to specify a neverallow
43# on attribute assignment, this relies on the fact that fork
44# permission only makes sense within a domain (hence should
45# never be granted to any other domain within mlstrustedsubject)
46# and an untrusted app is allowed fork permission to itself.
47neverallow all_untrusted_apps mlstrustedsubject:process fork;
48
49# Do not allow untrusted apps to hard link to any files.
50# In particular, if an untrusted app links to other app data
51# files, installd will not be able to guarantee the deletion
52# of the linked to file. Hard links also contribute to security
53# bugs, so we want to ensure untrusted apps never have this
54# capability.
55neverallow all_untrusted_apps file_type:file link;
56
57# Do not allow untrusted apps to access network MAC address file
58neverallow all_untrusted_apps sysfs_mac_address:file no_rw_file_perms;
59
60# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the
61# ioctl permission, or 3. disallow the socket class.
62neverallowxperm all_untrusted_apps domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
63neverallow all_untrusted_apps *:{ netlink_route_socket netlink_selinux_socket } ioctl;
64neverallow all_untrusted_apps *:{
65  socket netlink_socket packet_socket key_socket appletalk_socket
66  netlink_tcpdiag_socket netlink_nflog_socket
67  netlink_xfrm_socket netlink_audit_socket
68  netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
69  netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
70  netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
71  netlink_rdma_socket netlink_crypto_socket
72} *;
73
74# Do not allow untrusted apps access to /cache
75neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:dir ~{ r_dir_perms };
76neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:file ~{ read getattr };
77
78# Do not allow untrusted apps to create/unlink files outside of its sandbox,
79# internal storage or sdcard.
80# World accessible data locations allow application to fill the device
81# with unaccounted for data. This data will not get removed during
82# application un-installation.
83neverallow { all_untrusted_apps -mediaprovider } {
84  fs_type
85  -fuse                     # sdcard
86  -sdcardfs                 # sdcard
87  -vfat
88  file_type
89  -app_data_file            # The apps sandbox itself
90  -media_rw_data_file       # Internal storage. Known that apps can
91                            # leave artfacts here after uninstall.
92  -user_profile_data_file   # Access to profile files
93  userdebug_or_eng(`
94    -method_trace_data_file # only on ro.debuggable=1
95    -coredump_file          # userdebug/eng only
96  ')
97}:dir_file_class_set { create unlink };
98
99# No untrusted component should be touching /dev/fuse
100neverallow all_untrusted_apps fuse_device:chr_file *;
101
102# Do not allow untrusted apps to directly open tun_device
103neverallow all_untrusted_apps tun_device:chr_file open;
104
105# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553)
106neverallow all_untrusted_apps anr_data_file:file ~{ open append };
107neverallow all_untrusted_apps anr_data_file:dir ~search;
108
109# Avoid reads from generically labeled /proc files
110# Create a more specific label if needed
111neverallow all_untrusted_apps proc:file { no_rw_file_perms no_x_file_perms };
112
113# Avoid all access to kernel configuration
114neverallow all_untrusted_apps config_gz:file { no_rw_file_perms no_x_file_perms };
115
116# Do not allow untrusted apps access to preloads data files
117neverallow all_untrusted_apps preloads_data_file:file no_rw_file_perms;
118
119# Locking of files on /system could lead to denial of service attacks
120# against privileged system components
121neverallow all_untrusted_apps system_file:file lock;
122
123# Do not permit untrusted apps to perform actions on HwBinder service_manager
124# other than find actions for services listed below
125neverallow all_untrusted_apps *:hwservice_manager ~find;
126
127# Do not permit access from apps which host arbitrary code to HwBinder services,
128# except those considered sufficiently safe for access from such apps.
129# The two main reasons for this are:
130# 1. HwBinder servers do not perform client authentication because HIDL
131#    currently does not expose caller UID information and, even if it did, many
132#    HwBinder services either operate at a level below that of apps (e.g., HALs)
133#    or must not rely on app identity for authorization. Thus, to be safe, the
134#    default assumption is that every HwBinder service treats all its clients as
135#    equally authorized to perform operations offered by the service.
136# 2. HAL servers (a subset of HwBinder services) contain code with higher
137#    incidence rate of security issues than system/core components and have
138#    access to lower layes of the stack (all the way down to hardware) thus
139#    increasing opportunities for bypassing the Android security model.
140#
141# Safe services include:
142# - same process services: because they by definition run in the process
143#   of the client and thus have the same access as the client domain in which
144#   the process runs
145# - coredomain_hwservice: are considered safe because they do not pose risks
146#   associated with reason #2 above.
147# - hal_configstore_ISurfaceFlingerConfigs:  becuase it has specifically been
148#   designed for use by any domain.
149# - hal_graphics_allocator_hwservice: because these operations are also offered
150#   by surfaceflinger Binder service, which apps are permitted to access
151# - hal_omx_hwservice: because this is a HwBinder version of the mediacodec
152#   Binder service which apps were permitted to access.
153neverallow all_untrusted_apps {
154  hwservice_manager_type
155  -same_process_hwservice
156  -coredomain_hwservice
157  -hal_configstore_ISurfaceFlingerConfigs
158  -hal_graphics_allocator_hwservice
159  -hal_omx_hwservice
160  -hal_cas_hwservice
161  -untrusted_app_visible_hwservice
162}:hwservice_manager find;
163neverallow untrusted_app_visible_hwservice unlabeled:service_manager list; #TODO: b/62658302
164# Make sure that the following services are never accessible by untrusted_apps
165neverallow all_untrusted_apps {
166  default_android_hwservice
167  hal_audio_hwservice
168  hal_bluetooth_hwservice
169  hal_bootctl_hwservice
170  hal_camera_hwservice
171  hal_contexthub_hwservice
172  hal_drm_hwservice
173  hal_dumpstate_hwservice
174  hal_fingerprint_hwservice
175  hal_gatekeeper_hwservice
176  hal_gnss_hwservice
177  hal_graphics_composer_hwservice
178  hal_health_hwservice
179  hal_ir_hwservice
180  hal_keymaster_hwservice
181  hal_light_hwservice
182  hal_memtrack_hwservice
183  hal_neuralnetworks_hwservice
184  hal_nfc_hwservice
185  hal_oemlock_hwservice
186  hal_power_hwservice
187  hal_sensors_hwservice
188  hal_telephony_hwservice
189  hal_thermal_hwservice
190  hal_tv_cec_hwservice
191  hal_tv_input_hwservice
192  hal_usb_hwservice
193  hal_vibrator_hwservice
194  hal_vr_hwservice
195  hal_weaver_hwservice
196  hal_wifi_hwservice
197  hal_wifi_offload_hwservice
198  hal_wifi_supplicant_hwservice
199  hidl_base_hwservice
200  system_net_netd_hwservice
201  thermalcallback_hwservice
202}:hwservice_manager find;
203# HwBinder services offered by core components (as opposed to vendor components)
204# are considered somewhat safer due to point #2 above.
205neverallow all_untrusted_apps {
206  coredomain_hwservice
207  -same_process_hwservice
208  -hidl_allocator_hwservice # Designed for use by any domain
209  -hidl_manager_hwservice # Designed for use by any domain
210  -hidl_memory_hwservice # Designed for use by any domain
211  -hidl_token_hwservice # Designed for use by any domain
212}:hwservice_manager find;
213
214# SELinux is not an API for untrusted apps to use
215neverallow all_untrusted_apps selinuxfs:file no_rw_file_perms;
216
217# Restrict *Binder access from apps to HAL domains. We can only do this on full
218# Treble devices where *Binder communications between apps and HALs are tightly
219# restricted.
220full_treble_only(`
221  neverallow all_untrusted_apps {
222    halserverdomain
223    -coredomain
224    -hal_configstore_server
225    -hal_graphics_allocator_server
226    -hal_cas_server
227    -binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone
228  }:binder { call transfer };
229')
230