1### 2### neverallow rules for untrusted app domains 3### 4 5define(`all_untrusted_apps',`{ 6 ephemeral_app 7 isolated_app 8 mediaprovider 9 untrusted_app 10 untrusted_app_25 11 untrusted_app_27 12 untrusted_app_all 13 untrusted_v2_app 14}') 15# Receive or send uevent messages. 16neverallow all_untrusted_apps domain:netlink_kobject_uevent_socket *; 17 18# Receive or send generic netlink messages 19neverallow all_untrusted_apps domain:netlink_socket *; 20 21# Too much leaky information in debugfs. It's a security 22# best practice to ensure these files aren't readable. 23neverallow all_untrusted_apps debugfs_type:file read; 24 25# Do not allow untrusted apps to register services. 26# Only trusted components of Android should be registering 27# services. 28neverallow all_untrusted_apps service_manager_type:service_manager add; 29 30# Do not allow untrusted apps to use VendorBinder 31neverallow all_untrusted_apps vndbinder_device:chr_file *; 32neverallow all_untrusted_apps vndservice_manager_type:service_manager *; 33 34# Do not allow untrusted apps to connect to the property service 35# or set properties. b/10243159 36neverallow { all_untrusted_apps -mediaprovider } property_socket:sock_file write; 37neverallow { all_untrusted_apps -mediaprovider } init:unix_stream_socket connectto; 38neverallow { all_untrusted_apps -mediaprovider } property_type:property_service set; 39 40# net.dns properties are not a public API. Temporarily exempt pre-Oreo apps, 41# but otherwise disallow untrusted apps from reading this property. 42neverallow { all_untrusted_apps -untrusted_app_25 } net_dns_prop:file read; 43 44# Do not allow untrusted apps to be assigned mlstrustedsubject. 45# This would undermine the per-user isolation model being 46# enforced via levelFrom=user in seapp_contexts and the mls 47# constraints. As there is no direct way to specify a neverallow 48# on attribute assignment, this relies on the fact that fork 49# permission only makes sense within a domain (hence should 50# never be granted to any other domain within mlstrustedsubject) 51# and an untrusted app is allowed fork permission to itself. 52neverallow all_untrusted_apps mlstrustedsubject:process fork; 53 54# Do not allow untrusted apps to hard link to any files. 55# In particular, if an untrusted app links to other app data 56# files, installd will not be able to guarantee the deletion 57# of the linked to file. Hard links also contribute to security 58# bugs, so we want to ensure untrusted apps never have this 59# capability. 60neverallow all_untrusted_apps file_type:file link; 61 62# Do not allow untrusted apps to access network MAC address file 63neverallow all_untrusted_apps sysfs_mac_address:file no_rw_file_perms; 64 65# Do not allow any write access to files in /sys 66neverallow all_untrusted_apps sysfs_type:file { no_w_file_perms no_x_file_perms }; 67 68# Apps may never access the default sysfs label. 69neverallow all_untrusted_apps sysfs:file no_rw_file_perms; 70 71# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the 72# ioctl permission, or 3. disallow the socket class. 73neverallowxperm all_untrusted_apps domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls; 74neverallow all_untrusted_apps *:{ netlink_route_socket netlink_selinux_socket } ioctl; 75neverallow all_untrusted_apps *:{ 76 socket netlink_socket packet_socket key_socket appletalk_socket 77 netlink_tcpdiag_socket netlink_nflog_socket 78 netlink_xfrm_socket netlink_audit_socket 79 netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket 80 netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket 81 netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket 82 netlink_rdma_socket netlink_crypto_socket 83} *; 84 85# Do not allow untrusted apps access to /cache 86neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:dir ~{ r_dir_perms }; 87neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:file ~{ read getattr }; 88 89# Do not allow untrusted apps to create/unlink files outside of its sandbox, 90# internal storage or sdcard. 91# World accessible data locations allow application to fill the device 92# with unaccounted for data. This data will not get removed during 93# application un-installation. 94neverallow { all_untrusted_apps -mediaprovider } { 95 fs_type 96 -sdcard_type 97 file_type 98 -app_data_file # The apps sandbox itself 99 -media_rw_data_file # Internal storage. Known that apps can 100 # leave artfacts here after uninstall. 101 -user_profile_data_file # Access to profile files 102 userdebug_or_eng(` 103 -method_trace_data_file # only on ro.debuggable=1 104 -coredump_file # userdebug/eng only 105 ') 106}:dir_file_class_set { create unlink }; 107 108# No untrusted component should be touching /dev/fuse 109neverallow all_untrusted_apps fuse_device:chr_file *; 110 111# Do not allow untrusted apps to directly open tun_device 112neverallow all_untrusted_apps tun_device:chr_file open; 113 114# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553) 115neverallow all_untrusted_apps anr_data_file:file ~{ open append }; 116neverallow all_untrusted_apps anr_data_file:dir ~search; 117 118# Avoid reads from generically labeled /proc files 119# Create a more specific label if needed 120neverallow all_untrusted_apps { 121 proc 122 proc_asound 123 proc_filesystems 124 proc_kmsg 125 proc_loadavg 126 proc_mounts 127 proc_pagetypeinfo 128 proc_stat 129 proc_swaps 130 proc_uptime 131 proc_version 132 proc_vmallocinfo 133 proc_vmstat 134}:file { no_rw_file_perms no_x_file_perms }; 135 136# Avoid all access to kernel configuration 137neverallow all_untrusted_apps config_gz:file { no_rw_file_perms no_x_file_perms }; 138 139# Do not allow untrusted apps access to preloads data files 140neverallow all_untrusted_apps preloads_data_file:file no_rw_file_perms; 141 142# Locking of files on /system could lead to denial of service attacks 143# against privileged system components 144neverallow all_untrusted_apps system_file:file lock; 145 146# Do not permit untrusted apps to perform actions on HwBinder service_manager 147# other than find actions for services listed below 148neverallow all_untrusted_apps *:hwservice_manager ~find; 149 150# Do not permit access from apps which host arbitrary code to HwBinder services, 151# except those considered sufficiently safe for access from such apps. 152# The two main reasons for this are: 153# 1. HwBinder servers do not perform client authentication because HIDL 154# currently does not expose caller UID information and, even if it did, many 155# HwBinder services either operate at a level below that of apps (e.g., HALs) 156# or must not rely on app identity for authorization. Thus, to be safe, the 157# default assumption is that every HwBinder service treats all its clients as 158# equally authorized to perform operations offered by the service. 159# 2. HAL servers (a subset of HwBinder services) contain code with higher 160# incidence rate of security issues than system/core components and have 161# access to lower layes of the stack (all the way down to hardware) thus 162# increasing opportunities for bypassing the Android security model. 163# 164# Safe services include: 165# - same process services: because they by definition run in the process 166# of the client and thus have the same access as the client domain in which 167# the process runs 168# - coredomain_hwservice: are considered safe because they do not pose risks 169# associated with reason #2 above. 170# - hal_configstore_ISurfaceFlingerConfigs: becuase it has specifically been 171# designed for use by any domain. 172# - hal_graphics_allocator_hwservice: because these operations are also offered 173# by surfaceflinger Binder service, which apps are permitted to access 174# - hal_omx_hwservice: because this is a HwBinder version of the mediacodec 175# Binder service which apps were permitted to access. 176# - hal_codec2_hwservice: because this is a newer version of hal_omx_hwservice. 177neverallow all_untrusted_apps { 178 hwservice_manager_type 179 -same_process_hwservice 180 -coredomain_hwservice 181 -hal_codec2_hwservice 182 -hal_configstore_ISurfaceFlingerConfigs 183 -hal_graphics_allocator_hwservice 184 -hal_omx_hwservice 185 -hal_cas_hwservice 186 -hal_neuralnetworks_hwservice 187 -untrusted_app_visible_hwservice 188}:hwservice_manager find; 189 190# Make sure that the following services are never accessible by untrusted_apps 191neverallow all_untrusted_apps { 192 default_android_hwservice 193 hal_audio_hwservice 194 hal_authsecret_hwservice 195 hal_bluetooth_hwservice 196 hal_bootctl_hwservice 197 hal_camera_hwservice 198 hal_confirmationui_hwservice 199 hal_contexthub_hwservice 200 hal_drm_hwservice 201 hal_dumpstate_hwservice 202 hal_fingerprint_hwservice 203 hal_gatekeeper_hwservice 204 hal_gnss_hwservice 205 hal_graphics_composer_hwservice 206 hal_health_hwservice 207 hal_ir_hwservice 208 hal_keymaster_hwservice 209 hal_light_hwservice 210 hal_memtrack_hwservice 211 hal_nfc_hwservice 212 hal_oemlock_hwservice 213 hal_power_hwservice 214 hal_secure_element_hwservice 215 hal_sensors_hwservice 216 hal_telephony_hwservice 217 hal_thermal_hwservice 218 hal_tv_cec_hwservice 219 hal_tv_input_hwservice 220 hal_usb_hwservice 221 hal_vibrator_hwservice 222 hal_vr_hwservice 223 hal_weaver_hwservice 224 hal_wifi_hwservice 225 hal_wifi_offload_hwservice 226 hal_wifi_supplicant_hwservice 227 hidl_base_hwservice 228 system_net_netd_hwservice 229 thermalcallback_hwservice 230}:hwservice_manager find; 231# HwBinder services offered by core components (as opposed to vendor components) 232# are considered somewhat safer due to point #2 above. 233neverallow all_untrusted_apps { 234 coredomain_hwservice 235 -same_process_hwservice 236 -hidl_allocator_hwservice # Designed for use by any domain 237 -hidl_manager_hwservice # Designed for use by any domain 238 -hidl_memory_hwservice # Designed for use by any domain 239 -hidl_token_hwservice # Designed for use by any domain 240}:hwservice_manager find; 241 242# SELinux is not an API for untrusted apps to use 243neverallow all_untrusted_apps selinuxfs:file no_rw_file_perms; 244 245# Restrict *Binder access from apps to HAL domains. We can only do this on full 246# Treble devices where *Binder communications between apps and HALs are tightly 247# restricted. 248full_treble_only(` 249 neverallow all_untrusted_apps { 250 halserverdomain 251 -coredomain 252 -hal_configstore_server 253 -hal_graphics_allocator_server 254 -hal_cas_server 255 -hal_neuralnetworks_server 256 -binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone 257 -untrusted_app_visible_halserver 258 }:binder { call transfer }; 259') 260 261# Untrusted apps are not allowed to find mediaextractor update service. 262neverallow all_untrusted_apps mediaextractor_update_service:service_manager find; 263