domain.te revision ad0d0fc722d04e465ce2b0bfd2f8e04714c75391
1dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich# Rules for all domains. 2dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich 3dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich# Allow reaping by init. 4dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain init:process sigchld; 5dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich 6dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich# Read access to properties mapping. 7dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain kernel:fd use; 8dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain tmpfs:file { read getattr }; 9dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich 10dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich# Search /storage/emulated tmpfs mount. 11dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain tmpfs:dir r_dir_perms; 12dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich 13dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich# Intra-domain accesses. 14356f4be679544363466dad93e7bee68b2a6f2cf0Stephen Smalleyallow domain self:process ~{ execmem execstack execheap ptrace setexec setfscreate setcurrent setkeycreate setsockcreate }; 15dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain self:fd use; 16dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain self:dir r_dir_perms; 17dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain self:lnk_file r_file_perms; 18dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain self:{ fifo_file file } rw_file_perms; 191601132086b054adc70e7f8f38ed24574c90bc37Stephen Smalleyallow domain self:unix_dgram_socket { create_socket_perms sendto }; 201601132086b054adc70e7f8f38ed24574c90bc37Stephen Smalleyallow domain self:unix_stream_socket { create_stream_socket_perms connectto }; 21dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich 22dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich# Inherit or receive open files from others. 23dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain init:fd use; 241fdee11df2552e29da0c48e3432f26f7a93e3bffAlex Klyubinallow domain system_server:fd use; 25dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich 26dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich# Connect to adbd and use a socket transferred from it. 27c4021cebcf19a4c3f95395f7715a3cc9ed2b44c0Stephen Smalley# This is used for e.g. adb backup/restore. 28dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain adbd:unix_stream_socket connectto; 29dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain adbd:fd use; 30c4021cebcf19a4c3f95395f7715a3cc9ed2b44c0Stephen Smalleyallow domain adbd:unix_stream_socket { getattr getopt read write shutdown }; 31dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich 327d0f955ef09be5b2558da432a1f8cd525c5ccfe4Nick Kralevichuserdebug_or_eng(` 337d0f955ef09be5b2558da432a1f8cd525c5ccfe4Nick Kralevich # Same as adbd rules above, except allow su to do the same thing 347d0f955ef09be5b2558da432a1f8cd525c5ccfe4Nick Kralevich allow domain su:unix_stream_socket connectto; 357d0f955ef09be5b2558da432a1f8cd525c5ccfe4Nick Kralevich allow domain su:fd use; 367d0f955ef09be5b2558da432a1f8cd525c5ccfe4Nick Kralevich allow domain su:unix_stream_socket { getattr getopt read write shutdown }; 377d0f955ef09be5b2558da432a1f8cd525c5ccfe4Nick Kralevich 383dad7b611a448fa43a678ff760c23a00f387947eStephen Smalley binder_call(domain, su) 393dad7b611a448fa43a678ff760c23a00f387947eStephen Smalley 407d0f955ef09be5b2558da432a1f8cd525c5ccfe4Nick Kralevich # Running something like "pm dump com.android.bluetooth" requires 417d0f955ef09be5b2558da432a1f8cd525c5ccfe4Nick Kralevich # fifo writes 427d0f955ef09be5b2558da432a1f8cd525c5ccfe4Nick Kralevich allow domain su:fifo_file { write getattr }; 437d0f955ef09be5b2558da432a1f8cd525c5ccfe4Nick Kralevich 447d0f955ef09be5b2558da432a1f8cd525c5ccfe4Nick Kralevich # allow "gdbserver --attach" to work for su. 457d0f955ef09be5b2558da432a1f8cd525c5ccfe4Nick Kralevich allow domain su:process sigchld; 467d0f955ef09be5b2558da432a1f8cd525c5ccfe4Nick Kralevich') 477d0f955ef09be5b2558da432a1f8cd525c5ccfe4Nick Kralevich 485919d1c86a2a1fea52f840ab30709048bd63f1f5Nick Kralevich### 495919d1c86a2a1fea52f840ab30709048bd63f1f5Nick Kralevich### Talk to debuggerd. 505919d1c86a2a1fea52f840ab30709048bd63f1f5Nick Kralevich### 51dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain debuggerd:process sigchld; 52dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain debuggerd:unix_stream_socket connectto; 53dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich 54dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich# Root fs. 55dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain rootfs:dir r_dir_perms; 566634a1080e6617854d0b29bc65bb1c852ad3d5b6Nick Kralevichallow domain rootfs:file r_file_perms; 57712ca0a4d5c3ff77179da2544aafd6eb8e5a70c2Stephen Smalleyallow domain rootfs:lnk_file r_file_perms; 58dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich 59dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich# Device accesses. 60dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain device:dir search; 61712ca0a4d5c3ff77179da2544aafd6eb8e5a70c2Stephen Smalleyallow domain dev_type:lnk_file r_file_perms; 62dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain devpts:dir search; 63dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain device:file read; 6420feb75b572a21a7a376d6780cc5c1d636cda610Robert Craigallow domain socket_device:dir r_dir_perms; 65dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain owntty_device:chr_file rw_file_perms; 66dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain null_device:chr_file rw_file_perms; 67f007d03628f98a40c01c12ad105ca6be14fd3c78Nick Kralevichallow domain zero_device:chr_file rw_file_perms; 68dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain ashmem_device:chr_file rw_file_perms; 69dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain binder_device:chr_file rw_file_perms; 70dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain ptmx_device:chr_file rw_file_perms; 71dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain log_device:dir search; 72dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain log_device:chr_file rw_file_perms; 73dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain alarm_device:chr_file r_file_perms; 74a2477056ae6a702e7e71b671cd0c47afc1c7da8aAlex Klyubinallow domain urandom_device:chr_file rw_file_perms; 75a2477056ae6a702e7e71b671cd0c47afc1c7da8aAlex Klyubinallow domain random_device:chr_file rw_file_perms; 76dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain properties_device:file r_file_perms; 77dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich 788ed750e9731e6e3a21785e91e9b1cf7390c16738Mark Salyzyn# logd access 798ed750e9731e6e3a21785e91e9b1cf7390c16738Mark Salyzynwrite_logd(domain) 808ed750e9731e6e3a21785e91e9b1cf7390c16738Mark Salyzyn 81dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich# Filesystem accesses. 82dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain fs_type:filesystem getattr; 83dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain fs_type:dir getattr; 84dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich 85dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich# System file accesses. 86dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain system_file:dir r_dir_perms; 87dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain system_file:file r_file_perms; 88dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain system_file:file execute; 89712ca0a4d5c3ff77179da2544aafd6eb8e5a70c2Stephen Smalleyallow domain system_file:lnk_file r_file_perms; 90dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich 91dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich# Read files already opened under /data. 92dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain system_data_file:dir { search getattr }; 93dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain system_data_file:file { getattr read }; 94712ca0a4d5c3ff77179da2544aafd6eb8e5a70c2Stephen Smalleyallow domain system_data_file:lnk_file r_file_perms; 95dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich 96dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich# Read apk files under /data/app. 9781560733a47633036133ce548bf638bc3d91f5cfGeremy Condraallow domain apk_data_file:dir { getattr search }; 98dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain apk_data_file:file r_file_perms; 99dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich 100dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich# Read /data/dalvik-cache. 101dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain dalvikcache_data_file:dir { search getattr }; 102dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain dalvikcache_data_file:file r_file_perms; 10319c509034ee309c60c958637841c151d3c273421Stephen Smalleyallow domain dalvikcache_profiles_data_file:dir { search getattr }; 10419c509034ee309c60c958637841c151d3c273421Stephen Smalleyallow domain dalvikcache_profiles_data_file:file r_file_perms; 105dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich 106dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich# Read already opened /cache files. 107dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain cache_file:dir r_dir_perms; 108dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain cache_file:file { getattr read }; 109712ca0a4d5c3ff77179da2544aafd6eb8e5a70c2Stephen Smalleyallow domain cache_file:lnk_file r_file_perms; 110dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich 1117466f9b69341e3d86b0242d8ad18ae98d22f05a2Nick Kralevich# Read timezone related information 1127466f9b69341e3d86b0242d8ad18ae98d22f05a2Nick Kralevichr_dir_file(domain, zoneinfo_data_file) 1137466f9b69341e3d86b0242d8ad18ae98d22f05a2Nick Kralevich 114dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich# For /acct/uid/*/tasks. 115dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain cgroup:dir { search write }; 116dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain cgroup:file w_file_perms; 117dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich 118dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich#Allow access to ion memory allocation device 119dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain ion_device:chr_file rw_file_perms; 120dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich 121dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich# Read access to pseudo filesystems. 122dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichr_dir_file(domain, proc) 123dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichr_dir_file(domain, sysfs) 124967f39a6e88c60b5f65a37397d6619197a1d0514Nick Kralevichr_dir_file(domain, sysfs_devices_system_cpu) 125dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichr_dir_file(domain, inotify) 126dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichr_dir_file(domain, cgroup) 127529fcbe06506d62370525f04380ae41ae7fc7892Robert Craigr_dir_file(domain, proc_net) 128dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich 129dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich# debugfs access 130dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain debugfs:dir r_dir_perms; 1318758cc5f8b341352e553e62989e7eab57b094e1dNick Kralevichallow domain debugfs:file w_file_perms; 132dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevich 133712ca0a4d5c3ff77179da2544aafd6eb8e5a70c2Stephen Smalley# Get SELinux enforcing status. 134712ca0a4d5c3ff77179da2544aafd6eb8e5a70c2Stephen Smalleyselinux_getenforce(domain) 135712ca0a4d5c3ff77179da2544aafd6eb8e5a70c2Stephen Smalley 136f926817875dfabc7698013bead30f5aaf7867bdfStephen Smalley# /data/security files 137dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain security_file:dir { search getattr }; 138dbd28d91d3c6d970f1704df8350b0333b51758b1Nick Kralevichallow domain security_file:file getattr; 139f926817875dfabc7698013bead30f5aaf7867bdfStephen Smalleyallow domain security_file:lnk_file r_file_perms; 1400c9708b2af4ea345277a47ae7bc1ce890e90d2bcNick Kralevich 14148b18832c476f0bd8fcb8ee3e308258392f36aafRobert Craig# World readable asec image contents 14248b18832c476f0bd8fcb8ee3e308258392f36aafRobert Craigallow domain asec_public_file:file r_file_perms; 14348b18832c476f0bd8fcb8ee3e308258392f36aafRobert Craigallow domain { asec_public_file asec_apk_file }:dir r_dir_perms; 14448b18832c476f0bd8fcb8ee3e308258392f36aafRobert Craig 1455ce079b9165c18a5bd27b853e82478de8d9e0a7bNick Kralevich######## Backwards compatibility - Unlabeled files ############ 1465ce079b9165c18a5bd27b853e82478de8d9e0a7bNick Kralevich 1475ce079b9165c18a5bd27b853e82478de8d9e0a7bNick Kralevich# Revert to DAC rules when looking at unlabeled files. Over time, the number 1485ce079b9165c18a5bd27b853e82478de8d9e0a7bNick Kralevich# of unlabeled files should decrease. 1495ce079b9165c18a5bd27b853e82478de8d9e0a7bNick Kralevich# TODO: delete these rules in the future. 1505ce079b9165c18a5bd27b853e82478de8d9e0a7bNick Kralevich# 1515ce079b9165c18a5bd27b853e82478de8d9e0a7bNick Kralevichallow domain unlabeled:notdevfile_class_set { create_file_perms relabelfrom }; 1525ce079b9165c18a5bd27b853e82478de8d9e0a7bNick Kralevichallow domain unlabeled:dir { create_dir_perms relabelfrom }; 1537a186b3fa80000acf0d7d2e9ad7d597433aebc82Nick Kralevichauditallow { domain -init -installd } unlabeled:notdevfile_class_set { create_file_perms relabelfrom }; 1547a186b3fa80000acf0d7d2e9ad7d597433aebc82Nick Kralevichauditallow { domain -init -kernel -installd } unlabeled:dir { create_dir_perms relabelfrom }; 1555ce079b9165c18a5bd27b853e82478de8d9e0a7bNick Kralevichauditallow kernel unlabeled:dir ~search; 1567a186b3fa80000acf0d7d2e9ad7d597433aebc82Nick Kralevichauditallow installd unlabeled:dir ~{ getattr search relabelfrom }; 1577a186b3fa80000acf0d7d2e9ad7d597433aebc82Nick Kralevichauditallow installd unlabeled:notdevfile_class_set ~{ getattr relabelfrom }; 1585ce079b9165c18a5bd27b853e82478de8d9e0a7bNick Kralevich 1592637198f92d5d9c65262e42d78123d216889d546Nick Kralevich### 1602637198f92d5d9c65262e42d78123d216889d546Nick Kralevich### neverallow rules 1612637198f92d5d9c65262e42d78123d216889d546Nick Kralevich### 1622637198f92d5d9c65262e42d78123d216889d546Nick Kralevich 1635487ca00d4788de367a9d099714f6df4d86ef261Stephen Smalley# Limit ability to ptrace or read sensitive /proc/pid files of processes 1645487ca00d4788de367a9d099714f6df4d86ef261Stephen Smalley# with other UIDs to these whitelisted domains. 1655487ca00d4788de367a9d099714f6df4d86ef261Stephen Smalleyneverallow { domain -debuggerd -vold -dumpstate -system_server } self:capability sys_ptrace; 1665487ca00d4788de367a9d099714f6df4d86ef261Stephen Smalley 1675487ca00d4788de367a9d099714f6df4d86ef261Stephen Smalley# Limit device node creation and raw I/O to these whitelisted domains. 16896eeb1ecb3980e34a5f9ed1a4afd8ffa6ada0cf0Nick Kralevichneverallow { domain -kernel -init -recovery -ueventd -watchdogd -healthd -vold -uncrypt } self:capability { sys_rawio mknod }; 1695487ca00d4788de367a9d099714f6df4d86ef261Stephen Smalley 1707ffb9972076bfbd2abab1df6b4d759d14d55af96Stephen Smalley# No process can map low memory (< CONFIG_LSM_MMAP_MIN_ADDR). 1717ffb9972076bfbd2abab1df6b4d759d14d55af96Stephen Smalleyneverallow domain self:memprotect mmap_zero; 1727ffb9972076bfbd2abab1df6b4d759d14d55af96Stephen Smalley 1735487ca00d4788de367a9d099714f6df4d86ef261Stephen Smalley# No domain needs mac_override as it is unused by SELinux. 17404ee5dfb80491f8493fedcd099bd4551c9503c83Stephen Smalleyneverallow domain self:capability2 mac_override; 1755487ca00d4788de367a9d099714f6df4d86ef261Stephen Smalley 1765487ca00d4788de367a9d099714f6df4d86ef261Stephen Smalley# Only recovery needs mac_admin to set contexts not defined in current policy. 17704ee5dfb80491f8493fedcd099bd4551c9503c83Stephen Smalleyneverallow { domain -recovery } self:capability2 mac_admin; 17804ee5dfb80491f8493fedcd099bd4551c9503c83Stephen Smalley 179fea6e66fad0dd87e66d4df8255733b6840752316Stephen Smalley# Only init should be able to load SELinux policies. 180fea6e66fad0dd87e66d4df8255733b6840752316Stephen Smalley# The first load technically occurs while still in the kernel domain, 181fea6e66fad0dd87e66d4df8255733b6840752316Stephen Smalley# but this does not trigger a denial since there is no policy yet. 182fea6e66fad0dd87e66d4df8255733b6840752316Stephen Smalley# Policy reload requires allowing this to the init domain. 183fea6e66fad0dd87e66d4df8255733b6840752316Stephen Smalleyneverallow { domain -init } kernel:security load_policy; 184fea6e66fad0dd87e66d4df8255733b6840752316Stephen Smalley 185fea6e66fad0dd87e66d4df8255733b6840752316Stephen Smalley# Only init prior to switching context should be able to set enforcing mode. 186fea6e66fad0dd87e66d4df8255733b6840752316Stephen Smalley# init starts in kernel domain and switches to init domain via setcon in 187fea6e66fad0dd87e66d4df8255733b6840752316Stephen Smalley# the init.rc, so the setenforce occurs while still in kernel. After 188fea6e66fad0dd87e66d4df8255733b6840752316Stephen Smalley# switching domains, there is never any need to setenforce again by init. 189abae8a9b586c98cf3e7bd08e63473a5ce99ccd27Nick Kralevichneverallow domain kernel:security setenforce; 190abae8a9b586c98cf3e7bd08e63473a5ce99ccd27Nick Kralevichneverallow { domain -kernel } kernel:security setcheckreqprot; 1910130154985aa5042b9e40c45fe60492e40004761Stephen Smalley 192853ffaad323b3e5db14d3f2e4fbe7fa96160ede4Stephen Smalley# No booleans in AOSP policy, so no need to ever set them. 193853ffaad323b3e5db14d3f2e4fbe7fa96160ede4Stephen Smalleyneverallow domain kernel:security setbool; 194853ffaad323b3e5db14d3f2e4fbe7fa96160ede4Stephen Smalley 195853ffaad323b3e5db14d3f2e4fbe7fa96160ede4Stephen Smalley# Adjusting the AVC cache threshold. 196853ffaad323b3e5db14d3f2e4fbe7fa96160ede4Stephen Smalley# Not presently allowed to anything in policy, but possibly something 197853ffaad323b3e5db14d3f2e4fbe7fa96160ede4Stephen Smalley# that could be set from init.rc. 198853ffaad323b3e5db14d3f2e4fbe7fa96160ede4Stephen Smalleyneverallow { domain -init } kernel:security setsecparam; 199853ffaad323b3e5db14d3f2e4fbe7fa96160ede4Stephen Smalley 20085c5fc21c8a6259ec74686d62cf2c9a3fe01a56eWilliam Roberts# Only init, ueventd and system_server should be able to access HW RNG 20185c5fc21c8a6259ec74686d62cf2c9a3fe01a56eWilliam Robertsneverallow { domain -init -system_server -ueventd -unconfineddomain } hw_random_device:chr_file *; 2028d688315aeb053eadc2606badbe4ce52899bb694Alex Klyubin 2030130154985aa5042b9e40c45fe60492e40004761Stephen Smalley# Ensure that all entrypoint executables are in exec_type. 2040130154985aa5042b9e40c45fe60492e40004761Stephen Smalleyneverallow domain { file_type -exec_type }:file entrypoint; 205ddf98fa8cf11000f91329945abc23ee791adfe69Geremy Condra 206ddf98fa8cf11000f91329945abc23ee791adfe69Geremy Condra# Ensure that nothing in userspace can access /dev/mem or /dev/kmem 207ddf98fa8cf11000f91329945abc23ee791adfe69Geremy Condraneverallow { domain -kernel -ueventd -init } kmem_device:chr_file *; 208ddf98fa8cf11000f91329945abc23ee791adfe69Geremy Condraneverallow domain kmem_device:chr_file ~{ create relabelto unlink setattr }; 2097adb999e701ee96356c506ffa93fce190791e8b7Stephen Smalley 2107adb999e701ee96356c506ffa93fce190791e8b7Stephen Smalley# Only init should be able to configure kernel usermodehelpers or 2117adb999e701ee96356c506ffa93fce190791e8b7Stephen Smalley# security-sensitive proc settings. 2127adb999e701ee96356c506ffa93fce190791e8b7Stephen Smalleyneverallow { domain -init } usermodehelper:file { append write }; 2137adb999e701ee96356c506ffa93fce190791e8b7Stephen Smalleyneverallow { domain -init } proc_security:file { append write }; 21495e0842e341352af16bed4055ccf67878c322985Stephen Smalley 21595e0842e341352af16bed4055ccf67878c322985Stephen Smalley# No domain should be allowed to ptrace init. 21695e0842e341352af16bed4055ccf67878c322985Stephen Smalleyneverallow domain init:process ptrace; 217a730e50bd93cd058b271ce3a4affcc6ac75da58bNick Kralevich 218a730e50bd93cd058b271ce3a4affcc6ac75da58bNick Kralevich# Init can't receive binder calls. If this neverallow rule is being 219a730e50bd93cd058b271ce3a4affcc6ac75da58bNick Kralevich# triggered, it's probably due to a service with no SELinux domain. 220a730e50bd93cd058b271ce3a4affcc6ac75da58bNick Kralevichneverallow domain init:binder call; 221d0919ec25361ffeda3aa44cc2ecaf875f99784c3William Roberts 222d0919ec25361ffeda3aa44cc2ecaf875f99784c3William Roberts# Don't allow raw read/write/open access to block_device 223d0919ec25361ffeda3aa44cc2ecaf875f99784c3William Roberts# Rather force a relabel to a more specific type 22496eeb1ecb3980e34a5f9ed1a4afd8ffa6ada0cf0Nick Kralevichneverallow { domain -kernel -init -recovery -vold -uncrypt } block_device:blk_file { open read write }; 225a637b2f21eda997f6d1bcb8f2600a5ee3195785dWilliam Roberts 226a637b2f21eda997f6d1bcb8f2600a5ee3195785dWilliam Roberts# Don't allow raw read/write/open access to generic devices. 227a637b2f21eda997f6d1bcb8f2600a5ee3195785dWilliam Roberts# Rather force a relabel to a more specific type. 228a637b2f21eda997f6d1bcb8f2600a5ee3195785dWilliam Roberts# ueventd is exempt from this, as its managing these devices. 229a637b2f21eda997f6d1bcb8f2600a5ee3195785dWilliam Robertsneverallow { domain -unconfineddomain -ueventd } device:chr_file { open read write }; 230b081cc1e050843ecb7dff687f780787ad05d6143Stephen Smalley 231b081cc1e050843ecb7dff687f780787ad05d6143Stephen Smalley# Limit what domains can mount filesystems or change their mount flags. 232b081cc1e050843ecb7dff687f780787ad05d6143Stephen Smalley# sdcard_type / vfat is exempt as a larger set of domains need 233b081cc1e050843ecb7dff687f780787ad05d6143Stephen Smalley# this capability, including device-specific domains. 234b081cc1e050843ecb7dff687f780787ad05d6143Stephen Smalleyneverallow { domain -kernel -init -recovery -vold -zygote } { fs_type -sdcard_type }:filesystem { mount remount relabelfrom relabelto }; 235629fbc9540b4ab6d780cfa8442160b4923373021Nick Kralevich 236629fbc9540b4ab6d780cfa8442160b4923373021Nick Kralevich# 237629fbc9540b4ab6d780cfa8442160b4923373021Nick Kralevich# Assert that, to the extent possible, we're not loading executable content from 238629fbc9540b4ab6d780cfa8442160b4923373021Nick Kralevich# outside the /system partition except for a few whitelisted domains. 239629fbc9540b4ab6d780cfa8442160b4923373021Nick Kralevich# 240629fbc9540b4ab6d780cfa8442160b4923373021Nick Kralevichneverallow { 241629fbc9540b4ab6d780cfa8442160b4923373021Nick Kralevich domain 242629fbc9540b4ab6d780cfa8442160b4923373021Nick Kralevich -appdomain 243629fbc9540b4ab6d780cfa8442160b4923373021Nick Kralevich -dumpstate 244629fbc9540b4ab6d780cfa8442160b4923373021Nick Kralevich -shelldomain 245629fbc9540b4ab6d780cfa8442160b4923373021Nick Kralevich userdebug_or_eng(`-su') 246629fbc9540b4ab6d780cfa8442160b4923373021Nick Kralevich -system_server 247629fbc9540b4ab6d780cfa8442160b4923373021Nick Kralevich -zygote 248629fbc9540b4ab6d780cfa8442160b4923373021Nick Kralevich} { file_type -system_file -exec_type }:file execute; 249ad0d0fc722d04e465ce2b0bfd2f8e04714c75391Stephen Smalley 250ad0d0fc722d04e465ce2b0bfd2f8e04714c75391Stephen Smalley# Only the init property service should write to /data/property. 251ad0d0fc722d04e465ce2b0bfd2f8e04714c75391Stephen Smalleyneverallow { domain -init } property_data_file:dir { create setattr relabelfrom rename write add_name remove_name rmdir }; 252ad0d0fc722d04e465ce2b0bfd2f8e04714c75391Stephen Smalleyneverallow { domain -init } property_data_file:file { create setattr relabelfrom write append unlink link rename }; 253