123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284128512861287128812891290129112921293129412951296129712981299130013011302130313041305130613071308130913101311131213131314131513161317131813191320132113221323132413251326132713281329133013311332133313341335133613371338133913401341134213431344134513461347134813491350135113521353135413551356135713581359136013611362136313641365136613671368136913701371137213731374137513761377137813791380138113821383138413851386138713881389139013911392139313941395139613971398139914001401140214031404140514061407140814091410 |
- allow domain init:process sigchld;
- allow domain self:process {
- fork
- sigchld
- sigkill
- sigstop
- signull
- signal
- getsched
- setsched
- getsession
- getpgid
- setpgid
- getcap
- setcap
- getattr
- setrlimit
- };
- allow domain self:fd use;
- allow domain proc:dir r_dir_perms;
- allow domain proc_net_type:dir search;
- r_dir_file(domain, self)
- allow domain self:{ fifo_file file } rw_file_perms;
- allow domain self:unix_dgram_socket { create_socket_perms sendto };
- allow domain self:unix_stream_socket { create_stream_socket_perms connectto };
- allow domain init:fd use;
- userdebug_or_eng(`
- allow domain su:fd use;
- allow domain su:unix_stream_socket { connectto getattr getopt read write shutdown };
- allow domain su:unix_dgram_socket sendto;
- allow { domain -init } su:binder { call transfer };
- allow domain su:fifo_file { write getattr };
- allow domain su:process sigchld;
- allow domain coredump_file:file create_file_perms;
- allow domain coredump_file:dir ra_dir_perms;
- ')
- with_native_coverage(`
- allow domain method_trace_data_file:dir create_dir_perms;
- allow domain method_trace_data_file:file create_file_perms;
- ')
- allow domain tmpfs:dir { getattr search };
- allow domain rootfs:dir search;
- allow domain rootfs:lnk_file { read getattr };
- allow domain device:dir search;
- allow domain dev_type:lnk_file r_file_perms;
- allow domain devpts:dir search;
- allow domain socket_device:dir r_dir_perms;
- allow domain owntty_device:chr_file rw_file_perms;
- allow domain null_device:chr_file rw_file_perms;
- allow domain zero_device:chr_file rw_file_perms;
- allow {
- domain
- -mediaprovider
- -ephemeral_app
- -isolated_app
- -untrusted_app_all
- } ashmem_device:chr_file rw_file_perms;
- allow domain ashmemd:fd use;
- allow {
- coredomain
- appdomain
- binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone
- -hwservicemanager
- } binder_device:chr_file rw_file_perms;
- not_full_treble(`allow { domain -hwservicemanager -vndservicemanager } binder_device:chr_file rw_file_perms;')
- allow { domain -servicemanager -vndservicemanager -isolated_app } hwbinder_device:chr_file rw_file_perms;
- allow domain ptmx_device:chr_file rw_file_perms;
- allow domain random_device:chr_file rw_file_perms;
- allow domain proc_random:dir r_dir_perms;
- allow domain proc_random:file r_file_perms;
- allow domain properties_device:dir { search getattr };
- allow domain properties_serial:file r_file_perms;
- allow domain property_info:file r_file_perms;
- get_prop(domain, debug_prop)
- get_prop(domain, exported_config_prop)
- get_prop(domain, exported_default_prop)
- get_prop(domain, exported_dumpstate_prop)
- get_prop(domain, exported_fingerprint_prop)
- get_prop(domain, exported_radio_prop)
- get_prop(domain, exported_secure_prop)
- get_prop(domain, exported_system_prop)
- get_prop(domain, exported_vold_prop)
- get_prop(domain, exported2_default_prop)
- get_prop(domain, logd_prop)
- get_prop(domain, log_property_type)
- dontaudit domain property_type:file audit_access;
- allow domain property_contexts_file:file r_file_perms;
- allow domain init:key search;
- allow domain vold:key search;
- write_logd(domain)
- allow domain {
- system_file
- system_lib_file
- system_seccomp_policy_file
- system_security_cacerts_file
- }:dir r_dir_perms;
- allow domain system_file:lnk_file { getattr read };
- allow domain system_seccomp_policy_file:file r_file_perms;
- allow domain system_security_cacerts_file:file r_file_perms;
- allow domain system_linker_exec:file { execute read open getattr map };
- allow domain system_linker_config_file:file r_file_perms;
- allow domain system_lib_file:file { execute read open getattr map };
- allow domain system_linker_exec:lnk_file { read open getattr };
- allow domain system_lib_file:lnk_file { read open getattr };
- allow domain system_event_log_tags_file:file r_file_perms;
- allow { appdomain coredomain } system_file:file { execute read open getattr map };
- not_full_treble(`
- allow domain system_file:file { execute read open getattr map };
- allow domain vendor_file_type:dir { search getattr };
- allow domain vendor_file_type:file { execute read open getattr map };
- allow domain vendor_file_type:lnk_file { getattr read };
- ')
- allow domain vendor_hal_file:dir r_dir_perms;
- allow domain same_process_hal_file:dir r_dir_perms;
- allow {
- domain
- -coredomain # access is explicitly granted to individual coredomains
- } same_process_hal_file:file { execute read open getattr map };
- allow domain vndk_sp_file:dir r_dir_perms;
- allow domain vndk_sp_file:file { execute read open getattr map };
- allow domain vendor_configs_file:dir r_dir_perms;
- allow domain vendor_configs_file:file { read open getattr map };
- full_treble_only(`
- allow domain vendor_file_type:lnk_file { getattr open read };
- allow domain vendor_file:dir { getattr search };
- allow { domain -coredomain } vendor_file_type:dir r_dir_perms;
- allow { domain -coredomain } vendor_file_type:file { read open getattr execute map };
- allow { domain -coredomain } vendor_file_type:lnk_file { getattr read };
- ')
- allow domain sysfs:lnk_file { getattr read };
- allow domain { system_zoneinfo_file zoneinfo_data_file }:file r_file_perms;
- allow domain { system_zoneinfo_file zoneinfo_data_file }:dir r_dir_perms;
- r_dir_file(domain, sysfs_devices_system_cpu)
- r_dir_file(domain, sysfs_usb);
- allow domain sysfs_transparent_hugepage:dir search;
- allow domain sysfs_transparent_hugepage:file r_file_perms;
- not_full_treble(`
- allow domain system_data_file:dir getattr;
- ')
- allow { coredomain appdomain } system_data_file:dir getattr;
- allow domain system_data_file:dir search;
- allow domain vendor_data_file:dir { getattr search };
- allow domain proc:lnk_file { getattr read };
- allow domain proc_cpuinfo:file r_file_perms;
- allow domain dev_cpu_variant:file r_file_perms;
- allow domain proc_overcommit_memory:file r_file_perms;
- allow domain proc_perf:file r_file_perms;
- allow domain selinuxfs:dir search;
- allow domain selinuxfs:file getattr;
- allow domain sysfs:dir search;
- allow domain selinuxfs:filesystem getattr;
- allow domain debugfs:dir search;
- allow domain debugfs_tracing:dir search;
- allow domain debugfs_tracing_debug:dir search;
- allow domain debugfs_trace_marker:file w_file_perms;
- allow domain fs_type:filesystem getattr;
- allow domain fs_type:dir getattr;
- allowxperm domain domain:{ icmp_socket rawip_socket tcp_socket udp_socket }
- ioctl { unpriv_sock_ioctls unpriv_tty_ioctls };
- allowxperm domain { domain pdx_channel_socket_type }:{ unix_dgram_socket unix_stream_socket }
- ioctl unpriv_unix_sock_ioctls;
- allowxperm domain devpts:chr_file ioctl unpriv_tty_ioctls;
- allowxperm domain { file_type fs_type domain dev_type }:{ dir notdevfile_class_set blk_file } ioctl { FIOCLEX FIONCLEX };
- allowxperm domain tun_device:chr_file ioctl { FIOCLEX FIONCLEX };
- allowxperm domain { file_type fs_type }:file ioctl { TCGETS };
- allowxperm domain domain:fifo_file ioctl { TCGETS };
- allowxperm domain dev_type:blk_file ioctl { BLKGETSIZE64 BLKSSZGET };
- allowxperm domain { file_type sdcard_type }:file ioctl {
- F2FS_IOC_ABORT_VOLATILE_WRITE
- F2FS_IOC_COMMIT_ATOMIC_WRITE
- F2FS_IOC_GET_FEATURES
- F2FS_IOC_GET_PIN_FILE
- F2FS_IOC_SET_PIN_FILE
- F2FS_IOC_START_ATOMIC_WRITE
- };
- allow { domain -domain } hwservice_manager_type:hwservice_manager { add find };
- allow { domain -domain } vndservice_manager_type:service_manager { add find };
- with_asan(`allow domain system_data_file:dir getattr;')
- with_asan(`allow domain system_asan_options_file:file r_file_perms;')
- allow domain apex_mnt_dir:dir { getattr search };
- allow domain apex_mnt_dir:lnk_file r_file_perms;
- neverallowxperm * *:{ dir notdevfile_class_set socket_class_set blk_file } ioctl { 0 };
- neverallowxperm domain domain:socket_class_set ioctl { SIOCATMARK };
- neverallowxperm * devpts:chr_file ioctl TIOCSTI;
- neverallow { domain -init -recovery } unlabeled:dir_file_class_set create;
- neverallow {
- domain
- -kernel
- -init
- -ueventd
- -vold
- } self:global_capability_class_set mknod;
- neverallow * self:memprotect mmap_zero;
- neverallow * self:global_capability2_class_set mac_override;
- neverallow * self:global_capability2_class_set mac_admin;
- neverallow * kernel:security load_policy;
- neverallow * kernel:security setenforce;
- neverallow { domain -kernel } kernel:security setcheckreqprot;
- neverallow * kernel:security setbool;
- neverallow { domain -init } kernel:security setsecparam;
- neverallow {
- domain
- -init
- -shell # For CTS and is restricted to getattr in shell.te
- -system_server
- -ueventd
- } hw_random_device:chr_file *;
- neverallow {
- domain
- -shell # stat of /dev, getattr only
- -ueventd
- } keychord_device:chr_file *;
- neverallow * { file_type -exec_type -postinstall_file }:file entrypoint;
- dontaudit domain postinstall_mnt_dir:dir audit_access;
- neverallow {
- domain
- -shell # Shell user should not have any abilities outside of getattr
- -ueventd
- } port_device:chr_file *;
- neverallow * port_device:chr_file ~{ create relabelto unlink setattr getattr };
- neverallow { domain -init } usermodehelper:file { append write };
- neverallow { domain -init -ueventd } sysfs_usermodehelper:file { append write };
- neverallow { domain -init -vendor_init } proc_security:file { append open read write };
- neverallow * init:binder ~{ transfer };
- neverallow { domain -servicemanager } init:binder { transfer };
- neverallow * vendor_init:binder *;
- neverallow { domain -kernel -init -recovery } block_device:blk_file { open read write };
- neverallow * *:{ blk_file chr_file } rename;
- neverallow domain device:chr_file { open read write };
- neverallow domain { cache_file cache_backup_file cache_private_backup_file cache_recovery_file }:file execute;
- neverallow {
- domain
- -appdomain
- } {
- data_file_type
- -dalvikcache_data_file
- -system_data_file # shared libs in apks
- -apk_data_file
- }:file no_x_file_perms;
- neverallow { domain userdebug_or_eng(`-kernel') } nativetest_data_file:file_class_set no_w_file_perms;
- neverallow domain nativetest_data_file:dir no_w_dir_perms;
- neverallow { domain userdebug_or_eng(`-shell') } nativetest_data_file:file no_x_file_perms;
- neverallow { domain -init } property_data_file:dir no_w_dir_perms;
- neverallow { domain -init } property_data_file:file { no_w_file_perms no_x_file_perms };
- neverallow { domain -init } property_type:file { no_w_file_perms no_x_file_perms };
- neverallow { domain -init } properties_device:file { no_w_file_perms no_x_file_perms };
- neverallow { domain -init } properties_serial:file { no_w_file_perms no_x_file_perms };
- neverallow {
- domain
- with_asan(`-asan_extract')
- recovery_only(`userdebug_or_eng(`-fastbootd')')
- } {
- system_file_type
- vendor_file_type
- exec_type
- }:dir_file_class_set { create write setattr relabelfrom append unlink link rename };
- neverallow { domain -kernel with_asan(`-asan_extract') } { system_file_type vendor_file_type exec_type }:dir_file_class_set relabelto;
- neverallow * exec_type:dir_file_class_set mounton;
- neverallow { domain -init } { system_file_type vendor_file_type }:dir_file_class_set mounton;
- neverallow * rootfs:file { create write setattr relabelto append unlink link rename };
- neverallow * {fs_type -contextmount_type}:filesystem relabelto;
- neverallow * contextmount_type:dir_file_class_set
- { create setattr relabelfrom relabelto append link rename };
- neverallow { domain recovery_only(`userdebug_or_eng(`-fastbootd')') } contextmount_type:dir_file_class_set { write unlink };
- neverallow * default_android_service:service_manager add;
- neverallow * default_android_vndservice:service_manager { add find };
- neverallow * default_android_hwservice:hwservice_manager { add find };
- neverallow * hidl_base_hwservice:hwservice_manager find;
- neverallow { domain -init -vendor_init } default_prop:property_service set;
- neverallow { domain -init -vendor_init } mmc_prop:property_service set;
- compatible_property_only(`
- neverallow { domain -init } default_prop:property_service set;
- neverallow { domain -init } mmc_prop:property_service set;
- neverallow { domain -init -vendor_init } exported_default_prop:property_service set;
- neverallow { domain -init } exported_secure_prop:property_service set;
- neverallow { domain -init } exported2_default_prop:property_service set;
- neverallow { domain -init -vendor_init } exported3_default_prop:property_service set;
- neverallow { domain -init -vendor_init } vendor_default_prop:property_service set;
- ')
- neverallow { domain -init -system_server } pm_prop:property_service set;
- neverallow { domain -coredomain } pm_prop:file no_rw_file_perms;
- compatible_property_only(`
- neverallow { domain -init -system_server -vendor_init } exported_pm_prop:property_service set;
- neverallow { domain -coredomain -vendor_init } exported_pm_prop:file no_rw_file_perms;
- ')
- neverallow {
- domain
- -adbd
- -dumpstate
- -fastbootd
- -hal_camera_server
- -hal_cas_server
- -hal_drm_server
- -init
- -mediadrmserver
- -recovery
- -shell
- -system_server
- -vendor_init
- } serialno_prop:file r_file_perms;
- neverallow { domain -init -system_server -dumpstate } firstboot_prop:file r_file_perms;
- neverallow {
- domain
- -init
- -recovery
- -system_server
- -shell # Shell is further restricted in shell.te
- -ueventd # Further restricted in ueventd.te
- } frp_block_device:blk_file no_rw_file_perms;
- neverallow {
- domain
- -init
- -recovery
- -vold
- -e2fs
- -fsck
- -fastbootd
- } metadata_block_device:blk_file { append link rename write open read ioctl lock };
- neverallow {
- domain
- -fastbootd
- userdebug_or_eng(`-fsck')
- userdebug_or_eng(`-init')
- -recovery
- -update_engine
- } system_block_device:blk_file { write append };
- neverallow {
- domain
- userdebug_or_eng(`-domain') # exclude debuggable builds
- -fastbootd
- -hal_bootctl_server
- -init
- -uncrypt
- -update_engine
- -vendor_init
- -vendor_misc_writer
- -vold
- -recovery
- -ueventd
- } misc_block_device:blk_file { append link relabelfrom rename write open read ioctl lock };
- neverallow { domain -servicemanager -hwservicemanager -vndservicemanager } *:binder set_context_mgr;
- neverallow servicemanager hwbinder_device:chr_file no_rw_file_perms;
- neverallow servicemanager vndbinder_device:chr_file no_rw_file_perms;
- neverallow hwservicemanager binder_device:chr_file no_rw_file_perms;
- neverallow hwservicemanager vndbinder_device:chr_file no_rw_file_perms;
- neverallow vndservicemanager binder_device:chr_file no_rw_file_perms;
- neverallow vndservicemanager hwbinder_device:chr_file no_rw_file_perms;
- full_treble_only(`
- neverallow {
- domain
- -coredomain
- -appdomain
- -binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone
- } binder_device:chr_file rw_file_perms;
- ')
- dontaudit domain binder_device:chr_file audit_access;
- full_treble_only(`
- neverallow {
- domain
- -coredomain
- -appdomain # restrictions for vendor apps are declared lower down
- -binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone
- } service_manager_type:service_manager find;
- ')
- full_treble_only(`
- neverallow {
- appdomain
- -coredomain
- } {
- service_manager_type
- -app_api_service
- -ephemeral_app_api_service
- -audioserver_service # TODO(b/36783122) remove exemptions below once app_api_service is fixed
- -cameraserver_service
- -drmserver_service
- -keystore_service
- -mediadrmserver_service
- -mediaextractor_service
- -mediametrics_service
- -mediaserver_service
- -nfc_service
- -radio_service
- -virtual_touchpad_service
- -vr_hwc_service
- -vr_manager_service
- }:service_manager find;
- ')
- full_treble_only(`
- neverallow {
- domain
- -coredomain
- -appdomain
- -binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone
- } servicemanager:binder { call transfer };
- ')
- full_treble_only(`
- neverallow {
- coredomain
- -shell
- userdebug_or_eng(`-su')
- -ueventd # uevent is granted create for this device, but we still neverallow I/O below
- } vndbinder_device:chr_file rw_file_perms;
- ')
- full_treble_only(`
- neverallow ueventd vndbinder_device:chr_file { read write append ioctl };
- ')
- full_treble_only(`
- neverallow {
- coredomain
- -shell
- userdebug_or_eng(`-su')
- } vndservice_manager_type:service_manager *;
- ')
- full_treble_only(`
- neverallow {
- coredomain
- -shell
- userdebug_or_eng(`-su')
- } vndservicemanager:binder *;
- ')
- full_treble_only(`
- neverallow_establish_socket_comms({
- coredomain
- -init
- -adbd
- }, {
- domain
- -coredomain
- -socket_between_core_and_vendor_violators
- });
- ')
- full_treble_only(`
- neverallow_establish_socket_comms({
- domain
- -coredomain
- -appdomain
- -socket_between_core_and_vendor_violators
- }, {
- coredomain
- -logd # Logging by writing to logd Unix domain socket is public API
- -netd # netdomain needs this
- -mdnsd # netdomain needs this
- userdebug_or_eng(`-su') # communications with su are permitted only on userdebug or eng builds
- -init
- -tombstoned # linker to tombstoned
- userdebug_or_eng('-heapprofd`)
- });
- ')
- full_treble_only(`
- neverallow_establish_socket_comms({
- domain
- -coredomain
- -netdomain
- -socket_between_core_and_vendor_violators
- }, netd);
- ')
- full_treble_only(`
- neverallow {
- domain
- -coredomain
- -appdomain # appdomain restrictions below
- -data_between_core_and_vendor_violators # b/70393317
- -socket_between_core_and_vendor_violators
- -vendor_init
- } {
- coredomain_socket
- core_data_file_type
- unlabeled # used only by core domains
- }:sock_file ~{ append getattr ioctl read write };
- ')
- full_treble_only(`
- neverallow {
- appdomain
- -coredomain
- } {
- coredomain_socket
- unlabeled # used only by core domains
- core_data_file_type
- -app_data_file
- -privapp_data_file
- -pdx_endpoint_socket_type # used by VR layer
- -pdx_channel_socket_type # used by VR layer
- }:sock_file ~{ append getattr ioctl read write };
- ')
- full_treble_only(`
- neverallow {
- coredomain
- -init
- -ueventd
- -socket_between_core_and_vendor_violators
- } {
- file_type
- dev_type
- -coredomain_socket
- -core_data_file_type
- -unlabeled
- }:sock_file ~{ append getattr ioctl read write };
- ')
- full_treble_only(`
- neverallow {
- coredomain
- -appdomain # TODO(b/34980020) remove exemption for appdomain
- -data_between_core_and_vendor_violators
- -init
- -vold_prepare_subdirs
- } {
- data_file_type
- -core_data_file_type
- }:file_class_set ~{ append getattr ioctl read write map };
- ')
- full_treble_only(`
- neverallow {
- coredomain
- -appdomain # TODO(b/34980020) remove exemption for appdomain
- -data_between_core_and_vendor_violators
- -init
- -vold_prepare_subdirs
- } {
- data_file_type
- -core_data_file_type
- -vendor_data_file
- }:dir *;
- ')
- full_treble_only(`
- neverallow {
- domain
- -appdomain # TODO(b/34980020) remove exemption for appdomain
- -coredomain
- -data_between_core_and_vendor_violators # TODO(b/34980020) Remove once all violators have been cleaned up
- -vendor_init
- } {
- core_data_file_type
- -zoneinfo_data_file
- with_native_coverage(`-method_trace_data_file')
- }:file_class_set ~{ append getattr ioctl read write map };
- neverallow {
- vendor_init
- -data_between_core_and_vendor_violators
- } {
- core_data_file_type
- -unencrypted_data_file
- -zoneinfo_data_file
- with_native_coverage(`-method_trace_data_file')
- }:file_class_set ~{ append getattr ioctl read write map };
- neverallow vendor_init unencrypted_data_file:file ~r_file_perms;
- ')
- full_treble_only(`
- neverallow {
- domain
- -appdomain # TODO(b/34980020) remove exemption for appdomain
- -coredomain
- -data_between_core_and_vendor_violators
- -vendor_init
- } {
- core_data_file_type
- -system_data_file # default label for files on /data. Covered below...
- -vendor_data_file
- -zoneinfo_data_file
- with_native_coverage(`-method_trace_data_file')
- }:dir *;
- neverallow {
- vendor_init
- -data_between_core_and_vendor_violators
- } {
- core_data_file_type
- -unencrypted_data_file
- -system_data_file
- -vendor_data_file
- -zoneinfo_data_file
- with_native_coverage(`-method_trace_data_file')
- }:dir *;
- neverallow vendor_init unencrypted_data_file:dir ~search;
- ')
- full_treble_only(`
- neverallow {
- domain
- -appdomain # TODO(b/34980020) remove exemption for appdomain
- -coredomain
- -data_between_core_and_vendor_violators # TODO(b/34980020) Remove once all violators have been cleaned up
- } {
- system_data_file # default label for files on /data. Covered below
- }:dir ~{ getattr search };
- ')
- full_treble_only(`
- neverallow {
- coredomain
- -data_between_core_and_vendor_violators # TODO(b/34980020) Remove once all violators have been cleaned up
- -init
- -vold # vold creates per-user storage for both system and vendor
- -vold_prepare_subdirs
- } {
- vendor_data_file # default label for files on /data. Covered below
- }:dir ~{ getattr search };
- ')
- full_treble_only(`
- neverallow {
- coredomain
- -data_between_core_and_vendor_violators # TODO(b/34980020) Remove once all violators have been cleaned up
- -init
- } {
- vendor_data_file # default label for files on /data/vendor{,_ce,_de}.
- }:file_class_set ~{ append getattr ioctl read write map };
- ')
- full_treble_only(`
- neverallow {
- coredomain
- -init
- -shell
- } vendor_shell_exec:file { execute execute_no_trans };
- ')
- full_treble_only(`
- neverallow {
- domain
- -coredomain
- -appdomain
- -vendor_executes_system_violators
- -vendor_init
- } {
- system_file_type
- -system_lib_file
- -system_linker_exec
- -crash_dump_exec
- -netutils_wrapper_exec
- userdebug_or_eng(`-tcpdump_exec')
- }:file { entrypoint execute execute_no_trans };
- ')
- full_treble_only(`
- neverallow {
- coredomain
- -init
- -shell
- -system_executes_vendor_violators
- } {
- vendor_file_type
- -same_process_hal_file
- -vndk_sp_file
- -vendor_app_file
- -vendor_public_lib_file
- }:file execute;
- ')
- full_treble_only(`
- neverallow {
- coredomain
- -shell
- -system_executes_vendor_violators
- } {
- vendor_file_type
- -same_process_hal_file
- }:file execute_no_trans;
- ')
- full_treble_only(`
- neverallow {
- coredomain
- -crash_dump
- -init # starts vendor executables
- -kernel # loads /vendor/firmware
- userdebug_or_eng(`-perfprofd')
- userdebug_or_eng(`-heapprofd')
- -shell
- -system_executes_vendor_violators
- -ueventd # reads /vendor/ueventd.rc
- } {
- vendor_file_type
- -same_process_hal_file
- -vendor_app_file
- -vendor_configs_file
- -vendor_framework_file
- -vendor_idc_file
- -vendor_keychars_file
- -vendor_keylayout_file
- -vendor_overlay_file
- -vendor_public_lib_file
- -vendor_task_profiles_file
- -vndk_sp_file
- }:file *;
- ')
- full_treble_only(`
- neverallow {
- domain
- -appdomain
- -coredomain
- -vendor_executes_system_violators
- -vendor_init
- } {
- system_file_type
- -crash_dump_exec
- -file_contexts_file
- -netutils_wrapper_exec
- -property_contexts_file
- -system_event_log_tags_file
- -system_lib_file
- with_asan(`-system_asan_options_file')
- -system_linker_exec
- -system_linker_config_file
- -system_seccomp_policy_file
- -system_security_cacerts_file
- -system_zoneinfo_file
- -task_profiles_file
- userdebug_or_eng(`-tcpdump_exec')
- }:file *;
- ')
- neverallow { domain -zygote -system_server } zygote:unix_stream_socket connectto;
- neverallow { domain -system_server } zygote_socket:sock_file write;
- neverallow { domain -system_server -webview_zygote -app_zygote } webview_zygote:unix_stream_socket connectto;
- neverallow { domain -system_server } webview_zygote:sock_file write;
- neverallow { domain -system_server } app_zygote:sock_file write;
- neverallow {
- domain
- -tombstoned
- -crash_dump
- -dumpstate
- -incidentd
- -system_server
- -hal_codec2_server
- -hal_omx_server
- -mediaextractor
- } tombstoned_crash_socket:unix_stream_socket connectto;
- neverallow { domain -dumpstate -incidentd -system_server } tombstoned_intercept_socket:sock_file write;
- neverallow { domain -dumpstate -incidentd -system_server } tombstoned_intercept_socket:unix_stream_socket connectto;
- neverallow * *:{ shm sem msg msgq } *;
- neverallow * { file_type fs_type dev_type }:{ lnk_file fifo_file sock_file } mounton;
- neverallow { domain userdebug_or_eng(`-dumpstate -shell -su') } su_exec:file no_x_file_perms;
- neverallow * {
- file_type
- -apk_data_file
- -app_data_file
- -asec_public_file
- }:file execmod;
- neverallow * self:process { execstack execheap };
- neverallow { domain -untrusted_app_25 -untrusted_app_27 } file_type:file execmod;
- neverallow { domain -init } proc:{ file dir } mounton;
- neverallow ~domain domain:process { transition dyntransition };
- neverallow {
- domain
- -system_server
- -system_app
- -init
- -toolbox # TODO(b/141108496) We want to remove toolbox
- -installd # for relabelfrom and unlink, check for this in explicit neverallow
- -vold_prepare_subdirs # For unlink
- with_asan(`-asan_extract')
- } system_data_file:file no_w_file_perms;
- neverallow installd system_data_file:file ~{ r_file_perms relabelfrom unlink };
- neverallow {
- domain
- -appdomain # finer-grained rules for appdomain are listed below
- -system_server #populate com.android.providers.settings/databases/settings.db.
- -installd # creation of app sandbox
- -traced_probes # resolve inodes for i/o tracing.
- } system_app_data_file:dir_file_class_set { create unlink open };
- neverallow {
- isolated_app
- untrusted_app_all # finer-grained rules for appdomain are listed below
- ephemeral_app
- priv_app
- } system_app_data_file:dir_file_class_set { create unlink open };
- neverallow {
- domain
- -adbd
- -init
- -runas
- -zygote
- } shell:process { transition dyntransition };
- neverallow { domain -simpleperf_app_runner -runas -app_zygote -webview_zygote -zygote } {
- appdomain -shell userdebug_or_eng(`-su')
- }:process { transition dyntransition };
- neverallow {
- domain
- -appdomain
- -installd
- } { app_data_file privapp_data_file }:lnk_file read;
- neverallow {
- domain
- -shell
- userdebug_or_eng(`-uncrypt')
- -installd
- } shell_data_file:lnk_file read;
- neverallow {
- domain
- -adbd
- -dumpstate
- -installd
- -init
- -shell
- -vold
- } shell_data_file:dir no_w_dir_perms;
- neverallow {
- domain
- -adbd
- -appdomain
- -dumpstate
- -init
- -installd
- -simpleperf_app_runner
- -system_server # why?
- userdebug_or_eng(`-uncrypt')
- } shell_data_file:dir { open search };
- neverallow {
- domain
- -adbd
- -appdomain
- -dumpstate
- -installd
- userdebug_or_eng(`-uncrypt')
- } shell_data_file:file open;
- neverallow * ~{
- servicemanager
- vndservicemanager
- }:service_manager list;
- neverallow * ~{
- hwservicemanager
- }:hwservice_manager list;
- neverallow * domain:file { execute execute_no_trans entrypoint };
- neverallow { domain -init -vendor_init -dumpstate } debugfs:{ file lnk_file } no_rw_file_perms;
- neverallow domain debugfs_type:file { execute execute_no_trans };
- neverallow {
- domain
- -installd
- -profman
- } profman_exec:file no_x_file_perms;
- neverallow * ~{ system_file vendor_file rootfs }:system module_load;
- neverallow * self:global_capability_class_set setfcap;
- neverallow domain crash_dump:process noatsecure;
- neverallow ~coredomain coredomain_hwservice:hwservice_manager add;
- neverallow * same_process_hwservice:hwservice_manager add;
- full_treble_only(`
- neverallow {
- coredomain
- -appdomain
- -bootanim
- -crash_dump
- -init
- -kernel
- -perfprofd
- -heapprofd
- -ueventd
- } vendor_file:file { no_w_file_perms no_x_file_perms open };
- ')
- neverallow domain {
- proc_type
- sysfs_type
- }:dir { add_name create link remove_name rename reparent rmdir write };
- neverallow domain cgroup:file create;
- dontaudit domain proc_type:dir write;
- dontaudit domain sysfs_type:dir write;
- dontaudit domain cgroup:file create;
- userdebug_or_eng(`
- dontaudit domain proc_type:dir add_name;
- dontaudit domain sysfs_type:dir add_name;
- dontaudit domain proc_type:file create;
- dontaudit domain sysfs_type:file create;
- ')
- neverallow {
- coredomain
- -init
- -ueventd
- -vold
- -system_writes_mnt_vendor_violators
- } mnt_vendor_file:dir *;
- full_treble_only(`
- neverallow {
- coredomain
- -appdomain
- } vendor_public_lib_file:file { execute execute_no_trans };
- ')
- neverallow {
- domain
- -coredomain
- } mnt_product_file:dir *;
- full_treble_only(`
- neverallow {
- coredomain
- -healthd
- -shell
- -ueventd
- -recovery
- -charger
- -incidentd
- } sysfs_batteryinfo:file { open read };
- ')
- neverallow {
- domain
- -hal_codec2_server
- -hal_omx_server
- } hal_codec2_hwservice:hwservice_manager add;
|