Home | History | Annotate | Download | only in sepolicy 
      1 ###
      2 ### Untrusted apps.
      3 ###
      4 ### This file defines the rules for untrusted apps.
      5 ### Apps are labeled based on mac_permissions.xml (maps signer and
      6 ### optionally package name to seinfo value) and seapp_contexts (maps UID
      7 ### and optionally seinfo value to domain for process and type for data
      8 ### directory).  The untrusted_app domain is the default assignment in
      9 ### seapp_contexts for any app with UID between APP_AID (10000)
     10 ### and AID_ISOLATED_START (99000) if the app has no specific seinfo
     11 ### value as determined from mac_permissions.xml.  In current AOSP, this
     12 ### domain is assigned to all non-system apps as well as to any system apps
     13 ### that are not signed by the platform key.  To move
     14 ### a system app into a specific domain, add a signer entry for it to
     15 ### mac_permissions.xml and assign it one of the pre-existing seinfo values
     16 ### or define and use a new seinfo value in both mac_permissions.xml and
     17 ### seapp_contexts.
     18 ###
     19 ### untrusted_app includes all the appdomain rules, plus the
     20 ### additional following rules:
     21 ###
     22 
     23 type untrusted_app, domain;
     24 app_domain(untrusted_app)
     25 net_domain(untrusted_app)
     26 bluetooth_domain(untrusted_app)
     27 
     28 # Some apps ship with shared libraries and binaries that they write out
     29 # to their sandbox directory and then execute.
     30 allow untrusted_app app_data_file:file { rx_file_perms execmod };
     31 
     32 allow untrusted_app tun_device:chr_file rw_file_perms;
     33 
     34 # ASEC
     35 allow untrusted_app asec_apk_file:file r_file_perms;
     36 # Execute libs in asec containers.
     37 allow untrusted_app asec_public_file:file { execute execmod };
     38 
     39 # Allow the allocation and use of ptys
     40 # Used by: https://play.google.com/store/apps/details?id=jackpal.androidterm
     41 create_pty(untrusted_app)
     42 
     43 # Used by Finsky / Android "Verify Apps" functionality when
     44 # running "adb install foo.apk".
     45 # TODO: Long term, we don't want apps probing into shell data files.
     46 # Figure out a way to remove these rules.
     47 allow untrusted_app shell_data_file:file r_file_perms;
     48 allow untrusted_app shell_data_file:dir r_dir_perms;
     49 
     50 # b/18504118: Allow reads from /data/anr/traces.txt
     51 # TODO: We shouldn't be allowing all untrusted_apps to read
     52 # this file. This is only needed for the GMS feedback agent.
     53 # See also b/18340553. GMS runs as untrusted_app, and
     54 # it's too late to change the domain it runs in.
     55 # This line needs to be deleted.
     56 allow untrusted_app anr_data_file:file r_file_perms;
     57 
     58 #
     59 # Rules migrated from old app domains coalesced into untrusted_app.
     60 # This includes what used to be media_app, shared_app, and release_app.
     61 #
     62 
     63 # Access /dev/mtp_usb.
     64 allow untrusted_app mtp_device:chr_file rw_file_perms;
     65 
     66 # Access to /data/media.
     67 allow untrusted_app media_rw_data_file:dir create_dir_perms;
     68 allow untrusted_app media_rw_data_file:file create_file_perms;
     69 
     70 # Write to /cache.
     71 allow untrusted_app cache_file:dir create_dir_perms;
     72 allow untrusted_app cache_file:file create_file_perms;
     73 
     74 ###
     75 ### neverallow rules
     76 ###
     77 
     78 # Receive or send uevent messages.
     79 neverallow untrusted_app domain:netlink_kobject_uevent_socket *;
     80 
     81 # Receive or send generic netlink messages
     82 neverallow untrusted_app domain:netlink_socket *;
     83 
     84 # Too much leaky information in debugfs. It's a security
     85 # best practice to ensure these files aren't readable.
     86 neverallow untrusted_app debugfs:file read;
     87 
     88 # Do not allow untrusted apps to register services.
     89 # Only trusted components of Android should be registering
     90 # services.
     91 neverallow untrusted_app service_manager_type:service_manager add;
     92 
     93 # Do not allow untrusted_apps to connect to the property service
     94 # or set properties. b/10243159
     95 neverallow untrusted_app property_socket:sock_file write;
     96 neverallow untrusted_app init:unix_stream_socket connectto;
     97 neverallow untrusted_app property_type:property_service set;
     98 
     99 # Allow verifier to access staged apks.
    100 allow untrusted_app { apk_tmp_file apk_private_tmp_file }:dir r_dir_perms;
    101 allow untrusted_app { apk_tmp_file apk_private_tmp_file }:file r_file_perms;
    102