1 ### 2 ### Domain for all zygote spawned apps 3 ### 4 ### This file is the base policy for all zygote spawned apps. 5 ### Other policy files, such as isolated_app.te, untrusted_app.te, etc 6 ### extend from this policy. Only policies which should apply to ALL 7 ### zygote spawned apps should be added here. 8 ### 9 10 # TODO: deal with tmpfs_domain pub/priv split properly 11 # Read system properties managed by zygote. 12 allow appdomain zygote_tmpfs:file read; 13 14 # WebView and other application-specific JIT compilers 15 allow appdomain self:process execmem; 16 17 allow appdomain ashmem_device:chr_file execute; 18 19 # Receive and use open file descriptors inherited from zygote. 20 allow appdomain zygote:fd use; 21 22 # gdbserver for ndk-gdb reads the zygote. 23 # valgrind needs mmap exec for zygote 24 allow appdomain zygote_exec:file rx_file_perms; 25 26 # Notify zygote of death; 27 allow appdomain zygote:process sigchld; 28 29 # Place process into foreground / background 30 allow appdomain cgroup:dir { search write }; 31 allow appdomain cgroup:file rw_file_perms; 32 33 # Read /data/dalvik-cache. 34 allow appdomain dalvikcache_data_file:dir { search getattr }; 35 allow appdomain dalvikcache_data_file:file r_file_perms; 36 37 # Read the /sdcard and /mnt/sdcard symlinks 38 allow { appdomain -isolated_app } rootfs:lnk_file r_file_perms; 39 allow { appdomain -isolated_app } tmpfs:lnk_file r_file_perms; 40 41 # Search /storage/emulated tmpfs mount. 42 allow appdomain tmpfs:dir r_dir_perms; 43 44 userdebug_or_eng(` 45 # Notify zygote of the wrapped process PID when using --invoke-with. 46 allow appdomain zygote:fifo_file write; 47 48 # Allow apps to create and write method traces in /data/misc/trace. 49 allow appdomain method_trace_data_file:dir w_dir_perms; 50 allow appdomain method_trace_data_file:file { create w_file_perms }; 51 ') 52 53 # Notify shell and adbd of death when spawned via runas for ndk-gdb. 54 allow appdomain shell:process sigchld; 55 allow appdomain adbd:process sigchld; 56 57 # child shell or gdbserver pty access for runas. 58 allow appdomain devpts:chr_file { getattr read write ioctl }; 59 60 # Use pipes and sockets provided by system_server via binder or local socket. 61 allow appdomain system_server:fd use; 62 allow appdomain system_server:fifo_file rw_file_perms; 63 allow appdomain system_server:unix_stream_socket { read write setopt getattr getopt shutdown }; 64 allow appdomain system_server:tcp_socket { read write getattr getopt shutdown }; 65 66 # Communication with other apps via fifos 67 allow appdomain appdomain:fifo_file rw_file_perms; 68 69 # Communicate with surfaceflinger. 70 allow appdomain surfaceflinger:unix_stream_socket { read write setopt getattr getopt shutdown }; 71 72 # Query whether a Surface supports wide color 73 allow { appdomain -isolated_app } hal_configstore_ISurfaceFlingerConfigs:hwservice_manager find; 74 75 # App sandbox file accesses. 76 allow { appdomain -isolated_app } app_data_file:dir create_dir_perms; 77 allow { appdomain -isolated_app } app_data_file:notdevfile_class_set create_file_perms; 78 79 # Traverse into expanded storage 80 allow appdomain mnt_expand_file:dir r_dir_perms; 81 82 # Keychain and user-trusted credentials 83 r_dir_file(appdomain, keychain_data_file) 84 allow appdomain misc_user_data_file:dir r_dir_perms; 85 allow appdomain misc_user_data_file:file r_file_perms; 86 87 # TextClassifier 88 r_dir_file({ appdomain -isolated_app }, textclassifier_data_file) 89 90 # Access to OEM provided data and apps 91 allow appdomain oemfs:dir r_dir_perms; 92 allow appdomain oemfs:file rx_file_perms; 93 94 # Execute the shell or other system executables. 95 allow { appdomain -ephemeral_app -untrusted_v2_app } shell_exec:file rx_file_perms; 96 allow { appdomain -ephemeral_app -untrusted_v2_app } toolbox_exec:file rx_file_perms; 97 allow { appdomain -ephemeral_app -untrusted_v2_app } system_file:file x_file_perms; 98 not_full_treble(`allow { appdomain -ephemeral_app -untrusted_v2_app } vendor_file:file x_file_perms;') 99 100 # Renderscript needs the ability to read directories on /system 101 allow appdomain system_file:dir r_dir_perms; 102 allow appdomain system_file:lnk_file { getattr open read }; 103 # Renderscript specific permissions to open /system/vendor/lib64. 104 not_full_treble(` 105 allow appdomain vendor_file_type:dir r_dir_perms; 106 allow appdomain vendor_file_type:lnk_file { getattr open read }; 107 ') 108 109 full_treble_only(` 110 # For looking up Renderscript vendor drivers 111 allow { appdomain -isolated_app } vendor_file:dir { open read }; 112 ') 113 114 # Allow apps access to /vendor/app except for privileged 115 # apps which cannot be in /vendor. 116 r_dir_file({ appdomain -ephemeral_app -untrusted_v2_app }, vendor_app_file) 117 allow { appdomain -ephemeral_app -untrusted_v2_app } vendor_app_file:file execute; 118 119 # Allow apps access to /vendor/overlay 120 r_dir_file(appdomain, vendor_overlay_file) 121 122 # Allow apps access to /vendor/framework 123 # for vendor provided libraries. 124 r_dir_file(appdomain, vendor_framework_file) 125 126 # Execute dex2oat when apps call dexclassloader 127 allow appdomain dex2oat_exec:file rx_file_perms; 128 129 # Read/write wallpaper file (opened by system). 130 allow appdomain wallpaper_file:file { getattr read write }; 131 132 # Read/write cached ringtones (opened by system). 133 allow appdomain ringtone_file:file { getattr read write }; 134 135 # Read ShortcutManager icon files (opened by system). 136 allow appdomain shortcut_manager_icons:file { getattr read }; 137 138 # Read icon file (opened by system). 139 allow appdomain icon_file:file { getattr read }; 140 141 # Write to /data/anr/traces.txt. 142 allow appdomain anr_data_file:dir search; 143 allow appdomain anr_data_file:file { open append }; 144 145 # Allow apps to send dump information to dumpstate 146 allow appdomain dumpstate:fd use; 147 allow appdomain dumpstate:unix_stream_socket { read write getopt getattr shutdown }; 148 allow appdomain dumpstate:fifo_file { write getattr }; 149 allow appdomain shell_data_file:file { write getattr }; 150 151 # Write profiles /data/misc/profiles 152 allow appdomain user_profile_data_file:dir { search write add_name }; 153 allow appdomain user_profile_data_file:file create_file_perms; 154 155 # Send heap dumps to system_server via an already open file descriptor 156 # % adb shell am set-watch-heap com.android.systemui 1048576 157 # % adb shell dumpsys procstats --start-testing 158 # debuggable builds only. 159 userdebug_or_eng(` 160 allow appdomain heapdump_data_file:file append; 161 ') 162 163 # Write to /proc/net/xt_qtaguid/ctrl file. 164 allow appdomain qtaguid_proc:file rw_file_perms; 165 # read /proc/net/xt_qtguid/stats 166 r_dir_file({ appdomain -ephemeral_app}, proc_net) 167 # Everybody can read the xt_qtaguid resource tracking misc dev. 168 # So allow all apps to read from /dev/xt_qtaguid. 169 allow appdomain qtaguid_device:chr_file r_file_perms; 170 171 # Grant GPU access to all processes started by Zygote. 172 # They need that to render the standard UI. 173 allow { appdomain -isolated_app } gpu_device:chr_file rw_file_perms; 174 175 # Use the Binder. 176 binder_use(appdomain) 177 # Perform binder IPC to binder services. 178 binder_call(appdomain, binderservicedomain) 179 # Perform binder IPC to other apps. 180 binder_call(appdomain, appdomain) 181 # Perform binder IPC to ephemeral apps. 182 binder_call(appdomain, ephemeral_app) 183 184 # TODO(b/36375899): Replace this with hal_client_domain once mediacodec is properly attributized 185 # as OMX HAL 186 hwbinder_use({ appdomain -isolated_app }) 187 allow { appdomain -isolated_app } hal_omx_hwservice:hwservice_manager find; 188 allow { appdomain -isolated_app } hidl_token_hwservice:hwservice_manager find; 189 190 # Talk with graphics composer fences 191 allow appdomain hal_graphics_composer:fd use; 192 193 # Already connected, unnamed sockets being passed over some other IPC 194 # hence no sock_file or connectto permission. This appears to be how 195 # Chrome works, may need to be updated as more apps using isolated services 196 # are examined. 197 allow appdomain appdomain:unix_stream_socket { getopt getattr read write shutdown }; 198 199 # Backup ability for every app. BMS opens and passes the fd 200 # to any app that has backup ability. Hence, no open permissions here. 201 allow appdomain backup_data_file:file { read write getattr }; 202 allow appdomain cache_backup_file:file { read write getattr }; 203 allow appdomain cache_backup_file:dir getattr; 204 # Backup ability using 'adb backup' 205 allow appdomain system_data_file:lnk_file r_file_perms; 206 allow appdomain system_data_file:file { getattr read }; 207 208 # Allow read/stat of /data/media files passed by Binder or local socket IPC. 209 allow { appdomain -isolated_app } media_rw_data_file:file { read getattr }; 210 211 # Read and write /data/data/com.android.providers.telephony files passed over Binder. 212 allow { appdomain -isolated_app } radio_data_file:file { read write getattr }; 213 214 # Allow access to external storage; we have several visible mount points under /storage 215 # and symlinks to primary storage at places like /storage/sdcard0 and /mnt/user/0/primary 216 allow { appdomain -isolated_app -ephemeral_app } storage_file:dir r_dir_perms; 217 allow { appdomain -isolated_app -ephemeral_app } storage_file:lnk_file r_file_perms; 218 allow { appdomain -isolated_app -ephemeral_app } mnt_user_file:dir r_dir_perms; 219 allow { appdomain -isolated_app -ephemeral_app } mnt_user_file:lnk_file r_file_perms; 220 221 # Read/write visible storage 222 allow { appdomain -isolated_app -ephemeral_app } fuse:dir create_dir_perms; 223 allow { appdomain -isolated_app -ephemeral_app } fuse:file create_file_perms; 224 allow { appdomain -isolated_app -ephemeral_app } sdcardfs:dir create_dir_perms; 225 allow { appdomain -isolated_app -ephemeral_app } sdcardfs:file create_file_perms; 226 # This should be removed if sdcardfs is modified to alter the secontext for its 227 # accesses to the underlying FS. 228 allow { appdomain -isolated_app -ephemeral_app } { media_rw_data_file vfat }:dir create_dir_perms; 229 allow { appdomain -isolated_app -ephemeral_app } { media_rw_data_file vfat }:file create_file_perms; 230 231 # Access OBBs (vfat images) mounted by vold (b/17633509) 232 # File write access allowed for FDs returned through Storage Access Framework 233 allow { appdomain -isolated_app -ephemeral_app } vfat:dir r_dir_perms; 234 allow { appdomain -isolated_app -ephemeral_app } vfat:file rw_file_perms; 235 236 # Allow apps to use the USB Accessory interface. 237 # http://developer.android.com/guide/topics/connectivity/usb/accessory.html 238 # 239 # USB devices are first opened by the system server (USBDeviceManagerService) 240 # and the file descriptor is passed to the right Activity via binder. 241 allow { appdomain -isolated_app -ephemeral_app } usb_device:chr_file { read write getattr ioctl }; 242 allow { appdomain -isolated_app -ephemeral_app } usbaccessory_device:chr_file { read write getattr }; 243 244 # For art. 245 allow appdomain dalvikcache_data_file:file execute; 246 allow appdomain dalvikcache_data_file:lnk_file r_file_perms; 247 248 # Allow any app to read shared RELRO files. 249 allow appdomain shared_relro_file:dir search; 250 allow appdomain shared_relro_file:file r_file_perms; 251 252 # Allow apps to read/execute installed binaries 253 allow appdomain apk_data_file:dir r_dir_perms; 254 allow appdomain apk_data_file:file rx_file_perms; 255 256 # /data/resource-cache 257 allow appdomain resourcecache_data_file:file r_file_perms; 258 allow appdomain resourcecache_data_file:dir r_dir_perms; 259 260 # logd access 261 read_logd(appdomain) 262 control_logd({ appdomain -ephemeral_app untrusted_v2_app }) 263 # application inherit logd write socket (urge is to deprecate this long term) 264 allow appdomain zygote:unix_dgram_socket write; 265 266 allow { appdomain -isolated_app -ephemeral_app } keystore:keystore_key { get_state get insert delete exist list sign verify }; 267 268 use_keystore({ appdomain -isolated_app -ephemeral_app }) 269 270 allow appdomain console_device:chr_file { read write }; 271 272 # only allow unprivileged socket ioctl commands 273 allowxperm { appdomain -bluetooth } self:{ rawip_socket tcp_socket udp_socket } 274 ioctl { unpriv_sock_ioctls unpriv_tty_ioctls }; 275 276 allow { appdomain -isolated_app } ion_device:chr_file rw_file_perms; 277 # TODO is write really necessary ? 278 auditallow { appdomain userdebug_or_eng(`-su') } ion_device:chr_file { write append }; 279 280 # TODO(b/36375899) replace with hal_client_domain for mediacodec (hal_omx) 281 get_prop({ appdomain -isolated_app }, hwservicemanager_prop); 282 283 # Allow app access to mediacodec (IOMX HAL) 284 binder_call({ appdomain -isolated_app }, mediacodec) 285 286 # Allow AAudio apps to use shared memory file descriptors from the HAL 287 allow { appdomain -isolated_app } hal_audio:fd use; 288 289 # Allow app to access shared memory created by camera HAL1 290 allow { appdomain -isolated_app } hal_camera:fd use; 291 292 # RenderScript always-passthrough HAL 293 allow { appdomain -isolated_app } hal_renderscript_hwservice:hwservice_manager find; 294 295 # TODO: switch to meminfo service 296 allow appdomain proc_meminfo:file r_file_perms; 297 298 # For app fuse. 299 allow appdomain app_fuse_file:file { getattr read append write }; 300 301 pdx_client({ appdomain -isolated_app -ephemeral_app }, display_client) 302 pdx_client({ appdomain -isolated_app -ephemeral_app }, display_manager) 303 pdx_client({ appdomain -isolated_app -ephemeral_app }, display_vsync) 304 pdx_client({ appdomain -isolated_app -ephemeral_app }, performance_client) 305 # Apps do not directly open the IPC socket for bufferhubd. 306 pdx_use({ appdomain -isolated_app -ephemeral_app }, bufferhub_client) 307 308 ### 309 ### CTS-specific rules 310 ### 311 312 # For cts/tests/tests/permission/src/android/permission/cts/FileSystemPermissionTest.java. 313 # testRunAsHasCorrectCapabilities 314 allow appdomain runas_exec:file getattr; 315 # Others are either allowed elsewhere or not desired. 316 317 # For cts/tests/tests/security/src/android/security/cts/SELinuxTest.java 318 # Check SELinux policy and contexts. 319 selinux_check_access(appdomain) 320 selinux_check_context(appdomain) 321 322 # Apps receive an open tun fd from the framework for 323 # device traffic. Do not allow untrusted app to directly open tun_device 324 allow { appdomain -isolated_app -ephemeral_app } tun_device:chr_file { read write getattr ioctl append }; 325 326 # Connect to adbd and use a socket transferred from it. 327 # This is used for e.g. adb backup/restore. 328 allow appdomain adbd:unix_stream_socket connectto; 329 allow appdomain adbd:fd use; 330 allow appdomain adbd:unix_stream_socket { getattr getopt ioctl read write shutdown }; 331 332 allow appdomain cache_file:dir getattr; 333 334 ### 335 ### Neverallow rules 336 ### 337 ### These are things that Android apps should NEVER be able to do 338 ### 339 340 # Superuser capabilities. 341 # bluetooth requires net_admin and wake_alarm. 342 neverallow { appdomain -bluetooth } self:capability *; 343 neverallow { appdomain -bluetooth } self:capability2 *; 344 345 # Block device access. 346 neverallow appdomain dev_type:blk_file { read write }; 347 348 # Access to any of the following character devices. 349 neverallow appdomain { 350 audio_device 351 camera_device 352 dm_device 353 radio_device 354 rpmsg_device 355 video_device 356 }:chr_file { read write }; 357 358 # Note: Try expanding list of app domains in the future. 359 neverallow { untrusted_app isolated_app shell } graphics_device:chr_file { read write }; 360 361 neverallow { appdomain -nfc } nfc_device:chr_file 362 { read write }; 363 neverallow { appdomain -bluetooth } hci_attach_dev:chr_file 364 { read write }; 365 neverallow appdomain tee_device:chr_file { read write }; 366 367 # Privileged netlink socket interfaces. 368 neverallow appdomain 369 domain:{ 370 netlink_tcpdiag_socket 371 netlink_nflog_socket 372 netlink_xfrm_socket 373 netlink_audit_socket 374 netlink_dnrt_socket 375 } *; 376 377 # These messages are broadcast messages from the kernel to userspace. 378 # Do not allow the writing of netlink messages, which has been a source 379 # of rooting vulns in the past. 380 neverallow appdomain domain:netlink_kobject_uevent_socket { write append }; 381 382 # Sockets under /dev/socket that are not specifically typed. 383 neverallow appdomain socket_device:sock_file write; 384 385 # Unix domain sockets. 386 neverallow appdomain adbd_socket:sock_file write; 387 neverallow { appdomain -radio } rild_socket:sock_file write; 388 neverallow appdomain vold_socket:sock_file write; 389 neverallow appdomain zygote_socket:sock_file write; 390 391 # ptrace access to non-app domains. 392 neverallow appdomain { domain -appdomain }:process ptrace; 393 394 # Write access to /proc/pid entries for any non-app domain. 395 neverallow appdomain { domain -appdomain }:file write; 396 397 # signal access to non-app domains. 398 # sigchld allowed for parent death notification. 399 # signull allowed for kill(pid, 0) existence test. 400 # All others prohibited. 401 neverallow appdomain { domain -appdomain }:process 402 { sigkill sigstop signal }; 403 404 # Transition to a non-app domain. 405 # Exception for the shell and su domains, can transition to runas, etc. 406 # Exception for crash_dump. 407 neverallow { appdomain -shell userdebug_or_eng(`-su') } { domain -appdomain -crash_dump }:process 408 { transition }; 409 neverallow { appdomain -shell userdebug_or_eng(`-su') } { domain -appdomain }:process 410 { dyntransition }; 411 412 # Write to rootfs. 413 neverallow appdomain rootfs:dir_file_class_set 414 { create write setattr relabelfrom relabelto append unlink link rename }; 415 416 # Write to /system. 417 neverallow appdomain system_file:dir_file_class_set 418 { create write setattr relabelfrom relabelto append unlink link rename }; 419 420 # Write to entrypoint executables. 421 neverallow appdomain exec_type:file 422 { create write setattr relabelfrom relabelto append unlink link rename }; 423 424 # Write to system-owned parts of /data. 425 # This is the default type for anything under /data not otherwise 426 # specified in file_contexts. Define a different type for portions 427 # that should be writable by apps. 428 neverallow appdomain system_data_file:dir_file_class_set 429 { create write setattr relabelfrom relabelto append unlink link rename }; 430 431 # Write to various other parts of /data. 432 neverallow appdomain drm_data_file:dir_file_class_set 433 { create write setattr relabelfrom relabelto append unlink link rename }; 434 neverallow { appdomain -platform_app } 435 apk_data_file:dir_file_class_set 436 { create write setattr relabelfrom relabelto append unlink link rename }; 437 neverallow { appdomain -platform_app } 438 apk_tmp_file:dir_file_class_set 439 { create write setattr relabelfrom relabelto append unlink link rename }; 440 neverallow { appdomain -platform_app } 441 apk_private_data_file:dir_file_class_set 442 { create write setattr relabelfrom relabelto append unlink link rename }; 443 neverallow { appdomain -platform_app } 444 apk_private_tmp_file:dir_file_class_set 445 { create write setattr relabelfrom relabelto append unlink link rename }; 446 neverallow { appdomain -shell } 447 shell_data_file:dir_file_class_set 448 { create setattr relabelfrom relabelto append unlink link rename }; 449 neverallow { appdomain -bluetooth } 450 bluetooth_data_file:dir_file_class_set 451 { create write setattr relabelfrom relabelto append unlink link rename }; 452 neverallow appdomain 453 keystore_data_file:dir_file_class_set 454 { create write setattr relabelfrom relabelto append unlink link rename }; 455 neverallow appdomain 456 systemkeys_data_file:dir_file_class_set 457 { create write setattr relabelfrom relabelto append unlink link rename }; 458 neverallow appdomain 459 wifi_data_file:dir_file_class_set 460 { create write setattr relabelfrom relabelto append unlink link rename }; 461 neverallow appdomain 462 dhcp_data_file:dir_file_class_set 463 { create write setattr relabelfrom relabelto append unlink link rename }; 464 465 # access tmp apk files 466 neverallow { appdomain -platform_app -priv_app } 467 { apk_tmp_file apk_private_tmp_file }:dir_file_class_set *; 468 469 # Access to factory files. 470 neverallow appdomain efs_file:dir_file_class_set write; 471 neverallow { appdomain -shell } efs_file:dir_file_class_set read; 472 473 # Write to various pseudo file systems. 474 neverallow { appdomain -bluetooth -nfc } 475 sysfs:dir_file_class_set write; 476 neverallow appdomain 477 proc:dir_file_class_set write; 478 479 # Access to syslog(2) or /proc/kmsg. 480 neverallow appdomain kernel:system { syslog_read syslog_mod syslog_console }; 481 482 # Ability to perform any filesystem operation other than statfs(2). 483 # i.e. no mount(2), unmount(2), etc. 484 neverallow appdomain fs_type:filesystem ~getattr; 485 486 # prevent creation/manipulation of globally readable symlinks 487 neverallow appdomain { 488 apk_data_file 489 cache_file 490 cache_recovery_file 491 dev_type 492 rootfs 493 system_file 494 tmpfs 495 }:lnk_file no_w_file_perms; 496 497 # Blacklist app domains not allowed to execute from /data 498 neverallow { 499 bluetooth 500 isolated_app 501 nfc 502 radio 503 shared_relro 504 system_app 505 } { 506 data_file_type 507 -dalvikcache_data_file 508 -system_data_file # shared libs in apks 509 -apk_data_file 510 }:file no_x_file_perms; 511 512 # Applications should use the activity model for receiving events 513 neverallow { 514 appdomain 515 -shell # bugreport 516 } input_device:chr_file ~getattr; 517 518 # Do not allow access to Bluetooth-related system properties except for a few whitelisted domains. 519 # neverallow rules for access to Bluetooth-related data files are above. 520 neverallow { 521 appdomain 522 -bluetooth 523 -system_app 524 } bluetooth_prop:file create_file_perms; 525
