Home | History | Annotate | Download | only in private 
      1 ###
      2 ### A domain for further sandboxing privileged apps.
      3 ###
      4 
      5 typeattribute priv_app coredomain;
      6 app_domain(priv_app)
      7 
      8 # Access the network.
      9 net_domain(priv_app)
     10 # Access bluetooth.
     11 bluetooth_domain(priv_app)
     12 
     13 # Allow the allocation and use of ptys
     14 # Used by: https://play.privileged.com/store/apps/details?id=jackpal.androidterm
     15 create_pty(priv_app)
     16 
     17 # webview crash handling depends on self ptrace (b/27697529, b/20150694, b/19277529#comment7)
     18 allow priv_app self:process ptrace;
     19 
     20 # Some apps ship with shared libraries that they write out
     21 # to their sandbox directory and then dlopen().
     22 allow priv_app app_data_file:file execute;
     23 
     24 allow priv_app audioserver_service:service_manager find;
     25 allow priv_app cameraserver_service:service_manager find;
     26 allow priv_app drmserver_service:service_manager find;
     27 allow priv_app mediacodec_service:service_manager find;
     28 allow priv_app mediametrics_service:service_manager find;
     29 allow priv_app mediadrmserver_service:service_manager find;
     30 allow priv_app mediacasserver_service:service_manager find;
     31 allow priv_app mediaextractor_service:service_manager find;
     32 allow priv_app mediaserver_service:service_manager find;
     33 allow priv_app nfc_service:service_manager find;
     34 allow priv_app oem_lock_service:service_manager find;
     35 allow priv_app radio_service:service_manager find;
     36 allow priv_app surfaceflinger_service:service_manager find;
     37 allow priv_app app_api_service:service_manager find;
     38 allow priv_app system_api_service:service_manager find;
     39 allow priv_app persistent_data_block_service:service_manager find;
     40 allow priv_app recovery_service:service_manager find;
     41 
     42 # Write to /cache.
     43 allow priv_app { cache_file cache_recovery_file }:dir create_dir_perms;
     44 allow priv_app { cache_file cache_recovery_file }:file create_file_perms;
     45 # /cache is a symlink to /data/cache on some devices. Allow reading the link.
     46 allow priv_app cache_file:lnk_file r_file_perms;
     47 
     48 # Write to /data/ota_package for OTA packages.
     49 allow priv_app ota_package_file:dir rw_dir_perms;
     50 allow priv_app ota_package_file:file create_file_perms;
     51 
     52 # Access to /data/media.
     53 allow priv_app media_rw_data_file:dir create_dir_perms;
     54 allow priv_app media_rw_data_file:file create_file_perms;
     55 
     56 # Used by Finsky / Android "Verify Apps" functionality when
     57 # running "adb install foo.apk".
     58 allow priv_app shell_data_file:file r_file_perms;
     59 allow priv_app shell_data_file:dir r_dir_perms;
     60 
     61 # Allow verifier to access staged apks.
     62 allow priv_app { apk_tmp_file apk_private_tmp_file }:dir r_dir_perms;
     63 allow priv_app { apk_tmp_file apk_private_tmp_file }:file r_file_perms;
     64 
     65 # b/18504118: Allow reads from /data/anr/traces.txt
     66 allow priv_app anr_data_file:file r_file_perms;
     67 
     68 # Allow GMS core to access perfprofd output, which is stored
     69 # in /data/misc/perfprofd/. GMS core will need to list all
     70 # data stored in that directory to process them one by one.
     71 userdebug_or_eng(`
     72   allow priv_app perfprofd_data_file:file r_file_perms;
     73   allow priv_app perfprofd_data_file:dir r_dir_perms;
     74 ')
     75 
     76 # For AppFuse.
     77 allow priv_app vold:fd use;
     78 allow priv_app fuse_device:chr_file { read write };
     79 
     80 # /sys and /proc access
     81 r_dir_file(priv_app, sysfs_type)
     82 r_dir_file(priv_app, proc)
     83 r_dir_file(priv_app, rootfs)
     84 
     85 # Allow GMS core to open kernel config for OTA matching through libvintf
     86 allow priv_app config_gz:file { open read getattr };
     87 
     88 # access the mac address
     89 allowxperm priv_app self:udp_socket ioctl SIOCGIFHWADDR;
     90 
     91 # Allow GMS core to communicate with update_engine for A/B update.
     92 binder_call(priv_app, update_engine)
     93 allow priv_app update_engine_service:service_manager find;
     94 
     95 # Allow GMS core to communicate with dumpsys storaged.
     96 binder_call(priv_app, storaged)
     97 allow priv_app storaged_service:service_manager find;
     98 
     99 # Allow Phone to read/write cached ringtones (opened by system).
    100 allow priv_app ringtone_file:file { getattr read write };
    101 
    102 # Access to /data/preloads
    103 allow priv_app preloads_data_file:file r_file_perms;
    104 allow priv_app preloads_data_file:dir r_dir_perms;
    105 allow priv_app preloads_media_file:file r_file_perms;
    106 allow priv_app preloads_media_file:dir r_dir_perms;
    107 
    108 # TODO: revert this as part of fixing 33574909
    109 # android.process.media uses /dev/mtp_usb
    110 allow priv_app mtp_device:chr_file rw_file_perms;
    111 
    112 # TODO: revert this as part of fixing 33574909
    113 # MtpServer uses /dev/usb-ffs/mtp
    114 allow priv_app functionfs:dir search;
    115 allow priv_app functionfs:file rw_file_perms;
    116 
    117 # TODO: revert this as part of fixing 33574909
    118 # Traverse into /mnt/media_rw for bypassing FUSE daemon
    119 # TODO: narrow this to just MediaProvider
    120 allow priv_app mnt_media_rw_file:dir search;
    121 
    122 # Allow privileged apps (e.g. GMS core) to generate unique hardware IDs
    123 allow priv_app keystore:keystore_key gen_unique_id;
    124 
    125 read_runtime_log_tags(priv_app)
    126 
    127 ###
    128 ### neverallow rules
    129 ###
    130 
    131 # Receive or send uevent messages.
    132 neverallow priv_app domain:netlink_kobject_uevent_socket *;
    133 
    134 # Receive or send generic netlink messages
    135 neverallow priv_app domain:netlink_socket *;
    136 
    137 # Too much leaky information in debugfs. It's a security
    138 # best practice to ensure these files aren't readable.
    139 neverallow priv_app debugfs:file read;
    140 
    141 # Do not allow privileged apps to register services.
    142 # Only trusted components of Android should be registering
    143 # services.
    144 neverallow priv_app service_manager_type:service_manager add;
    145 
    146 # Do not allow privileged apps to connect to the property service
    147 # or set properties. b/10243159
    148 neverallow priv_app property_socket:sock_file write;
    149 neverallow priv_app init:unix_stream_socket connectto;
    150 neverallow priv_app property_type:property_service set;
    151 
    152 # Do not allow priv_app to be assigned mlstrustedsubject.
    153 # This would undermine the per-user isolation model being
    154 # enforced via levelFrom=user in seapp_contexts and the mls
    155 # constraints.  As there is no direct way to specify a neverallow
    156 # on attribute assignment, this relies on the fact that fork
    157 # permission only makes sense within a domain (hence should
    158 # never be granted to any other domain within mlstrustedsubject)
    159 # and priv_app is allowed fork permission to itself.
    160 neverallow priv_app mlstrustedsubject:process fork;
    161 
    162 # Do not allow priv_app to hard link to any files.
    163 # In particular, if priv_app links to other app data
    164 # files, installd will not be able to guarantee the deletion
    165 # of the linked to file. Hard links also contribute to security
    166 # bugs, so we want to ensure priv_app never has this
    167 # capability.
    168 neverallow priv_app file_type:file link;
    169