1 ### 2 ### Services with isolatedProcess=true in their manifest. 3 ### 4 ### This file defines the rules for isolated apps. An "isolated 5 ### app" is an APP with UID between AID_ISOLATED_START (99000) 6 ### and AID_ISOLATED_END (99999). 7 ### 8 9 typeattribute isolated_app coredomain; 10 11 app_domain(isolated_app) 12 13 # Access already open app data files received over Binder or local socket IPC. 14 allow isolated_app app_data_file:file { append read write getattr lock }; 15 16 allow isolated_app activity_service:service_manager find; 17 allow isolated_app display_service:service_manager find; 18 allow isolated_app webviewupdate_service:service_manager find; 19 20 # Google Breakpad (crash reporter for Chrome) relies on ptrace 21 # functionality. Without the ability to ptrace, the crash reporter 22 # tool is broken. 23 # b/20150694 24 # https://code.google.com/p/chromium/issues/detail?id=475270 25 allow isolated_app self:process ptrace; 26 27 # b/32896414: Allow accessing sdcard file descriptors passed to isolated_apps 28 # by other processes. Open should never be allowed, and is blocked by 29 # neverallow rules below. 30 # TODO: consider removing write/append. We want to limit isolated_apps 31 # ability to mutate files of any type. 32 # media_rw_data_file is included for sdcardfs, and can be removed if sdcardfs 33 # is modified to change the secontext when accessing the lower filesystem. 34 allow isolated_app { sdcard_type media_rw_data_file }:file { read write append getattr lock }; 35 auditallow isolated_app { sdcard_type media_rw_data_file }:file { write append }; 36 37 # For webviews, isolated_app processes can be forked from the webview_zygote 38 # in addition to the zygote. Allow access to resources inherited from the 39 # webview_zygote process. These rules are specialized copies of the ones in app.te. 40 # Inherit FDs from the webview_zygote. 41 allow isolated_app webview_zygote:fd use; 42 # Notify webview_zygote of child death. 43 allow isolated_app webview_zygote:process sigchld; 44 # Inherit logd write socket. 45 allow isolated_app webview_zygote:unix_dgram_socket write; 46 # Read system properties managed by webview_zygote. 47 allow isolated_app webview_zygote_tmpfs:file read; 48 49 # TODO (b/63631799) fix this access 50 # suppress denials to /data/local/tmp 51 dontaudit isolated_app shell_data_file:dir search; 52 53 ##### 54 ##### Neverallow 55 ##### 56 57 # Do not allow isolated_app to directly open tun_device 58 neverallow isolated_app tun_device:chr_file open; 59 60 # Isolated apps should not directly open app data files themselves. 61 neverallow isolated_app app_data_file:file open; 62 63 # Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553) 64 # TODO: are there situations where isolated_apps write to this file? 65 # TODO: should we tighten these restrictions further? 66 neverallow isolated_app anr_data_file:file ~{ open append }; 67 neverallow isolated_app anr_data_file:dir ~search; 68 69 # Isolated apps must not be permitted to use HwBinder 70 neverallow isolated_app hwbinder_device:chr_file *; 71 neverallow isolated_app *:hwservice_manager *; 72 73 # Isolated apps must not be permitted to use VndBinder 74 neverallow isolated_app vndbinder_device:chr_file *; 75 76 # Isolated apps must not be permitted to perform actions on Binder and VndBinder service_manager 77 # except the find actions for services whitelisted below. 78 neverallow isolated_app *:service_manager ~find; 79 80 # b/17487348 81 # Isolated apps can only access three services, 82 # activity_service, display_service and webviewupdate_service. 83 neverallow isolated_app { 84 service_manager_type 85 -activity_service 86 -display_service 87 -webviewupdate_service 88 }:service_manager find; 89 90 # Isolated apps shouldn't be able to access the driver directly. 91 neverallow isolated_app gpu_device:chr_file { rw_file_perms execute }; 92 93 # Do not allow isolated_app access to /cache 94 neverallow isolated_app cache_file:dir ~{ r_dir_perms }; 95 neverallow isolated_app cache_file:file ~{ read getattr }; 96 97 # Do not allow isolated_app to access external storage, except for files passed 98 # via file descriptors (b/32896414). 99 neverallow isolated_app { storage_file mnt_user_file sdcard_type }:dir ~getattr; 100 neverallow isolated_app { storage_file mnt_user_file }:file_class_set *; 101 neverallow isolated_app sdcard_type:{ devfile_class_set lnk_file sock_file fifo_file } *; 102 neverallow isolated_app sdcard_type:file ~{ read write append getattr lock }; 103 104 # Do not allow USB access 105 neverallow isolated_app { usb_device usbaccessory_device }:chr_file *; 106 107 # Restrict the webview_zygote control socket. 108 neverallow isolated_app webview_zygote_socket:sock_file write; 109
