Home | History | Annotate | Download | only in public 
      1 # recovery console (used in recovery init.rc for /sbin/recovery)
      2 
      3 # Declare the domain unconditionally so we can always reference it
      4 # in neverallow rules.
      5 type recovery, domain;
      6 
      7 # But the allow rules are only included in the recovery policy.
      8 # Otherwise recovery is only allowed the domain rules.
      9 recovery_only(`
     10   # Allow recovery to perform an update as update_engine would do.
     11   typeattribute recovery update_engine_common;
     12   # Recovery can only use HALs in passthrough mode
     13   passthrough_hal_client_domain(recovery, hal_bootctl)
     14 
     15   allow recovery self:global_capability_class_set {
     16     chown
     17     dac_override
     18     fowner
     19     setuid
     20     setgid
     21     sys_admin
     22     sys_tty_config
     23   };
     24 
     25   # Run helpers from / or /system without changing domain.
     26   r_dir_file(recovery, rootfs)
     27   allow recovery rootfs:file execute_no_trans;
     28   allow recovery system_file:file execute_no_trans;
     29   allow recovery toolbox_exec:file rx_file_perms;
     30 
     31   # Mount filesystems.
     32   allow recovery rootfs:dir mounton;
     33   allow recovery fs_type:filesystem ~relabelto;
     34   allow recovery unlabeled:filesystem ~relabelto;
     35   allow recovery contextmount_type:filesystem relabelto;
     36 
     37   # We may be asked to set an SELinux label for a type not known to the
     38   # currently loaded policy. Allow it.
     39   allow recovery unlabeled:{ file lnk_file } { create_file_perms relabelfrom relabelto };
     40   allow recovery unlabeled:dir { create_dir_perms relabelfrom relabelto };
     41 
     42   # Get file contexts
     43   allow recovery file_contexts_file:file r_file_perms;
     44 
     45   # Write to /proc/sys/vm/drop_caches
     46   allow recovery proc_drop_caches:file w_file_perms;
     47 
     48   # Read /proc/swaps
     49   allow recovery proc_swaps:file r_file_perms;
     50 
     51   # Read kernel config through libvintf for OTA matching
     52   allow recovery config_gz:file { open read getattr };
     53 
     54   # Write to /sys/class/android_usb/android0/enable.
     55   r_dir_file(recovery, sysfs_android_usb)
     56   allow recovery sysfs_android_usb:file w_file_perms;
     57 
     58   # Write to /sys/devices/system/cpu/cpu0/cpufreq/scaling_max_freq.
     59   allow recovery sysfs_devices_system_cpu:file w_file_perms;
     60 
     61   allow recovery sysfs_batteryinfo:file r_file_perms;
     62 
     63   # Read /sysfs/fs/ext4/features
     64   r_dir_file(recovery, sysfs_fs_ext4_features)
     65 
     66   # Read from /sys/class/leds/lcd-backlight/max_brightness and write to /s/c/l/l/brightness to
     67   # control backlight brightness.
     68   allow recovery sysfs_leds:dir r_dir_perms;
     69   allow recovery sysfs_leds:file rw_file_perms;
     70   allow recovery sysfs_leds:lnk_file read;
     71 
     72   allow recovery kernel:system syslog_read;
     73 
     74   # Access /dev/usb-ffs/adb/ep0
     75   allow recovery functionfs:dir search;
     76   allow recovery functionfs:file rw_file_perms;
     77 
     78   # Access to /sys/fs/selinux/policyvers for compatibility check
     79   allow recovery selinuxfs:file r_file_perms;
     80 
     81   # Required to e.g. wipe userdata/cache.
     82   allow recovery device:dir r_dir_perms;
     83   allow recovery block_device:dir r_dir_perms;
     84   allow recovery dev_type:blk_file rw_file_perms;
     85 
     86   # GUI
     87   allow recovery graphics_device:chr_file rw_file_perms;
     88   allow recovery graphics_device:dir r_dir_perms;
     89   allow recovery input_device:dir r_dir_perms;
     90   allow recovery input_device:chr_file r_file_perms;
     91   allow recovery tty_device:chr_file rw_file_perms;
     92 
     93   # Create /tmp/recovery.log and execute /tmp/update_binary.
     94   allow recovery tmpfs:file { create_file_perms x_file_perms };
     95   allow recovery tmpfs:dir create_dir_perms;
     96 
     97   # Manage files on /cache and /cache/recovery
     98   allow recovery { cache_file cache_recovery_file }:dir create_dir_perms;
     99   allow recovery { cache_file cache_recovery_file }:file create_file_perms;
    100 
    101   # Read /sys/class/thermal/*/temp for thermal info.
    102   r_dir_file(recovery, sysfs_thermal)
    103 
    104   # Read files on /oem.
    105   r_dir_file(recovery, oemfs);
    106 
    107   # Reboot the device
    108   set_prop(recovery, powerctl_prop)
    109 
    110   # Start/stop adbd via ctl.start adbd
    111   set_prop(recovery, ctl_default_prop)
    112 
    113   # Read serial number of the device from system properties
    114   get_prop(recovery, serialno_prop)
    115 
    116   # Set sys.usb.ffs.ready when starting minadbd for sideload.
    117   set_prop(recovery, ffs_prop)
    118   set_prop(recovery, exported_ffs_prop)
    119 
    120   # Read ro.boot.bootreason
    121   get_prop(recovery, bootloader_boot_reason_prop)
    122 
    123   # Use setfscreatecon() to label files for OTA updates.
    124   allow recovery self:process setfscreate;
    125 
    126   # Allow recovery to create a fuse filesystem, and read files from it.
    127   allow recovery fuse_device:chr_file rw_file_perms;
    128   allow recovery fuse:dir r_dir_perms;
    129   allow recovery fuse:file r_file_perms;
    130 
    131   wakelock_use(recovery)
    132 
    133   # This line seems suspect, as it should not really need to
    134   # set scheduling parameters for a kernel domain task.
    135   allow recovery kernel:process setsched;
    136 ')
    137 
    138 ###
    139 ### neverallow rules
    140 ###
    141 
    142 # Recovery should never touch /data.
    143 #
    144 # In particular, if /data is encrypted, it is not accessible
    145 # to recovery anyway.
    146 #
    147 # For now, we only enforce write/execute restrictions, as domain.te
    148 # contains a number of read-only rules that apply to all
    149 # domains, including recovery.
    150 #
    151 # TODO: tighten this up further.
    152 neverallow recovery {
    153    data_file_type
    154    -cache_file
    155    -cache_recovery_file
    156 }:file { no_w_file_perms no_x_file_perms };
    157 neverallow recovery {
    158    data_file_type
    159    -cache_file
    160    -cache_recovery_file
    161 }:dir no_w_dir_perms;
    162