1 ##################################### 2 # domain_trans(olddomain, type, newdomain) 3 # Allow a transition from olddomain to newdomain 4 # upon executing a file labeled with type. 5 # This only allows the transition; it does not 6 # cause it to occur automatically - use domain_auto_trans 7 # if that is what you want. 8 # 9 define(`domain_trans', ` 10 # Old domain may exec the file and transition to the new domain. 11 allow $1 $2:file { getattr open read execute map }; 12 allow $1 $3:process transition; 13 # New domain is entered by executing the file. 14 allow $3 $2:file { entrypoint open read execute getattr map }; 15 # New domain can send SIGCHLD to its caller. 16 ifelse($1, `init', `', `allow $3 $1:process sigchld;') 17 # Enable AT_SECURE, i.e. libc secure mode. 18 dontaudit $1 $3:process noatsecure; 19 # XXX dontaudit candidate but requires further study. 20 allow $1 $3:process { siginh rlimitinh }; 21 ') 22 23 ##################################### 24 # domain_auto_trans(olddomain, type, newdomain) 25 # Automatically transition from olddomain to newdomain 26 # upon executing a file labeled with type. 27 # 28 define(`domain_auto_trans', ` 29 # Allow the necessary permissions. 30 domain_trans($1,$2,$3) 31 # Make the transition occur by default. 32 type_transition $1 $2:process $3; 33 ') 34 35 ##################################### 36 # file_type_trans(domain, dir_type, file_type) 37 # Allow domain to create a file labeled file_type in a 38 # directory labeled dir_type. 39 # This only allows the transition; it does not 40 # cause it to occur automatically - use file_type_auto_trans 41 # if that is what you want. 42 # 43 define(`file_type_trans', ` 44 # Allow the domain to add entries to the directory. 45 allow $1 $2:dir ra_dir_perms; 46 # Allow the domain to create the file. 47 allow $1 $3:notdevfile_class_set create_file_perms; 48 allow $1 $3:dir create_dir_perms; 49 ') 50 51 ##################################### 52 # file_type_auto_trans(domain, dir_type, file_type) 53 # Automatically label new files with file_type when 54 # they are created by domain in directories labeled dir_type. 55 # 56 define(`file_type_auto_trans', ` 57 # Allow the necessary permissions. 58 file_type_trans($1, $2, $3) 59 # Make the transition occur by default. 60 type_transition $1 $2:dir $3; 61 type_transition $1 $2:notdevfile_class_set $3; 62 ') 63 64 ##################################### 65 # r_dir_file(domain, type) 66 # Allow the specified domain to read directories, files 67 # and symbolic links of the specified type. 68 define(`r_dir_file', ` 69 allow $1 $2:dir r_dir_perms; 70 allow $1 $2:{ file lnk_file } r_file_perms; 71 ') 72 73 ##################################### 74 # tmpfs_domain(domain) 75 # Define and allow access to a unique type for 76 # this domain when creating tmpfs / shmem / ashmem files. 77 define(`tmpfs_domain', ` 78 type $1_tmpfs, file_type; 79 type_transition $1 tmpfs:file $1_tmpfs; 80 allow $1 $1_tmpfs:file { read write getattr map }; 81 allow $1 tmpfs:dir { getattr search }; 82 ') 83 84 # pdx macros for IPC. pdx is a high-level name which contains transport-specific 85 # rules from underlying transport (e.g. UDS-based implementation). 86 87 ##################################### 88 # pdx_service_attributes(service) 89 # Defines type attribute used to identify various service-related types. 90 define(`pdx_service_attributes', ` 91 attribute pdx_$1_endpoint_dir_type; 92 attribute pdx_$1_endpoint_socket_type; 93 attribute pdx_$1_channel_socket_type; 94 attribute pdx_$1_server_type; 95 ') 96 97 ##################################### 98 # pdx_service_socket_types(service, endpoint_dir_t) 99 # Define types for endpoint and channel sockets. 100 define(`pdx_service_socket_types', ` 101 typeattribute $2 pdx_$1_endpoint_dir_type; 102 type pdx_$1_endpoint_socket, pdx_$1_endpoint_socket_type, pdx_endpoint_socket_type, file_type, coredomain_socket, mlstrustedobject, mlstrustedsubject; 103 type pdx_$1_channel_socket, pdx_$1_channel_socket_type, pdx_channel_socket_type, coredomain_socket; 104 userdebug_or_eng(` 105 dontaudit su pdx_$1_endpoint_socket:unix_stream_socket *; 106 dontaudit su pdx_$1_channel_socket:unix_stream_socket *; 107 ') 108 ') 109 110 ##################################### 111 # pdx_server(server_domain, service) 112 define(`pdx_server', ` 113 # Mark the server domain as a PDX server. 114 typeattribute $1 pdx_$2_server_type; 115 # Allow the init process to create the initial endpoint socket. 116 allow init pdx_$2_endpoint_socket_type:unix_stream_socket { create bind }; 117 # Allow the server domain to use the endpoint socket and accept connections on it. 118 # Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights 119 # than we need (e.g. we don"t need "bind" or "connect"). 120 allow $1 pdx_$2_endpoint_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown listen accept }; 121 # Allow the server domain to apply security context label to the channel socket pair (allow process to use setsockcreatecon_raw()). 122 allow $1 self:process setsockcreate; 123 # Allow the server domain to create a client channel socket. 124 allow $1 pdx_$2_channel_socket_type:unix_stream_socket create_stream_socket_perms; 125 # Prevent other processes from claiming to be a server for the same service. 126 neverallow {domain -$1} pdx_$2_endpoint_socket_type:unix_stream_socket { listen accept }; 127 ') 128 129 ##################################### 130 # pdx_connect(client, service) 131 define(`pdx_connect', ` 132 # Allow client to open the service endpoint file. 133 allow $1 pdx_$2_endpoint_dir_type:dir r_dir_perms; 134 allow $1 pdx_$2_endpoint_socket_type:sock_file rw_file_perms; 135 # Allow the client to connect to endpoint socket. 136 allow $1 pdx_$2_endpoint_socket_type:unix_stream_socket { connectto read write shutdown }; 137 ') 138 139 ##################################### 140 # pdx_use(client, service) 141 define(`pdx_use', ` 142 # Allow the client to use the PDX channel socket. 143 # Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights 144 # than we need (e.g. we don"t need "bind" or "connect"). 145 allow $1 pdx_$2_channel_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown }; 146 # Client needs to use an channel event fd from the server. 147 allow $1 pdx_$2_server_type:fd use; 148 # Servers may receive sync fences, gralloc buffers, etc, from clients. 149 # This could be tightened on a per-server basis, but keeping track of service 150 # clients is error prone. 151 allow pdx_$2_server_type $1:fd use; 152 ') 153 154 ##################################### 155 # pdx_client(client, service) 156 define(`pdx_client', ` 157 pdx_connect($1, $2) 158 pdx_use($1, $2) 159 ') 160 161 ##################################### 162 # init_daemon_domain(domain) 163 # Set up a transition from init to the daemon domain 164 # upon executing its binary. 165 define(`init_daemon_domain', ` 166 domain_auto_trans(init, $1_exec, $1) 167 tmpfs_domain($1) 168 ') 169 170 ##################################### 171 # app_domain(domain) 172 # Allow a base set of permissions required for all apps. 173 define(`app_domain', ` 174 typeattribute $1 appdomain; 175 # Label ashmem objects with our own unique type. 176 tmpfs_domain($1) 177 # Map with PROT_EXEC. 178 allow $1 $1_tmpfs:file execute; 179 neverallow { $1 -shell } { domain -$1 }:file no_rw_file_perms; 180 neverallow { appdomain -shell -$1 } $1:file no_rw_file_perms; 181 ') 182 183 ##################################### 184 # untrusted_app_domain(domain) 185 # Allow a base set of permissions required for all untrusted apps. 186 define(`untrusted_app_domain', ` 187 typeattribute $1 untrusted_app_all; 188 ') 189 190 ##################################### 191 # net_domain(domain) 192 # Allow a base set of permissions required for network access. 193 define(`net_domain', ` 194 typeattribute $1 netdomain; 195 ') 196 197 ##################################### 198 # bluetooth_domain(domain) 199 # Allow a base set of permissions required for bluetooth access. 200 define(`bluetooth_domain', ` 201 typeattribute $1 bluetoothdomain; 202 ') 203 204 ##################################### 205 # hal_attribute(hal_name) 206 # Add an attribute for hal implementations along with necessary 207 # restrictions. 208 define(`hal_attribute', ` 209 attribute hal_$1; 210 expandattribute hal_$1 true; 211 attribute hal_$1_client; 212 expandattribute hal_$1_client true; 213 attribute hal_$1_server; 214 expandattribute hal_$1_server false; 215 216 neverallow { hal_$1_server -halserverdomain } domain:process fork; 217 ') 218 219 ##################################### 220 # hal_server_domain(domain, hal_type) 221 # Allow a base set of permissions required for a domain to offer a 222 # HAL implementation of the specified type over HwBinder. 223 # 224 # For example, default implementation of Foo HAL: 225 # type hal_foo_default, domain; 226 # hal_server_domain(hal_foo_default, hal_foo) 227 # 228 define(`hal_server_domain', ` 229 typeattribute $1 halserverdomain; 230 typeattribute $1 $2_server; 231 typeattribute $1 $2; 232 ') 233 234 ##################################### 235 # hal_client_domain(domain, hal_type) 236 # Allow a base set of permissions required for a domain to be a 237 # client of a HAL of the specified type. 238 # 239 # For example, make some_domain a client of Foo HAL: 240 # hal_client_domain(some_domain, hal_foo) 241 # 242 define(`hal_client_domain', ` 243 typeattribute $1 halclientdomain; 244 typeattribute $1 $2_client; 245 246 # TODO(b/34170079): Make the inclusion of the rules below conditional also on 247 # non-Treble devices. For now, on non-Treble device, always grant clients of a 248 # HAL sufficient access to run the HAL in passthrough mode (i.e., in-process). 249 not_full_treble(` 250 typeattribute $1 $2; 251 # Find passthrough HAL implementations 252 allow $2 system_file:dir r_dir_perms; 253 allow $2 vendor_file:dir r_dir_perms; 254 allow $2 vendor_file:file { read open getattr execute map }; 255 ') 256 ') 257 258 ##################################### 259 # passthrough_hal_client_domain(domain, hal_type) 260 # Allow a base set of permissions required for a domain to be a 261 # client of a passthrough HAL of the specified type. 262 # 263 # For example, make some_domain a client of passthrough Foo HAL: 264 # passthrough_hal_client_domain(some_domain, hal_foo) 265 # 266 define(`passthrough_hal_client_domain', ` 267 typeattribute $1 halclientdomain; 268 typeattribute $1 $2_client; 269 typeattribute $1 $2; 270 # Find passthrough HAL implementations 271 allow $2 system_file:dir r_dir_perms; 272 allow $2 vendor_file:dir r_dir_perms; 273 allow $2 vendor_file:file { read open getattr execute map }; 274 ') 275 276 ##################################### 277 # unix_socket_connect(clientdomain, socket, serverdomain) 278 # Allow a local socket connection from clientdomain via 279 # socket to serverdomain. 280 # 281 # Note: If you see denial records that distill to the 282 # following allow rules: 283 # allow clientdomain property_socket:sock_file write; 284 # allow clientdomain init:unix_stream_socket connectto; 285 # allow clientdomain something_prop:property_service set; 286 # 287 # This sequence is indicative of attempting to set a property. 288 # use set_prop(sourcedomain, targetproperty) 289 # 290 define(`unix_socket_connect', ` 291 allow $1 $2_socket:sock_file write; 292 allow $1 $3:unix_stream_socket connectto; 293 ') 294 295 ##################################### 296 # set_prop(sourcedomain, targetproperty) 297 # Allows source domain to set the 298 # targetproperty. 299 # 300 define(`set_prop', ` 301 unix_socket_connect($1, property, init) 302 allow $1 $2:property_service set; 303 get_prop($1, $2) 304 ') 305 306 ##################################### 307 # get_prop(sourcedomain, targetproperty) 308 # Allows source domain to read the 309 # targetproperty. 310 # 311 define(`get_prop', ` 312 allow $1 $2:file r_file_perms; 313 ') 314 315 ##################################### 316 # unix_socket_send(clientdomain, socket, serverdomain) 317 # Allow a local socket send from clientdomain via 318 # socket to serverdomain. 319 define(`unix_socket_send', ` 320 allow $1 $2_socket:sock_file write; 321 allow $1 $3:unix_dgram_socket sendto; 322 ') 323 324 ##################################### 325 # binder_use(domain) 326 # Allow domain to use Binder IPC. 327 define(`binder_use', ` 328 # Call the servicemanager and transfer references to it. 329 allow $1 servicemanager:binder { call transfer }; 330 # servicemanager performs getpidcon on clients. 331 allow servicemanager $1:dir search; 332 allow servicemanager $1:file { read open }; 333 allow servicemanager $1:process getattr; 334 # rw access to /dev/binder and /dev/ashmem is presently granted to 335 # all domains in domain.te. 336 ') 337 338 ##################################### 339 # hwbinder_use(domain) 340 # Allow domain to use HwBinder IPC. 341 define(`hwbinder_use', ` 342 # Call the hwservicemanager and transfer references to it. 343 allow $1 hwservicemanager:binder { call transfer }; 344 # Allow hwservicemanager to send out callbacks 345 allow hwservicemanager $1:binder { call transfer }; 346 # hwservicemanager performs getpidcon on clients. 347 allow hwservicemanager $1:dir search; 348 allow hwservicemanager $1:file { read open }; 349 allow hwservicemanager $1:process getattr; 350 # rw access to /dev/hwbinder and /dev/ashmem is presently granted to 351 # all domains in domain.te. 352 ') 353 354 ##################################### 355 # vndbinder_use(domain) 356 # Allow domain to use Binder IPC. 357 define(`vndbinder_use', ` 358 # Talk to the vndbinder device node 359 allow $1 vndbinder_device:chr_file rw_file_perms; 360 # Call the vndservicemanager and transfer references to it. 361 allow $1 vndservicemanager:binder { call transfer }; 362 # vndservicemanager performs getpidcon on clients. 363 allow vndservicemanager $1:dir search; 364 allow vndservicemanager $1:file { read open }; 365 allow vndservicemanager $1:process getattr; 366 ') 367 368 ##################################### 369 # binder_call(clientdomain, serverdomain) 370 # Allow clientdomain to perform binder IPC to serverdomain. 371 define(`binder_call', ` 372 # Call the server domain and optionally transfer references to it. 373 allow $1 $2:binder { call transfer }; 374 # Allow the serverdomain to transfer references to the client on the reply. 375 allow $2 $1:binder transfer; 376 # Receive and use open files from the server. 377 allow $1 $2:fd use; 378 ') 379 380 ##################################### 381 # binder_service(domain) 382 # Mark a domain as being a Binder service domain. 383 # Used to allow binder IPC to the various system services. 384 define(`binder_service', ` 385 typeattribute $1 binderservicedomain; 386 ') 387 388 ##################################### 389 # wakelock_use(domain) 390 # Allow domain to manage wake locks 391 define(`wakelock_use', ` 392 # Access /sys/power/wake_lock and /sys/power/wake_unlock 393 allow $1 sysfs_wake_lock:file rw_file_perms; 394 # Accessing these files requires CAP_BLOCK_SUSPEND 395 allow $1 self:global_capability2_class_set block_suspend; 396 ') 397 398 ##################################### 399 # selinux_check_access(domain) 400 # Allow domain to check SELinux permissions via selinuxfs. 401 define(`selinux_check_access', ` 402 r_dir_file($1, selinuxfs) 403 allow $1 selinuxfs:file w_file_perms; 404 allow $1 kernel:security compute_av; 405 allow $1 self:netlink_selinux_socket { read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind }; 406 ') 407 408 ##################################### 409 # selinux_check_context(domain) 410 # Allow domain to check SELinux contexts via selinuxfs. 411 define(`selinux_check_context', ` 412 r_dir_file($1, selinuxfs) 413 allow $1 selinuxfs:file w_file_perms; 414 allow $1 kernel:security check_context; 415 ') 416 417 ##################################### 418 # create_pty(domain) 419 # Allow domain to create and use a pty, isolated from any other domain ptys. 420 define(`create_pty', ` 421 # Each domain gets a unique devpts type. 422 type $1_devpts, fs_type; 423 # Label the pty with the unique type when created. 424 type_transition $1 devpts:chr_file $1_devpts; 425 # Allow use of the pty after creation. 426 allow $1 $1_devpts:chr_file { open getattr read write ioctl }; 427 allowxperm $1 $1_devpts:chr_file ioctl unpriv_tty_ioctls; 428 # TIOCSTI is only ever used for exploits. Block it. 429 # b/33073072, b/7530569 430 # http://www.openwall.com/lists/oss-security/2016/09/26/14 431 neverallowxperm * $1_devpts:chr_file ioctl TIOCSTI; 432 # Note: devpts:dir search and ptmx_device:chr_file rw_file_perms 433 # allowed to everyone via domain.te. 434 ') 435 436 ##################################### 437 # Non system_app application set 438 # 439 define(`non_system_app_set', `{ appdomain -system_app }') 440 441 ##################################### 442 # Recovery only 443 # SELinux rules which apply only to recovery mode 444 # 445 define(`recovery_only', ifelse(target_recovery, `true', $1, )) 446 447 ##################################### 448 # Full TREBLE only 449 # SELinux rules which apply only to full TREBLE devices 450 # 451 define(`full_treble_only', ifelse(target_full_treble, `true', $1, 452 ifelse(target_full_treble, `cts', 453 # BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify 454 $1 455 # END_TREBLE_ONLY -- this marker is used by CTS -- do not modify 456 , ))) 457 458 ##################################### 459 # Not full TREBLE 460 # SELinux rules which apply only to devices which are not full TREBLE devices 461 # 462 define(`not_full_treble', ifelse(target_full_treble, `true', , $1)) 463 464 ##################################### 465 # Compatible property only 466 # SELinux rules which apply only to devices with compatible property 467 # 468 define(`compatible_property_only', ifelse(target_compatible_property, `true', $1, 469 ifelse(target_compatible_property, `cts', 470 # BEGIN_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify 471 $1 472 # END_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify 473 , ))) 474 475 ##################################### 476 # Not compatible property 477 # SELinux rules which apply only to devices without compatible property 478 # 479 define(`not_compatible_property', ifelse(target_compatible_property, `true', , $1)) 480 481 ##################################### 482 # Userdebug or eng builds 483 # SELinux rules which apply only to userdebug or eng builds 484 # 485 define(`userdebug_or_eng', ifelse(target_build_variant, `eng', $1, ifelse(target_build_variant, `userdebug', $1))) 486 487 ##################################### 488 # asan builds 489 # SELinux rules which apply only to asan builds 490 # 491 define(`with_asan', ifelse(target_with_asan, `true', userdebug_or_eng(`$1'), )) 492 493 #################################### 494 # Fallback crash handling for processes that can't exec crash_dump (e.g. because of seccomp). 495 # 496 define(`crash_dump_fallback', ` 497 userdebug_or_eng(` 498 allow $1 su:fifo_file append; 499 ') 500 allow $1 anr_data_file:file append; 501 allow $1 dumpstate:fd use; 502 allow $1 incidentd:fd use; 503 # TODO: Figure out why write is needed. 504 allow $1 dumpstate:fifo_file { append write }; 505 allow $1 incidentd:fifo_file { append write }; 506 allow $1 system_server:fifo_file { append write }; 507 allow $1 tombstoned:unix_stream_socket connectto; 508 allow $1 tombstoned:fd use; 509 allow $1 tombstoned_crash_socket:sock_file write; 510 allow $1 tombstone_data_file:file append; 511 ') 512 513 ##################################### 514 # WITH_DEXPREOPT builds 515 # SELinux rules which apply only when pre-opting. 516 # 517 define(`with_dexpreopt', ifelse(target_with_dexpreopt, `true', $1)) 518 519 ##################################### 520 # write_logd(domain) 521 # Ability to write to android log 522 # daemon via sockets 523 define(`write_logd', ` 524 unix_socket_send($1, logdw, logd) 525 allow $1 pmsg_device:chr_file w_file_perms; 526 ') 527 528 ##################################### 529 # read_logd(domain) 530 # Ability to run logcat and read from android 531 # log daemon via sockets 532 define(`read_logd', ` 533 allow $1 logcat_exec:file rx_file_perms; 534 unix_socket_connect($1, logdr, logd) 535 ') 536 537 ##################################### 538 # read_runtime_log_tags(domain) 539 # ability to directly map the runtime event log tags 540 define(`read_runtime_log_tags', ` 541 allow $1 runtime_event_log_tags_file:file r_file_perms; 542 ') 543 544 ##################################### 545 # control_logd(domain) 546 # Ability to control 547 # android log daemon via sockets 548 define(`control_logd', ` 549 # Group AID_LOG checked by filesystem & logd 550 # to permit control commands 551 unix_socket_connect($1, logd, logd) 552 ') 553 554 ##################################### 555 # use_keystore(domain) 556 # Ability to use keystore. 557 # Keystore is requires the following permissions 558 # to call getpidcon. 559 define(`use_keystore', ` 560 allow keystore $1:dir search; 561 allow keystore $1:file { read open }; 562 allow keystore $1:process getattr; 563 allow $1 keystore_service:service_manager find; 564 binder_call($1, keystore) 565 binder_call(keystore, $1) 566 ') 567 568 ########################################### 569 # use_drmservice(domain) 570 # Ability to use DrmService which requires 571 # DrmService to call getpidcon. 572 define(`use_drmservice', ` 573 allow drmserver $1:dir search; 574 allow drmserver $1:file { read open }; 575 allow drmserver $1:process getattr; 576 ') 577 578 ########################################### 579 # add_service(domain, service) 580 # Ability for domain to add a service to service_manager 581 # and find it. It also creates a neverallow preventing 582 # others from adding it. 583 define(`add_service', ` 584 allow $1 $2:service_manager { add find }; 585 neverallow { domain -$1 } $2:service_manager add; 586 ') 587 588 ########################################### 589 # add_hwservice(domain, service) 590 # Ability for domain to add a service to hwservice_manager 591 # and find it. It also creates a neverallow preventing 592 # others from adding it. 593 define(`add_hwservice', ` 594 allow $1 $2:hwservice_manager { add find }; 595 allow $1 hidl_base_hwservice:hwservice_manager add; 596 neverallow { domain -$1 } $2:hwservice_manager add; 597 ') 598
