app.te 13.4 KB
Newer Older
1 2 3 4 5 6 7 8 9
###
### Domain for all zygote spawned apps
###
### This file is the base policy for all zygote spawned apps.
### Other policy files, such as isolated_app.te, untrusted_app.te, etc
### extend from this policy. Only policies which should apply to ALL
### zygote spawned apps should be added here.
###

10 11
# Dalvik Compiler JIT Mapping.
allow appdomain self:process execmem;
12
allow appdomain ashmem_device:chr_file execute;
13

14 15 16
# Receive and use open file descriptors inherited from zygote.
allow appdomain zygote:fd use;

17
# gdbserver for ndk-gdb reads the zygote.
18 19
# valgrind needs mmap exec for zygote
allow appdomain zygote_exec:file rx_file_perms;
20 21 22 23

# gdbserver for ndk-gdb ptrace attaches to app process.
allow appdomain self:process ptrace;

24 25 26 27 28 29
# Read system properties managed by zygote.
allow appdomain zygote_tmpfs:file read;

# Notify zygote of death;
allow appdomain zygote:process sigchld;

30 31 32 33 34 35 36
# Notify shell and adbd of death when spawned via runas for ndk-gdb.
allow appdomain shell:process sigchld;
allow appdomain adbd:process sigchld;

# child shell or gdbserver pty access for runas.
allow appdomain devpts:chr_file { getattr read write ioctl };

37
# Use pipes and sockets provided by system_server via binder or local socket.
38
allow appdomain system_server:fifo_file rw_file_perms;
39 40
allow appdomain system_server:unix_stream_socket { read write setopt getattr getopt shutdown };
allow appdomain system_server:tcp_socket { read write getattr getopt shutdown };
41

42 43 44
# Communication with other apps via fifos
allow appdomain appdomain:fifo_file rw_file_perms;

45
# Communicate with surfaceflinger.
46
allow appdomain surfaceflinger:unix_stream_socket { read write setopt getattr getopt shutdown };
47 48 49

# App sandbox file accesses.
allow appdomain app_data_file:dir create_dir_perms;
50
allow appdomain app_data_file:notdevfile_class_set create_file_perms;
51 52 53

# lib subdirectory of /data/data dir is system-owned.
allow appdomain system_data_file:dir r_dir_perms;
54
allow appdomain system_data_file:file { execute execute_no_trans open execmod };
55

56 57 58 59
# Access to OEM provided data and apps
allow appdomain oemfs:dir r_dir_perms;
allow appdomain oemfs:file rx_file_perms;

60 61 62 63 64
# Execute the shell or other system executables.
allow appdomain shell_exec:file rx_file_perms;
allow appdomain system_file:file rx_file_perms;

# Read/write wallpaper file (opened by system).
65
allow appdomain wallpaper_file:file { getattr read write };
66 67 68 69 70

# Write to /data/anr/traces.txt.
allow appdomain anr_data_file:dir search;
allow appdomain anr_data_file:file { open append };

Nick Kralevich's avatar
Nick Kralevich committed
71 72
# Allow apps to send dump information to dumpstate
allow appdomain dumpstate:fd use;
73
allow appdomain dumpstate:unix_stream_socket { read write getopt getattr shutdown };
Nick Kralevich's avatar
Nick Kralevich committed
74
allow appdomain shell_data_file:file { write getattr };
Nick Kralevich's avatar
Nick Kralevich committed
75

76 77 78 79 80 81
# Write to /proc/net/xt_qtaguid/ctrl file.
allow appdomain qtaguid_proc:file rw_file_perms;
# Everybody can read the xt_qtaguid resource tracking misc dev.
# So allow all apps to read from /dev/xt_qtaguid.
allow appdomain qtaguid_device:chr_file r_file_perms;

82 83 84 85
# Grant GPU access to all processes started by Zygote.
# They need that to render the standard UI.
allow appdomain gpu_device:chr_file { rw_file_perms execute };

86 87 88 89 90 91 92 93 94 95 96
# Use the Binder.
binder_use(appdomain)
# Perform binder IPC to binder services.
binder_call(appdomain, binderservicedomain)
# Perform binder IPC to other apps.
binder_call(appdomain, appdomain)

# Already connected, unnamed sockets being passed over some other IPC
# hence no sock_file or connectto permission. This appears to be how
# Chrome works, may need to be updated as more apps using isolated services
# are examined.
97
allow appdomain appdomain:unix_stream_socket { getopt getattr read write shutdown };
98 99 100

# Backup ability for every app. BMS opens and passes the fd
# to any app that has backup ability. Hence, no open permissions here.
101 102
allow appdomain backup_data_file:file { read write getattr };
allow appdomain cache_backup_file:file { read write getattr };
103
allow appdomain cache_backup_file:dir getattr;
104 105 106
# Backup ability using 'adb backup'
allow appdomain system_data_file:lnk_file getattr;

107 108 109
# Allow read/stat of /data/media files passed by Binder or local socket IPC.
allow appdomain media_rw_data_file:file { read getattr };

110 111
# Read and write /data/data/com.android.providers.telephony files passed over Binder.
allow appdomain radio_data_file:file { read write getattr };
112

113 114 115 116 117
# Read and write system app data files passed over Binder.
# Motivating case was /data/data/com.android.settings/cache/*.jpg for
# cropping or taking user photos.
allow untrusted_app system_app_data_file:file { read write getattr };

118 119 120
# Access SDcard via the fuse mount.
allow appdomain sdcard_internal:dir create_dir_perms;
allow appdomain sdcard_internal:file create_file_perms;
121

122 123 124 125 126 127 128 129
# Allow apps to use the USB Accessory interface.
# http://developer.android.com/guide/topics/connectivity/usb/accessory.html
#
# USB devices are first opened by the system server (USBDeviceManagerService)
# and the file descriptor is passed to the right Activity via binder.
allow appdomain usb_device:chr_file { read write getattr ioctl };
allow appdomain usbaccessory_device:chr_file { read write getattr };

130 131 132
# For art.
allow appdomain dalvikcache_data_file:file execute;

133
# /data/dalvik-cache/profiles
134 135
allow appdomain dalvikcache_profiles_data_file:dir { search getattr };
allow appdomain dalvikcache_profiles_data_file:file rw_file_perms;
136

137 138 139 140
# Allow any app to read shared RELRO files.
allow appdomain shared_relro_file:dir search;
allow appdomain shared_relro_file:file r_file_perms;

141 142 143
# Allow apps to read/execute installed binaries
allow appdomain apk_data_file:file { rx_file_perms execmod };

144 145 146 147
# /data/resource-cache
allow appdomain resourcecache_data_file:file r_file_perms;
allow appdomain resourcecache_data_file:dir r_dir_perms;

148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171
###
### CTS-specific rules
###

# For cts/tools/device-setup/TestDeviceSetup/src/android/tests/getinfo/RootProcessScanner.java.
# Reads /proc/pid/status and statm entries to check that
# no unexpected root processes are running.
# Also for cts/tests/tests/security/src/android/security/cts/VoldExploitTest.java
# Reads /proc/pid/cmdline of vold.
allow appdomain domain:dir { open read search getattr };
allow appdomain domain:{ file lnk_file } { open read getattr };

# For cts/tests/tests/permission/src/android/permission/cts/FileSystemPermissionTest.java.
# testRunAsHasCorrectCapabilities
allow appdomain runas_exec:file getattr;
# Others are either allowed elsewhere or not desired.

# For cts/tests/tests/security/src/android/security/cts/SELinuxTest.java
# Check SELinux policy and contexts.
selinux_check_access(appdomain)
selinux_check_context(appdomain)
# Validate that each process is running in the correct security context.
allow appdomain domain:process getattr;

172 173 174 175 176
# logd access
read_logd(appdomain)
# application inherit logd write socket (urge is to deprecate this long term)
allow appdomain zygote:unix_dgram_socket write;

177 178 179 180
allow appdomain keystore:keystore_key { test get insert delete exist saw sign verify };

use_keystore(appdomain)

181 182 183 184 185 186 187
###
### Neverallow rules
###
### These are things that Android apps should NEVER be able to do
###

# Superuser capabilities.
188
# bluetooth requires net_admin and wake_alarm.
189
neverallow { appdomain -unconfineddomain -bluetooth } self:capability *;
190
neverallow { appdomain -unconfineddomain -bluetooth } self:capability2 *;
191 192 193 194

# Block device access.
neverallow { appdomain -unconfineddomain } dev_type:blk_file { read write };

195 196 197 198 199 200 201 202 203 204 205
# Access to any of the following character devices.
neverallow { appdomain -unconfineddomain } {
    audio_device
    camera_device
    dm_device
    radio_device
    gps_device
    rpmsg_device
}:chr_file { read write };

# Note: Try expanding list of app domains in the future.
206
neverallow { untrusted_app isolated_app shell -unconfineddomain } graphics_device:chr_file { read write };
207 208 209 210 211 212 213

neverallow { appdomain -nfc -unconfineddomain } nfc_device:chr_file
    { read write };
neverallow { appdomain -bluetooth -unconfineddomain } hci_attach_dev:chr_file
    { read write };
neverallow { appdomain -unconfineddomain } tee_device:chr_file { read write };

214 215 216 217 218 219 220 221 222 223 224 225 226 227
# Privileged netlink socket interfaces.
neverallow { appdomain -unconfineddomain }
    self:{
        netlink_socket
        netlink_firewall_socket
        netlink_tcpdiag_socket
        netlink_nflog_socket
        netlink_xfrm_socket
        netlink_audit_socket
        netlink_ip6fw_socket
        netlink_dnrt_socket
        netlink_kobject_uevent_socket
    } *;

228 229 230 231 232 233 234 235 236 237 238 239
# Sockets under /dev/socket that are not specifically typed.
neverallow { appdomain -unconfineddomain } socket_device:sock_file write;

# Unix domain sockets.
neverallow { appdomain -unconfineddomain } adbd_socket:sock_file write;
neverallow { appdomain -unconfineddomain } installd_socket:sock_file write;
neverallow { appdomain -bluetooth -radio -shell -system_app -unconfineddomain }
    property_socket:sock_file write;
neverallow { appdomain -radio -unconfineddomain } rild_socket:sock_file write;
neverallow { appdomain -unconfineddomain } vold_socket:sock_file write;
neverallow { appdomain -unconfineddomain } zygote_socket:sock_file write;

240 241 242
# ptrace access to non-app domains.
neverallow { appdomain -unconfineddomain } { domain -appdomain }:process ptrace;

243
# Write access to /proc/pid entries for any non-app domain.
Nick Kralevich's avatar
Nick Kralevich committed
244
neverallow { appdomain -unconfineddomain } { domain -appdomain }:file write;
245 246 247 248 249 250 251 252

# signal access to non-app domains.
# sigchld allowed for parent death notification.
# signull allowed for kill(pid, 0) existence test.
# All others prohibited.
neverallow { appdomain -unconfineddomain } { domain -appdomain }:process
    { sigkill sigstop signal };

253
# Transition to a non-app domain.
Stephen Smalley's avatar
Stephen Smalley committed
254
# Exception for the shell domain, can transition to runas, etc.
255
neverallow { appdomain -shell -unconfineddomain } ~appdomain:process
256 257 258 259 260
    { transition dyntransition };

# Write to rootfs.
neverallow { appdomain -unconfineddomain } rootfs:dir_file_class_set
    { create write setattr relabelfrom relabelto append unlink link rename };
261 262

# Write to /system.
263 264 265 266 267 268
neverallow { appdomain -unconfineddomain } system_file:dir_file_class_set
    { create write setattr relabelfrom relabelto append unlink link rename };

# Write to entrypoint executables.
neverallow { appdomain -unconfineddomain } exec_type:file
    { create write setattr relabelfrom relabelto append unlink link rename };
269 270 271 272 273 274

# Write to system-owned parts of /data.
# This is the default type for anything under /data not otherwise
# specified in file_contexts.  Define a different type for portions
# that should be writable by apps.
# Exception for system_app for Settings.
275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297
neverallow { appdomain -unconfineddomain -system_app }
    system_data_file:dir_file_class_set
    { create write setattr relabelfrom relabelto append unlink link rename };

# Write to various other parts of /data.
neverallow { appdomain -unconfineddomain } drm_data_file:dir_file_class_set
    { create write setattr relabelfrom relabelto append unlink link rename };
neverallow { appdomain -unconfineddomain } gps_data_file:dir_file_class_set
    { create write setattr relabelfrom relabelto append unlink link rename };
neverallow { appdomain -platform_app -unconfineddomain }
    apk_data_file:dir_file_class_set
    { create write setattr relabelfrom relabelto append unlink link rename };
neverallow { appdomain -platform_app -unconfineddomain }
    apk_tmp_file:dir_file_class_set
    { create write setattr relabelfrom relabelto append unlink link rename };
neverallow { appdomain -platform_app -unconfineddomain }
    apk_private_data_file:dir_file_class_set
    { create write setattr relabelfrom relabelto append unlink link rename };
neverallow { appdomain -platform_app -unconfineddomain }
    apk_private_tmp_file:dir_file_class_set
    { create write setattr relabelfrom relabelto append unlink link rename };
neverallow { appdomain -shell -unconfineddomain }
    shell_data_file:dir_file_class_set
Nick Kralevich's avatar
Nick Kralevich committed
298
    { create setattr relabelfrom relabelto append unlink link rename };
299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319
neverallow { appdomain -bluetooth -unconfineddomain }
    bluetooth_data_file:dir_file_class_set
    { create write setattr relabelfrom relabelto append unlink link rename };
neverallow { appdomain -unconfineddomain }
    keystore_data_file:dir_file_class_set
    { create write setattr relabelfrom relabelto append unlink link rename };
neverallow { appdomain -unconfineddomain }
    systemkeys_data_file:dir_file_class_set
    { create write setattr relabelfrom relabelto append unlink link rename };
neverallow { appdomain -unconfineddomain }
    wifi_data_file:dir_file_class_set
    { create write setattr relabelfrom relabelto append unlink link rename };
neverallow { appdomain -unconfineddomain }
    dhcp_data_file:dir_file_class_set
    { create write setattr relabelfrom relabelto append unlink link rename };

# Access to factory files.
neverallow { appdomain -unconfineddomain }
    efs_file:dir_file_class_set { read write };

# Write to various pseudo file systems.
320
neverallow { appdomain -bluetooth -nfc -unconfineddomain }
321 322 323 324 325
    sysfs:dir_file_class_set write;
neverallow { appdomain -unconfineddomain }
    proc:dir_file_class_set write;

# Access to syslog(2) or /proc/kmsg.
326
neverallow { appdomain -system_app }
Nick Kralevich's avatar
Nick Kralevich committed
327
    kernel:system { syslog_mod syslog_console };
Stephen Smalley's avatar
Stephen Smalley committed
328
neverallow { appdomain -system_app -shell }
Nick Kralevich's avatar
Nick Kralevich committed
329
    kernel:system syslog_read;
330 331 332 333 334 335 336 337

# Ability to perform any filesystem operation other than statfs(2).
# i.e. no mount(2), unmount(2), etc.
neverallow { appdomain -unconfineddomain } fs_type:filesystem ~getattr;

# Ability to set system properties.
neverallow { appdomain -system_app -radio -shell -bluetooth -unconfineddomain }
    property_type:property_service set;