Nick Kralevich | 748fdef | 2013-07-12 16:33:29 -0700 | [diff] [blame] | 1 | ### |
| 2 | ### Domain for all zygote spawned apps |
| 3 | ### |
| 4 | ### This file is the base policy for all zygote spawned apps. |
| 5 | ### Other policy files, such as isolated_app.te, untrusted_app.te, etc |
| 6 | ### extend from this policy. Only policies which should apply to ALL |
| 7 | ### zygote spawned apps should be added here. |
| 8 | ### |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 9 | |
Stephen Smalley | ad7df7b | 2013-12-20 08:24:12 -0500 | [diff] [blame] | 10 | # Dalvik Compiler JIT Mapping. |
| 11 | allow appdomain self:process execmem; |
Stephen Smalley | e7ec2f5 | 2013-12-23 16:18:55 -0500 | [diff] [blame] | 12 | allow appdomain ashmem_device:chr_file execute; |
Stephen Smalley | ad7df7b | 2013-12-20 08:24:12 -0500 | [diff] [blame] | 13 | |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 14 | # Receive and use open file descriptors inherited from zygote. |
| 15 | allow appdomain zygote:fd use; |
| 16 | |
Stephen Smalley | 48759ca | 2013-10-29 14:42:39 -0400 | [diff] [blame] | 17 | # gdbserver for ndk-gdb reads the zygote. |
Nick Kralevich | 4fce0ef | 2014-05-22 15:00:25 -0700 | [diff] [blame] | 18 | # valgrind needs mmap exec for zygote |
| 19 | allow appdomain zygote_exec:file rx_file_perms; |
Stephen Smalley | 48759ca | 2013-10-29 14:42:39 -0400 | [diff] [blame] | 20 | |
| 21 | # gdbserver for ndk-gdb ptrace attaches to app process. |
| 22 | allow appdomain self:process ptrace; |
| 23 | |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 24 | # Read system properties managed by zygote. |
| 25 | allow appdomain zygote_tmpfs:file read; |
| 26 | |
| 27 | # Notify zygote of death; |
| 28 | allow appdomain zygote:process sigchld; |
| 29 | |
Stephen Smalley | 48759ca | 2013-10-29 14:42:39 -0400 | [diff] [blame] | 30 | # Notify shell and adbd of death when spawned via runas for ndk-gdb. |
| 31 | allow appdomain shell:process sigchld; |
| 32 | allow appdomain adbd:process sigchld; |
| 33 | |
| 34 | # child shell or gdbserver pty access for runas. |
| 35 | allow appdomain devpts:chr_file { getattr read write ioctl }; |
| 36 | |
Stephen Smalley | 3dad7b6 | 2014-03-05 09:50:08 -0500 | [diff] [blame] | 37 | # Use pipes and sockets provided by system_server via binder or local socket. |
Alex Klyubin | 1fdee11 | 2013-09-13 15:59:04 -0700 | [diff] [blame] | 38 | allow appdomain system_server:fifo_file rw_file_perms; |
Stephen Smalley | 3dad7b6 | 2014-03-05 09:50:08 -0500 | [diff] [blame] | 39 | allow appdomain system_server:unix_stream_socket { read write setopt getattr getopt shutdown }; |
| 40 | allow appdomain system_server:tcp_socket { read write getattr getopt shutdown }; |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 41 | |
Nick Kralevich | 82fc3b5 | 2013-12-06 13:31:16 -0800 | [diff] [blame] | 42 | # Communication with other apps via fifos |
| 43 | allow appdomain appdomain:fifo_file rw_file_perms; |
| 44 | |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 45 | # Communicate with surfaceflinger. |
Stephen Smalley | b0db712 | 2014-03-06 16:03:48 -0500 | [diff] [blame] | 46 | allow appdomain surfaceflinger:unix_stream_socket { read write setopt getattr getopt shutdown }; |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 47 | |
| 48 | # App sandbox file accesses. |
| 49 | allow appdomain app_data_file:dir create_dir_perms; |
Stephen Smalley | 6531712 | 2013-12-11 09:08:09 -0500 | [diff] [blame] | 50 | allow appdomain app_data_file:notdevfile_class_set create_file_perms; |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 51 | |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 52 | # lib subdirectory of /data/data dir is system-owned. |
| 53 | allow appdomain system_data_file:dir r_dir_perms; |
Nick Kralevich | 78706f9 | 2014-06-02 14:49:10 -0700 | [diff] [blame] | 54 | allow appdomain system_data_file:file { execute execute_no_trans open execmod }; |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 55 | |
Jeff Sharkey | 6736bac | 2014-04-24 13:31:29 -0700 | [diff] [blame] | 56 | # Access to OEM provided data and apps |
| 57 | allow appdomain oemfs:dir r_dir_perms; |
| 58 | allow appdomain oemfs:file rx_file_perms; |
| 59 | |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 60 | # Execute the shell or other system executables. |
| 61 | allow appdomain shell_exec:file rx_file_perms; |
| 62 | allow appdomain system_file:file rx_file_perms; |
| 63 | |
Ed Heyl | 8ee37b4 | 2014-07-14 23:32:08 -0700 | [diff] [blame] | 64 | # Execute dex2oat when apps call dexclassloader |
| 65 | allow appdomain dex2oat_exec:file rx_file_perms; |
| 66 | |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 67 | # Read/write wallpaper file (opened by system). |
Robert Craig | fc4c6b7 | 2014-01-23 10:05:28 -0500 | [diff] [blame] | 68 | allow appdomain wallpaper_file:file { getattr read write }; |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 69 | |
| 70 | # Write to /data/anr/traces.txt. |
| 71 | allow appdomain anr_data_file:dir search; |
| 72 | allow appdomain anr_data_file:file { open append }; |
| 73 | |
Nick Kralevich | 09e6abd | 2013-12-13 22:19:45 -0800 | [diff] [blame] | 74 | # Allow apps to send dump information to dumpstate |
| 75 | allow appdomain dumpstate:fd use; |
Stephen Smalley | b0db712 | 2014-03-06 16:03:48 -0500 | [diff] [blame] | 76 | allow appdomain dumpstate:unix_stream_socket { read write getopt getattr shutdown }; |
Nick Kralevich | 2e7a301 | 2014-01-10 23:05:25 -0800 | [diff] [blame] | 77 | allow appdomain shell_data_file:file { write getattr }; |
Nick Kralevich | 09e6abd | 2013-12-13 22:19:45 -0800 | [diff] [blame] | 78 | |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 79 | # Write to /proc/net/xt_qtaguid/ctrl file. |
| 80 | allow appdomain qtaguid_proc:file rw_file_perms; |
| 81 | # Everybody can read the xt_qtaguid resource tracking misc dev. |
| 82 | # So allow all apps to read from /dev/xt_qtaguid. |
| 83 | allow appdomain qtaguid_device:chr_file r_file_perms; |
| 84 | |
Stephen Smalley | 3ba9012 | 2013-12-12 09:09:53 -0500 | [diff] [blame] | 85 | # Grant GPU access to all processes started by Zygote. |
| 86 | # They need that to render the standard UI. |
| 87 | allow appdomain gpu_device:chr_file { rw_file_perms execute }; |
| 88 | |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 89 | # Use the Binder. |
| 90 | binder_use(appdomain) |
| 91 | # Perform binder IPC to binder services. |
| 92 | binder_call(appdomain, binderservicedomain) |
| 93 | # Perform binder IPC to other apps. |
| 94 | binder_call(appdomain, appdomain) |
| 95 | |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 96 | # Already connected, unnamed sockets being passed over some other IPC |
| 97 | # hence no sock_file or connectto permission. This appears to be how |
| 98 | # Chrome works, may need to be updated as more apps using isolated services |
| 99 | # are examined. |
Stephen Smalley | b0db712 | 2014-03-06 16:03:48 -0500 | [diff] [blame] | 100 | allow appdomain appdomain:unix_stream_socket { getopt getattr read write shutdown }; |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 101 | |
| 102 | # Backup ability for every app. BMS opens and passes the fd |
| 103 | # to any app that has backup ability. Hence, no open permissions here. |
Geremy Condra | 8156073 | 2013-08-30 13:02:30 -0700 | [diff] [blame] | 104 | allow appdomain backup_data_file:file { read write getattr }; |
| 105 | allow appdomain cache_backup_file:file { read write getattr }; |
Stephen Smalley | 9ba844f | 2014-04-04 09:09:25 -0400 | [diff] [blame] | 106 | allow appdomain cache_backup_file:dir getattr; |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 107 | # Backup ability using 'adb backup' |
| 108 | allow appdomain system_data_file:lnk_file getattr; |
| 109 | |
Stephen Smalley | 2737cef | 2014-03-04 13:44:01 -0500 | [diff] [blame] | 110 | # Allow read/stat of /data/media files passed by Binder or local socket IPC. |
| 111 | allow appdomain media_rw_data_file:file { read getattr }; |
| 112 | |
Nick Kralevich | 1545b60 | 2014-05-05 11:04:12 -0700 | [diff] [blame] | 113 | # Read and write /data/data/com.android.providers.telephony files passed over Binder. |
| 114 | allow appdomain radio_data_file:file { read write getattr }; |
Stephen Smalley | 3fbc536 | 2014-03-27 09:45:26 -0400 | [diff] [blame] | 115 | |
Stephen Smalley | 91a4f8d | 2014-05-07 13:10:02 -0400 | [diff] [blame] | 116 | # Read and write system app data files passed over Binder. |
| 117 | # Motivating case was /data/data/com.android.settings/cache/*.jpg for |
| 118 | # cropping or taking user photos. |
| 119 | allow untrusted_app system_app_data_file:file { read write getattr }; |
| 120 | |
Stephen Smalley | cf61069 | 2014-06-20 14:13:14 -0400 | [diff] [blame] | 121 | # Access SDcard via the fuse mount. |
Ed Heyl | e9c90bd | 2014-07-14 23:29:21 -0700 | [diff] [blame] | 122 | allow appdomain fuse:dir create_dir_perms; |
| 123 | allow appdomain fuse:file create_file_perms; |
Stephen Smalley | b0db712 | 2014-03-06 16:03:48 -0500 | [diff] [blame] | 124 | |
Nick Kralevich | 0b8c20e | 2013-10-09 12:27:27 -0700 | [diff] [blame] | 125 | # Allow apps to use the USB Accessory interface. |
| 126 | # http://developer.android.com/guide/topics/connectivity/usb/accessory.html |
| 127 | # |
| 128 | # USB devices are first opened by the system server (USBDeviceManagerService) |
| 129 | # and the file descriptor is passed to the right Activity via binder. |
| 130 | allow appdomain usb_device:chr_file { read write getattr ioctl }; |
| 131 | allow appdomain usbaccessory_device:chr_file { read write getattr }; |
| 132 | |
Stephen Smalley | 527316a | 2013-12-23 14:48:02 -0500 | [diff] [blame] | 133 | # For art. |
| 134 | allow appdomain dalvikcache_data_file:file execute; |
| 135 | |
Stephen Smalley | 19c5090 | 2014-04-09 14:24:33 -0400 | [diff] [blame] | 136 | # /data/dalvik-cache/profiles |
Nick Kralevich | 8670305 | 2014-06-10 18:42:22 -0700 | [diff] [blame] | 137 | allow appdomain dalvikcache_profiles_data_file:dir { search getattr }; |
| 138 | allow appdomain dalvikcache_profiles_data_file:file rw_file_perms; |
Stephen Smalley | 19c5090 | 2014-04-09 14:24:33 -0400 | [diff] [blame] | 139 | |
Torne (Richard Coles) | 9786af2 | 2014-05-23 11:01:58 +0100 | [diff] [blame] | 140 | # Allow any app to read shared RELRO files. |
| 141 | allow appdomain shared_relro_file:dir search; |
| 142 | allow appdomain shared_relro_file:file r_file_perms; |
| 143 | |
Christopher Tate | 6f6c425 | 2014-05-30 15:21:22 -0700 | [diff] [blame] | 144 | # Allow apps to read/execute installed binaries |
| 145 | allow appdomain apk_data_file:file { rx_file_perms execmod }; |
| 146 | |
Nick Kralevich | fad4d5f | 2014-06-16 14:19:31 -0700 | [diff] [blame] | 147 | # /data/resource-cache |
| 148 | allow appdomain resourcecache_data_file:file r_file_perms; |
| 149 | allow appdomain resourcecache_data_file:dir r_dir_perms; |
| 150 | |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 151 | ### |
Stephen Smalley | 5946937 | 2013-12-16 08:55:24 -0500 | [diff] [blame] | 152 | ### CTS-specific rules |
| 153 | ### |
| 154 | |
| 155 | # For cts/tools/device-setup/TestDeviceSetup/src/android/tests/getinfo/RootProcessScanner.java. |
| 156 | # Reads /proc/pid/status and statm entries to check that |
| 157 | # no unexpected root processes are running. |
| 158 | # Also for cts/tests/tests/security/src/android/security/cts/VoldExploitTest.java |
| 159 | # Reads /proc/pid/cmdline of vold. |
| 160 | allow appdomain domain:dir { open read search getattr }; |
| 161 | allow appdomain domain:{ file lnk_file } { open read getattr }; |
| 162 | |
| 163 | # For cts/tests/tests/permission/src/android/permission/cts/FileSystemPermissionTest.java. |
| 164 | # testRunAsHasCorrectCapabilities |
| 165 | allow appdomain runas_exec:file getattr; |
| 166 | # Others are either allowed elsewhere or not desired. |
| 167 | |
| 168 | # For cts/tests/tests/security/src/android/security/cts/SELinuxTest.java |
| 169 | # Check SELinux policy and contexts. |
| 170 | selinux_check_access(appdomain) |
| 171 | selinux_check_context(appdomain) |
| 172 | # Validate that each process is running in the correct security context. |
| 173 | allow appdomain domain:process getattr; |
| 174 | |
Mark Salyzyn | 8ed750e | 2013-11-12 15:34:52 -0800 | [diff] [blame] | 175 | # logd access |
| 176 | read_logd(appdomain) |
| 177 | # application inherit logd write socket (urge is to deprecate this long term) |
| 178 | allow appdomain zygote:unix_dgram_socket write; |
| 179 | |
Riley Spahn | 1196d2a | 2014-06-17 14:58:52 -0700 | [diff] [blame] | 180 | allow appdomain keystore:keystore_key { test get insert delete exist saw sign verify }; |
Riley Spahn | 1196d2a | 2014-06-17 14:58:52 -0700 | [diff] [blame] | 181 | |
| 182 | use_keystore(appdomain) |
| 183 | |
Stephen Smalley | 5946937 | 2013-12-16 08:55:24 -0500 | [diff] [blame] | 184 | ### |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 185 | ### Neverallow rules |
| 186 | ### |
| 187 | ### These are things that Android apps should NEVER be able to do |
| 188 | ### |
| 189 | |
| 190 | # Superuser capabilities. |
Sharvil Nanavati | 77eb352 | 2014-06-29 10:45:03 -0700 | [diff] [blame] | 191 | # bluetooth requires net_admin and wake_alarm. |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 192 | neverallow { appdomain -bluetooth } self:capability *; |
| 193 | neverallow { appdomain -bluetooth } self:capability2 *; |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 194 | |
| 195 | # Block device access. |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 196 | neverallow appdomain dev_type:blk_file { read write }; |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 197 | |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 198 | # Access to any of the following character devices. |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 199 | neverallow appdomain { |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 200 | audio_device |
| 201 | camera_device |
| 202 | dm_device |
| 203 | radio_device |
| 204 | gps_device |
| 205 | rpmsg_device |
| 206 | }:chr_file { read write }; |
| 207 | |
| 208 | # Note: Try expanding list of app domains in the future. |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 209 | neverallow { untrusted_app isolated_app shell } graphics_device:chr_file { read write }; |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 210 | |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 211 | neverallow { appdomain -nfc } nfc_device:chr_file |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 212 | { read write }; |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 213 | neverallow { appdomain -bluetooth } hci_attach_dev:chr_file |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 214 | { read write }; |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 215 | neverallow appdomain tee_device:chr_file { read write }; |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 216 | |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 217 | # Privileged netlink socket interfaces. |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 218 | neverallow appdomain |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 219 | self:{ |
| 220 | netlink_socket |
| 221 | netlink_firewall_socket |
| 222 | netlink_tcpdiag_socket |
| 223 | netlink_nflog_socket |
| 224 | netlink_xfrm_socket |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 225 | netlink_audit_socket |
| 226 | netlink_ip6fw_socket |
| 227 | netlink_dnrt_socket |
| 228 | netlink_kobject_uevent_socket |
| 229 | } *; |
| 230 | |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 231 | # Sockets under /dev/socket that are not specifically typed. |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 232 | neverallow appdomain socket_device:sock_file write; |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 233 | |
| 234 | # Unix domain sockets. |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 235 | neverallow appdomain adbd_socket:sock_file write; |
| 236 | neverallow appdomain installd_socket:sock_file write; |
| 237 | neverallow { appdomain -bluetooth -radio -shell -system_app } |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 238 | property_socket:sock_file write; |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 239 | neverallow { appdomain -radio } rild_socket:sock_file write; |
| 240 | neverallow appdomain vold_socket:sock_file write; |
| 241 | neverallow appdomain zygote_socket:sock_file write; |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 242 | |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 243 | # ptrace access to non-app domains. |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 244 | neverallow appdomain { domain -appdomain }:process ptrace; |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 245 | |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 246 | # Write access to /proc/pid entries for any non-app domain. |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 247 | neverallow appdomain { domain -appdomain }:file write; |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 248 | |
| 249 | # signal access to non-app domains. |
| 250 | # sigchld allowed for parent death notification. |
| 251 | # signull allowed for kill(pid, 0) existence test. |
| 252 | # All others prohibited. |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 253 | neverallow appdomain { domain -appdomain }:process |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 254 | { sigkill sigstop signal }; |
| 255 | |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 256 | # Transition to a non-app domain. |
Stephen Smalley | 396015c | 2014-01-07 12:47:10 -0500 | [diff] [blame] | 257 | # Exception for the shell domain, can transition to runas, etc. |
Stephen Smalley | d990a78 | 2014-07-29 14:50:30 -0400 | [diff] [blame^] | 258 | neverallow { appdomain -shell } { domain -appdomain }:process |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 259 | { transition dyntransition }; |
| 260 | |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 261 | # Write to rootfs. |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 262 | neverallow appdomain rootfs:dir_file_class_set |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 263 | { create write setattr relabelfrom relabelto append unlink link rename }; |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 264 | |
| 265 | # Write to /system. |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 266 | neverallow appdomain system_file:dir_file_class_set |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 267 | { create write setattr relabelfrom relabelto append unlink link rename }; |
| 268 | |
| 269 | # Write to entrypoint executables. |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 270 | neverallow appdomain exec_type:file |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 271 | { create write setattr relabelfrom relabelto append unlink link rename }; |
Nick Kralevich | 6634a10 | 2013-07-12 18:45:56 -0700 | [diff] [blame] | 272 | |
| 273 | # Write to system-owned parts of /data. |
| 274 | # This is the default type for anything under /data not otherwise |
| 275 | # specified in file_contexts. Define a different type for portions |
| 276 | # that should be writable by apps. |
| 277 | # Exception for system_app for Settings. |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 278 | neverallow { appdomain -system_app } |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 279 | system_data_file:dir_file_class_set |
| 280 | { create write setattr relabelfrom relabelto append unlink link rename }; |
| 281 | |
| 282 | # Write to various other parts of /data. |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 283 | neverallow appdomain drm_data_file:dir_file_class_set |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 284 | { create write setattr relabelfrom relabelto append unlink link rename }; |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 285 | neverallow appdomain gps_data_file:dir_file_class_set |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 286 | { create write setattr relabelfrom relabelto append unlink link rename }; |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 287 | neverallow { appdomain -platform_app } |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 288 | apk_data_file:dir_file_class_set |
| 289 | { create write setattr relabelfrom relabelto append unlink link rename }; |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 290 | neverallow { appdomain -platform_app } |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 291 | apk_tmp_file:dir_file_class_set |
| 292 | { create write setattr relabelfrom relabelto append unlink link rename }; |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 293 | neverallow { appdomain -platform_app } |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 294 | apk_private_data_file:dir_file_class_set |
| 295 | { create write setattr relabelfrom relabelto append unlink link rename }; |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 296 | neverallow { appdomain -platform_app } |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 297 | apk_private_tmp_file:dir_file_class_set |
| 298 | { create write setattr relabelfrom relabelto append unlink link rename }; |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 299 | neverallow { appdomain -shell } |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 300 | shell_data_file:dir_file_class_set |
Nick Kralevich | 2e7a301 | 2014-01-10 23:05:25 -0800 | [diff] [blame] | 301 | { create setattr relabelfrom relabelto append unlink link rename }; |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 302 | neverallow { appdomain -bluetooth } |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 303 | bluetooth_data_file:dir_file_class_set |
| 304 | { create write setattr relabelfrom relabelto append unlink link rename }; |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 305 | neverallow appdomain |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 306 | keystore_data_file:dir_file_class_set |
| 307 | { create write setattr relabelfrom relabelto append unlink link rename }; |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 308 | neverallow appdomain |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 309 | systemkeys_data_file:dir_file_class_set |
| 310 | { create write setattr relabelfrom relabelto append unlink link rename }; |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 311 | neverallow appdomain |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 312 | wifi_data_file:dir_file_class_set |
| 313 | { create write setattr relabelfrom relabelto append unlink link rename }; |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 314 | neverallow appdomain |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 315 | dhcp_data_file:dir_file_class_set |
| 316 | { create write setattr relabelfrom relabelto append unlink link rename }; |
| 317 | |
| 318 | # Access to factory files. |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 319 | neverallow appdomain |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 320 | efs_file:dir_file_class_set { read write }; |
| 321 | |
| 322 | # Write to various pseudo file systems. |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 323 | neverallow { appdomain -bluetooth -nfc } |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 324 | sysfs:dir_file_class_set write; |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 325 | neverallow appdomain |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 326 | proc:dir_file_class_set write; |
| 327 | |
| 328 | # Access to syslog(2) or /proc/kmsg. |
Nick Kralevich | 685e2f9 | 2014-05-28 13:48:52 -0700 | [diff] [blame] | 329 | neverallow { appdomain -system_app } |
Nick Kralevich | f821b5a | 2014-05-27 16:49:59 -0700 | [diff] [blame] | 330 | kernel:system { syslog_mod syslog_console }; |
Stephen Smalley | 42fb824 | 2014-06-11 07:10:09 -0400 | [diff] [blame] | 331 | neverallow { appdomain -system_app -shell } |
Nick Kralevich | f821b5a | 2014-05-27 16:49:59 -0700 | [diff] [blame] | 332 | kernel:system syslog_read; |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 333 | |
| 334 | # Ability to perform any filesystem operation other than statfs(2). |
| 335 | # i.e. no mount(2), unmount(2), etc. |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 336 | neverallow appdomain fs_type:filesystem ~getattr; |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 337 | |
| 338 | # Ability to set system properties. |
Nick Kralevich | be66069 | 2014-07-04 10:12:13 -0700 | [diff] [blame] | 339 | neverallow { appdomain -system_app -radio -shell -bluetooth } |
Stephen Smalley | 2a273ad | 2013-09-27 10:55:59 -0400 | [diff] [blame] | 340 | property_type:property_service set; |