Stephen Smalley | 6d10ca8 | 2014-01-13 09:45:45 -0500 | [diff] [blame] | 1 | # recovery console (used in recovery init.rc for /sbin/recovery) |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 2 | |
| 3 | # Declare the domain unconditionally so we can always reference it |
| 4 | # in neverallow rules. |
Stephen Smalley | 6d10ca8 | 2014-01-13 09:45:45 -0500 | [diff] [blame] | 5 | type recovery, domain; |
Stephen Smalley | 6d10ca8 | 2014-01-13 09:45:45 -0500 | [diff] [blame] | 6 | |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 7 | # But the allow rules are only included in the recovery policy. |
| 8 | # Otherwise recovery is only allowed the domain rules. |
| 9 | recovery_only(` |
Ethan Yonker | bf7fd2b | 2014-12-16 14:23:00 -0600 | [diff] [blame] | 10 | # Allow recovery to set permissive mode |
| 11 | permissive recovery; |
| 12 | |
Stephen Smalley | 1095d69 | 2014-06-19 12:15:22 -0400 | [diff] [blame] | 13 | allow recovery self:capability { chown dac_override fowner fsetid setfcap setuid setgid sys_admin sys_tty_config }; |
Nick Kralevich | 03dbf07 | 2014-06-03 16:16:21 -0700 | [diff] [blame] | 14 | |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 15 | # Set security contexts on files that are not known to the loaded policy. |
| 16 | allow recovery self:capability2 mac_admin; |
Stephen Smalley | 6d10ca8 | 2014-01-13 09:45:45 -0500 | [diff] [blame] | 17 | |
Stephen Smalley | f3c3a1a | 2014-06-19 09:07:17 -0400 | [diff] [blame] | 18 | # Run helpers from / or /system without changing domain. |
| 19 | allow recovery rootfs:file execute_no_trans; |
| 20 | allow recovery system_file:file execute_no_trans; |
| 21 | |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 22 | # Mount filesystems. |
Nick Kralevich | 03dbf07 | 2014-06-03 16:16:21 -0700 | [diff] [blame] | 23 | allow recovery rootfs:dir mounton; |
Stephen Smalley | 75e2ef9 | 2014-06-16 13:05:38 -0400 | [diff] [blame] | 24 | allow recovery fs_type:filesystem ~relabelto; |
| 25 | allow recovery unlabeled:filesystem ~relabelto; |
| 26 | allow recovery contextmount_type:filesystem relabelto; |
Stephen Smalley | eb1bbf2 | 2014-05-29 14:35:55 -0400 | [diff] [blame] | 27 | |
Maarten Derks | 7a09aea | 2017-06-14 13:34:48 +0200 | [diff] [blame] | 28 | allow recovery selinuxfs:file rw_file_perms; |
| 29 | |
Nick Kralevich | a03d761 | 2014-06-04 23:43:03 -0700 | [diff] [blame] | 30 | # Create and relabel files and directories under /system. |
| 31 | allow recovery exec_type:{ file lnk_file } { create_file_perms relabelfrom relabelto }; |
| 32 | allow recovery system_file:{ file lnk_file } { create_file_perms relabelfrom relabelto }; |
| 33 | allow recovery system_file:dir { create_dir_perms relabelfrom relabelto }; |
| 34 | |
Nick Kralevich | 558710c | 2014-07-07 13:19:24 -0700 | [diff] [blame] | 35 | # We may be asked to set an SELinux label for a type not known to the |
| 36 | # currently loaded policy. Allow it. |
Nick Kralevich | 5fad3d9 | 2014-10-23 12:12:58 -0700 | [diff] [blame] | 37 | allow recovery unlabeled:{ file lnk_file } { create_file_perms relabelfrom relabelto }; |
Nick Kralevich | 558710c | 2014-07-07 13:19:24 -0700 | [diff] [blame] | 38 | allow recovery unlabeled:dir { create_dir_perms relabelfrom relabelto }; |
| 39 | |
Nick Kralevich | ff409bb | 2014-06-15 09:40:12 -0700 | [diff] [blame] | 40 | # 0eb17d944704b3eb140bb9dded299d3be3aed77e in build/ added SELinux |
| 41 | # support to OTAs. However, that code has a bug. When an update occurs, |
| 42 | # some directories are inappropriately labeled as exec_type. This is |
| 43 | # only transient, and subsequent steps in the OTA script correct this |
Nick Kralevich | b76966d | 2015-03-05 14:58:30 -0800 | [diff] [blame] | 44 | # mistake. New devices are moving to block based OTAs, so this is not |
| 45 | # worth fixing. b/15575013 |
Nick Kralevich | ff409bb | 2014-06-15 09:40:12 -0700 | [diff] [blame] | 46 | allow recovery exec_type:dir { create_dir_perms relabelfrom relabelto }; |
Nick Kralevich | ff409bb | 2014-06-15 09:40:12 -0700 | [diff] [blame] | 47 | |
Nick Kralevich | a03d761 | 2014-06-04 23:43:03 -0700 | [diff] [blame] | 48 | # Write to /proc/sys/vm/drop_caches |
Jeff Sharkey | c960596 | 2015-05-14 20:55:31 -0700 | [diff] [blame] | 49 | allow recovery proc_drop_caches:file w_file_perms; |
Nick Kralevich | 03ce512 | 2014-05-20 11:09:16 -0700 | [diff] [blame] | 50 | |
Stephen Smalley | 1095d69 | 2014-06-19 12:15:22 -0400 | [diff] [blame] | 51 | # Write to /sys/class/android_usb/android0/enable. |
| 52 | # TODO: create more specific label? |
| 53 | allow recovery sysfs:file w_file_perms; |
| 54 | |
Patrick Tjin | bd050a8 | 2014-12-09 12:43:26 -0800 | [diff] [blame] | 55 | access_kmsg(recovery) |
| 56 | |
Doug Zongker | bad4e91 | 2014-07-10 13:40:25 -0700 | [diff] [blame] | 57 | # Access /dev/android_adb or /dev/usb-ffs/adb/ep0 |
Stephen Smalley | 1095d69 | 2014-06-19 12:15:22 -0400 | [diff] [blame] | 58 | allow recovery adb_device:chr_file rw_file_perms; |
Doug Zongker | bad4e91 | 2014-07-10 13:40:25 -0700 | [diff] [blame] | 59 | allow recovery functionfs:dir search; |
| 60 | allow recovery functionfs:file rw_file_perms; |
Stephen Smalley | 1095d69 | 2014-06-19 12:15:22 -0400 | [diff] [blame] | 61 | |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 62 | # Required to e.g. wipe userdata/cache. |
Nick Kralevich | ff409bb | 2014-06-15 09:40:12 -0700 | [diff] [blame] | 63 | allow recovery device:dir r_dir_perms; |
Nick Kralevich | 03dbf07 | 2014-06-03 16:16:21 -0700 | [diff] [blame] | 64 | allow recovery block_device:dir r_dir_perms; |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 65 | allow recovery dev_type:blk_file rw_file_perms; |
Stephen Smalley | 3f40d4f | 2014-02-11 14:40:14 -0500 | [diff] [blame] | 66 | |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 67 | # GUI |
| 68 | allow recovery self:process execmem; |
| 69 | allow recovery ashmem_device:chr_file execute; |
Nick Kralevich | 03dbf07 | 2014-06-03 16:16:21 -0700 | [diff] [blame] | 70 | allow recovery graphics_device:chr_file rw_file_perms; |
| 71 | allow recovery graphics_device:dir r_dir_perms; |
| 72 | allow recovery input_device:dir r_dir_perms; |
| 73 | allow recovery input_device:chr_file r_file_perms; |
Nick Kralevich | 8b7ca45 | 2014-06-07 11:48:35 -0700 | [diff] [blame] | 74 | allow recovery tty_device:chr_file rw_file_perms; |
Stephen Smalley | 356f4be | 2014-05-23 11:26:19 -0400 | [diff] [blame] | 75 | |
Nick Kralevich | 03dbf07 | 2014-06-03 16:16:21 -0700 | [diff] [blame] | 76 | # Create /tmp/recovery.log and execute /tmp/update_binary. |
| 77 | allow recovery tmpfs:file { create_file_perms x_file_perms }; |
| 78 | allow recovery tmpfs:dir create_dir_perms; |
| 79 | |
| 80 | # Manage files on /cache |
| 81 | allow recovery cache_file:dir create_dir_perms; |
| 82 | allow recovery cache_file:file create_file_perms; |
| 83 | |
Tao Bao | d245789 | 2015-06-10 15:52:49 -0700 | [diff] [blame] | 84 | # Read files on /oem. |
| 85 | r_dir_file(recovery, oemfs); |
| 86 | |
Nick Kralevich | 03dbf07 | 2014-06-03 16:16:21 -0700 | [diff] [blame] | 87 | # Reboot the device |
William Roberts | 2f5a6a9 | 2015-05-04 18:22:45 -0700 | [diff] [blame] | 88 | set_prop(recovery, powerctl_prop) |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 89 | |
Stephen Smalley | fee4915 | 2014-06-19 10:27:02 -0400 | [diff] [blame] | 90 | # Start/stop adbd via ctl.start adbd |
William Roberts | 2f5a6a9 | 2015-05-04 18:22:45 -0700 | [diff] [blame] | 91 | set_prop(recovery, ctl_default_prop) |
Stephen Smalley | fee4915 | 2014-06-19 10:27:02 -0400 | [diff] [blame] | 92 | |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 93 | # Use setfscreatecon() to label files for OTA updates. |
| 94 | allow recovery self:process setfscreate; |
Nick Kralevich | 03dbf07 | 2014-06-03 16:16:21 -0700 | [diff] [blame] | 95 | |
Stephen Smalley | 374b2a1 | 2014-07-08 14:45:09 -0400 | [diff] [blame] | 96 | # Allow recovery to create a fuse filesystem, and read files from it. |
Doug Zongker | 93d849b | 2014-07-02 10:28:20 -0700 | [diff] [blame] | 97 | allow recovery fuse_device:chr_file rw_file_perms; |
Stephen Smalley | 374b2a1 | 2014-07-08 14:45:09 -0400 | [diff] [blame] | 98 | allow recovery fuse:dir r_dir_perms; |
| 99 | allow recovery fuse:file r_file_perms; |
Doug Zongker | 93d849b | 2014-07-02 10:28:20 -0700 | [diff] [blame] | 100 | |
Nick Kralevich | 03dbf07 | 2014-06-03 16:16:21 -0700 | [diff] [blame] | 101 | wakelock_use(recovery) |
Nick Kralevich | 8b7ca45 | 2014-06-07 11:48:35 -0700 | [diff] [blame] | 102 | |
Nick Kralevich | f4e6902 | 2014-06-09 20:35:51 -0700 | [diff] [blame] | 103 | # This line seems suspect, as it should not really need to |
Nick Kralevich | 8b7ca45 | 2014-06-07 11:48:35 -0700 | [diff] [blame] | 104 | # set scheduling parameters for a kernel domain task. |
Nick Kralevich | 03dbf07 | 2014-06-03 16:16:21 -0700 | [diff] [blame] | 105 | allow recovery kernel:process setsched; |
Stephen Smalley | e60723a | 2014-05-29 16:40:15 -0400 | [diff] [blame] | 106 | ') |
Nick Kralevich | a17a266 | 2014-11-05 15:30:41 -0800 | [diff] [blame] | 107 | |
| 108 | ### |
| 109 | ### neverallow rules |
| 110 | ### |
| 111 | |
| 112 | # Recovery should never touch /data. |
| 113 | # |
| 114 | # In particular, if /data is encrypted, it is not accessible |
| 115 | # to recovery anyway. |
| 116 | # |
| 117 | # For now, we only enforce write/execute restrictions, as domain.te |
| 118 | # contains a number of read-only rules that apply to all |
| 119 | # domains, including recovery. |
| 120 | # |
| 121 | # TODO: tighten this up further. |
| 122 | neverallow recovery data_file_type:file { no_w_file_perms no_x_file_perms }; |
| 123 | neverallow recovery data_file_type:dir no_w_dir_perms; |