xref: /aosp_15_r20/system/sepolicy/prebuilts/api/202404/private/webview_zygote.te (revision e4a36f4174b17bbab9dc043f4a65dc8d87377290)
1# webview_zygote is an auxiliary zygote process that is used to spawn
2# isolated_app processes for rendering untrusted web content.
3
4typeattribute webview_zygote coredomain;
5
6# The webview_zygote needs to be able to transition domains.
7typeattribute webview_zygote mlstrustedsubject;
8
9# Allow access to temporary files, which is normally permitted through
10# a domain macro.
11tmpfs_domain(webview_zygote);
12
13userfaultfd_use(webview_zygote)
14
15# Allow reading/executing installed binaries to enable preloading the
16# installed WebView implementation.
17allow webview_zygote apk_data_file:dir r_dir_perms;
18allow webview_zygote apk_data_file:file { r_file_perms execute };
19
20# Access to the WebView relro file.
21allow webview_zygote shared_relro_file:dir search;
22allow webview_zygote shared_relro_file:file r_file_perms;
23
24# Set the UID/GID of the process.
25allow webview_zygote self:global_capability_class_set { setgid setuid };
26# Drop capabilities from bounding set.
27allow webview_zygote self:global_capability_class_set setpcap;
28# Switch SELinux context to app domains.
29allow webview_zygote self:process setcurrent;
30allow webview_zygote isolated_app:process dyntransition;
31
32# For art.
33allow webview_zygote { apex_art_data_file dalvikcache_data_file }:dir r_dir_perms;
34allow webview_zygote dalvikcache_data_file:lnk_file r_file_perms;
35allow webview_zygote { apex_art_data_file dalvikcache_data_file }:file { r_file_perms execute };
36allow webview_zygote apex_module_data_file:dir search;
37
38# To load overlay from /apex (vendor APEXes)
39allow webview_zygote vendor_apex_metadata_file:dir search;
40
41# Allow webview_zygote to create JIT memory.
42allow webview_zygote self:process execmem;
43
44# Allow webview_zygote to stat the files that it opens. It must
45# be able to inspect them so that it can reopen them on fork
46# if necessary: b/30963384.
47allow webview_zygote debugfs_trace_marker:file getattr;
48
49# Allow webview_zygote to manage the pgroup of its children.
50allow webview_zygote system_server:process getpgid;
51
52# Interaction between the webview_zygote and its children.
53allow webview_zygote isolated_app:process setpgid;
54
55# TODO (b/63631799) fix this access
56# Suppress denials to storage. Webview zygote should not be accessing.
57dontaudit webview_zygote mnt_expand_file:dir getattr;
58
59# TODO (b/72957399) remove this when webview_zygote is reparented to
60# app_process zygote
61dontaudit webview_zygote dex2oat_exec:file execute;
62
63# Get seapp_contexts
64allow webview_zygote seapp_contexts_file:file r_file_perms;
65# Check validity of SELinux context before use.
66selinux_check_context(webview_zygote)
67# Check SELinux permissions.
68selinux_check_access(webview_zygote)
69
70# Directory listing in /system.
71allow webview_zygote system_file:dir r_dir_perms;
72
73# Read and inspect temporary files (like system properties) managed by zygote.
74allow webview_zygote zygote_tmpfs:file { read getattr };
75# Child of zygote.
76allow webview_zygote zygote:fd use;
77allow webview_zygote zygote:process sigchld;
78
79# Allow apps access to /vendor/overlay
80r_dir_file(webview_zygote, vendor_overlay_file)
81
82allow webview_zygote same_process_hal_file:file { execute read open getattr map };
83
84allow webview_zygote system_data_file:lnk_file r_file_perms;
85
86# Send unsolicited message to system_server
87unix_socket_send(webview_zygote, system_unsolzygote, system_server)
88
89# Allow the webview_zygote to access the runtime feature flag properties.
90get_prop(webview_zygote, device_config_runtime_native_prop)
91get_prop(webview_zygote, device_config_runtime_native_boot_prop)
92
93# Allow webview_zygote to access odsign verification status
94get_prop(zygote, odsign_prop)
95
96# /data/resource-cache
97allow webview_zygote resourcecache_data_file:file r_file_perms;
98allow webview_zygote resourcecache_data_file:dir r_dir_perms;
99
100#####
101##### Neverallow
102#####
103
104# Only permit transition to isolated_app.
105neverallow webview_zygote { domain -isolated_app }:process dyntransition;
106
107# Only setcon() transitions, no exec() based transitions, except for crash_dump.
108neverallow webview_zygote { domain -crash_dump }:process transition;
109
110# Must not exec() a program without changing domains.
111# Having said that, exec() above is not allowed.
112neverallow webview_zygote *:file execute_no_trans;
113
114# The only way to enter this domain is for the zygote to fork a new
115# webview_zygote child.
116neverallow { domain -zygote } webview_zygote:process dyntransition;
117
118# Disallow write access to properties.
119neverallow webview_zygote property_socket:sock_file write;
120neverallow webview_zygote property_type:property_service set;
121
122# Should not have any access to app data files.
123neverallow webview_zygote app_data_file_type:file { rwx_file_perms };
124
125neverallow webview_zygote {
126    service_manager_type
127    -activity_service
128    -webviewupdate_service
129}:service_manager find;
130
131# Isolated apps shouldn't be able to access the driver directly.
132neverallow webview_zygote gpu_device:chr_file { rwx_file_perms };
133
134# Do not allow webview_zygote access to /cache.
135neverallow webview_zygote cache_file:dir ~{ r_dir_perms };
136neverallow webview_zygote cache_file:file ~{ read getattr };
137
138# Do not allow most socket access. This is socket_class_set, excluding unix_dgram_socket,
139# unix_stream_socket, and netlink_selinux_socket.
140neverallow webview_zygote domain:{
141  socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket key_socket
142  appletalk_socket netlink_route_socket netlink_tcpdiag_socket
143  netlink_nflog_socket netlink_xfrm_socket netlink_audit_socket
144  netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket
145  netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket
146  netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket
147  sctp_socket icmp_socket ax25_socket ipx_socket netrom_socket atmpvc_socket
148  x25_socket rose_socket decnet_socket atmsvc_socket rds_socket irda_socket
149  pppox_socket llc_socket can_socket tipc_socket bluetooth_socket iucv_socket
150  rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket
151  alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket
152  xdp_socket
153} *;
154
155# Do not allow access to Bluetooth-related system properties.
156# neverallow rules for Bluetooth-related data files are listed above.
157neverallow webview_zygote {
158  bluetooth_a2dp_offload_prop
159  bluetooth_audio_hal_prop
160  bluetooth_prop
161  exported_bluetooth_prop
162}:file create_file_perms;
163