1### 2### Domain for all zygote spawned apps 3### 4### This file is the base policy for all zygote spawned apps. 5### Other policy files, such as isolated_app.te, untrusted_app.te, etc 6### extend from this policy. Only policies which should apply to ALL 7### zygote spawned apps should be added here. 8### 9type appdomain_tmpfs, file_type; 10 11### 12### Neverallow rules 13### 14### These are things that Android apps should NEVER be able to do 15### 16 17# Superuser capabilities. 18# bluetooth requires net_admin and wake_alarm. network stack app requires net_admin. 19neverallow { appdomain -bluetooth -network_stack } self:capability_class_set *; 20 21# Block device access. 22neverallow appdomain dev_type:blk_file { read write }; 23 24# Note: Try expanding list of app domains in the future. 25neverallow { untrusted_app isolated_app shell } graphics_device:chr_file { read write }; 26 27neverallow { appdomain -nfc } nfc_device:chr_file 28 { read write }; 29neverallow { appdomain -bluetooth } hci_attach_dev:chr_file 30 { read write }; 31neverallow appdomain tee_device:chr_file { read write }; 32 33# Privileged netlink socket interfaces. 34neverallow { appdomain -network_stack } 35 domain:{ 36 netlink_tcpdiag_socket 37 netlink_nflog_socket 38 netlink_xfrm_socket 39 netlink_audit_socket 40 netlink_dnrt_socket 41 } *; 42 43# These messages are broadcast messages from the kernel to userspace. 44# Do not allow the writing of netlink messages, which has been a source 45# of rooting vulns in the past. 46neverallow { appdomain -network_stack } 47 domain:netlink_kobject_uevent_socket { write append }; 48 49# Sockets under /dev/socket that are not specifically typed. 50neverallow appdomain socket_device:sock_file write; 51 52# Unix domain sockets. 53neverallow appdomain adbd_socket:sock_file write; 54neverallow { appdomain -radio } rild_socket:sock_file write; 55 56# ptrace access to non-app domains. 57neverallow appdomain { domain -appdomain }:process ptrace; 58 59# The Android security model guarantees the confidentiality and integrity 60# of application data and execution state. Ptrace bypasses those 61# confidentiality guarantees. Disallow ptrace access from system components 62# to apps. Crash_dump is excluded, as it needs ptrace access to 63# produce stack traces. llkd is excluded, as it needs ptrace access to 64# inspect stack traces for live lock conditions. 65 66neverallow { 67 domain 68 -appdomain 69 -crash_dump 70 userdebug_or_eng(`-llkd') 71} appdomain:process ptrace; 72 73# Read or write access to /proc/pid entries for any non-app domain. 74# A different form of hidepid=2 like protections 75neverallow appdomain { domain -appdomain }:file no_w_file_perms; 76neverallow { appdomain -shell } { domain -appdomain }:file no_rw_file_perms; 77 78# signal access to non-app domains. 79# sigchld allowed for parent death notification. 80# signull allowed for kill(pid, 0) existence test. 81# All others prohibited. 82# -perfetto is to allow shell (which is an appdomain) to kill perfetto 83# (see private/shell.te). 84neverallow appdomain { domain -appdomain -perfetto }:process 85 { sigkill sigstop signal }; 86 87# Write to rootfs. 88neverallow appdomain rootfs:dir_file_class_set 89 { create write setattr relabelfrom relabelto append unlink link rename }; 90 91# Write to /system. 92neverallow appdomain system_file_type:dir_file_class_set 93 { create write setattr relabelfrom relabelto append unlink link rename }; 94 95# Write to entrypoint executables. 96neverallow appdomain exec_type:file 97 { create write setattr relabelfrom relabelto append unlink link rename }; 98 99# Write to system-owned parts of /data. 100# This is the default type for anything under /data not otherwise 101# specified in file_contexts. Define a different type for portions 102# that should be writable by apps. 103neverallow appdomain system_data_file:dir_file_class_set 104 { create write setattr relabelfrom relabelto append unlink link rename }; 105 106# Write to various other parts of /data. 107neverallow appdomain drm_data_file:dir_file_class_set 108 { create write setattr relabelfrom relabelto append unlink link rename }; 109neverallow { appdomain -platform_app } 110 apk_data_file:dir_file_class_set 111 { create write setattr relabelfrom relabelto append unlink link rename }; 112neverallow { appdomain -platform_app } 113 apk_private_data_file:dir_file_class_set 114 { create write setattr relabelfrom relabelto append unlink link rename }; 115neverallow { appdomain -platform_app } 116 apk_private_tmp_file:dir_file_class_set 117 { create write setattr relabelfrom relabelto append unlink link rename }; 118neverallow { appdomain -shell } 119 shell_data_file:dir_file_class_set 120 { create setattr relabelfrom relabelto append unlink link rename }; 121neverallow { appdomain -bluetooth } 122 bluetooth_data_file:dir_file_class_set 123 { create write setattr relabelfrom relabelto append unlink link rename }; 124neverallow { domain -credstore -init } credstore_data_file:dir_file_class_set *; 125neverallow appdomain 126 keystore_data_file:dir_file_class_set 127 { create write setattr relabelfrom relabelto append unlink link rename }; 128neverallow appdomain 129 systemkeys_data_file:dir_file_class_set 130 { create write setattr relabelfrom relabelto append unlink link rename }; 131neverallow appdomain 132 wifi_data_file:dir_file_class_set 133 { create write setattr relabelfrom relabelto append unlink link rename }; 134neverallow appdomain 135 dhcp_data_file:dir_file_class_set 136 { create write setattr relabelfrom relabelto append unlink link rename }; 137 138# access tmp apk files 139neverallow { appdomain -platform_app } 140 apk_tmp_file:dir_file_class_set 141 { create write setattr relabelfrom relabelto append unlink link rename }; 142 143neverallow { appdomain -untrusted_app_all -platform_app -priv_app -isolated_app_all } 144 { apk_tmp_file apk_private_tmp_file }:dir_file_class_set *; 145 146neverallow { untrusted_app_all isolated_app_all } { apk_tmp_file apk_private_tmp_file }:{ devfile_class_set dir fifo_file lnk_file sock_file } *; 147neverallow { untrusted_app_all isolated_app_all } { apk_tmp_file apk_private_tmp_file }:file ~{ getattr read }; 148 149# Access to factory files. 150neverallow appdomain efs_file:dir_file_class_set write; 151neverallow { appdomain -shell } efs_file:dir_file_class_set read; 152 153# Write to various pseudo file systems. 154neverallow { appdomain -bluetooth -nfc } 155 sysfs:dir_file_class_set write; 156neverallow appdomain 157 proc:dir_file_class_set write; 158 159# Access to syslog(2) or /proc/kmsg. 160neverallow appdomain kernel:system { syslog_read syslog_mod syslog_console }; 161 162# SELinux is not an API for apps to use 163neverallow { appdomain -shell } *:security { compute_av check_context }; 164neverallow { appdomain -shell } *:netlink_selinux_socket *; 165 166# Ability to perform any filesystem operation other than statfs(2). 167# i.e. no mount(2), unmount(2), etc. 168neverallow appdomain fs_type:filesystem ~getattr; 169 170# prevent creation/manipulation of globally readable symlinks 171neverallow appdomain { 172 apk_data_file 173 cache_file 174 cache_recovery_file 175 dev_type 176 rootfs 177 system_file 178 tmpfs 179}:lnk_file no_w_file_perms; 180 181# Applications should use the activity model for receiving events 182neverallow { 183 appdomain 184 -shell # bugreport 185} input_device:chr_file ~getattr; 186 187# Do not allow access to Bluetooth-related system properties except for a few allowed domains. 188# neverallow rules for access to Bluetooth-related data files are above. 189neverallow { 190 appdomain 191 -bluetooth 192 -system_app 193} { bluetooth_audio_hal_prop bluetooth_a2dp_offload_prop bluetooth_prop exported_bluetooth_prop }:file create_file_perms; 194 195# allow system_app to access Nfc-related system properties. 196set_prop(system_app, nfc_prop) 197 198# allow system_app to access radio_config system properties. 199set_prop(system_app, radio_control_prop) 200 201# Apps cannot access proc_uid_time_in_state 202neverallow appdomain proc_uid_time_in_state:file *; 203 204# Apps cannot access proc_uid_concurrent_active_time 205neverallow appdomain proc_uid_concurrent_active_time:file *; 206 207# Apps cannot access proc_uid_concurrent_policy_time 208neverallow appdomain proc_uid_concurrent_policy_time:file *; 209 210# Apps cannot access proc_uid_cpupower 211neverallow appdomain proc_uid_cpupower:file *; 212 213# Apps may not read /proc/net/{tcp,tcp6,udp,udp6}. These files leak information across the 214# application boundary. VPN apps may use the ConnectivityManager.getConnectionOwnerUid() API to 215# perform UID lookups. 216neverallow { appdomain -shell } proc_net_tcp_udp:file *; 217 218# Apps cannot access bootstrap files. The bootstrap files are only for 219# extremely early processes (like init, etc.) which are started before 220# the runtime APEX is activated and Bionic libs are provided from there. 221# If app process accesses (or even load/execute) the bootstrap files, 222# it might cause problems such as ODR violation, etc. 223neverallow appdomain system_bootstrap_lib_file:file 224 { open read write append execute execute_no_trans map }; 225neverallow appdomain system_bootstrap_lib_file:dir 226 { open read getattr search }; 227