1type keystore, domain, keystore2_key_type; 2type keystore_exec, system_file_type, exec_type, file_type; 3 4# keystore daemon 5typeattribute keystore mlstrustedsubject; 6binder_use(keystore) 7binder_service(keystore) 8binder_call(keystore, remote_provisioning_service_server) 9binder_call(keystore, system_server) 10binder_call(keystore, wificond) 11 12allow keystore keystore_data_file:dir create_dir_perms; 13allow keystore keystore_data_file:notdevfile_class_set create_file_perms; 14allow keystore keystore_exec:file { getattr }; 15 16add_service(keystore, keystore_service) 17allow keystore sec_key_att_app_id_provider_service:service_manager find; 18allow keystore dropbox_service:service_manager find; 19allow keystore remote_provisioning_service:service_manager find; 20add_service(keystore, apc_service) 21add_service(keystore, keystore_compat_hal_service) 22add_service(keystore, authorization_service) 23add_service(keystore, keystore_maintenance_service) 24add_service(keystore, keystore_metrics_service) 25add_service(keystore, legacykeystore_service) 26 27# Check SELinux permissions. 28selinux_check_access(keystore) 29 30r_dir_file(keystore, cgroup) 31r_dir_file(keystore, cgroup_v2) 32 33### 34### Neverallow rules 35### 36### Protect ourself from others 37### 38 39neverallow { domain -keystore } keystore_data_file:dir ~{ open create read getattr setattr search relabelto ioctl }; 40neverallow { domain -keystore } keystore_data_file:notdevfile_class_set ~{ relabelto getattr }; 41 42neverallow { domain -keystore -init } keystore_data_file:dir *; 43neverallow { domain -keystore -init } keystore_data_file:notdevfile_class_set *; 44 45# TODO(b/186868271): Remove the crash dump exception soon-ish (maybe by May 14, 2021?) 46neverallow { domain userdebug_or_eng(`-crash_dump') } keystore:process ptrace; 47 48# The software KeyMint implementation used in km_compat needs 49# to read the vendor security patch level. 50get_prop(keystore, vendor_security_patch_level_prop); 51 52# Allow keystore to read its vendor configuration 53get_prop(keystore, keystore_config_prop) 54