1# vendor_init is its own domain. 2type vendor_init, domain, mlstrustedsubject; 3 4# Communication to the main init process 5allow vendor_init init:unix_stream_socket { read write }; 6 7# Logging to kmsg 8allow vendor_init kmsg_device:chr_file { open getattr write }; 9 10# Mount on /dev/usb-ffs/adb. 11allow vendor_init device:dir mounton; 12 13# Create and remove symlinks in /. 14allow vendor_init rootfs:lnk_file { create unlink }; 15 16# Create cgroups mount points in tmpfs and mount cgroups on them. 17allow vendor_init cgroup:dir create_dir_perms; 18allow vendor_init cgroup:file w_file_perms; 19allow vendor_init cgroup_v2:dir create_dir_perms; 20allow vendor_init cgroup_v2:file w_file_perms; 21 22# /config 23allow vendor_init configfs:dir mounton; 24allow vendor_init configfs:dir create_dir_perms; 25allow vendor_init configfs:{ file lnk_file } create_file_perms; 26 27# Create directories under /dev/cpuctl after chowning it to system. 28allow vendor_init self:global_capability_class_set { dac_override dac_read_search }; 29 30# mkdir, symlink, write, rm/rmdir, chown/chmod, restorecon/restorecon_recursive from init.rc files. 31# chown/chmod require open+read+setattr required for open()+fchown/fchmod(). 32# system/core/init.rc requires at least cache_file and data_file_type. 33# init.<board>.rc files often include device-specific types, so 34# we just allow all file types except /system files here. 35allow vendor_init self:global_capability_class_set { chown fowner fsetid }; 36 37# mkdir with FBE requires reading /data/unencrypted/{ref,mode}. 38allow vendor_init unencrypted_data_file:dir search; 39allow vendor_init unencrypted_data_file:file r_file_perms; 40 41# Set encryption policy on dirs in /data 42allowxperm vendor_init data_file_type:dir ioctl { 43 FS_IOC_GET_ENCRYPTION_POLICY 44 FS_IOC_SET_ENCRYPTION_POLICY 45}; 46 47allow vendor_init system_data_file:dir getattr; 48 49allow vendor_init { 50 file_type 51 -bpffs_type 52 -core_data_file_type 53 -exec_type 54 -system_dlkm_file_type 55 -system_file_type 56 -mnt_product_file 57 -password_slot_metadata_file 58 -ota_metadata_file 59 -unlabeled 60 -vendor_file_type 61 -vold_metadata_file 62 -gsi_metadata_file_type 63 -apex_metadata_file 64 -userspace_reboot_metadata_file 65 -aconfig_storage_metadata_file 66 -aconfig_storage_flags_metadata_file 67}:dir { create search getattr open read setattr ioctl write add_name remove_name rmdir relabelfrom }; 68 69allow vendor_init unlabeled:{ dir notdevfile_class_set } { getattr relabelfrom }; 70 71allow vendor_init { 72 file_type 73 -bpffs_type 74 -core_data_file_type 75 -exec_type 76 -password_slot_metadata_file 77 -ota_metadata_file 78 -runtime_event_log_tags_file 79 -system_dlkm_file_type 80 -system_file_type 81 -unlabeled 82 -vendor_file_type 83 -vold_metadata_file 84 -gsi_metadata_file_type 85 -apex_metadata_file 86 -apex_info_file 87 -userspace_reboot_metadata_file 88 -aconfig_storage_metadata_file 89 -aconfig_storage_flags_metadata_file 90 enforce_debugfs_restriction(`-debugfs_type') 91}:file { create getattr open read write setattr relabelfrom unlink map }; 92 93allow vendor_init { 94 file_type 95 -bpffs_type 96 -core_data_file_type 97 -exec_type 98 -password_slot_metadata_file 99 -ota_metadata_file 100 -system_dlkm_file_type 101 -system_file_type 102 -unlabeled 103 -vendor_file_type 104 -vold_metadata_file 105 -gsi_metadata_file_type 106 -apex_metadata_file 107 -userspace_reboot_metadata_file 108 -aconfig_storage_metadata_file 109 -aconfig_storage_flags_metadata_file 110}:{ sock_file fifo_file } { create getattr open read setattr relabelfrom unlink }; 111 112allow vendor_init { 113 file_type 114 -apex_mnt_dir 115 -bpffs_type 116 -core_data_file_type 117 -exec_type 118 -password_slot_metadata_file 119 -ota_metadata_file 120 -system_dlkm_file_type 121 -system_file_type 122 -unlabeled 123 -vendor_file_type 124 -vold_metadata_file 125 -gsi_metadata_file_type 126 -apex_metadata_file 127 -userspace_reboot_metadata_file 128 -aconfig_storage_metadata_file 129 -aconfig_storage_flags_metadata_file 130}:lnk_file { create getattr setattr relabelfrom unlink }; 131 132allow vendor_init { 133 file_type 134 -bpffs_type 135 -core_data_file_type 136 -exec_type 137 -mnt_product_file 138 -password_slot_metadata_file 139 -ota_metadata_file 140 -system_dlkm_file_type 141 -system_file_type 142 -vendor_file_type 143 -vold_metadata_file 144 -gsi_metadata_file_type 145 -apex_metadata_file 146 -userspace_reboot_metadata_file 147 -aconfig_storage_metadata_file 148 -aconfig_storage_flags_metadata_file 149}:dir_file_class_set relabelto; 150 151allow vendor_init dev_type:dir create_dir_perms; 152allow vendor_init dev_type:lnk_file create; 153 154# Disable tracing by writing to /sys/kernel/debug/tracing/tracing_on 155allow vendor_init debugfs_tracing:file w_file_perms; 156 157# chown/chmod on pseudo files. 158allow vendor_init { 159 fs_type 160 -bpffs_type 161 -contextmount_type 162 -keychord_device 163 -sdcard_type 164 -fusefs_type 165 -rootfs 166 -proc_uid_time_in_state 167 -proc_uid_concurrent_active_time 168 -proc_uid_concurrent_policy_time 169 enforce_debugfs_restriction(`-debugfs_type') 170}:file { open read setattr map }; 171 172allow vendor_init tracefs_type:file { open read setattr map }; 173 174allow vendor_init { 175 fs_type 176 -bpffs_type 177 -contextmount_type 178 -sdcard_type 179 -fusefs_type 180 -rootfs 181 -proc_uid_time_in_state 182 -proc_uid_concurrent_active_time 183 -proc_uid_concurrent_policy_time 184}:dir { open read setattr search }; 185 186allow vendor_init dev_type:blk_file getattr; 187 188# Write to /proc/sys/net/ping_group_range and other /proc/sys/net files. 189r_dir_file(vendor_init, proc_net_type) 190allow vendor_init proc_net_type:file w_file_perms; 191allow vendor_init self:global_capability_class_set net_admin; 192 193# Write to /proc/sys/vm/page-cluster 194allow vendor_init proc_page_cluster:file w_file_perms; 195 196# Write to sysfs nodes. 197allow vendor_init sysfs_type:dir r_dir_perms; 198allow vendor_init sysfs_type:lnk_file read; 199allow vendor_init { sysfs_type -sysfs_usermodehelper }:file rw_file_perms; 200 201# setfscreatecon() for labeling directories and socket files. 202allow vendor_init self:process { setfscreate }; 203 204r_dir_file(vendor_init, vendor_file_type) 205 206# Vendor init can read properties 207allow vendor_init serialno_prop:file { getattr open read map }; 208 209# Vendor init can perform operations on trusted and security Extended Attributes 210allow vendor_init self:global_capability_class_set sys_admin; 211 212# Raw writes to misc block device 213allow vendor_init misc_block_device:blk_file w_file_perms; 214 215# vendor_init is using bootstrap bionic 216use_bootstrap_libs(vendor_init) 217 218# allow filesystem tuning 219allow vendor_init userdata_sysdev:file create_file_perms; 220 221# Everything is labeled as rootfs in recovery mode. Vendor init has to execute 222# the dynamic linker and shared libraries. 223recovery_only(` 224 allow vendor_init rootfs:file { r_file_perms execute }; 225') 226 227not_compatible_property(` 228 set_prop(vendor_init, { 229 property_type 230 -system_internal_property_type 231 -system_restricted_property_type 232 }) 233') 234 235# Get file context 236allow vendor_init file_contexts_file:file r_file_perms; 237 238# Allow vendor_init to (re)set nice 239allow vendor_init self:capability sys_nice; 240 241set_prop(vendor_init, apk_verity_prop) 242set_prop(vendor_init, bluetooth_a2dp_offload_prop) 243set_prop(vendor_init, bluetooth_audio_hal_prop) 244set_prop(vendor_init, bluetooth_config_prop) 245set_prop(vendor_init, camera2_extensions_prop) 246set_prop(vendor_init, camerax_extensions_prop) 247set_prop(vendor_init, cpu_variant_prop) 248set_prop(vendor_init, dalvik_config_prop) 249set_prop(vendor_init, dalvik_dynamic_config_prop) 250set_prop(vendor_init, dalvik_runtime_prop) 251set_prop(vendor_init, debug_prop) 252set_prop(vendor_init, exported_bluetooth_prop) 253set_prop(vendor_init, exported_camera_prop) 254set_prop(vendor_init, exported_config_prop) 255set_prop(vendor_init, exported_default_prop) 256set_prop(vendor_init, exported_overlay_prop) 257set_prop(vendor_init, exported_pm_prop) 258set_prop(vendor_init, ffs_control_prop) 259set_prop(vendor_init, hw_timeout_multiplier_prop) 260set_prop(vendor_init, incremental_prop) 261set_prop(vendor_init, lmkd_prop) 262set_prop(vendor_init, logd_prop) 263set_prop(vendor_init, log_tag_prop) 264set_prop(vendor_init, log_prop) 265set_prop(vendor_init, graphics_config_writable_prop) 266set_prop(vendor_init, qemu_hw_prop) 267set_prop(vendor_init, radio_control_prop) 268set_prop(vendor_init, rebootescrow_hal_prop) 269set_prop(vendor_init, serialno_prop) 270set_prop(vendor_init, soc_prop) 271set_prop(vendor_init, surfaceflinger_color_prop) 272set_prop(vendor_init, usb_control_prop) 273set_prop(vendor_init, userspace_reboot_config_prop) 274set_prop(vendor_init, vehicle_hal_prop) 275set_prop(vendor_init, vendor_default_prop) 276set_prop(vendor_init, keystore_config_prop) 277set_prop(vendor_init, vendor_security_patch_level_prop) 278set_prop(vendor_init, vndk_prop) 279set_prop(vendor_init, virtual_ab_prop) 280set_prop(vendor_init, vold_post_fs_data_prop) 281set_prop(vendor_init, wifi_hal_prop) 282set_prop(vendor_init, wifi_log_prop) 283set_prop(vendor_init, zram_control_prop) 284 285get_prop(vendor_init, boot_status_prop) 286get_prop(vendor_init, exported3_system_prop) 287get_prop(vendor_init, ota_prop) 288get_prop(vendor_init, power_debug_prop) 289get_prop(vendor_init, provisioned_prop) 290get_prop(vendor_init, retaildemo_prop) 291get_prop(vendor_init, surfaceflinger_display_prop) 292get_prop(vendor_init, test_harness_prop) 293get_prop(vendor_init, theme_prop) 294set_prop(vendor_init, dck_prop) 295 296# Allow vendor_init to read vendor_system_native device config changes 297get_prop(vendor_init, device_config_vendor_system_native_prop) 298get_prop(vendor_init, device_config_vendor_system_native_boot_prop) 299 300### 301### neverallow rules 302### 303 304# Vendor init shouldn't communicate with any vendor process, nor most system processes. 305neverallow_establish_socket_comms(vendor_init, { 306 domain -init -logd -prng_seeder -su -vendor_init }); 307 308# The vendor_init domain is only entered via an exec based transition from the 309# init domain, never via setcon(). 310neverallow domain vendor_init:process dyntransition; 311neverallow { domain -init } vendor_init:process transition; 312neverallow vendor_init { file_type fs_type -init_exec }:file entrypoint; 313 314# Never read/follow symlinks created by shell or untrusted apps. 315neverallow vendor_init app_data_file_type:lnk_file read; 316neverallow vendor_init shell_data_file:lnk_file read; 317# Init should not be creating subdirectories in /data/local/tmp 318neverallow vendor_init shell_data_file:dir { write add_name remove_name }; 319 320# init should never execute a program without changing to another domain. 321neverallow vendor_init { file_type fs_type }:file execute_no_trans; 322 323# Init never adds or uses services via service_manager. 324neverallow vendor_init service_manager_type:service_manager { add find }; 325neverallow vendor_init servicemanager:service_manager list; 326 327# vendor_init should never be ptraced 328neverallow * vendor_init:process ptrace; 329