xref: /aosp_15_r20/system/sepolicy/prebuilts/api/32.0/private/apexd.te (revision e4a36f4174b17bbab9dc043f4a65dc8d87377290)
1typeattribute apexd coredomain;
2
3init_daemon_domain(apexd)
4
5# Allow creating, reading and writing of APEX files/dirs in the APEX data dir
6allow apexd apex_data_file:dir create_dir_perms;
7allow apexd apex_data_file:file create_file_perms;
8# Allow relabeling file created in /data/apex/decompressed
9allow apexd apex_data_file:file relabelfrom;
10
11# Allow creating, reading and writing of APEX files/dirs in the APEX metadata dir
12allow apexd metadata_file:dir search;
13allow apexd apex_metadata_file:dir create_dir_perms;
14allow apexd apex_metadata_file:file create_file_perms;
15
16# Allow reserving space on /data/apex/ota_reserved for apex decompression
17allow apexd apex_ota_reserved_file:dir create_dir_perms;
18allow apexd apex_ota_reserved_file:file create_file_perms;
19
20# Allow apexd to create files and directories for snapshots of apex data
21allow apexd apex_appsearch_data_file:dir { create_dir_perms relabelto };
22allow apexd apex_appsearch_data_file:file { create_file_perms relabelto };
23allow apexd apex_art_data_file:dir { create_dir_perms relabelto };
24allow apexd apex_art_data_file:file { create_file_perms relabelto };
25allow apexd apex_permission_data_file:dir { create_dir_perms relabelto };
26allow apexd apex_permission_data_file:file { create_file_perms relabelto };
27allow apexd apex_module_data_file:dir { create_dir_perms relabelfrom };
28allow apexd apex_module_data_file:file { create_file_perms relabelfrom };
29allow apexd apex_rollback_data_file:dir create_dir_perms;
30allow apexd apex_rollback_data_file:file create_file_perms;
31allow apexd apex_scheduling_data_file:dir { create_dir_perms relabelto };
32allow apexd apex_scheduling_data_file:file { create_file_perms relabelto };
33allow apexd apex_wifi_data_file:dir { create_dir_perms relabelto };
34allow apexd apex_wifi_data_file:file { create_file_perms relabelto };
35
36# Allow apexd to read directories under /data/misc_de in order to snapshot and
37# restore apex data for all users.
38allow apexd system_data_file:dir r_dir_perms;
39
40# allow apexd to create loop devices with /dev/loop-control
41allow apexd loop_control_device:chr_file rw_file_perms;
42# allow apexd to access loop devices
43allow apexd loop_device:blk_file rw_file_perms;
44allowxperm apexd loop_device:blk_file ioctl {
45  LOOP_GET_STATUS64
46  LOOP_SET_STATUS64
47  LOOP_SET_FD
48  LOOP_SET_BLOCK_SIZE
49  LOOP_SET_DIRECT_IO
50  LOOP_CLR_FD
51  BLKFLSBUF
52  LOOP_CONFIGURE
53};
54# Allow apexd to access /dev/block
55allow apexd bdev_type:dir r_dir_perms;
56allow apexd bdev_type:blk_file getattr;
57
58#allow apexd to access virtual disks
59allow apexd vd_device:blk_file r_file_perms;
60
61# allow apexd to access /dev/block/dm-* (device-mapper entries)
62allow apexd dm_device:chr_file rw_file_perms;
63allow apexd dm_device:blk_file rw_file_perms;
64
65# sys_admin is required to access the device-mapper and mount
66# dac_override, chown, and fowner are needed for snapshot and restore
67allow apexd self:global_capability_class_set { sys_admin chown dac_override dac_read_search fowner };
68
69# Note: fsetid is deliberately not included above. fsetid checks are
70# triggered by chmod on a directory or file owned by a group other
71# than one of the groups assigned to the current process to see if
72# the setgid bit should be cleared, regardless of whether the setgid
73# bit was even set.  We do not appear to truly need this capability
74# for apexd to operate.
75dontaudit apexd self:global_capability_class_set fsetid;
76
77# allow apexd to create a mount point in /apex
78allow apexd apex_mnt_dir:dir create_dir_perms;
79# allow apexd to mount in /apex
80allow apexd apex_mnt_dir:filesystem { mount unmount };
81allow apexd apex_mnt_dir:dir mounton;
82# allow apexd to create symlinks in /apex
83allow apexd apex_mnt_dir:lnk_file create_file_perms;
84# allow apexd to create /apex/apex-info-list.xml and relabel to apex_info_file
85allow apexd apex_mnt_dir:file { create_file_perms relabelfrom mounton };
86allow apexd apex_info_file:file relabelto;
87# apexd needs to update /apex/apex-info-list.xml after non-staged APEX update.
88allow apexd apex_info_file:file rw_file_perms;
89allow apexd apex_info_file:file mounton;
90
91# allow apexd to unlink apex files in /data/apex/active
92# note that apexd won't be able to unlink files in /data/app-staging/session_XXXX,
93# because it doesn't have write permission for staging_data_file object.
94allow apexd staging_data_file:file unlink;
95
96# allow apexd to read files from /data/app-staging and hardlink them to /data/apex.
97allow apexd staging_data_file:dir r_dir_perms;
98allow apexd staging_data_file:file { r_file_perms link };
99# # Allow relabeling file created in /data/apex/decompressed
100allow apexd staging_data_file:file relabelto;
101
102# allow apexd to read files from /vendor/apex
103allow apexd vendor_apex_file:dir r_dir_perms;
104allow apexd vendor_apex_file:file r_file_perms;
105
106# Unmount and mount filesystems
107allow apexd labeledfs:filesystem { mount unmount };
108
109# /sys directory tree traversal
110allow apexd sysfs_type:dir search;
111allow apexd sysfs_block_type:dir r_dir_perms;
112allow apexd sysfs_block_type:file r_file_perms;
113# Configure read-ahead of dm-verity and loop devices
114# for dm-X
115allow apexd sysfs_dm:dir r_dir_perms;
116allow apexd sysfs_dm:file rw_file_perms;
117# for loopX
118allow apexd sysfs_loop:dir r_dir_perms;
119allow apexd sysfs_loop:file rw_file_perms;
120
121# Allow apexd to log to the kernel.
122allow apexd kmsg_device:chr_file w_file_perms;
123
124# Allow apexd to reboot device. Required for rollbacks of apexes that are
125# not covered by rollback manager.
126set_prop(apexd, powerctl_prop)
127
128# Allow apexd to stop itself
129set_prop(apexd, ctl_apexd_prop)
130
131# Find the vold service, and call into vold to manage FS checkpoints
132allow apexd vold_service:service_manager find;
133binder_call(apexd, vold)
134
135# Apex pre- & post-install permission.
136
137# Allow self-execute for the fork mount helper.
138allow apexd apexd_exec:file execute_no_trans;
139
140# Unshare and make / private so that hooks cannot influence the
141# running system.
142allow apexd rootfs:dir mounton;
143
144# Allow to execute shell for pre- and postinstall scripts. A transition
145# rule is required, thus restricted to execute and not execute_no_trans.
146allow apexd shell_exec:file { r_file_perms execute };
147
148# apexd is using bootstrap bionic
149allow apexd system_bootstrap_lib_file:dir r_dir_perms;
150allow apexd system_bootstrap_lib_file:file { execute read open getattr map };
151
152# Allow transition to test APEX preinstall domain.
153userdebug_or_eng(`
154  domain_auto_trans(apexd, apex_test_prepostinstall_exec, apex_test_prepostinstall)
155')
156
157# Allow transition to GKI update pre/post install domain
158domain_auto_trans(apexd, gki_apex_prepostinstall_exec, gki_apex_prepostinstall)
159
160# Allow apexd to be invoked with logwrapper from init during userspace reboot.
161allow apexd devpts:chr_file { read write };
162
163# Allow apexd to create pts files via logwrap_fork_exec for its own use, to pass to
164# other processes
165create_pty(apexd)
166
167# Allow apexd to read file contexts when performing restorecon of snapshots.
168allow apexd file_contexts_file:file r_file_perms;
169
170# Allow apexd to execute toybox for snapshot & restore
171allow apexd toolbox_exec:file rx_file_perms;
172
173# Allow apexd to release compressed blocks in case /data is f2fs-compressed fs.
174allowxperm apexd staging_data_file:file ioctl {
175  FS_IOC_GETFLAGS
176  F2FS_IOC_RELEASE_COMPRESS_BLOCKS
177};
178
179# Allow apexd to read ro.cold_boot_done prop.
180# apexd uses it to decide whether it needs to keep retrying polling for loop device.
181get_prop(apexd, cold_boot_done_prop)
182
183# Allow apexd to read per-device configuration properties.
184get_prop(apexd, apexd_config_prop)
185
186neverallow { domain -apexd -init } apex_data_file:dir no_w_dir_perms;
187neverallow { domain -apexd -init } apex_metadata_file:dir no_w_dir_perms;
188neverallow { domain -apexd -init -kernel } apex_data_file:file no_w_file_perms;
189neverallow { domain -apexd -init -kernel } apex_metadata_file:file no_w_file_perms;
190neverallow { domain -apexd } apex_mnt_dir:lnk_file no_w_file_perms;
191
192neverallow { domain -apexd -init -vold_prepare_subdirs } apex_module_data_file:dir no_w_dir_perms;
193neverallow { domain -apexd -init -vold_prepare_subdirs } apex_module_data_file:file no_w_file_perms;
194
195neverallow { domain -apexd -init -vold_prepare_subdirs } apex_rollback_data_file:dir no_w_dir_perms;
196neverallow { domain -apexd -init -vold_prepare_subdirs } apex_rollback_data_file:file no_w_file_perms;
197
198# only apexd can set apexd sysprop
199set_prop(apexd, apexd_prop)
200neverallow { domain -apexd -init } apexd_prop:property_service set;
201
202# only apexd can write apex-info-list.xml
203neverallow { domain -apexd } apex_info_file:file no_w_file_perms;
204
205# Only apexd and init should be allowed to manage /apex mounts
206# A note on otapreopt_chroot. It used to mount APEXes during postainstall stage of A/B OTAs,
207# but starting from S it just calls into apexd to prepare /apex for otapreoprt. Once the sepolicies
208# around otapreopt_chroot are cleaned up we should be able to remove it from the lists below.
209neverallow { domain -apexd -init -otapreopt_chroot } apex_mnt_dir:filesystem { mount unmount };
210neverallow { domain -apexd -init -otapreopt_chroot } apex_mnt_dir:dir { mounton };
211
212# Allow for use in postinstall
213allow apexd otapreopt_chroot:fd use;
214allow apexd postinstall_apex_mnt_dir:dir { create_dir_perms mounton };
215allow apexd postinstall_apex_mnt_dir:file { create_file_perms relabelfrom };
216allow apexd postinstall_apex_mnt_dir:lnk_file create;
217allow apexd proc_filesystems:file r_file_perms;
218