1typeattribute apexd coredomain; 2 3init_daemon_domain(apexd) 4 5# Allow creating, reading and writing of APEX files/dirs in the APEX data dir 6allow apexd apex_data_file:dir create_dir_perms; 7allow apexd apex_data_file:file create_file_perms; 8# Allow relabeling file created in /data/apex/decompressed 9allow apexd apex_data_file:file relabelfrom; 10 11# Allow creating, reading and writing of APEX files/dirs in the APEX metadata dir 12allow apexd metadata_file:dir search; 13allow apexd apex_metadata_file:dir create_dir_perms; 14allow apexd apex_metadata_file:file create_file_perms; 15 16# Allow reserving space on /data/apex/ota_reserved for apex decompression 17allow apexd apex_ota_reserved_file:dir create_dir_perms; 18allow apexd apex_ota_reserved_file:file create_file_perms; 19 20# Allow apexd to create files and directories for snapshots of apex data 21allow apexd apex_appsearch_data_file:dir { create_dir_perms relabelto }; 22allow apexd apex_appsearch_data_file:file { create_file_perms relabelto }; 23allow apexd apex_art_data_file:dir { create_dir_perms relabelto }; 24allow apexd apex_art_data_file:file { create_file_perms relabelto }; 25allow apexd apex_permission_data_file:dir { create_dir_perms relabelto }; 26allow apexd apex_permission_data_file:file { create_file_perms relabelto }; 27allow apexd apex_module_data_file:dir { create_dir_perms relabelfrom }; 28allow apexd apex_module_data_file:file { create_file_perms relabelfrom }; 29allow apexd apex_rollback_data_file:dir create_dir_perms; 30allow apexd apex_rollback_data_file:file create_file_perms; 31allow apexd apex_scheduling_data_file:dir { create_dir_perms relabelto }; 32allow apexd apex_scheduling_data_file:file { create_file_perms relabelto }; 33allow apexd apex_wifi_data_file:dir { create_dir_perms relabelto }; 34allow apexd apex_wifi_data_file:file { create_file_perms relabelto }; 35 36# Allow apexd to read directories under /data/misc_de in order to snapshot and 37# restore apex data for all users. 38allow apexd system_data_file:dir r_dir_perms; 39 40# allow apexd to create loop devices with /dev/loop-control 41allow apexd loop_control_device:chr_file rw_file_perms; 42# allow apexd to access loop devices 43allow apexd loop_device:blk_file rw_file_perms; 44allowxperm apexd loop_device:blk_file ioctl { 45 LOOP_GET_STATUS64 46 LOOP_SET_STATUS64 47 LOOP_SET_FD 48 LOOP_SET_BLOCK_SIZE 49 LOOP_SET_DIRECT_IO 50 LOOP_CLR_FD 51 BLKFLSBUF 52 LOOP_CONFIGURE 53}; 54# Allow apexd to access /dev/block 55allow apexd bdev_type:dir r_dir_perms; 56allow apexd bdev_type:blk_file getattr; 57 58#allow apexd to access virtual disks 59allow apexd vd_device:blk_file r_file_perms; 60 61# allow apexd to access /dev/block/dm-* (device-mapper entries) 62allow apexd dm_device:chr_file rw_file_perms; 63allow apexd dm_device:blk_file rw_file_perms; 64 65# sys_admin is required to access the device-mapper and mount 66# dac_override, chown, and fowner are needed for snapshot and restore 67allow apexd self:global_capability_class_set { sys_admin chown dac_override dac_read_search fowner }; 68 69# Note: fsetid is deliberately not included above. fsetid checks are 70# triggered by chmod on a directory or file owned by a group other 71# than one of the groups assigned to the current process to see if 72# the setgid bit should be cleared, regardless of whether the setgid 73# bit was even set. We do not appear to truly need this capability 74# for apexd to operate. 75dontaudit apexd self:global_capability_class_set fsetid; 76 77# allow apexd to create a mount point in /apex 78allow apexd apex_mnt_dir:dir create_dir_perms; 79# allow apexd to mount in /apex 80allow apexd apex_mnt_dir:filesystem { mount unmount }; 81allow apexd apex_mnt_dir:dir mounton; 82# allow apexd to create symlinks in /apex 83allow apexd apex_mnt_dir:lnk_file create_file_perms; 84# allow apexd to create /apex/apex-info-list.xml and relabel to apex_info_file 85allow apexd apex_mnt_dir:file { create_file_perms relabelfrom mounton }; 86allow apexd apex_info_file:file relabelto; 87# apexd needs to update /apex/apex-info-list.xml after non-staged APEX update. 88allow apexd apex_info_file:file rw_file_perms; 89allow apexd apex_info_file:file mounton; 90 91# allow apexd to unlink apex files in /data/apex/active 92# note that apexd won't be able to unlink files in /data/app-staging/session_XXXX, 93# because it doesn't have write permission for staging_data_file object. 94allow apexd staging_data_file:file unlink; 95 96# allow apexd to read files from /data/app-staging and hardlink them to /data/apex. 97allow apexd staging_data_file:dir r_dir_perms; 98allow apexd staging_data_file:file { r_file_perms link }; 99# # Allow relabeling file created in /data/apex/decompressed 100allow apexd staging_data_file:file relabelto; 101 102# allow apexd to read files from /vendor/apex 103allow apexd vendor_apex_file:dir r_dir_perms; 104allow apexd vendor_apex_file:file r_file_perms; 105 106# Unmount and mount filesystems 107allow apexd labeledfs:filesystem { mount unmount }; 108 109# /sys directory tree traversal 110allow apexd sysfs_type:dir search; 111allow apexd sysfs_block_type:dir r_dir_perms; 112allow apexd sysfs_block_type:file r_file_perms; 113# Configure read-ahead of dm-verity and loop devices 114# for dm-X 115allow apexd sysfs_dm:dir r_dir_perms; 116allow apexd sysfs_dm:file rw_file_perms; 117# for loopX 118allow apexd sysfs_loop:dir r_dir_perms; 119allow apexd sysfs_loop:file rw_file_perms; 120 121# Allow apexd to log to the kernel. 122allow apexd kmsg_device:chr_file w_file_perms; 123 124# Allow apexd to reboot device. Required for rollbacks of apexes that are 125# not covered by rollback manager. 126set_prop(apexd, powerctl_prop) 127 128# Allow apexd to stop itself 129set_prop(apexd, ctl_apexd_prop) 130 131# Find the vold service, and call into vold to manage FS checkpoints 132allow apexd vold_service:service_manager find; 133binder_call(apexd, vold) 134 135# Apex pre- & post-install permission. 136 137# Allow self-execute for the fork mount helper. 138allow apexd apexd_exec:file execute_no_trans; 139 140# Unshare and make / private so that hooks cannot influence the 141# running system. 142allow apexd rootfs:dir mounton; 143 144# Allow to execute shell for pre- and postinstall scripts. A transition 145# rule is required, thus restricted to execute and not execute_no_trans. 146allow apexd shell_exec:file { r_file_perms execute }; 147 148# apexd is using bootstrap bionic 149allow apexd system_bootstrap_lib_file:dir r_dir_perms; 150allow apexd system_bootstrap_lib_file:file { execute read open getattr map }; 151 152# Allow transition to test APEX preinstall domain. 153userdebug_or_eng(` 154 domain_auto_trans(apexd, apex_test_prepostinstall_exec, apex_test_prepostinstall) 155') 156 157# Allow transition to GKI update pre/post install domain 158domain_auto_trans(apexd, gki_apex_prepostinstall_exec, gki_apex_prepostinstall) 159 160# Allow apexd to be invoked with logwrapper from init during userspace reboot. 161allow apexd devpts:chr_file { read write }; 162 163# Allow apexd to create pts files via logwrap_fork_exec for its own use, to pass to 164# other processes 165create_pty(apexd) 166 167# Allow apexd to read file contexts when performing restorecon of snapshots. 168allow apexd file_contexts_file:file r_file_perms; 169 170# Allow apexd to execute toybox for snapshot & restore 171allow apexd toolbox_exec:file rx_file_perms; 172 173# Allow apexd to release compressed blocks in case /data is f2fs-compressed fs. 174allowxperm apexd staging_data_file:file ioctl { 175 FS_IOC_GETFLAGS 176 F2FS_IOC_RELEASE_COMPRESS_BLOCKS 177}; 178 179# Allow apexd to read ro.cold_boot_done prop. 180# apexd uses it to decide whether it needs to keep retrying polling for loop device. 181get_prop(apexd, cold_boot_done_prop) 182 183# Allow apexd to read per-device configuration properties. 184get_prop(apexd, apexd_config_prop) 185 186neverallow { domain -apexd -init } apex_data_file:dir no_w_dir_perms; 187neverallow { domain -apexd -init } apex_metadata_file:dir no_w_dir_perms; 188neverallow { domain -apexd -init -kernel } apex_data_file:file no_w_file_perms; 189neverallow { domain -apexd -init -kernel } apex_metadata_file:file no_w_file_perms; 190neverallow { domain -apexd } apex_mnt_dir:lnk_file no_w_file_perms; 191 192neverallow { domain -apexd -init -vold_prepare_subdirs } apex_module_data_file:dir no_w_dir_perms; 193neverallow { domain -apexd -init -vold_prepare_subdirs } apex_module_data_file:file no_w_file_perms; 194 195neverallow { domain -apexd -init -vold_prepare_subdirs } apex_rollback_data_file:dir no_w_dir_perms; 196neverallow { domain -apexd -init -vold_prepare_subdirs } apex_rollback_data_file:file no_w_file_perms; 197 198# only apexd can set apexd sysprop 199set_prop(apexd, apexd_prop) 200neverallow { domain -apexd -init } apexd_prop:property_service set; 201 202# only apexd can write apex-info-list.xml 203neverallow { domain -apexd } apex_info_file:file no_w_file_perms; 204 205# Only apexd and init should be allowed to manage /apex mounts 206# A note on otapreopt_chroot. It used to mount APEXes during postainstall stage of A/B OTAs, 207# but starting from S it just calls into apexd to prepare /apex for otapreoprt. Once the sepolicies 208# around otapreopt_chroot are cleaned up we should be able to remove it from the lists below. 209neverallow { domain -apexd -init -otapreopt_chroot } apex_mnt_dir:filesystem { mount unmount }; 210neverallow { domain -apexd -init -otapreopt_chroot } apex_mnt_dir:dir { mounton }; 211 212# Allow for use in postinstall 213allow apexd otapreopt_chroot:fd use; 214allow apexd postinstall_apex_mnt_dir:dir { create_dir_perms mounton }; 215allow apexd postinstall_apex_mnt_dir:file { create_file_perms relabelfrom }; 216allow apexd postinstall_apex_mnt_dir:lnk_file create; 217allow apexd proc_filesystems:file r_file_perms; 218