1### 2### neverallow rules for untrusted app domains 3### 4 5define(`all_untrusted_apps',`{ 6 ephemeral_app 7 isolated_app 8 mediaprovider 9 mediaprovider_app 10 untrusted_app 11 untrusted_app_25 12 untrusted_app_27 13 untrusted_app_29 14 untrusted_app_30 15 untrusted_app_all 16}') 17# Receive or send uevent messages. 18neverallow all_untrusted_apps domain:netlink_kobject_uevent_socket *; 19 20# Receive or send generic netlink messages 21neverallow all_untrusted_apps domain:netlink_socket *; 22 23# Read or write kernel printk buffer 24neverallow all_untrusted_apps kmsg_device:chr_file no_rw_file_perms; 25 26# Too much leaky information in debugfs. It's a security 27# best practice to ensure these files aren't readable. 28neverallow all_untrusted_apps { debugfs_type -debugfs_kcov }:file read; 29neverallow {all_untrusted_apps userdebug_or_eng(`-domain')} debugfs_type:{ file lnk_file } read; 30 31# Do not allow untrusted apps to register services. 32# Only trusted components of Android should be registering 33# services. 34neverallow all_untrusted_apps service_manager_type:service_manager add; 35 36# Do not allow untrusted apps to use VendorBinder 37neverallow all_untrusted_apps vndbinder_device:chr_file *; 38neverallow all_untrusted_apps vndservice_manager_type:service_manager *; 39 40# Do not allow untrusted apps to connect to the property service 41# or set properties. b/10243159 42neverallow { all_untrusted_apps -mediaprovider } property_socket:sock_file write; 43neverallow { all_untrusted_apps -mediaprovider } init:unix_stream_socket connectto; 44neverallow { all_untrusted_apps -mediaprovider } property_type:property_service set; 45 46# net.dns properties are not a public API. Disallow untrusted apps from reading this property. 47neverallow { all_untrusted_apps } net_dns_prop:file read; 48 49# radio_cdma_ecm_prop properties are not a public API. Disallow untrusted apps from reading this property. 50neverallow { all_untrusted_apps } radio_cdma_ecm_prop:file read; 51 52# Shared libraries created by trusted components within an app home 53# directory can be dlopen()ed. To maintain the W^X property, these files 54# must never be writable to the app. 55neverallow all_untrusted_apps app_exec_data_file:file 56 { append create link relabelfrom relabelto rename setattr write }; 57 58# Block calling execve() on files in an apps home directory. 59# This is a W^X violation (loading executable code from a writable 60# home directory). For compatibility, allow for targetApi <= 28. 61# b/112357170 62neverallow { 63 all_untrusted_apps 64 -untrusted_app_25 65 -untrusted_app_27 66 -runas_app 67} { app_data_file privapp_data_file }:file execute_no_trans; 68 69# Do not allow untrusted apps to invoke dex2oat. This was historically required 70# by ART for compiling secondary dex files but has been removed in Q. 71# Exempt legacy apps (targetApi<=28) for compatibility. 72neverallow { 73 all_untrusted_apps 74 -untrusted_app_25 75 -untrusted_app_27 76} dex2oat_exec:file no_x_file_perms; 77 78# Do not allow untrusted apps to be assigned mlstrustedsubject. 79# This would undermine the per-user isolation model being 80# enforced via levelFrom=user in seapp_contexts and the mls 81# constraints. As there is no direct way to specify a neverallow 82# on attribute assignment, this relies on the fact that fork 83# permission only makes sense within a domain (hence should 84# never be granted to any other domain within mlstrustedsubject) 85# and an untrusted app is allowed fork permission to itself. 86neverallow all_untrusted_apps mlstrustedsubject:process fork; 87 88# Do not allow untrusted apps to hard link to any files. 89# In particular, if an untrusted app links to other app data 90# files, installd will not be able to guarantee the deletion 91# of the linked to file. Hard links also contribute to security 92# bugs, so we want to ensure untrusted apps never have this 93# capability. 94neverallow all_untrusted_apps file_type:file link; 95 96# Do not allow untrusted apps to access network MAC address file 97neverallow all_untrusted_apps sysfs_net:file no_rw_file_perms; 98 99# Do not allow any write access to files in /sys 100neverallow all_untrusted_apps sysfs_type:file { no_w_file_perms no_x_file_perms }; 101 102# Apps may never access the default sysfs label. 103neverallow all_untrusted_apps sysfs:file no_rw_file_perms; 104 105# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the 106# ioctl permission, or 3. disallow the socket class. 107neverallowxperm all_untrusted_apps domain:{ icmp_socket rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls; 108neverallow all_untrusted_apps *:{ netlink_route_socket netlink_selinux_socket } ioctl; 109neverallow all_untrusted_apps *:{ 110 socket netlink_socket packet_socket key_socket appletalk_socket 111 netlink_tcpdiag_socket netlink_nflog_socket 112 netlink_xfrm_socket netlink_audit_socket 113 netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket 114 netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket 115 netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket 116 netlink_rdma_socket netlink_crypto_socket sctp_socket 117 ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket 118 atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket 119 bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket 120 alg_socket nfc_socket kcm_socket qipcrtr_socket smc_socket xdp_socket 121} *; 122 123# Apps can read/write an already open vsock (e.g. created by 124# virtualizationservice) but nothing more than that (e.g. creating a 125# new vsock, etc.) 126neverallow all_untrusted_apps *:vsock_socket ~{ getattr read write }; 127 128# Disallow sending RTM_GETLINK messages on netlink sockets. 129neverallow all_untrusted_apps domain:netlink_route_socket { bind nlmsg_readpriv }; 130 131# Disallow sending RTM_GETNEIGH{TBL} messages on netlink sockets. 132neverallow { 133 all_untrusted_apps 134 -untrusted_app_25 135 -untrusted_app_27 136 -untrusted_app_29 137 -untrusted_app_30 138} domain:netlink_route_socket nlmsg_getneigh; 139 140# Do not allow untrusted apps access to /cache 141neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:dir ~{ r_dir_perms }; 142neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:file ~{ read getattr }; 143 144# Do not allow untrusted apps to create/unlink files outside of its sandbox, 145# internal storage or sdcard. 146# World accessible data locations allow application to fill the device 147# with unaccounted for data. This data will not get removed during 148# application un-installation. 149neverallow { all_untrusted_apps -mediaprovider } { 150 fs_type 151 -sdcard_type 152 -fuse 153 file_type 154 -app_data_file # The apps sandbox itself 155 -privapp_data_file 156 -app_exec_data_file # stored within the app sandbox directory 157 -media_rw_data_file # Internal storage. Known that apps can 158 # leave artfacts here after uninstall. 159 -user_profile_data_file # Access to profile files 160 userdebug_or_eng(` 161 -method_trace_data_file # only on ro.debuggable=1 162 -coredump_file # userdebug/eng only 163 ') 164}:dir_file_class_set { create unlink }; 165 166# No untrusted component except mediaprovider_app should be touching /dev/fuse 167neverallow { all_untrusted_apps -mediaprovider_app } fuse_device:chr_file *; 168 169# Do not allow untrusted apps to directly open the tun_device 170neverallow all_untrusted_apps tun_device:chr_file open; 171# The tun_device ioctls below are not allowed, to prove equivalence 172# to the kernel patch at 173# https://android.googlesource.com/kernel/common/+/11cee2be0c2062ba88f04eb51196506f870a3b5d%5E%21 174neverallowxperm all_untrusted_apps tun_device:chr_file ioctl ~{ FIOCLEX FIONCLEX TUNGETIFF }; 175 176# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553) 177neverallow all_untrusted_apps anr_data_file:file ~{ open append }; 178neverallow all_untrusted_apps anr_data_file:dir ~search; 179 180# Avoid reads from generically labeled /proc files 181# Create a more specific label if needed 182neverallow all_untrusted_apps { 183 proc 184 proc_asound 185 proc_kmsg 186 proc_loadavg 187 proc_mounts 188 proc_pagetypeinfo 189 proc_slabinfo 190 proc_stat 191 proc_swaps 192 proc_uptime 193 proc_version 194 proc_vmallocinfo 195 proc_vmstat 196}:file { no_rw_file_perms no_x_file_perms }; 197 198# /proc/filesystems is accessible to mediaprovider_app only since it handles 199# external storage 200neverallow { all_untrusted_apps - mediaprovider_app } proc_filesystems:file { no_rw_file_perms no_x_file_perms }; 201 202# Avoid all access to kernel configuration 203neverallow all_untrusted_apps config_gz:file { no_rw_file_perms no_x_file_perms }; 204 205# Do not allow untrusted apps access to preloads data files 206neverallow all_untrusted_apps preloads_data_file:file no_rw_file_perms; 207 208# Locking of files on /system could lead to denial of service attacks 209# against privileged system components 210neverallow all_untrusted_apps system_file:file lock; 211 212# Do not permit untrusted apps to perform actions on HwBinder service_manager 213# other than find actions for services listed below 214neverallow all_untrusted_apps *:hwservice_manager ~find; 215 216# Do not permit access from apps which host arbitrary code to the protected services 217# The two main reasons for this are: 218# 1. Protected HwBinder servers do not perform client authentication because 219# vendor code does not have a way to understand apps or their relation to 220# caller UID information and, even if it did, those services either operate 221# at a level below that of apps (e.g., HALs) or must not rely on app identity 222# for authorization. Thus, to be safe, the default assumption for all added 223# vendor services is that they treat all their clients as equally authorized 224# to perform operations offered by the service. 225# 2. HAL servers contain code with higher incidence rate of security issues 226# than system/core components and have access to lower layes of the stack 227# (all the way down to hardware) thus increasing opportunities for bypassing 228# the Android security model. 229neverallow all_untrusted_apps protected_hwservice:hwservice_manager find; 230neverallow all_untrusted_apps protected_service:service_manager find; 231 232# SELinux is not an API for untrusted apps to use 233neverallow all_untrusted_apps selinuxfs:file no_rw_file_perms; 234 235# Access to /proc/tty/drivers, to allow apps to determine if they 236# are running in an emulated environment. 237# b/33214085 b/33814662 b/33791054 b/33211769 238# https://github.com/strazzere/anti-emulator/blob/master/AntiEmulator/src/diff/strazzere/anti/emulator/FindEmulator.java 239# This will go away in a future Android release 240neverallow { all_untrusted_apps -untrusted_app_25 } proc_tty_drivers:file r_file_perms; 241neverallow all_untrusted_apps proc_tty_drivers:file ~r_file_perms; 242 243# Untrusted apps are not allowed to use cgroups. 244neverallow all_untrusted_apps cgroup:file *; 245neverallow all_untrusted_apps cgroup_v2:file *; 246 247# /mnt/sdcard symlink was supposed to have been removed in Gingerbread. Apps 248# must not use it. 249neverallow { 250 all_untrusted_apps 251 -untrusted_app_25 252 -untrusted_app_27 253} mnt_sdcard_file:lnk_file *; 254 255# Only privileged apps may find the incident service 256neverallow all_untrusted_apps incident_service:service_manager find; 257