1### 2### SDK Sandbox process. 3### 4### This file defines the security policy for the sdk sandbox processes. 5 6type sdk_sandbox, domain; 7 8typeattribute sdk_sandbox coredomain; 9 10net_domain(sdk_sandbox) 11app_domain(sdk_sandbox) 12 13# Allow finding services. This is different from ephemeral_app policy. 14# Adding services manually to the allowlist is preferred hence app_api_service is not used. 15allow sdk_sandbox activity_service:service_manager find; 16allow sdk_sandbox activity_task_service:service_manager find; 17allow sdk_sandbox audio_service:service_manager find; 18# Audit the access to signal that we are still investigating whether sdk_sandbox 19# should have access to audio_service 20# TODO(b/211632068): remove this line 21auditallow sdk_sandbox audio_service:service_manager find; 22allow sdk_sandbox hint_service:service_manager find; 23allow sdk_sandbox surfaceflinger_service:service_manager find; 24allow sdk_sandbox thermal_service:service_manager find; 25allow sdk_sandbox trust_service:service_manager find; 26allow sdk_sandbox uimode_service:service_manager find; 27allow sdk_sandbox webviewupdate_service:service_manager find; 28 29# Write app-specific trace data to the Perfetto traced damon. This requires 30# connecting to its producer socket and obtaining a (per-process) tmpfs fd. 31perfetto_producer(sdk_sandbox) 32 33# Allow profiling if the app opts in by being marked profileable/debuggable. 34can_profile_heap(sdk_sandbox) 35can_profile_perf(sdk_sandbox) 36 37# allow sdk sandbox to use UDP sockets provided by the system server but not 38# modify them other than to connect 39allow sdk_sandbox system_server:udp_socket { 40 connect getattr read recvfrom sendto write getopt setopt }; 41 42# allow sandbox to search in sdk system server directory 43# additionally, for webview to work, getattr has been permitted 44allow sdk_sandbox sdk_sandbox_system_data_file:dir { getattr search }; 45# allow sandbox to create files and dirs in sdk data directory 46allow sdk_sandbox sdk_sandbox_data_file:dir create_dir_perms; 47allow sdk_sandbox sdk_sandbox_data_file:file create_file_perms; 48 49### 50### neverallow rules 51### 52 53neverallow sdk_sandbox { app_data_file privapp_data_file }:file { execute execute_no_trans }; 54 55# Receive or send uevent messages. 56neverallow sdk_sandbox domain:netlink_kobject_uevent_socket *; 57 58# Receive or send generic netlink messages 59neverallow sdk_sandbox domain:netlink_socket *; 60 61# Too much leaky information in debugfs. It's a security 62# best practice to ensure these files aren't readable. 63neverallow sdk_sandbox debugfs:file read; 64 65# execute gpu_device 66neverallow sdk_sandbox gpu_device:chr_file execute; 67 68# access files in /sys with the default sysfs label 69neverallow sdk_sandbox sysfs:file *; 70 71# Avoid reads from generically labeled /proc files 72# Create a more specific label if needed 73neverallow sdk_sandbox proc:file { no_rw_file_perms no_x_file_perms }; 74 75# Directly access external storage 76neverallow sdk_sandbox { sdcard_type media_rw_data_file }:file {open create}; 77neverallow sdk_sandbox { sdcard_type media_rw_data_file }:dir search; 78 79# Avoid reads to proc_net, it contains too much device wide information about 80# ongoing connections. 81neverallow sdk_sandbox proc_net:file no_rw_file_perms; 82 83# SDK sandbox processes have their own storage not related to app_data_file or privapp_data_file 84neverallow sdk_sandbox { app_data_file privapp_data_file }:dir no_rw_file_perms; 85neverallow sdk_sandbox { app_data_file privapp_data_file }:file no_rw_file_perms; 86 87# SDK sandbox processes don't have any access to external storage 88neverallow sdk_sandbox { media_rw_data_file }:dir no_rw_file_perms; 89neverallow sdk_sandbox { media_rw_data_file }:file no_rw_file_perms; 90 91neverallow { sdk_sandbox } tmpfs:dir no_rw_file_perms; 92 93neverallow sdk_sandbox hal_drm_service:service_manager find; 94 95# Only certain system components should have access to sdk_sandbox_system_data_file 96# sdk_sandbox only needs search. Restricted in follow up neverallow rule. 97neverallow { 98 domain 99 -init 100 -installd 101 -system_server 102 -vold_prepare_subdirs 103} sdk_sandbox_system_data_file:dir { relabelfrom }; 104 105neverallow { 106 domain 107 -init 108 -installd 109 -sdk_sandbox 110 -system_server 111 -vold_prepare_subdirs 112 -zygote 113} sdk_sandbox_system_data_file:dir { create_dir_perms relabelto }; 114 115# sdk_sandbox only needs to traverse through the sdk_sandbox_system_data_file 116neverallow sdk_sandbox sdk_sandbox_system_data_file:dir ~{ getattr search }; 117 118# Only dirs should be created at sdk_sandbox_system_data_file level 119neverallow { domain -init } sdk_sandbox_system_data_file:file *; 120