1### 2### Domain for all zygote spawned apps 3### 4### This file is the base policy for all zygote spawned apps. 5### Other policy files, such as isolated_app.te, untrusted_app.te, etc 6### extend from this policy. Only policies which should apply to ALL 7### zygote spawned apps should be added here. 8### 9type appdomain_tmpfs, file_type; 10 11### 12### Neverallow rules 13### 14### These are things that Android apps should NEVER be able to do 15### 16 17# Superuser capabilities. 18# bluetooth requires net_admin and wake_alarm. network stack app requires net_admin. 19neverallow { appdomain -bluetooth -network_stack } self:capability_class_set *; 20 21# Block device access. 22neverallow appdomain dev_type:blk_file { read write }; 23 24# Access to any of the following character devices. 25neverallow appdomain { 26 audio_device 27 camera_device 28 dm_device 29 radio_device 30 rpmsg_device 31 video_device 32}:chr_file { read write }; 33 34# Note: Try expanding list of app domains in the future. 35neverallow { untrusted_app isolated_app shell } graphics_device:chr_file { read write }; 36 37neverallow { appdomain -nfc } nfc_device:chr_file 38 { read write }; 39neverallow { appdomain -bluetooth } hci_attach_dev:chr_file 40 { read write }; 41neverallow appdomain tee_device:chr_file { read write }; 42 43# Privileged netlink socket interfaces. 44neverallow { appdomain -network_stack } 45 domain:{ 46 netlink_tcpdiag_socket 47 netlink_nflog_socket 48 netlink_xfrm_socket 49 netlink_audit_socket 50 netlink_dnrt_socket 51 } *; 52 53# These messages are broadcast messages from the kernel to userspace. 54# Do not allow the writing of netlink messages, which has been a source 55# of rooting vulns in the past. 56neverallow { appdomain -network_stack } 57 domain:netlink_kobject_uevent_socket { write append }; 58 59# Sockets under /dev/socket that are not specifically typed. 60neverallow appdomain socket_device:sock_file write; 61 62# Unix domain sockets. 63neverallow appdomain adbd_socket:sock_file write; 64neverallow { appdomain -radio } rild_socket:sock_file write; 65 66# ptrace access to non-app domains. 67neverallow appdomain { domain -appdomain }:process ptrace; 68 69# The Android security model guarantees the confidentiality and integrity 70# of application data and execution state. Ptrace bypasses those 71# confidentiality guarantees. Disallow ptrace access from system components 72# to apps. Crash_dump is excluded, as it needs ptrace access to 73# produce stack traces. llkd is excluded, as it needs ptrace access to 74# inspect stack traces for live lock conditions. 75 76neverallow { 77 domain 78 -appdomain 79 -crash_dump 80 userdebug_or_eng(`-llkd') 81} appdomain:process ptrace; 82 83# Read or write access to /proc/pid entries for any non-app domain. 84# A different form of hidepid=2 like protections 85neverallow appdomain { domain -appdomain }:file no_w_file_perms; 86neverallow { appdomain -shell } { domain -appdomain }:file no_rw_file_perms; 87 88# signal access to non-app domains. 89# sigchld allowed for parent death notification. 90# signull allowed for kill(pid, 0) existence test. 91# All others prohibited. 92# -perfetto is to allow shell (which is an appdomain) to kill perfetto 93# (see private/shell.te). 94neverallow appdomain { domain -appdomain -perfetto }:process 95 { sigkill sigstop signal }; 96 97# Write to rootfs. 98neverallow appdomain rootfs:dir_file_class_set 99 { create write setattr relabelfrom relabelto append unlink link rename }; 100 101# Write to /system. 102neverallow appdomain system_file:dir_file_class_set 103 { create write setattr relabelfrom relabelto append unlink link rename }; 104 105# Write to entrypoint executables. 106neverallow appdomain exec_type:file 107 { create write setattr relabelfrom relabelto append unlink link rename }; 108 109# Write to system-owned parts of /data. 110# This is the default type for anything under /data not otherwise 111# specified in file_contexts. Define a different type for portions 112# that should be writable by apps. 113neverallow appdomain system_data_file:dir_file_class_set 114 { create write setattr relabelfrom relabelto append unlink link rename }; 115 116# Write to various other parts of /data. 117neverallow appdomain drm_data_file:dir_file_class_set 118 { create write setattr relabelfrom relabelto append unlink link rename }; 119neverallow { appdomain -platform_app } 120 apk_data_file:dir_file_class_set 121 { create write setattr relabelfrom relabelto append unlink link rename }; 122neverallow { appdomain -platform_app } 123 apk_tmp_file:dir_file_class_set 124 { create write setattr relabelfrom relabelto append unlink link rename }; 125neverallow { appdomain -platform_app } 126 apk_private_data_file:dir_file_class_set 127 { create write setattr relabelfrom relabelto append unlink link rename }; 128neverallow { appdomain -platform_app } 129 apk_private_tmp_file:dir_file_class_set 130 { create write setattr relabelfrom relabelto append unlink link rename }; 131neverallow { appdomain -shell } 132 shell_data_file:dir_file_class_set 133 { create setattr relabelfrom relabelto append unlink link rename }; 134neverallow { appdomain -bluetooth } 135 bluetooth_data_file:dir_file_class_set 136 { create write setattr relabelfrom relabelto append unlink link rename }; 137neverallow { domain -credstore -init } credstore_data_file:dir_file_class_set *; 138neverallow appdomain 139 keystore_data_file:dir_file_class_set 140 { create write setattr relabelfrom relabelto append unlink link rename }; 141neverallow appdomain 142 systemkeys_data_file:dir_file_class_set 143 { create write setattr relabelfrom relabelto append unlink link rename }; 144neverallow appdomain 145 wifi_data_file:dir_file_class_set 146 { create write setattr relabelfrom relabelto append unlink link rename }; 147neverallow appdomain 148 dhcp_data_file:dir_file_class_set 149 { create write setattr relabelfrom relabelto append unlink link rename }; 150 151# access tmp apk files 152neverallow { appdomain -untrusted_app_all -platform_app -priv_app } 153 { apk_tmp_file apk_private_tmp_file }:dir_file_class_set *; 154 155neverallow untrusted_app_all { apk_tmp_file apk_private_tmp_file }:{ devfile_class_set dir fifo_file lnk_file sock_file } *; 156neverallow untrusted_app_all { apk_tmp_file apk_private_tmp_file }:file ~{ getattr read }; 157 158# Access to factory files. 159neverallow appdomain efs_file:dir_file_class_set write; 160neverallow { appdomain -shell } efs_file:dir_file_class_set read; 161 162# Write to various pseudo file systems. 163neverallow { appdomain -bluetooth -nfc } 164 sysfs:dir_file_class_set write; 165neverallow appdomain 166 proc:dir_file_class_set write; 167 168# Access to syslog(2) or /proc/kmsg. 169neverallow appdomain kernel:system { syslog_read syslog_mod syslog_console }; 170 171# SELinux is not an API for apps to use 172neverallow { appdomain -shell } *:security { compute_av check_context }; 173neverallow { appdomain -shell } *:netlink_selinux_socket *; 174 175# Ability to perform any filesystem operation other than statfs(2). 176# i.e. no mount(2), unmount(2), etc. 177neverallow appdomain fs_type:filesystem ~getattr; 178 179# prevent creation/manipulation of globally readable symlinks 180neverallow appdomain { 181 apk_data_file 182 cache_file 183 cache_recovery_file 184 dev_type 185 rootfs 186 system_file 187 tmpfs 188}:lnk_file no_w_file_perms; 189 190# Applications should use the activity model for receiving events 191neverallow { 192 appdomain 193 -shell # bugreport 194} input_device:chr_file ~getattr; 195 196# Do not allow access to Bluetooth-related system properties except for a few allowed domains. 197# neverallow rules for access to Bluetooth-related data files are above. 198neverallow { 199 appdomain 200 -bluetooth 201 -system_app 202} { bluetooth_audio_hal_prop bluetooth_a2dp_offload_prop bluetooth_prop exported_bluetooth_prop }:file create_file_perms; 203 204# allow system_app to access Nfc-related system properties. 205set_prop(system_app, nfc_prop) 206 207# allow system_app to access radio_config system properties. 208set_prop(system_app, radio_control_prop) 209 210# Apps cannot access proc_uid_time_in_state 211neverallow appdomain proc_uid_time_in_state:file *; 212 213# Apps cannot access proc_uid_concurrent_active_time 214neverallow appdomain proc_uid_concurrent_active_time:file *; 215 216# Apps cannot access proc_uid_concurrent_policy_time 217neverallow appdomain proc_uid_concurrent_policy_time:file *; 218 219# Apps cannot access proc_uid_cpupower 220neverallow appdomain proc_uid_cpupower:file *; 221 222# Apps may not read /proc/net/{tcp,tcp6,udp,udp6}. These files leak information across the 223# application boundary. VPN apps may use the ConnectivityManager.getConnectionOwnerUid() API to 224# perform UID lookups. 225neverallow { appdomain -shell } proc_net_tcp_udp:file *; 226 227# Apps cannot access bootstrap files. The bootstrap files are only for 228# extremely early processes (like init, etc.) which are started before 229# the runtime APEX is activated and Bionic libs are provided from there. 230# If app process accesses (or even load/execute) the bootstrap files, 231# it might cause problems such as ODR violation, etc. 232neverallow appdomain system_bootstrap_lib_file:file 233 { open read write append execute execute_no_trans map }; 234neverallow appdomain system_bootstrap_lib_file:dir 235 { open read getattr search }; 236 237# Allow to read ro.vendor.camera.extensions.enabled 238get_prop(appdomain, camera2_extensions_prop) 239 240# Allow to ro.camerax.extensions.enabled 241get_prop(appdomain, camerax_extensions_prop) 242