1# vendor_init is its own domain. 2type vendor_init, domain, mlstrustedsubject; 3 4# Communication to the main init process 5allow vendor_init init:unix_stream_socket { read write }; 6 7# Logging to kmsg 8allow vendor_init kmsg_device:chr_file { open getattr write }; 9 10# Mount on /dev/usb-ffs/adb. 11allow vendor_init device:dir mounton; 12 13# Create and remove symlinks in /. 14allow vendor_init rootfs:lnk_file { create unlink }; 15 16# Create cgroups mount points in tmpfs and mount cgroups on them. 17allow vendor_init cgroup:dir create_dir_perms; 18allow vendor_init cgroup:file w_file_perms; 19allow vendor_init cgroup_v2:dir create_dir_perms; 20allow vendor_init cgroup_v2:file w_file_perms; 21 22# /config 23allow vendor_init configfs:dir mounton; 24allow vendor_init configfs:dir create_dir_perms; 25allow vendor_init configfs:{ file lnk_file } create_file_perms; 26 27# Create directories under /dev/cpuctl after chowning it to system. 28allow vendor_init self:global_capability_class_set { dac_override dac_read_search }; 29 30# mkdir, symlink, write, rm/rmdir, chown/chmod, restorecon/restorecon_recursive from init.rc files. 31# chown/chmod require open+read+setattr required for open()+fchown/fchmod(). 32# system/core/init.rc requires at least cache_file and data_file_type. 33# init.<board>.rc files often include device-specific types, so 34# we just allow all file types except /system files here. 35allow vendor_init self:global_capability_class_set { chown fowner fsetid }; 36 37# mkdir with FBE requires reading /data/unencrypted/{ref,mode}. 38allow vendor_init unencrypted_data_file:dir search; 39allow vendor_init unencrypted_data_file:file r_file_perms; 40 41# Set encryption policy on dirs in /data 42allowxperm vendor_init data_file_type:dir ioctl { 43 FS_IOC_GET_ENCRYPTION_POLICY 44 FS_IOC_SET_ENCRYPTION_POLICY 45}; 46 47allow vendor_init system_data_file:dir getattr; 48 49allow vendor_init { 50 file_type 51 -core_data_file_type 52 -exec_type 53 -system_dlkm_file_type 54 -system_file_type 55 -mnt_product_file 56 -password_slot_metadata_file 57 -ota_metadata_file 58 -unlabeled 59 -vendor_file_type 60 -vold_metadata_file 61 -gsi_metadata_file_type 62 -apex_metadata_file 63 -userspace_reboot_metadata_file 64}:dir { create search getattr open read setattr ioctl write add_name remove_name rmdir relabelfrom }; 65 66allow vendor_init unlabeled:{ dir notdevfile_class_set } { getattr relabelfrom }; 67 68allow vendor_init { 69 file_type 70 -core_data_file_type 71 -exec_type 72 -password_slot_metadata_file 73 -ota_metadata_file 74 -runtime_event_log_tags_file 75 -system_dlkm_file_type 76 -system_file_type 77 -unlabeled 78 -vendor_file_type 79 -vold_metadata_file 80 -gsi_metadata_file_type 81 -apex_metadata_file 82 -apex_info_file 83 -userspace_reboot_metadata_file 84 enforce_debugfs_restriction(`-debugfs_type') 85}:file { create getattr open read write setattr relabelfrom unlink map }; 86 87allow vendor_init { 88 file_type 89 -core_data_file_type 90 -exec_type 91 -password_slot_metadata_file 92 -ota_metadata_file 93 -system_dlkm_file_type 94 -system_file_type 95 -unlabeled 96 -vendor_file_type 97 -vold_metadata_file 98 -gsi_metadata_file_type 99 -apex_metadata_file 100 -userspace_reboot_metadata_file 101}:{ sock_file fifo_file } { create getattr open read setattr relabelfrom unlink }; 102 103allow vendor_init { 104 file_type 105 -apex_mnt_dir 106 -core_data_file_type 107 -exec_type 108 -password_slot_metadata_file 109 -ota_metadata_file 110 -system_dlkm_file_type 111 -system_file_type 112 -unlabeled 113 -vendor_file_type 114 -vold_metadata_file 115 -gsi_metadata_file_type 116 -apex_metadata_file 117 -userspace_reboot_metadata_file 118}:lnk_file { create getattr setattr relabelfrom unlink }; 119 120allow vendor_init { 121 file_type 122 -core_data_file_type 123 -exec_type 124 -mnt_product_file 125 -password_slot_metadata_file 126 -ota_metadata_file 127 -system_dlkm_file_type 128 -system_file_type 129 -vendor_file_type 130 -vold_metadata_file 131 -gsi_metadata_file_type 132 -apex_metadata_file 133 -userspace_reboot_metadata_file 134}:dir_file_class_set relabelto; 135 136allow vendor_init dev_type:dir create_dir_perms; 137allow vendor_init dev_type:lnk_file create; 138 139# Disable tracing by writing to /sys/kernel/debug/tracing/tracing_on 140allow vendor_init debugfs_tracing:file w_file_perms; 141 142# chown/chmod on pseudo files. 143allow vendor_init { 144 fs_type 145 -contextmount_type 146 -keychord_device 147 -sdcard_type 148 -fusefs_type 149 -rootfs 150 -proc_uid_time_in_state 151 -proc_uid_concurrent_active_time 152 -proc_uid_concurrent_policy_time 153 enforce_debugfs_restriction(`-debugfs_type') 154}:file { open read setattr map }; 155 156allow vendor_init tracefs_type:file { open read setattr map }; 157 158allow vendor_init { 159 fs_type 160 -contextmount_type 161 -sdcard_type 162 -fusefs_type 163 -rootfs 164 -proc_uid_time_in_state 165 -proc_uid_concurrent_active_time 166 -proc_uid_concurrent_policy_time 167}:dir { open read setattr search }; 168 169allow vendor_init dev_type:blk_file getattr; 170 171# Write to /proc/sys/net/ping_group_range and other /proc/sys/net files. 172r_dir_file(vendor_init, proc_net_type) 173allow vendor_init proc_net_type:file w_file_perms; 174allow vendor_init self:global_capability_class_set net_admin; 175 176# Write to /proc/sys/vm/page-cluster 177allow vendor_init proc_page_cluster:file w_file_perms; 178 179# Write to sysfs nodes. 180allow vendor_init sysfs_type:dir r_dir_perms; 181allow vendor_init sysfs_type:lnk_file read; 182allow vendor_init { sysfs_type -sysfs_usermodehelper }:file rw_file_perms; 183 184# setfscreatecon() for labeling directories and socket files. 185allow vendor_init self:process { setfscreate }; 186 187r_dir_file(vendor_init, vendor_file_type) 188 189# Vendor init can read properties 190allow vendor_init serialno_prop:file { getattr open read map }; 191 192# Vendor init can perform operations on trusted and security Extended Attributes 193allow vendor_init self:global_capability_class_set sys_admin; 194 195# Raw writes to misc block device 196allow vendor_init misc_block_device:blk_file w_file_perms; 197 198# vendor_init is using bootstrap bionic 199use_bootstrap_libs(vendor_init) 200 201# allow filesystem tuning 202allow vendor_init userdata_sysdev:file create_file_perms; 203 204# Everything is labeled as rootfs in recovery mode. Vendor init has to execute 205# the dynamic linker and shared libraries. 206recovery_only(` 207 allow vendor_init rootfs:file { r_file_perms execute }; 208') 209 210not_compatible_property(` 211 set_prop(vendor_init, { 212 property_type 213 -system_internal_property_type 214 -system_restricted_property_type 215 }) 216') 217 218# Get file context 219allow vendor_init file_contexts_file:file r_file_perms; 220 221# Allow vendor_init to (re)set nice 222allow vendor_init self:capability sys_nice; 223 224set_prop(vendor_init, apk_verity_prop) 225set_prop(vendor_init, bluetooth_a2dp_offload_prop) 226set_prop(vendor_init, bluetooth_audio_hal_prop) 227set_prop(vendor_init, bluetooth_config_prop) 228set_prop(vendor_init, camera2_extensions_prop) 229set_prop(vendor_init, camerax_extensions_prop) 230set_prop(vendor_init, cpu_variant_prop) 231set_prop(vendor_init, dalvik_runtime_prop) 232set_prop(vendor_init, debug_prop) 233set_prop(vendor_init, exported_bluetooth_prop) 234set_prop(vendor_init, exported_camera_prop) 235set_prop(vendor_init, exported_config_prop) 236set_prop(vendor_init, exported_default_prop) 237set_prop(vendor_init, exported_overlay_prop) 238set_prop(vendor_init, exported_pm_prop) 239set_prop(vendor_init, ffs_control_prop) 240set_prop(vendor_init, hw_timeout_multiplier_prop) 241set_prop(vendor_init, incremental_prop) 242set_prop(vendor_init, lmkd_prop) 243set_prop(vendor_init, logd_prop) 244set_prop(vendor_init, log_tag_prop) 245set_prop(vendor_init, log_prop) 246set_prop(vendor_init, qemu_hw_prop) 247set_prop(vendor_init, radio_control_prop) 248set_prop(vendor_init, rebootescrow_hal_prop) 249set_prop(vendor_init, serialno_prop) 250set_prop(vendor_init, soc_prop) 251set_prop(vendor_init, surfaceflinger_color_prop) 252set_prop(vendor_init, usb_control_prop) 253set_prop(vendor_init, userspace_reboot_config_prop) 254set_prop(vendor_init, vehicle_hal_prop) 255set_prop(vendor_init, vendor_default_prop) 256set_prop(vendor_init, vendor_security_patch_level_prop) 257set_prop(vendor_init, vndk_prop) 258set_prop(vendor_init, virtual_ab_prop) 259set_prop(vendor_init, vold_post_fs_data_prop) 260set_prop(vendor_init, wifi_hal_prop) 261set_prop(vendor_init, wifi_log_prop) 262set_prop(vendor_init, zram_control_prop) 263 264get_prop(vendor_init, boot_status_prop) 265get_prop(vendor_init, exported3_system_prop) 266get_prop(vendor_init, ota_prop) 267get_prop(vendor_init, power_debug_prop) 268get_prop(vendor_init, provisioned_prop) 269get_prop(vendor_init, retaildemo_prop) 270get_prop(vendor_init, surfaceflinger_display_prop) 271get_prop(vendor_init, test_harness_prop) 272get_prop(vendor_init, theme_prop) 273set_prop(vendor_init, dck_prop) 274 275# Allow vendor_init to read vendor_system_native device config changes 276get_prop(vendor_init, device_config_vendor_system_native_prop) 277get_prop(vendor_init, device_config_vendor_system_native_boot_prop) 278 279### 280### neverallow rules 281### 282 283# Vendor init shouldn't communicate with any vendor process, nor most system processes. 284neverallow_establish_socket_comms(vendor_init, { 285 domain -init -logd -prng_seeder -su -vendor_init }); 286 287# The vendor_init domain is only entered via an exec based transition from the 288# init domain, never via setcon(). 289neverallow domain vendor_init:process dyntransition; 290neverallow { domain -init } vendor_init:process transition; 291neverallow vendor_init { file_type fs_type -init_exec }:file entrypoint; 292 293# Never read/follow symlinks created by shell or untrusted apps. 294neverallow vendor_init { app_data_file privapp_data_file }:lnk_file read; 295neverallow vendor_init shell_data_file:lnk_file read; 296# Init should not be creating subdirectories in /data/local/tmp 297neverallow vendor_init shell_data_file:dir { write add_name remove_name }; 298 299# init should never execute a program without changing to another domain. 300neverallow vendor_init { file_type fs_type }:file execute_no_trans; 301 302# Init never adds or uses services via service_manager. 303neverallow vendor_init service_manager_type:service_manager { add find }; 304neverallow vendor_init servicemanager:service_manager list; 305 306# vendor_init should never be ptraced 307neverallow * vendor_init:process ptrace; 308