1### ADB daemon 2 3typeattribute adbd coredomain; 4typeattribute adbd mlstrustedsubject; 5 6init_daemon_domain(adbd) 7 8domain_auto_trans(adbd, shell_exec, shell) 9 10userdebug_or_eng(` 11 allow adbd self:process setcurrent; 12 allow adbd su:process dyntransition; 13') 14 15# When 'adb shell' is executed in recovery mode, adbd explicitly 16# switches into shell domain using setcon() because the shell executable 17# is not labeled as shell but as rootfs. 18recovery_only(` 19 domain_trans(adbd, rootfs, shell) 20 allow adbd shell:process dyntransition; 21 22 # Allows reboot fastboot to enter fastboot directly 23 unix_socket_connect(adbd, recovery, recovery) 24') 25 26# Control Perfetto traced and obtain traces from it. 27# Needed to allow port forwarding directly to traced. 28unix_socket_connect(adbd, traced_consumer, traced) 29 30# Do not sanitize the environment or open fds of the shell. Allow signaling 31# created processes. 32allow adbd shell:process { noatsecure signal }; 33 34# Set UID and GID to shell. Set supplementary groups. 35allow adbd self:global_capability_class_set { setuid setgid }; 36 37# Drop capabilities from bounding set on user builds. 38allow adbd self:global_capability_class_set setpcap; 39 40# ignore spurious denials for adbd when disk space is low. 41dontaudit adbd self:global_capability_class_set sys_resource; 42 43# adbd probes for vsock support. Do not generate denials when 44# this occurs. (b/123569840) 45dontaudit adbd self:{ socket vsock_socket } create; 46 47# Allow adbd inside vm to forward vm's vsock. 48allow adbd self:vsock_socket { create_socket_perms_no_ioctl listen accept }; 49 50# Create and use network sockets. 51net_domain(adbd) 52# Connect to mdnsd via mdnsd socket. 53unix_socket_connect(adbd, mdnsd, mdnsd) 54 55# Access /dev/usb-ffs/adb/ep0 56allow adbd functionfs:dir search; 57allow adbd functionfs:file rw_file_perms; 58allowxperm adbd functionfs:file ioctl { 59 FUNCTIONFS_ENDPOINT_DESC 60 FUNCTIONFS_CLEAR_HALT 61}; 62 63# Use a pseudo tty. 64allow adbd devpts:chr_file rw_file_perms; 65 66# adb push/pull /data/local/tmp. 67allow adbd shell_data_file:dir create_dir_perms; 68allow adbd shell_data_file:file create_file_perms; 69 70# adb pull /data/local/traces/* 71allow adbd trace_data_file:dir r_dir_perms; 72allow adbd trace_data_file:file r_file_perms; 73 74# adb pull /data/misc/profman. 75allow adbd profman_dump_data_file:dir r_dir_perms; 76allow adbd profman_dump_data_file:file r_file_perms; 77 78# adb push/pull sdcard. 79allow adbd tmpfs:dir search; 80allow adbd rootfs:lnk_file r_file_perms; # /sdcard symlink 81allow adbd tmpfs:lnk_file r_file_perms; # /mnt/sdcard symlink 82allow adbd { sdcard_type fuse }:dir create_dir_perms; 83allow adbd { sdcard_type fuse }:file create_file_perms; 84 85# adb pull /data/anr/traces.txt 86allow adbd anr_data_file:dir r_dir_perms; 87allow adbd anr_data_file:file r_file_perms; 88 89# adb pull /vendor/framework/* 90allow adbd vendor_framework_file:dir r_dir_perms; 91allow adbd vendor_framework_file:file r_file_perms; 92 93# Set service.adb.*, sys.powerctl, and sys.usb.ffs.ready properties. 94set_prop(adbd, shell_prop) 95set_prop(adbd, powerctl_prop) 96get_prop(adbd, ffs_config_prop) 97set_prop(adbd, ffs_control_prop) 98 99# Set service.adb.tcp.port, service.adb.tls.port, persist.adb.wifi.* properties 100set_prop(adbd, adbd_prop) 101set_prop(adbd, adbd_config_prop) 102 103# Allow adbd start/stop mdnsd via ctl.start 104set_prop(adbd, ctl_mdnsd_prop) 105 106# Access device logging gating property 107get_prop(adbd, device_logging_prop) 108 109# Read device's serial number from system properties 110get_prop(adbd, serialno_prop) 111 112# Read whether or not Test Harness Mode is enabled 113get_prop(adbd, test_harness_prop) 114 115# Read persist.adb.tls_server.enable property 116get_prop(adbd, system_adbd_prop) 117 118# Read device's overlayfs related properties and files 119userdebug_or_eng(` 120 get_prop(adbd, persistent_properties_ready_prop) 121 r_dir_file(adbd, sysfs_dt_firmware_android) 122') 123 124# Run /system/bin/bu 125allow adbd system_file:file rx_file_perms; 126 127# Perform binder IPC to surfaceflinger (screencap) 128# XXX Run screencap in a separate domain? 129binder_use(adbd) 130binder_call(adbd, surfaceflinger) 131binder_call(adbd, gpuservice) 132# b/13188914 133allow adbd gpu_device:chr_file rw_file_perms; 134allow adbd gpu_device:dir r_dir_perms; 135allow adbd ion_device:chr_file rw_file_perms; 136r_dir_file(adbd, system_file) 137 138# Needed for various screenshots 139hal_client_domain(adbd, hal_graphics_allocator) 140 141# Read /data/misc/adb/adb_keys. 142allow adbd adb_keys_file:dir search; 143allow adbd adb_keys_file:file r_file_perms; 144 145userdebug_or_eng(` 146 # Write debugging information to /data/adb 147 # when persist.adb.trace_mask is set 148 # https://code.google.com/p/android/issues/detail?id=72895 149 allow adbd adb_data_file:dir rw_dir_perms; 150 allow adbd adb_data_file:file create_file_perms; 151') 152 153# ndk-gdb invokes adb forward to forward the gdbserver socket. 154allow adbd app_data_file:dir search; 155allow adbd app_data_file:sock_file write; 156allow adbd appdomain:unix_stream_socket connectto; 157 158# ndk-gdb invokes adb pull of app_process, linker, and libc.so. 159allow adbd zygote_exec:file r_file_perms; 160allow adbd system_file:file r_file_perms; 161 162# Allow pulling the SELinux policy for CTS purposes 163allow adbd selinuxfs:dir r_dir_perms; 164allow adbd selinuxfs:file r_file_perms; 165allow adbd kernel:security read_policy; 166allow adbd service_contexts_file:file r_file_perms; 167allow adbd file_contexts_file:file r_file_perms; 168allow adbd seapp_contexts_file:file r_file_perms; 169allow adbd property_contexts_file:file r_file_perms; 170allow adbd sepolicy_file:file r_file_perms; 171 172# Allow pulling config.gz for CTS purposes 173allow adbd config_gz:file r_file_perms; 174 175# For CTS listening ports test. 176allow adbd proc_net_tcp_udp:file r_file_perms; 177 178allow adbd gpu_service:service_manager find; 179allow adbd surfaceflinger_service:service_manager find; 180allow adbd bootchart_data_file:dir search; 181allow adbd bootchart_data_file:file r_file_perms; 182 183# Allow access to external storage; we have several visible mount points under /storage 184# and symlinks to primary storage at places like /storage/sdcard0 and /mnt/user/0/primary 185allow adbd storage_file:dir r_dir_perms; 186allow adbd storage_file:lnk_file r_file_perms; 187allow adbd mnt_user_file:dir r_dir_perms; 188allow adbd mnt_user_file:lnk_file r_file_perms; 189 190# Access to /data/media. 191# This should be removed if sdcardfs is modified to alter the secontext for its 192# accesses to the underlying FS. 193allow adbd media_rw_data_file:dir create_dir_perms; 194allow adbd media_rw_data_file:file create_file_perms; 195 196r_dir_file(adbd, apk_data_file) 197 198allow adbd rootfs:dir r_dir_perms; 199 200# Allow killing child "perfetto" binary processes, which auto-transition to 201# their own domain. Allows propagating termination of "adb shell perfetto ..." 202# invocations. 203allow adbd perfetto:process signal; 204 205# Allow to pull Perfetto traces. 206allow adbd perfetto_traces_data_file:file r_file_perms; 207allow adbd perfetto_traces_data_file:dir r_dir_perms; 208 209# Allow to push and manage configs in /data/misc/perfetto-configs. 210allow adbd perfetto_configs_data_file:dir rw_dir_perms; 211allow adbd perfetto_configs_data_file:file create_file_perms; 212 213# Connect to shell and use a socket transferred from it. 214# Used for e.g. abb. 215allow adbd shell:unix_stream_socket { read write shutdown }; 216allow adbd shell:fd use; 217 218# Allow pull /vendor/apex files for CTS tests 219allow adbd vendor_apex_file:dir search; 220allow adbd vendor_apex_file:file r_file_perms; 221 222# Allow adb pull of updated apex files in /data/apex/active. 223allow adbd apex_data_file:dir search; 224allow adbd staging_data_file:file r_file_perms; 225 226# Allow adbd to pull /apex/apex-info-list.xml for CTS tests. 227allow adbd apex_info_file:file r_file_perms; 228 229### 230### Neverallow rules 231### 232 233# No transitions from adbd to non-shell, non-crash_dump domains. adbd only ever 234# transitions to the shell domain (except when it crashes). In particular, we 235# never want to see a transition from adbd to su (aka "adb root") 236neverallow adbd { domain -crash_dump -shell }:process transition; 237neverallow adbd { domain userdebug_or_eng(`-su') recovery_only(`-shell') }:process dyntransition; 238