1### 2### neverallow rules for untrusted app domains 3### 4 5define(`all_untrusted_apps',`{ 6 ephemeral_app 7 isolated_app 8 isolated_app_all 9 isolated_compute_app 10 mediaprovider 11 mediaprovider_app 12 untrusted_app 13 untrusted_app_25 14 untrusted_app_27 15 untrusted_app_29 16 untrusted_app_30 17 untrusted_app_all 18}') 19# Receive or send uevent messages. 20neverallow all_untrusted_apps domain:netlink_kobject_uevent_socket *; 21 22# Receive or send generic netlink messages 23neverallow all_untrusted_apps domain:netlink_socket *; 24 25# Read or write kernel printk buffer 26neverallow all_untrusted_apps kmsg_device:chr_file no_rw_file_perms; 27 28# Too much leaky information in debugfs. It's a security 29# best practice to ensure these files aren't readable. 30neverallow all_untrusted_apps { debugfs_type -debugfs_kcov }:file read; 31neverallow {all_untrusted_apps userdebug_or_eng(`-domain')} debugfs_type:{ file lnk_file } read; 32 33# Do not allow untrusted apps to register services. 34# Only trusted components of Android should be registering 35# services. 36neverallow all_untrusted_apps service_manager_type:service_manager add; 37 38# Do not allow untrusted apps to use VendorBinder 39neverallow all_untrusted_apps vndbinder_device:chr_file *; 40neverallow all_untrusted_apps vndservice_manager_type:service_manager *; 41 42# Do not allow untrusted apps to connect to the property service 43# or set properties. b/10243159 44neverallow { all_untrusted_apps -mediaprovider } property_socket:sock_file write; 45neverallow { all_untrusted_apps -mediaprovider } init:unix_stream_socket connectto; 46neverallow { all_untrusted_apps -mediaprovider } property_type:property_service set; 47 48# net.dns properties are not a public API. Disallow untrusted apps from reading this property. 49neverallow { all_untrusted_apps } net_dns_prop:file read; 50 51# radio_cdma_ecm_prop properties are not a public API. Disallow untrusted apps from reading this property. 52neverallow { all_untrusted_apps } radio_cdma_ecm_prop:file read; 53 54# Shared libraries created by trusted components within an app home 55# directory can be dlopen()ed. To maintain the W^X property, these files 56# must never be writable to the app. 57neverallow all_untrusted_apps app_exec_data_file:file 58 { append create link relabelfrom relabelto rename setattr write }; 59 60# Block calling execve() on files in an apps home directory. 61# This is a W^X violation (loading executable code from a writable 62# home directory). For compatibility, allow for targetApi <= 28. 63# b/112357170 64neverallow { 65 all_untrusted_apps 66 -untrusted_app_25 67 -untrusted_app_27 68 -runas_app 69} { app_data_file privapp_data_file }:file execute_no_trans; 70 71# Do not allow untrusted apps to invoke dex2oat. This was historically required 72# by ART for compiling secondary dex files but has been removed in Q. 73# Exempt legacy apps (targetApi<=28) for compatibility. 74neverallow { 75 all_untrusted_apps 76 -untrusted_app_25 77 -untrusted_app_27 78} dex2oat_exec:file no_x_file_perms; 79 80# Do not allow untrusted apps to be assigned mlstrustedsubject. 81# This would undermine the per-user isolation model being 82# enforced via levelFrom=user in seapp_contexts and the mls 83# constraints. As there is no direct way to specify a neverallow 84# on attribute assignment, this relies on the fact that fork 85# permission only makes sense within a domain (hence should 86# never be granted to any other domain within mlstrustedsubject) 87# and an untrusted app is allowed fork permission to itself. 88neverallow all_untrusted_apps mlstrustedsubject:process fork; 89 90# Do not allow untrusted apps to hard link to any files. 91# In particular, if an untrusted app links to other app data 92# files, installd will not be able to guarantee the deletion 93# of the linked to file. Hard links also contribute to security 94# bugs, so we want to ensure untrusted apps never have this 95# capability. 96neverallow all_untrusted_apps file_type:file link; 97 98# Do not allow untrusted apps to access network MAC address file 99neverallow all_untrusted_apps sysfs_net:file no_rw_file_perms; 100 101# Do not allow any write access to files in /sys 102neverallow all_untrusted_apps sysfs_type:file { no_w_file_perms no_x_file_perms }; 103 104# Apps may never access the default sysfs label. 105neverallow all_untrusted_apps sysfs:file no_rw_file_perms; 106 107# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the 108# ioctl permission, or 3. disallow the socket class. 109neverallowxperm all_untrusted_apps domain:{ icmp_socket rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls; 110neverallow all_untrusted_apps *:{ netlink_route_socket netlink_selinux_socket } ioctl; 111neverallow all_untrusted_apps *:{ 112 socket netlink_socket packet_socket key_socket appletalk_socket 113 netlink_tcpdiag_socket netlink_nflog_socket 114 netlink_xfrm_socket netlink_audit_socket 115 netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket 116 netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket 117 netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket 118 netlink_rdma_socket netlink_crypto_socket sctp_socket 119 ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket 120 atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket 121 bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket 122 alg_socket nfc_socket kcm_socket qipcrtr_socket smc_socket xdp_socket 123} *; 124 125# Apps can read/write an already open vsock (e.g. created by 126# virtualizationservice) but nothing more than that (e.g. creating a 127# new vsock, etc.) 128neverallow all_untrusted_apps *:vsock_socket ~{ getattr getopt read write }; 129 130# Disallow sending RTM_GETLINK messages on netlink sockets. 131neverallow all_untrusted_apps domain:netlink_route_socket { bind nlmsg_readpriv }; 132neverallow priv_app domain:netlink_route_socket { bind nlmsg_readpriv }; 133 134# Disallow sending RTM_GETNEIGH{TBL} messages on netlink sockets. 135neverallow { 136 all_untrusted_apps 137 -untrusted_app_25 138 -untrusted_app_27 139 -untrusted_app_29 140 -untrusted_app_30 141} domain:netlink_route_socket nlmsg_getneigh; 142 143# Do not allow untrusted apps access to /cache 144neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:dir ~{ r_dir_perms }; 145neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:file ~{ read getattr }; 146 147# Do not allow untrusted apps to create/unlink files outside of its sandbox, 148# internal storage or sdcard. 149# World accessible data locations allow application to fill the device 150# with unaccounted for data. This data will not get removed during 151# application un-installation. 152neverallow { all_untrusted_apps -mediaprovider } { 153 fs_type 154 -sdcard_type 155 -fuse 156 file_type 157 -app_data_file # The apps sandbox itself 158 -privapp_data_file 159 -app_exec_data_file # stored within the app sandbox directory 160 -media_rw_data_file # Internal storage. Known that apps can 161 # leave artfacts here after uninstall. 162 -user_profile_data_file # Access to profile files 163 userdebug_or_eng(` 164 -method_trace_data_file # only on ro.debuggable=1 165 -coredump_file # userdebug/eng only 166 ') 167}:dir_file_class_set { create unlink }; 168 169# No untrusted component except mediaprovider_app should be touching /dev/fuse 170neverallow { all_untrusted_apps -mediaprovider_app } fuse_device:chr_file *; 171 172# Do not allow untrusted apps to directly open the tun_device 173neverallow all_untrusted_apps tun_device:chr_file open; 174# The tun_device ioctls below are not allowed, to prove equivalence 175# to the kernel patch at 176# https://android.googlesource.com/kernel/common/+/11cee2be0c2062ba88f04eb51196506f870a3b5d%5E%21 177neverallowxperm all_untrusted_apps tun_device:chr_file ioctl ~{ FIOCLEX FIONCLEX TUNGETIFF }; 178 179# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553) 180neverallow all_untrusted_apps anr_data_file:file ~{ open append }; 181neverallow all_untrusted_apps anr_data_file:dir ~search; 182 183# Avoid reads from generically labeled /proc files 184# Create a more specific label if needed 185neverallow all_untrusted_apps { 186 proc 187 proc_asound 188 proc_kmsg 189 proc_loadavg 190 proc_mounts 191 proc_pagetypeinfo 192 proc_slabinfo 193 proc_stat 194 proc_swaps 195 proc_uptime 196 proc_version 197 proc_vmallocinfo 198 proc_vmstat 199}:file { no_rw_file_perms no_x_file_perms }; 200 201# /proc/filesystems is accessible to mediaprovider_app only since it handles 202# external storage 203neverallow { all_untrusted_apps - mediaprovider_app } proc_filesystems:file { no_rw_file_perms no_x_file_perms }; 204 205# Avoid all access to kernel configuration 206neverallow all_untrusted_apps config_gz:file { no_rw_file_perms no_x_file_perms }; 207 208# Do not allow untrusted apps access to preloads data files 209neverallow all_untrusted_apps preloads_data_file:file no_rw_file_perms; 210 211# Locking of files on /system could lead to denial of service attacks 212# against privileged system components 213neverallow all_untrusted_apps system_file:file lock; 214 215# Do not permit untrusted apps to perform actions on HwBinder service_manager 216# other than find actions for services listed below 217neverallow all_untrusted_apps *:hwservice_manager ~find; 218 219# Do not permit access from apps which host arbitrary code to the protected services 220# The two main reasons for this are: 221# 1. Protected HwBinder servers do not perform client authentication because 222# vendor code does not have a way to understand apps or their relation to 223# caller UID information and, even if it did, those services either operate 224# at a level below that of apps (e.g., HALs) or must not rely on app identity 225# for authorization. Thus, to be safe, the default assumption for all added 226# vendor services is that they treat all their clients as equally authorized 227# to perform operations offered by the service. 228# 2. HAL servers contain code with higher incidence rate of security issues 229# than system/core components and have access to lower layes of the stack 230# (all the way down to hardware) thus increasing opportunities for bypassing 231# the Android security model. 232neverallow all_untrusted_apps protected_hwservice:hwservice_manager find; 233neverallow all_untrusted_apps protected_service:service_manager find; 234 235# SELinux is not an API for untrusted apps to use 236neverallow all_untrusted_apps selinuxfs:file no_rw_file_perms; 237 238# Access to /proc/tty/drivers, to allow apps to determine if they 239# are running in an emulated environment. 240# b/33214085 b/33814662 b/33791054 b/33211769 241# https://github.com/strazzere/anti-emulator/blob/master/AntiEmulator/src/diff/strazzere/anti/emulator/FindEmulator.java 242# This will go away in a future Android release 243neverallow { all_untrusted_apps -untrusted_app_25 } proc_tty_drivers:file r_file_perms; 244neverallow all_untrusted_apps proc_tty_drivers:file ~r_file_perms; 245 246# Untrusted apps are not allowed to use cgroups. 247neverallow all_untrusted_apps cgroup:file *; 248neverallow all_untrusted_apps cgroup_v2:file *; 249 250# /mnt/sdcard symlink was supposed to have been removed in Gingerbread. Apps 251# must not use it. 252neverallow { 253 all_untrusted_apps 254 -untrusted_app_25 255 -untrusted_app_27 256} mnt_sdcard_file:lnk_file *; 257 258# Only privileged apps may find the incident service 259neverallow all_untrusted_apps incident_service:service_manager find; 260 261# Do not allow untrusted app to read hidden system proprerties. 262# We do not include in the exclusions other normally untrusted applications such as mediaprovider 263# due to the specific logging use cases. 264# Context: b/193912100 265neverallow { 266 all_untrusted_apps 267 -mediaprovider 268 -mediaprovider_app 269} { userdebug_or_eng_prop }:file read; 270 271# Do not allow untrusted app to access /dev/socket/mdnsd since U. The socket is 272# used to communicate to the mdnsd responder. The mdnsd responder will be 273# replaced by a java implementation which is integrated into the system server. 274# For untrusted apps running with API level 33-, they still have access to 275# /dev/socket/mdnsd for backward compatibility. 276neverallow { 277 all_untrusted_apps 278 -untrusted_app_25 279 -untrusted_app_27 280 -untrusted_app_29 281 -untrusted_app_30 282 -untrusted_app_32 283} mdnsd_socket:sock_file write; 284neverallow { 285 all_untrusted_apps 286 -untrusted_app_25 287 -untrusted_app_27 288 -untrusted_app_29 289 -untrusted_app_30 290 -untrusted_app_32 291} mdnsd:unix_stream_socket connectto; 292 293# Do not allow untrusted apps to use anonymous inodes. At the moment, 294# type transitions are the only way to distinguish between different 295# anon_inode usages like userfaultfd and io_uring. This prevents us from 296# creating a more fine-grained neverallow policy for each anon_inode usage. 297neverallow all_untrusted_apps domain:anon_inode *; 298