xref: /aosp_15_r20/system/sepolicy/private/kernel.te (revision e4a36f4174b17bbab9dc043f4a65dc8d87377290)

typeattribute kernel coredomain;

domain_auto_trans(kernel, init_exec, init)
domain_auto_trans(kernel, snapuserd_exec, snapuserd)

# Allow the kernel to read otapreopt_chroot's file descriptors and files under
# /postinstall, as it uses apexd logic to mount APEX packages in /postinstall/apex.
allow kernel otapreopt_chroot:fd use;
allow kernel postinstall_file:file read;

# The following sections are for the transition period during a Virtual A/B
# OTA. Once sepolicy is loaded, snapuserd must be re-launched in the correct
# context, and with properly labelled devices. This must be done before
# enabling enforcement, eg, in permissive mode while still in the kernel
# context.
allow kernel tmpfs:blk_file { getattr relabelfrom };
allow kernel tmpfs:chr_file { getattr relabelfrom };
allow kernel tmpfs:lnk_file { getattr relabelfrom };
allow kernel tmpfs:dir { open read relabelfrom };

allow kernel block_device:blk_file relabelto;
allow kernel block_device:lnk_file relabelto;
allow kernel dm_device:chr_file relabelto;
allow kernel dm_device:blk_file relabelto;
allow kernel dm_user_device:dir { read open search relabelto };
allow kernel dm_user_device:chr_file relabelto;
allow kernel kmsg_device:chr_file relabelto;
allow kernel null_device:chr_file relabelto;
allow kernel random_device:chr_file relabelto;
allow kernel snapuserd_exec:file relabelto;

allow kernel kmsg_device:chr_file write;
allow kernel gsid:fd use;

allow kernel self:global_capability_class_set sys_nice;

# Root fs.
r_dir_file(kernel, rootfs)

# Used to read androidboot.selinux property
allow kernel {
  proc_bootconfig
  proc_cmdline
}:file r_file_perms;

# Get SELinux enforcing status.
allow kernel selinuxfs:dir r_dir_perms;
allow kernel selinuxfs:file r_file_perms;

# Get file contexts during first stage
allow kernel file_contexts_file:file r_file_perms;

# Allow init relabel itself.
allow kernel rootfs:file relabelfrom;
allow kernel init_exec:file relabelto;
# TODO: investigate why we need this.
allow kernel init:process share;

# cgroup filesystem initialization prior to setting the cgroup root directory label.
allow kernel unlabeled:dir search;

# Mount usbfs.
allow kernel usbfs:filesystem mount;
allow kernel usbfs:dir search;

# Initial setenforce by init prior to switching to init domain.
# We use dontaudit instead of allow to prevent a kernel spawned userspace
# process from turning off SELinux once enabled.
dontaudit kernel self:security setenforce;

# Write to /proc/1/oom_adj prior to switching to init domain.
allow kernel self:global_capability_class_set sys_resource;

# Init reboot before switching selinux domains under certain error
# conditions. Allow it.
# As part of rebooting, init writes "u" to /proc/sysrq-trigger to
# remount filesystems read-only. /data is not mounted at this point,
# so we could ignore this. For now, we allow it.
allow kernel self:global_capability_class_set sys_boot;
allow kernel proc_sysrq:file w_file_perms;

# Allow writing to /dev/kmsg which was created prior to loading policy.
allow kernel tmpfs:chr_file write;

# Set checkreqprot by init.rc prior to switching to init domain.
allow kernel selinuxfs:file write;
allow kernel self:security setcheckreqprot;

# kernel thread "loop0", used by the loop block device, for ASECs (b/17158723)
allow kernel { sdcard_type fuse }:file { read write };

# f_mtp driver accesses files from kernel context.
allow kernel mediaprovider:fd use;

# Allow the kernel to read OBB files from app directories. (b/17428116)
# Kernel thread "loop0" reads a vold supplied file descriptor.
# Fixes CTS tests:
#  * android.os.storage.cts.StorageManagerTest#testMountAndUnmountObbNormal
#  * android.os.storage.cts.StorageManagerTest#testMountAndUnmountTwoObbs
allow kernel vold:fd use;
allow kernel { app_data_file privapp_data_file }:file read;
allow kernel asec_image_file:file read;

# Allow mounting loop device in update_engine_unittests. (b/28319454)
# and for LTP kernel tests (b/73220071)
userdebug_or_eng(`
  allow kernel update_engine_data_file:file { read write };
  allow kernel nativetest_data_file:file { read write };
')

# Access to /data/media.
# This should be removed if sdcardfs is modified to alter the secontext for its
# accesses to the underlying FS.
allow kernel media_rw_data_file:dir create_dir_perms;
allow kernel media_rw_data_file:file create_file_perms;

# Access to /data/misc/vold/virtual_disk.
allow kernel vold_data_file:file { read write };

# Allow the kernel to read APEX file descriptors and (staged) data files;
# Needed because APEX uses the loopback driver, which issues requests from
# a kernel thread in earlier kernel version.
allow kernel apexd:fd use;
allow kernel {
  apex_data_file
  staging_data_file
  vendor_apex_file
}:file read;
# Also allow the kernel to read/write /data/local/tmp files via loop device
# for ApexTestCases and fiemap_image_test.
userdebug_or_eng(`
  allow kernel shell_data_file:file { read write };
')

# Allow the first-stage init (which is running in the kernel domain) to execute the
# dynamic linker when it re-executes /init to switch into the second stage.
# Until Linux 4.8, the program interpreter (dynamic linker in this case) is executed
# before the domain is switched to the target domain. So, we need to allow the kernel
# domain (the source domain) to execute the dynamic linker (system_file type).
# TODO(b/110147943) remove these allow rules when we no longer need to support Linux
# kernel older than 4.8.
allow kernel system_file:file execute;
# The label for the dynamic linker is rootfs in the recovery partition. This is because
# the recovery partition which is rootfs does not support xattr and thus labeling can't be
# done at build-time. All files are by default labeled as rootfs upon booting.
recovery_only(`
  allow kernel rootfs:file execute;
')

# required by VTS lidbm unit test
allow kernel appdomain_tmpfs:file { read write };

dontaudit kernel metadata_file:dir search;
dontaudit kernel ota_metadata_file:dir rw_dir_perms;
dontaudit kernel sysfs:dir r_dir_perms;
dontaudit kernel sysfs:file { open read write };
dontaudit kernel sysfs:chr_file { open read write };
dontaudit kernel dm_device:chr_file ioctl;
dontaudit kernel self:capability { sys_admin setgid mknod };

dontaudit kernel dm_user_device:dir { write add_name };
dontaudit kernel dm_user_device:chr_file { create setattr };
dontaudit kernel tmpfs:lnk_file read;
dontaudit kernel tmpfs:blk_file { open read };

###
### neverallow rules
###

# The initial task starts in the kernel domain (assigned via
# initial_sid_contexts), but nothing ever transitions to it.
neverallow * kernel:process { transition dyntransition };

# The kernel domain is never entered via an exec, nor should it
# ever execute a program outside the rootfs without changing to another domain.
# If you encounter an execute_no_trans denial on the kernel domain, then
# possible causes include:
# - The program is a kernel usermodehelper.  In this case, define a domain
#   for the program and domain_auto_trans() to it.
# - You are running an exploit which switched to the init task credentials
#   and is then trying to exec a shell or other program.  You lose!
neverallow kernel *:file { entrypoint execute_no_trans };

# the kernel should not be accessing files owned by other users.
# Instead of adding dac_{read_search,override}, fix the unix permissions
# on files being accessed.
neverallow kernel self:global_capability_class_set { dac_override dac_read_search };

# Nobody should be ptracing kernel threads
neverallow * kernel:process ptrace;