1typeattribute keystore coredomain; 2 3init_daemon_domain(keystore) 4 5# talk to keymaster 6hal_client_domain(keystore, hal_keymaster) 7 8# talk to confirmationui 9hal_client_domain(keystore, hal_confirmationui) 10 11# talk to keymint 12hal_client_domain(keystore, hal_keymint) 13 14# This is used for the ConfirmationUI async callback. 15allow keystore platform_app:binder call; 16 17# Allow to check whether security logging is enabled. 18get_prop(keystore, device_logging_prop) 19 20# Allow keystore to check if the system is rkp only. 21get_prop(keystore, remote_prov_prop) 22 23# Allow keystore to check whether to post-process RKP certificates 24get_prop(keystore, remote_prov_cert_prop) 25 26# Allow keystore to check rkpd feature flags 27get_prop(keystore, device_config_remote_key_provisioning_native_prop) 28 29# Allow keystore to write to statsd. 30unix_socket_send(keystore, statsdw, statsd) 31 32# Keystore need access to the keystore2_key_contexts file to load the keystore key backend. 33allow keystore keystore2_key_contexts_file:file r_file_perms; 34 35# Allow keystore to listen to changing boot levels 36get_prop(keystore, keystore_listen_prop) 37 38# Keystore needs to transfer binder references to vold so that it 39# can call keystore methods on those references. 40allow keystore vold:binder transfer; 41 42set_prop(keystore, keystore_crash_prop) 43 44# keystore is using apex_info via libvintf 45use_apex_info(keystore) 46 47typeattribute keystore mlstrustedsubject; 48binder_use(keystore) 49binder_service(keystore) 50binder_call(keystore, remote_provisioning_service_server) 51binder_call(keystore, rkp_cert_processor) 52binder_call(keystore, system_server) 53binder_call(keystore, wificond) 54 55allow keystore keystore_data_file:dir create_dir_perms; 56allow keystore keystore_data_file:notdevfile_class_set create_file_perms; 57allow keystore keystore_exec:file { getattr }; 58 59add_service(keystore, keystore_service) 60allow keystore sec_key_att_app_id_provider_service:service_manager find; 61allow keystore remote_provisioning_service:service_manager find; 62allow keystore rkp_cert_processor_service:service_manager find; 63 64add_service(keystore, apc_service) 65add_service(keystore, keystore_compat_hal_service) 66add_service(keystore, authorization_service) 67add_service(keystore, keystore_maintenance_service) 68add_service(keystore, keystore_metrics_service) 69add_service(keystore, legacykeystore_service) 70 71# Check SELinux permissions. 72selinux_check_access(keystore) 73 74r_dir_file(keystore, cgroup) 75r_dir_file(keystore, cgroup_v2) 76 77# The software KeyMint implementation used in km_compat needs 78# to read the vendor security patch level. 79get_prop(keystore, vendor_security_patch_level_prop); 80 81# Allow keystore to read its vendor configuration 82get_prop(keystore, keystore_config_prop) 83 84### 85### Neverallow rules 86### 87### Protect ourself from others 88### 89 90neverallow { domain -keystore } keystore_data_file:dir ~{ open create read getattr setattr search relabelto ioctl }; 91neverallow { domain -keystore } keystore_data_file:notdevfile_class_set ~{ relabelto getattr }; 92 93neverallow { domain -keystore -init } keystore_data_file:dir *; 94neverallow { domain -keystore -init } keystore_data_file:notdevfile_class_set *; 95 96neverallow * keystore:process ptrace; 97 98# Only keystore can set keystore.crash_count system property. Since init is allowed to set any 99# system property, an exception is added for init as well. 100neverallow { domain -keystore -init } keystore_crash_prop:property_service set; 101