1##################################### 2# domain_trans(olddomain, type, newdomain) 3# Allow a transition from olddomain to newdomain 4# upon executing a file labeled with type. 5# This only allows the transition; it does not 6# cause it to occur automatically - use domain_auto_trans 7# if that is what you want. 8# 9define(`domain_trans', ` 10# Old domain may exec the file and transition to the new domain. 11allow $1 $2:file { getattr open read execute map }; 12allow $1 $3:process transition; 13# New domain is entered by executing the file. 14allow $3 $2:file { entrypoint open read execute getattr map }; 15# New domain can send SIGCHLD to its caller. 16ifelse($1, `init', `', `allow $3 $1:process sigchld;') 17# Enable AT_SECURE, i.e. libc secure mode. 18dontaudit $1 $3:process noatsecure; 19# XXX dontaudit candidate but requires further study. 20allow $1 $3:process { siginh rlimitinh }; 21') 22 23##################################### 24# domain_auto_trans(olddomain, type, newdomain) 25# Automatically transition from olddomain to newdomain 26# upon executing a file labeled with type. 27# 28define(`domain_auto_trans', ` 29# Allow the necessary permissions. 30domain_trans($1,$2,$3) 31# Make the transition occur by default. 32type_transition $1 $2:process $3; 33') 34 35##################################### 36# file_type_trans(domain, dir_type, file_type) 37# Allow domain to create a file labeled file_type in a 38# directory labeled dir_type. 39# This only allows the transition; it does not 40# cause it to occur automatically - use file_type_auto_trans 41# if that is what you want. 42# 43define(`file_type_trans', ` 44# Allow the domain to add entries to the directory. 45allow $1 $2:dir ra_dir_perms; 46# Allow the domain to create the file. 47allow $1 $3:notdevfile_class_set create_file_perms; 48allow $1 $3:dir create_dir_perms; 49') 50 51##################################### 52# file_type_auto_trans(domain, dir_type, file_type) 53# Automatically label new files with file_type when 54# they are created by domain in directories labeled dir_type. 55# 56define(`file_type_auto_trans', ` 57# Allow the necessary permissions. 58file_type_trans($1, $2, $3) 59# Make the transition occur by default. 60type_transition $1 $2:dir $3; 61type_transition $1 $2:notdevfile_class_set $3; 62') 63 64##################################### 65# r_dir_file(domain, type) 66# Allow the specified domain to read directories, files 67# and symbolic links of the specified type. 68define(`r_dir_file', ` 69allow $1 $2:dir r_dir_perms; 70allow $1 $2:{ file lnk_file } r_file_perms; 71') 72 73##################################### 74# tmpfs_domain(domain) 75# Allow access to a unique type for this domain when creating tmpfs / ashmem files. 76define(`tmpfs_domain', ` 77type_transition $1 tmpfs:file $1_tmpfs; 78allow $1 $1_tmpfs:file { read write getattr map }; 79') 80 81# pdx macros for IPC. pdx is a high-level name which contains transport-specific 82# rules from underlying transport (e.g. UDS-based implementation). 83 84##################################### 85# pdx_service_attributes(service) 86# Defines type attribute used to identify various service-related types. 87define(`pdx_service_attributes', ` 88attribute pdx_$1_endpoint_dir_type; 89attribute pdx_$1_endpoint_socket_type; 90attribute pdx_$1_channel_socket_type; 91attribute pdx_$1_server_type; 92') 93 94##################################### 95# pdx_service_socket_types(service, endpoint_dir_t) 96# Define types for endpoint and channel sockets. 97define(`pdx_service_socket_types', ` 98typeattribute $2 pdx_$1_endpoint_dir_type; 99type pdx_$1_endpoint_socket, pdx_$1_endpoint_socket_type, pdx_endpoint_socket_type, file_type, coredomain_socket, mlstrustedobject, mlstrustedsubject; 100type pdx_$1_channel_socket, pdx_$1_channel_socket_type, pdx_channel_socket_type, coredomain_socket; 101userdebug_or_eng(` 102dontaudit su pdx_$1_endpoint_socket:unix_stream_socket *; 103dontaudit su pdx_$1_channel_socket:unix_stream_socket *; 104') 105') 106 107##################################### 108# pdx_server(server_domain, service) 109define(`pdx_server', ` 110# Mark the server domain as a PDX server. 111typeattribute $1 pdx_$2_server_type; 112# Allow the init process to create the initial endpoint socket. 113allow init pdx_$2_endpoint_socket_type:unix_stream_socket { create bind }; 114# Allow the server domain to use the endpoint socket and accept connections on it. 115# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights 116# than we need (e.g. we don"t need "bind" or "connect"). 117allow $1 pdx_$2_endpoint_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown listen accept }; 118# Allow the server domain to apply security context label to the channel socket pair (allow process to use setsockcreatecon_raw()). 119allow $1 self:process setsockcreate; 120# Allow the server domain to create a client channel socket. 121allow $1 pdx_$2_channel_socket_type:unix_stream_socket create_stream_socket_perms; 122# Prevent other processes from claiming to be a server for the same service. 123neverallow {domain -$1} pdx_$2_endpoint_socket_type:unix_stream_socket { listen accept }; 124') 125 126##################################### 127# pdx_connect(client, service) 128define(`pdx_connect', ` 129# Allow client to open the service endpoint file. 130allow $1 pdx_$2_endpoint_dir_type:dir r_dir_perms; 131allow $1 pdx_$2_endpoint_socket_type:sock_file rw_file_perms; 132# Allow the client to connect to endpoint socket. 133allow $1 pdx_$2_endpoint_socket_type:unix_stream_socket { connectto read write shutdown }; 134') 135 136##################################### 137# pdx_use(client, service) 138define(`pdx_use', ` 139# Allow the client to use the PDX channel socket. 140# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights 141# than we need (e.g. we don"t need "bind" or "connect"). 142allow $1 pdx_$2_channel_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown }; 143# Client needs to use an channel event fd from the server. 144allow $1 pdx_$2_server_type:fd use; 145# Servers may receive sync fences, gralloc buffers, etc, from clients. 146# This could be tightened on a per-server basis, but keeping track of service 147# clients is error prone. 148allow pdx_$2_server_type $1:fd use; 149') 150 151##################################### 152# pdx_client(client, service) 153define(`pdx_client', ` 154pdx_connect($1, $2) 155pdx_use($1, $2) 156') 157 158##################################### 159# init_daemon_domain(domain) 160# Set up a transition from init to the daemon domain 161# upon executing its binary. 162define(`init_daemon_domain', ` 163domain_auto_trans(init, $1_exec, $1) 164') 165 166#################################### 167# userfaultfd_use(domain) 168# Allow domain to create/use userfaultfd. 169define(`userfaultfd_use', ` 170# Set up a type_transition to "userfaultfd" named anonymous inode object. 171type $1_userfaultfd; 172type_transition $1 $1:anon_inode $1_userfaultfd "[userfaultfd]"; 173# Allow domain to create/use userfaultfd anon_inode. 174allow $1 $1_userfaultfd:anon_inode { create ioctl read }; 175# Suppress errors generate during bugreport 176dontaudit su $1_userfaultfd:anon_inode *; 177# Other domains may not use userfaultfd anon_inodes created by this domain. 178neverallow { domain -$1 } $1_userfaultfd:anon_inode *; 179') 180 181#################################### 182# virtualizationservice_use(domain) 183# Allow domain to create and communicate with a virtual machine using 184# virtualizationservice and virtualizationmanager. 185define(`virtualizationservice_use', ` 186# Transition to virtualizationmanager when the client executes it. 187domain_auto_trans($1, virtualizationmanager_exec, virtualizationmanager) 188# Allow virtualizationmanager to communicate over UDS with the client. 189allow { virtualizationmanager crosvm } $1:unix_stream_socket { ioctl getattr read write }; 190# Let the client pass file descriptors to virtualizationmanager and on to crosvm. 191allow { virtualizationmanager crosvm } $1:fd use; 192# Let the client use file descriptors created by virtualizationmanager. 193allow $1 virtualizationmanager:fd use; 194# Allow piping console log to the client 195allow { virtualizationmanager crosvm } $1:fifo_file { ioctl getattr read write }; 196# Allow client to read/write vsock created by virtualizationmanager to communicate with the VM 197# that it created. Notice that we do not grant permission to create a vsock; 198# the client can only connect to VMs that it owns. 199allow $1 virtualizationmanager:vsock_socket { getattr getopt read write }; 200# Allow client to inspect hypervisor capabilities 201get_prop($1, hypervisor_prop) 202# Allow client to read (but not open) the crashdump provided by virtualizationmanager 203allow $1 virtualizationservice_data_file:file { getattr read }; 204') 205 206#################################### 207# early_virtmgr_use(domain) 208# Allow domain to create and communicate with an early virtual machine using 209# early_virtmgr. 210define(`early_virtmgr_use', ` 211# Transition to early_virtmgr when the client executes it. 212domain_auto_trans($1, early_virtmgr_exec, early_virtmgr) 213# Allow early_virtmgr to communicate over UDS with the client. 214allow { early_virtmgr crosvm } $1:unix_stream_socket { ioctl getattr read write }; 215# Let the client pass file descriptors to early_virtmgr and on to crosvm. 216allow { early_virtmgr crosvm } $1:fd use; 217allow { early_virtmgr crosvm } $1_tmpfs:file rw_file_perms; 218# Let the client use file descriptors created by early_virtmgr. 219allow $1 early_virtmgr:fd use; 220# Allow piping console log to the client 221allow { early_virtmgr crosvm } $1:fifo_file { ioctl getattr read write }; 222# Allow client to read/write vsock created by early_virtmgr to communicate with the VM 223# that it created. Notice that we do not grant permission to create a vsock; 224# the client can only connect to VMs that it owns. 225allow $1 early_virtmgr:vsock_socket { getattr getopt read write }; 226# Allow client to inspect hypervisor capabilities 227get_prop($1, hypervisor_prop) 228# Allow early_virtmgr to read the path of the client using /proc/{PID}/exe 229allow early_virtmgr $1:dir search; 230allow early_virtmgr $1:file read; 231allow early_virtmgr $1:lnk_file read; 232') 233 234##################################### 235# app_domain(domain) 236# Allow a base set of permissions required for all apps. 237define(`app_domain', ` 238typeattribute $1 appdomain; 239# Label tmpfs objects for all apps. 240type_transition $1 tmpfs:file appdomain_tmpfs; 241userfaultfd_use($1) 242allow $1 appdomain_tmpfs:file { execute getattr map read write }; 243neverallow { $1 -runas_app -shell -simpleperf } { domain -$1 }:file no_rw_file_perms; 244neverallow { appdomain -runas_app -shell -simpleperf -$1 } $1:file no_rw_file_perms; 245# The Android security model guarantees the confidentiality and integrity 246# of application data and execution state. Ptrace bypasses those 247# confidentiality guarantees. Disallow ptrace access from system components to 248# apps. crash_dump is excluded, as it needs ptrace access to produce stack 249# traces. runas_app is excluded, as it operates only on debuggable apps. 250# simpleperf is excluded, as it operates only on debuggable or profileable 251# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for 252# live lock conditions. 253neverallow { domain -$1 -crash_dump userdebug_or_eng(`-llkd') -runas_app -simpleperf } $1:process ptrace; 254') 255 256##################################### 257# untrusted_app_domain(domain) 258# Allow a base set of permissions required for all untrusted apps. 259define(`untrusted_app_domain', ` 260typeattribute $1 untrusted_app_all; 261') 262 263##################################### 264# isolated_app_domain(domain) 265# Allow a base set of permissions required for all isolated apps. 266define(`isolated_app_domain', ` 267typeattribute $1 isolated_app_all; 268') 269 270##################################### 271# net_domain(domain) 272# Allow a base set of permissions required for network access. 273define(`net_domain', ` 274typeattribute $1 netdomain; 275') 276 277##################################### 278# bluetooth_domain(domain) 279# Allow a base set of permissions required for bluetooth access. 280define(`bluetooth_domain', ` 281typeattribute $1 bluetoothdomain; 282') 283 284##################################### 285# hal_attribute(hal_name) 286# Add an attribute for hal implementations along with necessary 287# restrictions. 288define(`hal_attribute', ` 289attribute hal_$1; 290expandattribute hal_$1 true; 291attribute hal_$1_client; 292expandattribute hal_$1_client true; 293attribute hal_$1_server; 294expandattribute hal_$1_server false; 295 296neverallow { hal_$1_server -halserverdomain } domain:process fork; 297# hal_*_client and halclientdomain attributes are always expanded for 298# performance reasons. Neverallow rules targeting expanded attributes can not be 299# verified by CTS since these attributes are already expanded by that time. 300build_test_only(` 301neverallow { hal_$1_server -hal_$1 } domain:process fork; 302neverallow { hal_$1_client -halclientdomain } domain:process fork; 303') 304') 305 306##################################### 307# hal_server_domain(domain, hal_type) 308# Allow a base set of permissions required for a domain to offer a 309# HAL implementation of the specified type over HwBinder. 310# 311# For example, default implementation of Foo HAL: 312# type hal_foo_default, domain; 313# hal_server_domain(hal_foo_default, hal_foo) 314# 315define(`hal_server_domain', ` 316typeattribute $1 halserverdomain; 317typeattribute $1 $2_server; 318typeattribute $1 $2; 319') 320 321##################################### 322# hal_client_domain(domain, hal_type) 323# Allow a base set of permissions required for a domain to be a 324# client of a HAL of the specified type. 325# 326# For example, make some_domain a client of Foo HAL: 327# hal_client_domain(some_domain, hal_foo) 328# 329define(`hal_client_domain', ` 330typeattribute $1 halclientdomain; 331typeattribute $1 $2_client; 332 333# TODO(b/34170079): Make the inclusion of the rules below conditional also on 334# non-Treble devices. For now, on non-Treble device, always grant clients of a 335# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process). 336not_full_treble(` 337typeattribute $1 $2; 338# Find passthrough HAL implementations 339allow $2 system_file:dir r_dir_perms; 340allow $2 vendor_file:dir r_dir_perms; 341allow $2 vendor_file:file { read open getattr execute map }; 342') 343') 344 345##################################### 346# passthrough_hal_client_domain(domain, hal_type) 347# Allow a base set of permissions required for a domain to be a 348# client of a passthrough HAL of the specified type. 349# 350# For example, make some_domain a client of passthrough Foo HAL: 351# passthrough_hal_client_domain(some_domain, hal_foo) 352# 353define(`passthrough_hal_client_domain', ` 354typeattribute $1 halclientdomain; 355typeattribute $1 $2_client; 356typeattribute $1 $2; 357# Find passthrough HAL implementations 358allow $2 system_file:dir r_dir_perms; 359allow $2 vendor_file:dir r_dir_perms; 360allow $2 vendor_file:file { read open getattr execute map }; 361') 362 363##################################### 364# unix_socket_connect(clientdomain, socket, serverdomain) 365# Allow a local socket connection from clientdomain via 366# socket to serverdomain. 367# 368# Note: If you see denial records that distill to the 369# following allow rules: 370# allow clientdomain property_socket:sock_file write; 371# allow clientdomain init:unix_stream_socket connectto; 372# allow clientdomain something_prop:property_service set; 373# 374# This sequence is indicative of attempting to set a property. 375# use set_prop(sourcedomain, targetproperty) 376# 377define(`unix_socket_connect', ` 378allow $1 $2_socket:sock_file write; 379allow $1 $3:unix_stream_socket connectto; 380') 381 382##################################### 383# set_prop(sourcedomain, targetproperty) 384# Allows source domain to set the 385# targetproperty. 386# 387define(`set_prop', ` 388unix_socket_connect($1, property, init) 389allow $1 $2:property_service set; 390get_prop($1, $2) 391') 392 393##################################### 394# get_prop(sourcedomain, targetproperty) 395# Allows source domain to read the 396# targetproperty. 397# 398define(`get_prop', ` 399allow $1 $2:file { getattr open read map }; 400') 401 402##################################### 403# unix_socket_send(clientdomain, socket, serverdomain) 404# Allow a local socket send from clientdomain via 405# socket to serverdomain. 406define(`unix_socket_send', ` 407allow $1 $2_socket:sock_file write; 408allow $1 $3:unix_dgram_socket sendto; 409') 410 411##################################### 412# binder_use(domain) 413# Allow domain to use Binder IPC. 414define(`binder_use', ` 415# Call the servicemanager and transfer references to it. 416allow $1 servicemanager:binder { call transfer }; 417# Allow servicemanager to send out callbacks 418allow servicemanager $1:binder { call transfer }; 419# servicemanager performs getpidcon on clients. 420allow servicemanager $1:dir search; 421allow servicemanager $1:file { read open }; 422allow servicemanager $1:process getattr; 423# rw access to /dev/binder and /dev/ashmem is presently granted to 424# all domains in domain.te. 425') 426 427##################################### 428# hwbinder_use(domain) 429# Allow domain to use HwBinder IPC. 430define(`hwbinder_use', ` 431# Call the hwservicemanager and transfer references to it. 432allow $1 hwservicemanager:binder { call transfer }; 433# Allow hwservicemanager to send out callbacks 434allow hwservicemanager $1:binder { call transfer }; 435# hwservicemanager performs getpidcon on clients. 436allow hwservicemanager $1:dir search; 437allow hwservicemanager $1:file { read open map }; 438allow hwservicemanager $1:process getattr; 439# rw access to /dev/hwbinder and /dev/ashmem is presently granted to 440# all domains in domain.te. 441') 442 443##################################### 444# vndbinder_use(domain) 445# Allow domain to use Binder IPC. 446define(`vndbinder_use', ` 447# Talk to the vndbinder device node 448allow $1 vndbinder_device:chr_file rw_file_perms; 449# Call the vndservicemanager and transfer references to it. 450allow $1 vndservicemanager:binder { call transfer }; 451# vndservicemanager performs getpidcon on clients. 452allow vndservicemanager $1:dir search; 453allow vndservicemanager $1:file { read open map }; 454allow vndservicemanager $1:process getattr; 455') 456 457##################################### 458# binder_call(clientdomain, serverdomain) 459# Allow clientdomain to perform binder IPC to serverdomain. 460define(`binder_call', ` 461# Call the server domain and optionally transfer references to it. 462allow $1 $2:binder { call transfer }; 463# Allow the serverdomain to transfer references to the client on the reply. 464allow $2 $1:binder transfer; 465# Receive and use open files from the server. 466allow $1 $2:fd use; 467') 468 469##################################### 470# binder_service(domain) 471# Deprecated. Consider granting the exact permissions required by your service. 472define(`binder_service', ` 473typeattribute $1 binderservicedomain; 474') 475 476##################################### 477# wakelock_use(domain) 478# Allow domain to manage wake locks 479define(`wakelock_use', ` 480# TODO(b/115946999): Remove /sys/power/* permissions once CONFIG_PM_WAKELOCKS is 481# deprecated. 482# Access /sys/power/wake_lock and /sys/power/wake_unlock 483allow $1 sysfs_wake_lock:file rw_file_perms; 484# Accessing these files requires CAP_BLOCK_SUSPEND 485allow $1 self:global_capability2_class_set block_suspend; 486# system_suspend permissions 487binder_call($1, system_suspend_server) 488allow $1 system_suspend_hwservice:hwservice_manager find; 489# halclientdomain permissions 490hwbinder_use($1) 491get_prop($1, hwservicemanager_prop) 492allow $1 hidl_manager_hwservice:hwservice_manager find; 493# AIDL suspend hal permissions 494allow $1 hal_system_suspend_service:service_manager find; 495binder_use($1) 496') 497 498##################################### 499# selinux_check_access(domain) 500# Allow domain to check SELinux permissions via selinuxfs. 501define(`selinux_check_access', ` 502r_dir_file($1, selinuxfs) 503allow $1 selinuxfs:file w_file_perms; 504allow $1 kernel:security compute_av; 505allow $1 self:netlink_selinux_socket { read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind }; 506') 507 508##################################### 509# selinux_check_context(domain) 510# Allow domain to check SELinux contexts via selinuxfs. 511define(`selinux_check_context', ` 512r_dir_file($1, selinuxfs) 513allow $1 selinuxfs:file w_file_perms; 514allow $1 kernel:security check_context; 515') 516 517##################################### 518# create_pty(domain) 519# Allow domain to create and use a pty, isolated from any other domain ptys. 520define(`create_pty', ` 521# Each domain gets a unique devpts type. 522type $1_devpts, fs_type; 523# Label the pty with the unique type when created. 524type_transition $1 devpts:chr_file $1_devpts; 525# Allow use of the pty after creation. 526allow $1 $1_devpts:chr_file { open getattr read write ioctl }; 527allowxperm $1 $1_devpts:chr_file ioctl unpriv_tty_ioctls; 528# TIOCSTI is only ever used for exploits. Block it. 529# b/33073072, b/7530569 530# http://www.openwall.com/lists/oss-security/2016/09/26/14 531neverallowxperm * $1_devpts:chr_file ioctl TIOCSTI; 532# Note: devpts:dir search and ptmx_device:chr_file rw_file_perms 533# allowed to everyone via domain.te. 534') 535 536##################################### 537# Non system_app application set 538# 539define(`non_system_app_set', `{ appdomain -system_app }') 540 541##################################### 542# Recovery only 543# SELinux rules which apply only to recovery mode 544# 545define(`recovery_only', ifelse(target_recovery, `true', $1, )) 546 547##################################### 548# Not recovery 549# SELinux rules which apply only to non-recovery (normal) mode 550# 551define(`not_recovery', ifelse(target_recovery, `true', , $1)) 552 553##################################### 554# Full TREBLE only 555# SELinux rules which apply only to full TREBLE devices 556# 557define(`full_treble_only', ifelse(target_full_treble, `true', $1, 558ifelse(target_full_treble, `cts', 559# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify 560$1 561# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify 562, ))) 563 564##################################### 565# Not full TREBLE 566# SELinux rules which apply only to devices which are not full TREBLE devices 567# 568define(`not_full_treble', ifelse(target_full_treble, `true', , $1)) 569 570##################################### 571# enforce_debugfs_restriction 572# SELinux rules which apply to devices that enable debugfs restrictions. 573# The keyword "cts" is used to insert markers to only CTS test the neverallows 574# added by the macro for S-launch devices and newer. 575define(`enforce_debugfs_restriction', ifelse(target_enforce_debugfs_restriction, `true', $1, 576ifelse(target_enforce_debugfs_restriction, `cts', 577# BEGIN_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify 578$1 579# END_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify 580, ))) 581 582##################################### 583# no_debugfs_restriction 584# SELinux rules which apply to devices that do not have debugfs restrictions in non-user builds. 585define(`no_debugfs_restriction', ifelse(target_enforce_debugfs_restriction, `true', , $1)) 586 587##################################### 588# Compatible property only 589# SELinux rules which apply only to devices with compatible property 590# 591define(`compatible_property_only', ifelse(target_compatible_property, `true', $1, 592ifelse(target_compatible_property, `cts', 593# BEGIN_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify 594$1 595# END_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify 596, ))) 597 598##################################### 599# Not compatible property 600# SELinux rules which apply only to devices without compatible property 601# 602define(`not_compatible_property', ifelse(target_compatible_property, `true', , $1)) 603 604##################################### 605# Userdebug or eng builds 606# SELinux rules which apply only to userdebug or eng builds 607# 608define(`userdebug_or_eng', ifelse(target_build_variant, `eng', $1, ifelse(target_build_variant, `userdebug', $1))) 609 610##################################### 611# asan builds 612# SELinux rules which apply only to asan builds 613# 614define(`with_asan', ifelse(target_with_asan, `true', userdebug_or_eng(`$1'), )) 615 616##################################### 617# native coverage builds 618# SELinux rules which apply only to builds with native coverage 619# 620define(`with_native_coverage', ifelse(target_with_native_coverage, `true', userdebug_or_eng(`$1'), )) 621 622##################################### 623# Build-time-only test 624# SELinux rules which are verified during build, but not as part of *TS testing. 625# 626define(`build_test_only', ifelse(target_exclude_build_test, `true', , $1)) 627 628#################################### 629# Fallback crash handling for processes that can't exec crash_dump (e.g. because of seccomp). 630# 631define(`crash_dump_fallback', ` 632userdebug_or_eng(` 633 allow $1 su:fifo_file append; 634') 635allow $1 anr_data_file:file append; 636allow $1 dumpstate:fd use; 637allow $1 incidentd:fd use; 638# TODO: Figure out why write is needed. 639allow $1 dumpstate:fifo_file { append write }; 640allow $1 incidentd:fifo_file { append write }; 641allow $1 system_server:fifo_file { append write }; 642allow $1 tombstoned:unix_stream_socket connectto; 643allow $1 tombstoned:fd use; 644allow $1 tombstoned_crash_socket:sock_file write; 645allow $1 tombstone_data_file:file append; 646') 647 648##################################### 649# WITH_DEXPREOPT builds 650# SELinux rules which apply only when pre-opting. 651# 652define(`with_dexpreopt', ifelse(target_with_dexpreopt, `true', $1)) 653 654##################################### 655# write_logd(domain) 656# Ability to write to android log 657# daemon via sockets 658define(`write_logd', ` 659unix_socket_send($1, logdw, logd) 660allow $1 pmsg_device:chr_file w_file_perms; 661') 662 663##################################### 664# read_logd(domain) 665# Ability to run logcat and read from android 666# log daemon via sockets 667define(`read_logd', ` 668allow $1 logcat_exec:file rx_file_perms; 669unix_socket_connect($1, logdr, logd) 670') 671 672##################################### 673# read_runtime_log_tags(domain) 674# ability to directly map the runtime event log tags 675define(`read_runtime_log_tags', ` 676allow $1 runtime_event_log_tags_file:file r_file_perms; 677') 678 679##################################### 680# control_logd(domain) 681# Ability to control 682# android log daemon via sockets 683define(`control_logd', ` 684# Group AID_LOG checked by filesystem & logd 685# to permit control commands 686unix_socket_connect($1, logd, logd) 687') 688 689##################################### 690# use_keystore(domain) 691# Ability to use keystore. 692# Keystore is requires the following permissions 693# to call getpidcon. 694define(`use_keystore', ` 695 allow keystore $1:dir search; 696 allow keystore $1:file { read open }; 697 allow keystore $1:process getattr; 698 allow $1 apc_service:service_manager find; 699 allow $1 keystore_service:service_manager find; 700 allow $1 legacykeystore_service:service_manager find; 701 binder_call($1, keystore) 702 binder_call(keystore, $1) 703') 704 705##################################### 706# use_credstore(domain) 707# Ability to use credstore. 708define(`use_credstore', ` 709 allow credstore $1:dir search; 710 allow credstore $1:file { read open }; 711 allow credstore $1:process getattr; 712 allow $1 credstore_service:service_manager find; 713 binder_call($1, credstore) 714 binder_call(credstore, $1) 715') 716 717########################################### 718# use_drmservice(domain) 719# Ability to use DrmService which requires 720# DrmService to call getpidcon. 721define(`use_drmservice', ` 722 allow drmserver $1:dir search; 723 allow drmserver $1:file { read open }; 724 allow drmserver $1:process getattr; 725') 726 727########################################### 728# add_service(domain, service) 729# Ability for domain to add a service to service_manager 730# and find it. It also creates a neverallow preventing 731# others from adding it. 732define(`add_service', ` 733 allow $1 $2:service_manager { add find }; 734 neverallow { domain -$1 } $2:service_manager add; 735 736 # On debug builds with root, allow binder services to use binder over TCP. 737 # Not using rw_socket_perms_no_ioctl to avoid granting too many permissions. 738 userdebug_or_eng(` 739 allow $1 su:tcp_socket { accept getopt read write }; 740 ') 741') 742 743########################################### 744# add_hwservice(domain, service) 745# Ability for domain to add a service to hwservice_manager 746# and find it. It also creates a neverallow preventing 747# others from adding it. 748define(`add_hwservice', ` 749 allow $1 $2:hwservice_manager { add find }; 750 allow $1 hidl_base_hwservice:hwservice_manager add; 751 neverallow { domain -$1 } $2:hwservice_manager add; 752') 753 754########################################### 755# hal_attribute_hwservice(attribute, service) 756# Ability for domain to get a service to hwservice_manager 757# and find it. It also creates a neverallow preventing 758# others from adding it. 759# 760# Used to pair hal_foo_client with hal_foo_hwservice 761define(`hal_attribute_hwservice', ` 762 allow $1_client $2:hwservice_manager find; 763 add_hwservice($1_server, $2) 764 765 build_test_only(` 766 # if you are hitting this neverallow, try using: 767 # hal_client_domain(<your domain>, hal_<foo>) 768 # instead 769 neverallow { domain -$1_client -$1_server } $2:hwservice_manager find; 770 ') 771') 772 773########################################### 774# hal_attribute_service(attribute, service) 775# Ability for domain to get a service to service_manager 776# and find it. It also creates a neverallow preventing 777# others from adding it. 778# 779# Used to pair hal_foo_client with hal_foo_service 780define(`hal_attribute_service', ` 781 allow $1_client $2:service_manager find; 782 add_service($1_server, $2) 783 784 build_test_only(` 785 # if you are hitting this neverallow, try using: 786 # hal_client_domain(<your domain>, hal_<foo>) 787 # instead 788 neverallow { 789 domain 790 -$1_client 791 -$1_server 792 # some services are allowed to find all services 793 -atrace 794 -shell 795 -system_app 796 -traceur_app 797 } $2:service_manager find; 798 ') 799') 800 801################################### 802# can_profile_heap(domain) 803# Allow processes within the domain to have their heap profiled by central 804# heapprofd. 805define(`can_profile_heap', ` 806 # Allow central daemon to send signal for client initialization. 807 allow heapprofd $1:process signal; 808 # Allow connecting to the daemon. 809 unix_socket_connect($1, heapprofd, heapprofd) 810 # Allow daemon to use the passed fds. 811 allow heapprofd $1:fd use; 812 # Allow to read and write to heapprofd shmem. 813 # The client needs to read the read and write pointers in order to write. 814 allow $1 heapprofd_tmpfs:file { read write getattr map }; 815 # Use shared memory received over the unix socket. 816 allow $1 heapprofd:fd use; 817 818 # To read and write from the received file descriptors. 819 # /proc/[pid]/maps and /proc/[pid]/mem have the same SELinux label as the 820 # process they relate to. 821 # We need to write to /proc/$PID/page_idle to find idle allocations. 822 # The client only opens /proc/self/page_idle with RDWR, everything else 823 # with RDONLY. 824 # heapprofd cannot open /proc/$PID/mem itself, as it does not have 825 # sys_ptrace. 826 allow heapprofd $1:file rw_file_perms; 827 # Allow searching the /proc/[pid] directory for cmdline. 828 allow heapprofd $1:dir r_dir_perms; 829') 830 831################################### 832# never_profile_heap(domain) 833# Opt out of heap profiling by heapprofd. 834define(`never_profile_heap', ` 835 neverallow heapprofd $1:file read; 836 neverallow heapprofd $1:process signal; 837') 838 839################################### 840# can_profile_perf(domain) 841# Allow processes within the domain to be profiled, and have their stacks 842# sampled, by traced_perf. 843define(`can_profile_perf', ` 844 # Allow directory & file read to traced_perf, as it stat(2)s /proc/[pid], and 845 # reads /proc/[pid]/cmdline. 846 allow traced_perf $1:file r_file_perms; 847 allow traced_perf $1:dir r_dir_perms; 848 849 # Allow central daemon to send signal to request /proc/[pid]/maps and 850 # /proc/[pid]/mem fds from this process. 851 allow traced_perf $1:process signal; 852 853 # Allow connecting to the daemon. 854 unix_socket_connect($1, traced_perf, traced_perf) 855 # Allow daemon to use the passed fds. 856 allow traced_perf $1:fd use; 857') 858 859################################### 860# never_profile_perf(domain) 861# Opt out of profiling by traced_perf. 862define(`never_profile_perf', ` 863 neverallow traced_perf $1:file read; 864 neverallow traced_perf $1:process signal; 865') 866 867################################### 868# perfetto_producer(domain) 869# Allow processes within the domain to write data to Perfetto. 870# When applying this macro, you might need to also allow traced to use the 871# producer tmpfs domain, if the producer will be the one creating the shared 872# memory. 873define(`perfetto_producer', ` 874 allow $1 traced:fd use; 875 allow $1 traced_tmpfs:file { read write getattr map }; 876 unix_socket_connect($1, traced_producer, traced) 877 878 # Also allow the service to use the producer file descriptors. This is 879 # necessary when the producer is creating the shared memory, as it will be 880 # passed to the service as a file descriptor (obtained from memfd_create). 881 allow traced $1:fd use; 882') 883 884########################################### 885# dump_hal(hal_type) 886# Ability to dump the hal debug info 887# 888define(`dump_hal', ` 889 hal_client_domain(dumpstate, $1); 890 allow $1_server dumpstate:fifo_file write; 891 allow $1_server dumpstate:fd use; 892') 893 894##################################### 895# treble_sysprop_neverallow(rules) 896# SELinux neverallow rules which enforces the accessibility of each property 897# outside the owner. 898# 899# For devices launching with R or later, exported properties must be explicitly marked as 900# "restricted" or "public", depending on the accessibility outside the owner. 901# For devices launching with Q or eariler, this neverallow rules can be relaxed with defining 902# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true on BoardConfig.mk. 903# See {partition}_{accessibility}_prop macros below. 904# 905# CTS uses these rules only for devices launching with R or later. 906# 907# TODO(b/131162102): deprecate BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW 908# 909define(`treble_sysprop_neverallow', ifelse(target_treble_sysprop_neverallow, `true', $1, 910ifelse(target_treble_sysprop_neverallow, `cts', 911# BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify 912$1 913# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify 914, ))) 915 916##################################### 917# enforce_sysprop_owner(rules) 918# SELinux neverallow rules which enforces the owner of each property. 919# 920# For devices launching with S or later, all properties must be explicitly marked as one of: 921# system_property_type, vendor_property_type, or product_property_type. 922# For devices launching with R or eariler, this neverallow rules can be relaxed with defining 923# BUILD_BROKEN_ENFORCE_SYSPROP_OWNER := true on BoardConfig.mk. 924# See {partition}_{accessibility}_prop macros below. 925# 926# CTS uses these ules only for devices launching with S or later. 927# 928define(`enforce_sysprop_owner', ifelse(target_enforce_sysprop_owner, `true', $1, 929ifelse(target_enforce_sysprop_owner, `cts', 930# BEGIN_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify 931$1 932# END_LAUNCHING_WITH_S_ONLY -- this marker is used by CTS -- do not modify 933, ))) 934 935########################################### 936# define_prop(name, owner, scope) 937# Define a property with given owner and scope 938# 939define(`define_prop', ` 940 type $1, property_type, $2_property_type, $2_$3_property_type; 941') 942 943########################################### 944# system_internal_prop(name) 945# Define a /system-owned property used only in /system 946# For devices launching with Q or eariler, this restriction can be relaxed with 947# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true 948# 949define(`system_internal_prop', ` 950 define_prop($1, system, internal) 951 treble_sysprop_neverallow(` 952 neverallow { domain -coredomain } $1:file no_rw_file_perms; 953 ') 954') 955 956########################################### 957# system_restricted_prop(name) 958# Define a /system-owned property which can't be written outside /system 959# For devices launching with Q or eariler, this restriction can be relaxed with 960# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true 961# 962define(`system_restricted_prop', ` 963 define_prop($1, system, restricted) 964 treble_sysprop_neverallow(` 965 neverallow { domain -coredomain } $1:property_service set; 966 ') 967') 968 969########################################### 970# system_public_prop(name) 971# Define a /system-owned property with no restrictions 972# 973define(`system_public_prop', `define_prop($1, system, public)') 974 975########################################### 976# system_vendor_config_prop(name) 977# Define a /system-owned property which can only be written by vendor_init 978# This is a macro for vendor-specific configuration properties which is meant 979# to be set once from vendor_init. 980# 981define(`system_vendor_config_prop', ` 982 system_public_prop($1) 983 set_prop(vendor_init, $1) 984 neverallow { domain -init -vendor_init } $1:property_service set; 985') 986 987########################################### 988# product_internal_prop(name) 989# Define a /product-owned property used only in /product 990# For devices launching with Q or eariler, this restriction can be relaxed with 991# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true 992# 993define(`product_internal_prop', ` 994 define_prop($1, product, internal) 995 treble_sysprop_neverallow(` 996 neverallow { domain -coredomain } $1:file no_rw_file_perms; 997 ') 998') 999 1000########################################### 1001# product_restricted_prop(name) 1002# Define a /product-owned property which can't be written outside /product 1003# For devices launching with Q or eariler, this restriction can be relaxed with 1004# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true 1005# 1006define(`product_restricted_prop', ` 1007 define_prop($1, product, restricted) 1008 treble_sysprop_neverallow(` 1009 neverallow { domain -coredomain } $1:property_service set; 1010 ') 1011') 1012 1013########################################### 1014# product_public_prop(name) 1015# Define a /product-owned property with no restrictions 1016# 1017define(`product_public_prop', `define_prop($1, product, public)') 1018 1019########################################### 1020# vendor_internal_prop(name) 1021# Define a /vendor-owned property used only in /vendor 1022# For devices launching with Q or eariler, this restriction can be relaxed with 1023# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true 1024# 1025define(`vendor_internal_prop', ` 1026 define_prop($1, vendor, internal) 1027 treble_sysprop_neverallow(` 1028# init and dumpstate are in coredomain, but should be able to read all props. 1029 neverallow { coredomain -init -dumpstate } $1:file no_rw_file_perms; 1030 ') 1031') 1032 1033########################################### 1034# vendor_restricted_prop(name) 1035# Define a /vendor-owned property which can't be written outside /vendor 1036# For devices launching with Q or eariler, this restriction can be relaxed with 1037# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true 1038# 1039define(`vendor_restricted_prop', ` 1040 define_prop($1, vendor, restricted) 1041 treble_sysprop_neverallow(` 1042# init is in coredomain, but should be able to write all props. 1043 neverallow { coredomain -init } $1:property_service set; 1044 ') 1045') 1046 1047########################################### 1048# vendor_public_prop(name) 1049# Define a /vendor-owned property with no restrictions 1050# 1051define(`vendor_public_prop', `define_prop($1, vendor, public)') 1052 1053##################################### 1054# read_fstab(domain) 1055# Ability to call ReadDefaultFstab() and ReadFstabFromFile(). 1056# 1057define(`read_fstab', ` 1058 allow $1 { metadata_file gsi_metadata_file_type }:dir search; 1059 allow $1 gsi_public_metadata_file:file r_file_perms; 1060 allow $1 { proc_bootconfig proc_cmdline }:file r_file_perms; 1061') 1062 1063###################################### 1064# use_bootstrap_libs(domain) 1065# Allow domain to use bootstrap bionic libraries in system/lib[64]/bootstrap 1066define(`use_bootstrap_libs', ` 1067 allow $1 system_bootstrap_lib_file:dir r_dir_perms; 1068 allow $1 system_bootstrap_lib_file:file { execute read open getattr map }; 1069') 1070 1071###################################### 1072# use_apex_info(domain) 1073# Allow access to apex information 1074define(`use_apex_info', ` 1075 allow $1 apex_mnt_dir:dir r_dir_perms; 1076 allow $1 apex_info_file:file r_file_perms; 1077 r_dir_file($1, vendor_apex_metadata_file) 1078') 1079 1080#################################### 1081# io_uring_use(domain) 1082# Allow domain to create/use io_uring. 1083define(`io_uring_use', ` 1084# Set up a type_transition to "io_uring" named anonymous inode object. 1085type $1_iouring; 1086type_transition $1 $1:anon_inode $1_iouring "[io_uring]"; 1087# Allow domain to create/use io_uring anon_inode. 1088allow $1 $1_iouring:anon_inode { create map read write }; 1089allow $1 self:io_uring sqpoll; 1090# Other domains may not use iouring anon_inodes created by this domain. 1091neverallow { domain -$1 } $1_iouring:anon_inode *; 1092# io_uring checks for CAP_IPC_LOCK to determine whether or not to track 1093# memory usage per uid against RLIMIT_MEMLOCK. This can lead folks to 1094# grant CAP_IPC_LOCK to silence avc denials, which is undesireable. 1095dontaudit $1 self:global_capability_class_set ipc_lock; 1096') 1097