1# zygote 2typeattribute zygote coredomain; 3typeattribute zygote mlstrustedsubject; 4 5init_daemon_domain(zygote) 6 7read_runtime_log_tags(zygote) 8 9# Override DAC on files and switch uid/gid. 10allow zygote self:global_capability_class_set { dac_override setgid setuid fowner chown }; 11 12# Drop capabilities from bounding set. 13allow zygote self:global_capability_class_set setpcap; 14 15# Switch SELinux context to app domains. 16allow zygote self:process setcurrent; 17allow zygote system_server:process dyntransition; 18allow zygote appdomain:process dyntransition; 19allow zygote webview_zygote:process dyntransition; 20 21# Allow zygote to read app /proc/pid dirs (b/10455872). 22allow zygote appdomain:dir { getattr search }; 23allow zygote appdomain:file { r_file_perms }; 24 25# Move children into the peer process group. 26allow zygote system_server:process { getpgid setpgid }; 27allow zygote appdomain:process { getpgid setpgid }; 28allow zygote webview_zygote:process { getpgid setpgid }; 29 30# Read system data. 31allow zygote system_data_file:dir r_dir_perms; 32allow zygote system_data_file:file r_file_perms; 33 34# Write to /data/dalvik-cache. 35allow zygote dalvikcache_data_file:dir create_dir_perms; 36allow zygote dalvikcache_data_file:file create_file_perms; 37 38# Create symlinks in /data/dalvik-cache. 39allow zygote dalvikcache_data_file:lnk_file create_file_perms; 40 41# Write to /data/resource-cache. 42allow zygote resourcecache_data_file:dir rw_dir_perms; 43allow zygote resourcecache_data_file:file create_file_perms; 44 45# When WITH_DEXPREOPT is true, the zygote does not load executable content from 46# /data/dalvik-cache. 47allow { zygote with_dexpreopt(`-zygote') } dalvikcache_data_file:file execute; 48 49# Execute idmap and dex2oat within zygote's own domain. 50# TODO: Should either of these be transitioned to the same domain 51# used by installd or stay in-domain for zygote? 52allow zygote idmap_exec:file rx_file_perms; 53allow zygote dex2oat_exec:file rx_file_perms; 54 55# Allow apps access to /vendor/overlay 56r_dir_file(zygote, vendor_overlay_file) 57 58# Control cgroups. 59allow zygote cgroup:dir create_dir_perms; 60allow zygote cgroup:{ file lnk_file } r_file_perms; 61allow zygote self:global_capability_class_set sys_admin; 62 63# Allow zygote to stat the files that it opens. The zygote must 64# be able to inspect them so that it can reopen them on fork 65# if necessary: b/30963384. 66allow zygote pmsg_device:chr_file getattr; 67allow zygote debugfs_trace_marker:file getattr; 68 69# Get seapp_contexts 70allow zygote seapp_contexts_file:file r_file_perms; 71# Check validity of SELinux context before use. 72selinux_check_context(zygote) 73# Check SELinux permissions. 74selinux_check_access(zygote) 75 76# Native bridge functionality requires that zygote replaces 77# /proc/cpuinfo with /system/lib/<ISA>/cpuinfo using a bind mount 78allow zygote proc_cpuinfo:file mounton; 79 80# Allow remounting rootfs as MS_SLAVE. 81allow zygote rootfs:dir mounton; 82allow zygote tmpfs:filesystem { mount unmount }; 83allow zygote fuse:filesystem { unmount }; 84allow zygote sdcardfs:filesystem { unmount }; 85 86# Allow creating user-specific storage source if started before vold. 87allow zygote mnt_user_file:dir create_dir_perms; 88allow zygote mnt_user_file:lnk_file create_file_perms; 89# Allowed to mount user-specific storage into place 90allow zygote storage_file:dir { search mounton }; 91 92# Handle --invoke-with command when launching Zygote with a wrapper command. 93allow zygote zygote_exec:file rx_file_perms; 94 95# Read access to pseudo filesystems. 96r_dir_file(zygote, proc_net) 97 98# Root fs. 99r_dir_file(zygote, rootfs) 100 101# System file accesses. 102r_dir_file(zygote, system_file) 103 104userdebug_or_eng(` 105 # Allow zygote to create and write method traces in /data/misc/trace. 106 allow zygote method_trace_data_file:dir w_dir_perms; 107 allow zygote method_trace_data_file:file { create w_file_perms }; 108') 109 110allow zygote ion_device:chr_file r_file_perms; 111allow zygote tmpfs:dir r_dir_perms; 112 113# Let the zygote access overlays so it can initialize the AssetManager. 114get_prop(zygote, overlay_prop) 115get_prop(zygote, exported_overlay_prop) 116 117### 118### neverallow rules 119### 120 121# Ensure that all types assigned to app processes are included 122# in the appdomain attribute, so that all allow and neverallow rules 123# written on appdomain are applied to all app processes. 124# This is achieved by ensuring that it is impossible for zygote to 125# setcon (dyntransition) to any types other than those associated 126# with appdomain plus system_server and webview_zygote. 127neverallow zygote ~{ appdomain system_server webview_zygote }:process dyntransition; 128 129# Zygote should never execute anything from /data except for /data/dalvik-cache files. 130neverallow zygote { 131 data_file_type 132 -dalvikcache_data_file # map PROT_EXEC 133}:file no_x_file_perms; 134 135# Do not allow access to Bluetooth-related system properties and files 136neverallow zygote { 137 bluetooth_a2dp_offload_prop 138 bluetooth_prop 139 exported_bluetooth_prop 140}:file create_file_perms; 141