1# zygote 2typeattribute zygote coredomain; 3typeattribute zygote mlstrustedsubject; 4 5init_daemon_domain(zygote) 6 7read_runtime_log_tags(zygote) 8 9# Override DAC on files and switch uid/gid. 10allow zygote self:global_capability_class_set { dac_override dac_read_search setgid setuid fowner chown }; 11 12# Drop capabilities from bounding set. 13allow zygote self:global_capability_class_set setpcap; 14 15# Switch SELinux context to app domains. 16allow zygote self:process setcurrent; 17allow zygote system_server_startup:process dyntransition; 18allow zygote appdomain:process dyntransition; 19allow zygote webview_zygote:process dyntransition; 20allow zygote app_zygote:process dyntransition; 21 22# Allow zygote to read app /proc/pid dirs (b/10455872). 23allow zygote appdomain:dir { getattr search }; 24allow zygote appdomain:file { r_file_perms }; 25 26# Move children into the peer process group. 27allow zygote system_server:process { getpgid setpgid }; 28allow zygote appdomain:process { getpgid setpgid }; 29allow zygote webview_zygote:process { getpgid setpgid }; 30allow zygote app_zygote:process { getpgid setpgid }; 31 32# Read system data. 33allow zygote system_data_file:dir r_dir_perms; 34allow zygote system_data_file:file r_file_perms; 35 36# Write to /data/dalvik-cache. 37allow zygote dalvikcache_data_file:dir create_dir_perms; 38allow zygote dalvikcache_data_file:file create_file_perms; 39 40# Create symlinks in /data/dalvik-cache. 41allow zygote dalvikcache_data_file:lnk_file create_file_perms; 42 43# Write to /data/resource-cache. 44allow zygote resourcecache_data_file:dir rw_dir_perms; 45allow zygote resourcecache_data_file:file create_file_perms; 46 47# For updateability, the zygote may fetch the current boot 48# classpath from the dalvik cache. Integrity of the files 49# is ensured by fsverity protection (checked in art_apex_boot_integrity). 50allow zygote dalvikcache_data_file:file execute; 51 52# Allow zygote to create JIT memory. 53allow zygote self:process execmem; 54 55# Execute idmap and dex2oat within zygote's own domain. 56# TODO: Should either of these be transitioned to the same domain 57# used by installd or stay in-domain for zygote? 58allow zygote idmap_exec:file rx_file_perms; 59allow zygote dex2oat_exec:file rx_file_perms; 60 61# Allow apps access to /vendor/overlay 62r_dir_file(zygote, vendor_overlay_file) 63 64# Control cgroups. 65allow zygote cgroup:dir create_dir_perms; 66allow zygote cgroup:{ file lnk_file } r_file_perms; 67allow zygote self:global_capability_class_set sys_admin; 68 69# Allow zygote to stat the files that it opens. The zygote must 70# be able to inspect them so that it can reopen them on fork 71# if necessary: b/30963384. 72allow zygote pmsg_device:chr_file getattr; 73allow zygote debugfs_trace_marker:file getattr; 74 75# Get seapp_contexts 76allow zygote seapp_contexts_file:file r_file_perms; 77# Check validity of SELinux context before use. 78selinux_check_context(zygote) 79# Check SELinux permissions. 80selinux_check_access(zygote) 81 82# Native bridge functionality requires that zygote replaces 83# /proc/cpuinfo with /system/lib/<ISA>/cpuinfo using a bind mount 84allow zygote proc_cpuinfo:file mounton; 85 86# Allow remounting rootfs as MS_SLAVE. 87allow zygote rootfs:dir mounton; 88allow zygote tmpfs:filesystem { mount unmount }; 89allow zygote fuse:filesystem { unmount }; 90allow zygote sdcardfs:filesystem { unmount }; 91 92# Allow creating user-specific storage source if started before vold. 93allow zygote mnt_user_file:dir { create_dir_perms mounton }; 94allow zygote mnt_user_file:lnk_file create_file_perms; 95allow zygote mnt_user_file:file create_file_perms; 96# Allowed to mount user-specific storage into place 97allow zygote storage_file:dir { search mounton }; 98 99# Allow mounting and creating files, dirs on sdcardfs. 100# TODO: reduce this back to only sdcardfs once b/123533205 is root-caused 101# (Technically "sdcardfs" and "media_rw_data_file" are equivalent, since 102# sdcardfs simply wraps files stored under /data/media.) 103allow zygote { sdcard_type media_rw_data_file }:dir { create_dir_perms mounton }; 104allow zygote { sdcard_type media_rw_data_file }:file { create_file_perms }; 105 106# Allow zygote to expand app files while preloading libraries 107allow zygote mnt_expand_file:dir getattr; 108 109# Handle --invoke-with command when launching Zygote with a wrapper command. 110allow zygote zygote_exec:file rx_file_perms; 111 112# Allow zygote to write to statsd. 113unix_socket_send(zygote, statsdw, statsd) 114 115# Root fs. 116r_dir_file(zygote, rootfs) 117 118# System file accesses. 119r_dir_file(zygote, system_file) 120 121# /oem accesses. 122allow zygote oemfs:dir search; 123 124userdebug_or_eng(` 125 # Allow zygote to create and write method traces in /data/misc/trace. 126 allow zygote method_trace_data_file:dir w_dir_perms; 127 allow zygote method_trace_data_file:file { create w_file_perms }; 128') 129 130allow zygote ion_device:chr_file r_file_perms; 131allow zygote tmpfs:dir r_dir_perms; 132 133allow zygote same_process_hal_file:file { execute read open getattr map }; 134 135# Let the zygote access overlays so it can initialize the AssetManager. 136get_prop(zygote, overlay_prop) 137get_prop(zygote, exported_overlay_prop) 138 139# Allow the zygote to access the runtime feature flag properties. 140get_prop(zygote, device_config_runtime_native_prop) 141get_prop(zygote, device_config_runtime_native_boot_prop) 142 143# ingore spurious denials 144dontaudit zygote self:global_capability_class_set sys_resource; 145 146### 147### neverallow rules 148### 149 150# Ensure that all types assigned to app processes are included 151# in the appdomain attribute, so that all allow and neverallow rules 152# written on appdomain are applied to all app processes. 153# This is achieved by ensuring that it is impossible for zygote to 154# setcon (dyntransition) to any types other than those associated 155# with appdomain plus system_server_startup, webview_zygote and 156# app_zygote. 157neverallow zygote ~{ 158 appdomain 159 system_server_startup 160 webview_zygote 161 app_zygote 162}:process dyntransition; 163 164# Zygote should never execute anything from /data except for /data/dalvik-cache files. 165neverallow zygote { 166 data_file_type 167 -dalvikcache_data_file # map PROT_EXEC 168}:file no_x_file_perms; 169 170# Do not allow access to Bluetooth-related system properties and files 171neverallow zygote { 172 bluetooth_a2dp_offload_prop 173 bluetooth_audio_hal_prop 174 bluetooth_prop 175 exported_bluetooth_prop 176}:file create_file_perms; 177