1# vendor_init is its own domain. 2type vendor_init, domain, mlstrustedsubject; 3 4# Communication to the main init process 5allow vendor_init init:unix_stream_socket { read write }; 6 7# Logging to kmsg 8allow vendor_init kmsg_device:chr_file { open getattr write }; 9 10# Mount on /dev/usb-ffs/adb. 11allow vendor_init device:dir mounton; 12 13# Create and remove symlinks in /. 14allow vendor_init rootfs:lnk_file { create unlink }; 15 16# Create cgroups mount points in tmpfs and mount cgroups on them. 17allow vendor_init cgroup:dir create_dir_perms; 18allow vendor_init cgroup:file w_file_perms; 19 20# /config 21allow vendor_init configfs:dir mounton; 22allow vendor_init configfs:dir create_dir_perms; 23allow vendor_init configfs:{ file lnk_file } create_file_perms; 24 25# Create directories under /dev/cpuctl after chowning it to system. 26allow vendor_init self:global_capability_class_set { dac_override dac_read_search }; 27 28# mkdir, symlink, write, rm/rmdir, chown/chmod, restorecon/restorecon_recursive from init.rc files. 29# chown/chmod require open+read+setattr required for open()+fchown/fchmod(). 30# system/core/init.rc requires at least cache_file and data_file_type. 31# init.<board>.rc files often include device-specific types, so 32# we just allow all file types except /system files here. 33allow vendor_init self:global_capability_class_set { chown fowner fsetid }; 34 35# mkdir with FBE requires reading /data/unencrypted/{ref,mode}. 36allow vendor_init unencrypted_data_file:dir search; 37allow vendor_init unencrypted_data_file:file r_file_perms; 38 39# Set encryption policy on dirs in /data 40allowxperm vendor_init data_file_type:dir ioctl { 41 FS_IOC_GET_ENCRYPTION_POLICY 42 FS_IOC_SET_ENCRYPTION_POLICY 43}; 44 45allow vendor_init system_data_file:dir getattr; 46 47allow vendor_init { 48 file_type 49 -core_data_file_type 50 -exec_type 51 -system_file_type 52 -mnt_product_file 53 -password_slot_metadata_file 54 -unlabeled 55 -vendor_file_type 56 -vold_metadata_file 57 -gsi_metadata_file 58 -apex_metadata_file 59}:dir { create search getattr open read setattr ioctl write add_name remove_name rmdir relabelfrom }; 60 61allow vendor_init unlabeled:{ dir notdevfile_class_set } { getattr relabelfrom }; 62 63allow vendor_init { 64 file_type 65 -core_data_file_type 66 -exec_type 67 -password_slot_metadata_file 68 -runtime_event_log_tags_file 69 -system_file_type 70 -unlabeled 71 -vendor_file_type 72 -vold_metadata_file 73 -gsi_metadata_file 74 -apex_metadata_file 75}:file { create getattr open read write setattr relabelfrom unlink map }; 76 77allow vendor_init { 78 file_type 79 -core_data_file_type 80 -exec_type 81 -password_slot_metadata_file 82 -system_file_type 83 -unlabeled 84 -vendor_file_type 85 -vold_metadata_file 86 -gsi_metadata_file 87 -apex_metadata_file 88}:{ sock_file fifo_file } { create getattr open read setattr relabelfrom unlink }; 89 90allow vendor_init { 91 file_type 92 -apex_mnt_dir 93 -core_data_file_type 94 -exec_type 95 -password_slot_metadata_file 96 -system_file_type 97 -unlabeled 98 -vendor_file_type 99 -vold_metadata_file 100 -gsi_metadata_file 101 -apex_metadata_file 102}:lnk_file { create getattr setattr relabelfrom unlink }; 103 104allow vendor_init { 105 file_type 106 -core_data_file_type 107 -exec_type 108 -mnt_product_file 109 -password_slot_metadata_file 110 -system_file_type 111 -vendor_file_type 112 -vold_metadata_file 113 -gsi_metadata_file 114 -apex_metadata_file 115}:dir_file_class_set relabelto; 116 117allow vendor_init dev_type:dir create_dir_perms; 118allow vendor_init dev_type:lnk_file create; 119 120# Disable tracing by writing to /sys/kernel/debug/tracing/tracing_on 121allow vendor_init debugfs_tracing:file w_file_perms; 122 123# chown/chmod on pseudo files. 124allow vendor_init { 125 fs_type 126 -contextmount_type 127 -keychord_device 128 -sdcard_type 129 -rootfs 130 -proc_uid_time_in_state 131 -proc_uid_concurrent_active_time 132 -proc_uid_concurrent_policy_time 133}:file { open read setattr map }; 134 135allow vendor_init { 136 fs_type 137 -contextmount_type 138 -sdcard_type 139 -rootfs 140 -proc_uid_time_in_state 141 -proc_uid_concurrent_active_time 142 -proc_uid_concurrent_policy_time 143}:dir { open read setattr search }; 144 145# chown/chmod on devices, e.g. /dev/ttyHS0 146allow vendor_init { 147 dev_type 148 -keychord_device 149 -port_device 150 -lowpan_device 151 -hw_random_device 152}:chr_file setattr; 153 154allow vendor_init dev_type:blk_file getattr; 155 156# Write to /proc/sys/net/ping_group_range and other /proc/sys/net files. 157r_dir_file(vendor_init, proc_net_type) 158allow vendor_init proc_net_type:file w_file_perms; 159allow vendor_init self:global_capability_class_set net_admin; 160 161# Write to /proc/sys/vm/page-cluster 162allow vendor_init proc_page_cluster:file w_file_perms; 163 164# Write to sysfs nodes. 165allow vendor_init sysfs_type:dir r_dir_perms; 166allow vendor_init sysfs_type:lnk_file read; 167allow vendor_init { sysfs_type -sysfs_usermodehelper }:file rw_file_perms; 168 169# setfscreatecon() for labeling directories and socket files. 170allow vendor_init self:process { setfscreate }; 171 172r_dir_file(vendor_init, vendor_file_type) 173 174# Vendor init can read properties 175allow vendor_init serialno_prop:file { getattr open read map }; 176 177# Vendor init can perform operations on trusted and security Extended Attributes 178allow vendor_init self:global_capability_class_set sys_admin; 179 180# Raw writes to misc block device 181allow vendor_init misc_block_device:blk_file w_file_perms; 182 183# vendor_init is using bootstrap bionic 184allow vendor_init system_bootstrap_lib_file:dir r_dir_perms; 185allow vendor_init system_bootstrap_lib_file:file { execute read open getattr map }; 186 187# Everything is labeled as rootfs in recovery mode. Vendor init has to execute 188# the dynamic linker and shared libraries. 189recovery_only(` 190 allow vendor_init rootfs:file { r_file_perms execute }; 191') 192 193not_compatible_property(` 194 set_prop(vendor_init, { 195 property_type 196 -device_config_activity_manager_native_boot_prop 197 -device_config_boot_count_prop 198 -device_config_reset_performed_prop 199 -device_config_input_native_boot_prop 200 -device_config_netd_native_prop 201 -device_config_runtime_native_boot_prop 202 -device_config_runtime_native_prop 203 -device_config_media_native_prop 204 -restorecon_prop 205 -netd_stable_secret_prop 206 -firstboot_prop 207 -pm_prop 208 -system_boot_reason_prop 209 -bootloader_boot_reason_prop 210 -last_boot_reason_prop 211 -apexd_prop 212 -gsid_prop 213 -nnapi_ext_deny_product_prop 214 }) 215') 216 217# Get file context 218allow vendor_init file_contexts_file:file r_file_perms; 219 220set_prop(vendor_init, bluetooth_a2dp_offload_prop) 221set_prop(vendor_init, bluetooth_audio_hal_prop) 222set_prop(vendor_init, cpu_variant_prop) 223set_prop(vendor_init, debug_prop) 224set_prop(vendor_init, exported_audio_prop) 225set_prop(vendor_init, exported_bluetooth_prop) 226set_prop(vendor_init, exported_config_prop) 227set_prop(vendor_init, exported_dalvik_prop) 228set_prop(vendor_init, exported_default_prop) 229set_prop(vendor_init, exported_ffs_prop) 230set_prop(vendor_init, exported_overlay_prop) 231set_prop(vendor_init, exported_pm_prop) 232set_prop(vendor_init, exported_radio_prop) 233set_prop(vendor_init, exported_system_radio_prop) 234set_prop(vendor_init, exported_wifi_prop) 235set_prop(vendor_init, exported2_config_prop) 236set_prop(vendor_init, exported2_system_prop) 237set_prop(vendor_init, exported2_vold_prop) 238set_prop(vendor_init, exported3_default_prop) 239set_prop(vendor_init, exported3_radio_prop) 240set_prop(vendor_init, logd_prop) 241set_prop(vendor_init, log_tag_prop) 242set_prop(vendor_init, log_prop) 243set_prop(vendor_init, serialno_prop) 244set_prop(vendor_init, vendor_default_prop) 245set_prop(vendor_init, vendor_security_patch_level_prop) 246set_prop(vendor_init, wifi_log_prop) 247 248get_prop(vendor_init, exported2_radio_prop) 249get_prop(vendor_init, exported3_system_prop) 250get_prop(vendor_init, theme_prop) 251 252### 253### neverallow rules 254### 255 256# Vendor init shouldn't communicate with any vendor process, nor most system processes. 257neverallow_establish_socket_comms(vendor_init, { domain -init -logd -su -vendor_init }); 258 259# The vendor_init domain is only entered via an exec based transition from the 260# init domain, never via setcon(). 261neverallow domain vendor_init:process dyntransition; 262neverallow { domain -init } vendor_init:process transition; 263neverallow vendor_init { file_type fs_type -init_exec }:file entrypoint; 264 265# Never read/follow symlinks created by shell or untrusted apps. 266neverallow vendor_init { app_data_file privapp_data_file }:lnk_file read; 267neverallow vendor_init shell_data_file:lnk_file read; 268# Init should not be creating subdirectories in /data/local/tmp 269neverallow vendor_init shell_data_file:dir { write add_name remove_name }; 270 271# init should never execute a program without changing to another domain. 272neverallow vendor_init { file_type fs_type }:file execute_no_trans; 273 274# Init never adds or uses services via service_manager. 275neverallow vendor_init service_manager_type:service_manager { add find }; 276neverallow vendor_init servicemanager:service_manager list; 277 278# vendor_init should never be ptraced 279neverallow * vendor_init:process ptrace; 280