1### 2### Ephemeral apps. 3### 4### This file defines the security policy for apps with the ephemeral 5### feature. 6### 7### The ephemeral_app domain is a reduced permissions sandbox allowing 8### ephemeral applications to be safely installed and run. Non ephemeral 9### applications may also opt-in to ephemeral to take advantage of the 10### additional security features. 11### 12### PackageManager flags an app as ephemeral at install time. 13 14typeattribute ephemeral_app coredomain; 15 16net_domain(ephemeral_app) 17app_domain(ephemeral_app) 18 19# Allow ephemeral apps to read/write files in visible storage if provided fds 20allow ephemeral_app { sdcard_type media_rw_data_file }:file {read write getattr ioctl lock append}; 21 22# Some apps ship with shared libraries and binaries that they write out 23# to their sandbox directory and then execute. 24allow ephemeral_app privapp_data_file:file { r_file_perms execute }; 25allow ephemeral_app app_data_file:file { r_file_perms execute }; 26 27# Follow priv-app symlinks. This is used for dynamite functionality. 28allow ephemeral_app privapp_data_file:lnk_file r_file_perms; 29 30# Allow the renderscript compiler to be run. 31domain_auto_trans(ephemeral_app, rs_exec, rs) 32 33# Allow loading and deleting shared libraries created by trusted system 34# components within an application home directory. 35allow ephemeral_app app_exec_data_file:file { r_file_perms execute unlink }; 36 37# services 38allow ephemeral_app audioserver_service:service_manager find; 39allow ephemeral_app cameraserver_service:service_manager find; 40allow ephemeral_app mediaserver_service:service_manager find; 41allow ephemeral_app mediaextractor_service:service_manager find; 42allow ephemeral_app mediacodec_service:service_manager find; 43allow ephemeral_app mediametrics_service:service_manager find; 44allow ephemeral_app mediadrmserver_service:service_manager find; 45allow ephemeral_app drmserver_service:service_manager find; 46allow ephemeral_app radio_service:service_manager find; 47allow ephemeral_app ephemeral_app_api_service:service_manager find; 48allow ephemeral_app gpu_service:service_manager find; 49 50# Allow ephemeral apps to interact with gpuservice 51binder_call(ephemeral_app, gpuservice) 52 53# Write app-specific trace data to the Perfetto traced damon. This requires 54# connecting to its producer socket and obtaining a (per-process) tmpfs fd. 55allow ephemeral_app traced:fd use; 56allow ephemeral_app traced_tmpfs:file { read write getattr map }; 57unix_socket_connect(ephemeral_app, traced_producer, traced) 58 59# Allow heap profiling if the app opts in by being marked 60# profileable/debuggable. 61can_profile_heap(ephemeral_app) 62 63# allow ephemeral apps to use UDP sockets provided by the system server but not 64# modify them other than to connect 65allow ephemeral_app system_server:udp_socket { 66 connect getattr read recvfrom sendto write getopt setopt }; 67 68allow ephemeral_app ashmem_device:chr_file rw_file_perms; 69 70### 71### neverallow rules 72### 73 74neverallow ephemeral_app { app_data_file privapp_data_file }:file execute_no_trans; 75 76# Receive or send uevent messages. 77neverallow ephemeral_app domain:netlink_kobject_uevent_socket *; 78 79# Receive or send generic netlink messages 80neverallow ephemeral_app domain:netlink_socket *; 81 82# Too much leaky information in debugfs. It's a security 83# best practice to ensure these files aren't readable. 84neverallow ephemeral_app debugfs:file read; 85 86# execute gpu_device 87neverallow ephemeral_app gpu_device:chr_file execute; 88 89# access files in /sys with the default sysfs label 90neverallow ephemeral_app sysfs:file *; 91 92# Avoid reads from generically labeled /proc files 93# Create a more specific label if needed 94neverallow ephemeral_app proc:file { no_rw_file_perms no_x_file_perms }; 95 96# Directly access external storage 97neverallow ephemeral_app { sdcard_type media_rw_data_file }:file {open create}; 98neverallow ephemeral_app { sdcard_type media_rw_data_file }:dir search; 99 100# Avoid reads to proc_net, it contains too much device wide information about 101# ongoing connections. 102neverallow ephemeral_app proc_net:file no_rw_file_perms; 103