1### 2### Services with isolatedProcess=true in their manifest. 3### 4### This file defines the rules for isolated apps. An "isolated 5### app" is an APP with UID between AID_ISOLATED_START (99000) 6### and AID_ISOLATED_END (99999). 7### 8 9typeattribute isolated_app coredomain; 10 11app_domain(isolated_app) 12 13# Access already open app data files received over Binder or local socket IPC. 14allow isolated_app app_data_file:file { append read write getattr lock }; 15 16allow isolated_app activity_service:service_manager find; 17allow isolated_app display_service:service_manager find; 18allow isolated_app webviewupdate_service:service_manager find; 19 20# Google Breakpad (crash reporter for Chrome) relies on ptrace 21# functionality. Without the ability to ptrace, the crash reporter 22# tool is broken. 23# b/20150694 24# https://code.google.com/p/chromium/issues/detail?id=475270 25allow isolated_app self:process ptrace; 26 27# b/32896414: Allow accessing sdcard file descriptors passed to isolated_apps 28# by other processes. Open should never be allowed, and is blocked by 29# neverallow rules below. 30# TODO: consider removing write/append. We want to limit isolated_apps 31# ability to mutate files of any type. 32# media_rw_data_file is included for sdcardfs, and can be removed if sdcardfs 33# is modified to change the secontext when accessing the lower filesystem. 34allow isolated_app { sdcard_type media_rw_data_file }:file { read write append getattr lock }; 35auditallow isolated_app { sdcard_type media_rw_data_file }:file { write append }; 36 37# For webviews, isolated_app processes can be forked from the webview_zygote 38# in addition to the zygote. Allow access to resources inherited from the 39# webview_zygote process. These rules are specialized copies of the ones in app.te. 40# Inherit FDs from the webview_zygote. 41allow isolated_app webview_zygote:fd use; 42# Notify webview_zygote of child death. 43allow isolated_app webview_zygote:process sigchld; 44# Inherit logd write socket. 45allow isolated_app webview_zygote:unix_dgram_socket write; 46# Read system properties managed by webview_zygote. 47allow isolated_app webview_zygote_tmpfs:file read; 48 49##### 50##### Neverallow 51##### 52 53# Do not allow isolated_app to directly open tun_device 54neverallow isolated_app tun_device:chr_file open; 55 56# Isolated apps should not directly open app data files themselves. 57neverallow isolated_app app_data_file:file open; 58 59# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553) 60# TODO: are there situations where isolated_apps write to this file? 61# TODO: should we tighten these restrictions further? 62neverallow isolated_app anr_data_file:file ~{ open append }; 63neverallow isolated_app anr_data_file:dir ~search; 64 65# b/17487348 66# Isolated apps can only access three services, 67# activity_service, display_service and webviewupdate_service. 68neverallow isolated_app { 69 service_manager_type 70 -activity_service 71 -display_service 72 -webviewupdate_service 73}:service_manager find; 74 75# Isolated apps shouldn't be able to access the driver directly. 76neverallow isolated_app gpu_device:chr_file { rw_file_perms execute }; 77 78# Do not allow isolated_app access to /cache 79neverallow isolated_app cache_file:dir ~{ r_dir_perms }; 80neverallow isolated_app cache_file:file ~{ read getattr }; 81 82# Do not allow isolated_app to access external storage, except for files passed 83# via file descriptors (b/32896414). 84neverallow isolated_app { storage_file mnt_user_file sdcard_type }:dir ~getattr; 85neverallow isolated_app { storage_file mnt_user_file }:file_class_set *; 86neverallow isolated_app sdcard_type:{ devfile_class_set lnk_file sock_file fifo_file } *; 87neverallow isolated_app sdcard_type:file ~{ read write append getattr lock }; 88 89# Do not allow USB access 90neverallow isolated_app { usb_device usbaccessory_device }:chr_file *; 91 92# Restrict the webview_zygote control socket. 93neverallow isolated_app webview_zygote_socket:sock_file write; 94