1### ADB daemon 2 3typeattribute adbd coredomain; 4typeattribute adbd mlstrustedsubject; 5 6init_daemon_domain(adbd) 7 8domain_auto_trans(adbd, shell_exec, shell) 9 10userdebug_or_eng(` 11 allow adbd self:process setcurrent; 12 allow adbd su:process dyntransition; 13') 14 15# When 'adb shell' is executed in recovery mode, adbd explicitly 16# switches into shell domain using setcon() because the shell executable 17# is not labeled as shell but as rootfs. 18recovery_only(` 19 domain_trans(adbd, rootfs, shell) 20 allow adbd shell:process dyntransition; 21 22 # Allows reboot fastboot to enter fastboot directly 23 unix_socket_connect(adbd, recovery, recovery) 24') 25 26# Control Perfetto traced and obtain traces from it. 27# Needed to allow port forwarding directly to traced. 28unix_socket_connect(adbd, traced_consumer, traced) 29 30# Do not sanitize the environment or open fds of the shell. Allow signaling 31# created processes. 32allow adbd shell:process { noatsecure signal }; 33 34# Set UID and GID to shell. Set supplementary groups. 35allow adbd self:global_capability_class_set { setuid setgid }; 36 37# Drop capabilities from bounding set on user builds. 38allow adbd self:global_capability_class_set setpcap; 39 40# ignore spurious denials for adbd when disk space is low. 41dontaudit adbd self:global_capability_class_set sys_resource; 42 43# adbd probes for vsock support. Do not generate denials when 44# this occurs. (b/123569840) 45dontaudit adbd self:{ socket vsock_socket } create; 46 47# Create and use network sockets. 48net_domain(adbd) 49 50# Access /dev/usb-ffs/adb/ep0 51allow adbd functionfs:dir search; 52allow adbd functionfs:file rw_file_perms; 53allowxperm adbd functionfs:file ioctl { 54 FUNCTIONFS_ENDPOINT_DESC 55 FUNCTIONFS_CLEAR_HALT 56}; 57 58# Use a pseudo tty. 59allow adbd devpts:chr_file rw_file_perms; 60 61# adb push/pull /data/local/tmp. 62allow adbd shell_data_file:dir create_dir_perms; 63allow adbd shell_data_file:file create_file_perms; 64 65# adb pull /data/local/traces/* 66allow adbd trace_data_file:dir r_dir_perms; 67allow adbd trace_data_file:file r_file_perms; 68 69# adb pull /data/misc/profman. 70allow adbd profman_dump_data_file:dir r_dir_perms; 71allow adbd profman_dump_data_file:file r_file_perms; 72 73# adb push/pull sdcard. 74allow adbd tmpfs:dir search; 75allow adbd rootfs:lnk_file r_file_perms; # /sdcard symlink 76allow adbd tmpfs:lnk_file r_file_perms; # /mnt/sdcard symlink 77allow adbd sdcard_type:dir create_dir_perms; 78allow adbd sdcard_type:file create_file_perms; 79 80# adb pull /data/anr/traces.txt 81allow adbd anr_data_file:dir r_dir_perms; 82allow adbd anr_data_file:file r_file_perms; 83 84# Set service.adb.*, sys.powerctl, and sys.usb.ffs.ready properties. 85set_prop(adbd, shell_prop) 86set_prop(adbd, powerctl_prop) 87set_prop(adbd, ffs_prop) 88set_prop(adbd, exported_ffs_prop) 89 90# Access device logging gating property 91get_prop(adbd, device_logging_prop) 92 93# Read device's serial number from system properties 94get_prop(adbd, serialno_prop) 95 96# Read whether or not Test Harness Mode is enabled 97get_prop(adbd, test_harness_prop) 98 99# Read device's overlayfs related properties and files 100userdebug_or_eng(` 101 get_prop(adbd, persistent_properties_ready_prop) 102 r_dir_file(adbd, sysfs_dt_firmware_android) 103') 104 105# Run /system/bin/bu 106allow adbd system_file:file rx_file_perms; 107 108# Perform binder IPC to surfaceflinger (screencap) 109# XXX Run screencap in a separate domain? 110binder_use(adbd) 111binder_call(adbd, surfaceflinger) 112binder_call(adbd, gpuservice) 113# b/13188914 114allow adbd gpu_device:chr_file rw_file_perms; 115allow adbd ion_device:chr_file rw_file_perms; 116r_dir_file(adbd, system_file) 117 118# Needed for various screenshots 119hal_client_domain(adbd, hal_graphics_allocator) 120 121# Read /data/misc/adb/adb_keys. 122allow adbd adb_keys_file:dir search; 123allow adbd adb_keys_file:file r_file_perms; 124 125userdebug_or_eng(` 126 # Write debugging information to /data/adb 127 # when persist.adb.trace_mask is set 128 # https://code.google.com/p/android/issues/detail?id=72895 129 allow adbd adb_data_file:dir rw_dir_perms; 130 allow adbd adb_data_file:file create_file_perms; 131') 132 133# ndk-gdb invokes adb forward to forward the gdbserver socket. 134allow adbd app_data_file:dir search; 135allow adbd app_data_file:sock_file write; 136allow adbd appdomain:unix_stream_socket connectto; 137 138# ndk-gdb invokes adb pull of app_process, linker, and libc.so. 139allow adbd zygote_exec:file r_file_perms; 140allow adbd system_file:file r_file_perms; 141 142# Allow pulling the SELinux policy for CTS purposes 143allow adbd selinuxfs:dir r_dir_perms; 144allow adbd selinuxfs:file r_file_perms; 145allow adbd kernel:security read_policy; 146allow adbd service_contexts_file:file r_file_perms; 147allow adbd file_contexts_file:file r_file_perms; 148allow adbd seapp_contexts_file:file r_file_perms; 149allow adbd property_contexts_file:file r_file_perms; 150allow adbd sepolicy_file:file r_file_perms; 151 152# Allow pulling config.gz for CTS purposes 153allow adbd config_gz:file r_file_perms; 154 155allow adbd gpu_service:service_manager find; 156allow adbd surfaceflinger_service:service_manager find; 157allow adbd bootchart_data_file:dir search; 158allow adbd bootchart_data_file:file r_file_perms; 159 160# Allow access to external storage; we have several visible mount points under /storage 161# and symlinks to primary storage at places like /storage/sdcard0 and /mnt/user/0/primary 162allow adbd storage_file:dir r_dir_perms; 163allow adbd storage_file:lnk_file r_file_perms; 164allow adbd mnt_user_file:dir r_dir_perms; 165allow adbd mnt_user_file:lnk_file r_file_perms; 166 167# Access to /data/media. 168# This should be removed if sdcardfs is modified to alter the secontext for its 169# accesses to the underlying FS. 170allow adbd media_rw_data_file:dir create_dir_perms; 171allow adbd media_rw_data_file:file create_file_perms; 172 173r_dir_file(adbd, apk_data_file) 174 175allow adbd rootfs:dir r_dir_perms; 176 177# Allow to pull Perfetto traces. 178allow adbd perfetto_traces_data_file:file r_file_perms; 179allow adbd perfetto_traces_data_file:dir r_dir_perms; 180 181# Connect to shell and use a socket transferred from it. 182# Used for e.g. abb. 183allow adbd shell:unix_stream_socket { read write }; 184allow adbd shell:fd use; 185 186### 187### Neverallow rules 188### 189 190# No transitions from adbd to non-shell, non-crash_dump domains. adbd only ever 191# transitions to the shell domain (except when it crashes). In particular, we 192# never want to see a transition from adbd to su (aka "adb root") 193neverallow adbd { domain -crash_dump -shell }:process transition; 194neverallow adbd { domain userdebug_or_eng(`-su') recovery_only(`-shell') }:process dyntransition; 195