1##################################### 2# domain_trans(olddomain, type, newdomain) 3# Allow a transition from olddomain to newdomain 4# upon executing a file labeled with type. 5# This only allows the transition; it does not 6# cause it to occur automatically - use domain_auto_trans 7# if that is what you want. 8# 9define(`domain_trans', ` 10# Old domain may exec the file and transition to the new domain. 11allow $1 $2:file { getattr open read execute map }; 12allow $1 $3:process transition; 13# New domain is entered by executing the file. 14allow $3 $2:file { entrypoint open read execute getattr map }; 15# New domain can send SIGCHLD to its caller. 16ifelse($1, `init', `', `allow $3 $1:process sigchld;') 17# Enable AT_SECURE, i.e. libc secure mode. 18dontaudit $1 $3:process noatsecure; 19# XXX dontaudit candidate but requires further study. 20allow $1 $3:process { siginh rlimitinh }; 21') 22 23##################################### 24# domain_auto_trans(olddomain, type, newdomain) 25# Automatically transition from olddomain to newdomain 26# upon executing a file labeled with type. 27# 28define(`domain_auto_trans', ` 29# Allow the necessary permissions. 30domain_trans($1,$2,$3) 31# Make the transition occur by default. 32type_transition $1 $2:process $3; 33') 34 35##################################### 36# file_type_trans(domain, dir_type, file_type) 37# Allow domain to create a file labeled file_type in a 38# directory labeled dir_type. 39# This only allows the transition; it does not 40# cause it to occur automatically - use file_type_auto_trans 41# if that is what you want. 42# 43define(`file_type_trans', ` 44# Allow the domain to add entries to the directory. 45allow $1 $2:dir ra_dir_perms; 46# Allow the domain to create the file. 47allow $1 $3:notdevfile_class_set create_file_perms; 48allow $1 $3:dir create_dir_perms; 49') 50 51##################################### 52# file_type_auto_trans(domain, dir_type, file_type) 53# Automatically label new files with file_type when 54# they are created by domain in directories labeled dir_type. 55# 56define(`file_type_auto_trans', ` 57# Allow the necessary permissions. 58file_type_trans($1, $2, $3) 59# Make the transition occur by default. 60type_transition $1 $2:dir $3; 61type_transition $1 $2:notdevfile_class_set $3; 62') 63 64##################################### 65# r_dir_file(domain, type) 66# Allow the specified domain to read directories, files 67# and symbolic links of the specified type. 68define(`r_dir_file', ` 69allow $1 $2:dir r_dir_perms; 70allow $1 $2:{ file lnk_file } r_file_perms; 71') 72 73##################################### 74# tmpfs_domain(domain) 75# Allow access to a unique type for this domain when creating tmpfs / ashmem files. 76define(`tmpfs_domain', ` 77type_transition $1 tmpfs:file $1_tmpfs; 78allow $1 $1_tmpfs:file { read write getattr map }; 79') 80 81# pdx macros for IPC. pdx is a high-level name which contains transport-specific 82# rules from underlying transport (e.g. UDS-based implementation). 83 84##################################### 85# pdx_service_attributes(service) 86# Defines type attribute used to identify various service-related types. 87define(`pdx_service_attributes', ` 88attribute pdx_$1_endpoint_dir_type; 89attribute pdx_$1_endpoint_socket_type; 90attribute pdx_$1_channel_socket_type; 91attribute pdx_$1_server_type; 92') 93 94##################################### 95# pdx_service_socket_types(service, endpoint_dir_t) 96# Define types for endpoint and channel sockets. 97define(`pdx_service_socket_types', ` 98typeattribute $2 pdx_$1_endpoint_dir_type; 99type pdx_$1_endpoint_socket, pdx_$1_endpoint_socket_type, pdx_endpoint_socket_type, file_type, coredomain_socket, mlstrustedobject, mlstrustedsubject; 100type pdx_$1_channel_socket, pdx_$1_channel_socket_type, pdx_channel_socket_type, coredomain_socket; 101userdebug_or_eng(` 102dontaudit su pdx_$1_endpoint_socket:unix_stream_socket *; 103dontaudit su pdx_$1_channel_socket:unix_stream_socket *; 104') 105') 106 107##################################### 108# pdx_server(server_domain, service) 109define(`pdx_server', ` 110# Mark the server domain as a PDX server. 111typeattribute $1 pdx_$2_server_type; 112# Allow the init process to create the initial endpoint socket. 113allow init pdx_$2_endpoint_socket_type:unix_stream_socket { create bind }; 114# Allow the server domain to use the endpoint socket and accept connections on it. 115# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights 116# than we need (e.g. we don"t need "bind" or "connect"). 117allow $1 pdx_$2_endpoint_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown listen accept }; 118# Allow the server domain to apply security context label to the channel socket pair (allow process to use setsockcreatecon_raw()). 119allow $1 self:process setsockcreate; 120# Allow the server domain to create a client channel socket. 121allow $1 pdx_$2_channel_socket_type:unix_stream_socket create_stream_socket_perms; 122# Prevent other processes from claiming to be a server for the same service. 123neverallow {domain -$1} pdx_$2_endpoint_socket_type:unix_stream_socket { listen accept }; 124') 125 126##################################### 127# pdx_connect(client, service) 128define(`pdx_connect', ` 129# Allow client to open the service endpoint file. 130allow $1 pdx_$2_endpoint_dir_type:dir r_dir_perms; 131allow $1 pdx_$2_endpoint_socket_type:sock_file rw_file_perms; 132# Allow the client to connect to endpoint socket. 133allow $1 pdx_$2_endpoint_socket_type:unix_stream_socket { connectto read write shutdown }; 134') 135 136##################################### 137# pdx_use(client, service) 138define(`pdx_use', ` 139# Allow the client to use the PDX channel socket. 140# Not using macro like "rw_socket_perms_no_ioctl" because it provides more rights 141# than we need (e.g. we don"t need "bind" or "connect"). 142allow $1 pdx_$2_channel_socket_type:unix_stream_socket { read getattr write setattr lock append getopt setopt shutdown }; 143# Client needs to use an channel event fd from the server. 144allow $1 pdx_$2_server_type:fd use; 145# Servers may receive sync fences, gralloc buffers, etc, from clients. 146# This could be tightened on a per-server basis, but keeping track of service 147# clients is error prone. 148allow pdx_$2_server_type $1:fd use; 149') 150 151##################################### 152# pdx_client(client, service) 153define(`pdx_client', ` 154pdx_connect($1, $2) 155pdx_use($1, $2) 156') 157 158##################################### 159# init_daemon_domain(domain) 160# Set up a transition from init to the daemon domain 161# upon executing its binary. 162define(`init_daemon_domain', ` 163domain_auto_trans(init, $1_exec, $1) 164') 165 166##################################### 167# app_domain(domain) 168# Allow a base set of permissions required for all apps. 169define(`app_domain', ` 170typeattribute $1 appdomain; 171# Label tmpfs objects for all apps. 172type_transition $1 tmpfs:file appdomain_tmpfs; 173allow $1 appdomain_tmpfs:file { execute getattr map read write }; 174neverallow { $1 -runas_app -shell -simpleperf } { domain -$1 }:file no_rw_file_perms; 175neverallow { appdomain -runas_app -shell -simpleperf -$1 } $1:file no_rw_file_perms; 176# The Android security model guarantees the confidentiality and integrity 177# of application data and execution state. Ptrace bypasses those 178# confidentiality guarantees. Disallow ptrace access from system components to 179# apps. crash_dump is excluded, as it needs ptrace access to produce stack 180# traces. runas_app is excluded, as it operates only on debuggable apps. 181# simpleperf is excluded, as it operates only on debuggable or profileable 182# apps. llkd is excluded, as it needs ptrace access to inspect stack traces for 183# live lock conditions. 184neverallow { domain -$1 -crash_dump userdebug_or_eng(`-llkd') -runas_app -simpleperf } $1:process ptrace; 185') 186 187##################################### 188# untrusted_app_domain(domain) 189# Allow a base set of permissions required for all untrusted apps. 190define(`untrusted_app_domain', ` 191typeattribute $1 untrusted_app_all; 192') 193 194##################################### 195# net_domain(domain) 196# Allow a base set of permissions required for network access. 197define(`net_domain', ` 198typeattribute $1 netdomain; 199') 200 201##################################### 202# bluetooth_domain(domain) 203# Allow a base set of permissions required for bluetooth access. 204define(`bluetooth_domain', ` 205typeattribute $1 bluetoothdomain; 206') 207 208##################################### 209# hal_attribute(hal_name) 210# Add an attribute for hal implementations along with necessary 211# restrictions. 212define(`hal_attribute', ` 213attribute hal_$1; 214expandattribute hal_$1 true; 215attribute hal_$1_client; 216expandattribute hal_$1_client true; 217attribute hal_$1_server; 218expandattribute hal_$1_server false; 219 220neverallow { hal_$1_server -halserverdomain } domain:process fork; 221# hal_*_client and halclientdomain attributes are always expanded for 222# performance reasons. Neverallow rules targeting expanded attributes can not be 223# verified by CTS since these attributes are already expanded by that time. 224build_test_only(` 225neverallow { hal_$1_server -hal_$1 } domain:process fork; 226neverallow { hal_$1_client -halclientdomain } domain:process fork; 227') 228') 229 230##################################### 231# hal_server_domain(domain, hal_type) 232# Allow a base set of permissions required for a domain to offer a 233# HAL implementation of the specified type over HwBinder. 234# 235# For example, default implementation of Foo HAL: 236# type hal_foo_default, domain; 237# hal_server_domain(hal_foo_default, hal_foo) 238# 239define(`hal_server_domain', ` 240typeattribute $1 halserverdomain; 241typeattribute $1 $2_server; 242typeattribute $1 $2; 243') 244 245##################################### 246# hal_client_domain(domain, hal_type) 247# Allow a base set of permissions required for a domain to be a 248# client of a HAL of the specified type. 249# 250# For example, make some_domain a client of Foo HAL: 251# hal_client_domain(some_domain, hal_foo) 252# 253define(`hal_client_domain', ` 254typeattribute $1 halclientdomain; 255typeattribute $1 $2_client; 256 257# TODO(b/34170079): Make the inclusion of the rules below conditional also on 258# non-Treble devices. For now, on non-Treble device, always grant clients of a 259# HAL sufficient access to run the HAL in passthrough mode (i.e., in-process). 260not_full_treble(` 261typeattribute $1 $2; 262# Find passthrough HAL implementations 263allow $2 system_file:dir r_dir_perms; 264allow $2 vendor_file:dir r_dir_perms; 265allow $2 vendor_file:file { read open getattr execute map }; 266') 267') 268 269##################################### 270# passthrough_hal_client_domain(domain, hal_type) 271# Allow a base set of permissions required for a domain to be a 272# client of a passthrough HAL of the specified type. 273# 274# For example, make some_domain a client of passthrough Foo HAL: 275# passthrough_hal_client_domain(some_domain, hal_foo) 276# 277define(`passthrough_hal_client_domain', ` 278typeattribute $1 halclientdomain; 279typeattribute $1 $2_client; 280typeattribute $1 $2; 281# Find passthrough HAL implementations 282allow $2 system_file:dir r_dir_perms; 283allow $2 vendor_file:dir r_dir_perms; 284allow $2 vendor_file:file { read open getattr execute map }; 285') 286 287##################################### 288# unix_socket_connect(clientdomain, socket, serverdomain) 289# Allow a local socket connection from clientdomain via 290# socket to serverdomain. 291# 292# Note: If you see denial records that distill to the 293# following allow rules: 294# allow clientdomain property_socket:sock_file write; 295# allow clientdomain init:unix_stream_socket connectto; 296# allow clientdomain something_prop:property_service set; 297# 298# This sequence is indicative of attempting to set a property. 299# use set_prop(sourcedomain, targetproperty) 300# 301define(`unix_socket_connect', ` 302allow $1 $2_socket:sock_file write; 303allow $1 $3:unix_stream_socket connectto; 304') 305 306##################################### 307# set_prop(sourcedomain, targetproperty) 308# Allows source domain to set the 309# targetproperty. 310# 311define(`set_prop', ` 312unix_socket_connect($1, property, init) 313allow $1 $2:property_service set; 314get_prop($1, $2) 315') 316 317##################################### 318# get_prop(sourcedomain, targetproperty) 319# Allows source domain to read the 320# targetproperty. 321# 322define(`get_prop', ` 323allow $1 $2:file { getattr open read map }; 324') 325 326##################################### 327# unix_socket_send(clientdomain, socket, serverdomain) 328# Allow a local socket send from clientdomain via 329# socket to serverdomain. 330define(`unix_socket_send', ` 331allow $1 $2_socket:sock_file write; 332allow $1 $3:unix_dgram_socket sendto; 333') 334 335##################################### 336# binder_use(domain) 337# Allow domain to use Binder IPC. 338define(`binder_use', ` 339# Call the servicemanager and transfer references to it. 340allow $1 servicemanager:binder { call transfer }; 341# Allow servicemanager to send out callbacks 342allow servicemanager $1:binder { call transfer }; 343# servicemanager performs getpidcon on clients. 344allow servicemanager $1:dir search; 345allow servicemanager $1:file { read open }; 346allow servicemanager $1:process getattr; 347# rw access to /dev/binder and /dev/ashmem is presently granted to 348# all domains in domain.te. 349') 350 351##################################### 352# hwbinder_use(domain) 353# Allow domain to use HwBinder IPC. 354define(`hwbinder_use', ` 355# Call the hwservicemanager and transfer references to it. 356allow $1 hwservicemanager:binder { call transfer }; 357# Allow hwservicemanager to send out callbacks 358allow hwservicemanager $1:binder { call transfer }; 359# hwservicemanager performs getpidcon on clients. 360allow hwservicemanager $1:dir search; 361allow hwservicemanager $1:file { read open map }; 362allow hwservicemanager $1:process getattr; 363# rw access to /dev/hwbinder and /dev/ashmem is presently granted to 364# all domains in domain.te. 365') 366 367##################################### 368# vndbinder_use(domain) 369# Allow domain to use Binder IPC. 370define(`vndbinder_use', ` 371# Talk to the vndbinder device node 372allow $1 vndbinder_device:chr_file rw_file_perms; 373# Call the vndservicemanager and transfer references to it. 374allow $1 vndservicemanager:binder { call transfer }; 375# vndservicemanager performs getpidcon on clients. 376allow vndservicemanager $1:dir search; 377allow vndservicemanager $1:file { read open map }; 378allow vndservicemanager $1:process getattr; 379') 380 381##################################### 382# binder_call(clientdomain, serverdomain) 383# Allow clientdomain to perform binder IPC to serverdomain. 384define(`binder_call', ` 385# Call the server domain and optionally transfer references to it. 386allow $1 $2:binder { call transfer }; 387# Allow the serverdomain to transfer references to the client on the reply. 388allow $2 $1:binder transfer; 389# Receive and use open files from the server. 390allow $1 $2:fd use; 391') 392 393##################################### 394# binder_service(domain) 395# Mark a domain as being a Binder service domain. 396# Used to allow binder IPC to the various system services. 397define(`binder_service', ` 398typeattribute $1 binderservicedomain; 399') 400 401##################################### 402# wakelock_use(domain) 403# Allow domain to manage wake locks 404define(`wakelock_use', ` 405# TODO(b/115946999): Remove /sys/power/* permissions once CONFIG_PM_WAKELOCKS is 406# deprecated. 407# Access /sys/power/wake_lock and /sys/power/wake_unlock 408allow $1 sysfs_wake_lock:file rw_file_perms; 409# Accessing these files requires CAP_BLOCK_SUSPEND 410allow $1 self:global_capability2_class_set block_suspend; 411# system_suspend permissions 412binder_call($1, system_suspend_server) 413allow $1 system_suspend_hwservice:hwservice_manager find; 414# halclientdomain permissions 415hwbinder_use($1) 416get_prop($1, hwservicemanager_prop) 417allow $1 hidl_manager_hwservice:hwservice_manager find; 418') 419 420##################################### 421# selinux_check_access(domain) 422# Allow domain to check SELinux permissions via selinuxfs. 423define(`selinux_check_access', ` 424r_dir_file($1, selinuxfs) 425allow $1 selinuxfs:file w_file_perms; 426allow $1 kernel:security compute_av; 427allow $1 self:netlink_selinux_socket { read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto name_bind }; 428') 429 430##################################### 431# selinux_check_context(domain) 432# Allow domain to check SELinux contexts via selinuxfs. 433define(`selinux_check_context', ` 434r_dir_file($1, selinuxfs) 435allow $1 selinuxfs:file w_file_perms; 436allow $1 kernel:security check_context; 437') 438 439##################################### 440# create_pty(domain) 441# Allow domain to create and use a pty, isolated from any other domain ptys. 442define(`create_pty', ` 443# Each domain gets a unique devpts type. 444type $1_devpts, fs_type; 445# Label the pty with the unique type when created. 446type_transition $1 devpts:chr_file $1_devpts; 447# Allow use of the pty after creation. 448allow $1 $1_devpts:chr_file { open getattr read write ioctl }; 449allowxperm $1 $1_devpts:chr_file ioctl unpriv_tty_ioctls; 450# TIOCSTI is only ever used for exploits. Block it. 451# b/33073072, b/7530569 452# http://www.openwall.com/lists/oss-security/2016/09/26/14 453neverallowxperm * $1_devpts:chr_file ioctl TIOCSTI; 454# Note: devpts:dir search and ptmx_device:chr_file rw_file_perms 455# allowed to everyone via domain.te. 456') 457 458##################################### 459# Non system_app application set 460# 461define(`non_system_app_set', `{ appdomain -system_app }') 462 463##################################### 464# Recovery only 465# SELinux rules which apply only to recovery mode 466# 467define(`recovery_only', ifelse(target_recovery, `true', $1, )) 468 469##################################### 470# Full TREBLE only 471# SELinux rules which apply only to full TREBLE devices 472# 473define(`full_treble_only', ifelse(target_full_treble, `true', $1, 474ifelse(target_full_treble, `cts', 475# BEGIN_TREBLE_ONLY -- this marker is used by CTS -- do not modify 476$1 477# END_TREBLE_ONLY -- this marker is used by CTS -- do not modify 478, ))) 479 480##################################### 481# Not full TREBLE 482# SELinux rules which apply only to devices which are not full TREBLE devices 483# 484define(`not_full_treble', ifelse(target_full_treble, `true', , $1)) 485 486##################################### 487# Compatible property only 488# SELinux rules which apply only to devices with compatible property 489# 490define(`compatible_property_only', ifelse(target_compatible_property, `true', $1, 491ifelse(target_compatible_property, `cts', 492# BEGIN_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify 493$1 494# END_COMPATIBLE_PROPERTY_ONLY -- this marker is used by CTS -- do not modify 495, ))) 496 497##################################### 498# Not compatible property 499# SELinux rules which apply only to devices without compatible property 500# 501define(`not_compatible_property', ifelse(target_compatible_property, `true', , $1)) 502 503##################################### 504# Userdebug or eng builds 505# SELinux rules which apply only to userdebug or eng builds 506# 507define(`userdebug_or_eng', ifelse(target_build_variant, `eng', $1, ifelse(target_build_variant, `userdebug', $1))) 508 509##################################### 510# asan builds 511# SELinux rules which apply only to asan builds 512# 513define(`with_asan', ifelse(target_with_asan, `true', userdebug_or_eng(`$1'), )) 514 515##################################### 516# native coverage builds 517# SELinux rules which apply only to builds with native coverage 518# 519define(`with_native_coverage', ifelse(target_with_native_coverage, `true', userdebug_or_eng(`$1'), )) 520 521##################################### 522# Build-time-only test 523# SELinux rules which are verified during build, but not as part of *TS testing. 524# 525define(`build_test_only', ifelse(target_exclude_build_test, `true', , $1)) 526 527#################################### 528# Fallback crash handling for processes that can't exec crash_dump (e.g. because of seccomp). 529# 530define(`crash_dump_fallback', ` 531userdebug_or_eng(` 532 allow $1 su:fifo_file append; 533') 534allow $1 anr_data_file:file append; 535allow $1 dumpstate:fd use; 536allow $1 incidentd:fd use; 537# TODO: Figure out why write is needed. 538allow $1 dumpstate:fifo_file { append write }; 539allow $1 incidentd:fifo_file { append write }; 540allow $1 system_server:fifo_file { append write }; 541allow $1 tombstoned:unix_stream_socket connectto; 542allow $1 tombstoned:fd use; 543allow $1 tombstoned_crash_socket:sock_file write; 544allow $1 tombstone_data_file:file append; 545') 546 547##################################### 548# WITH_DEXPREOPT builds 549# SELinux rules which apply only when pre-opting. 550# 551define(`with_dexpreopt', ifelse(target_with_dexpreopt, `true', $1)) 552 553##################################### 554# write_logd(domain) 555# Ability to write to android log 556# daemon via sockets 557define(`write_logd', ` 558unix_socket_send($1, logdw, logd) 559allow $1 pmsg_device:chr_file w_file_perms; 560') 561 562##################################### 563# read_logd(domain) 564# Ability to run logcat and read from android 565# log daemon via sockets 566define(`read_logd', ` 567allow $1 logcat_exec:file rx_file_perms; 568unix_socket_connect($1, logdr, logd) 569') 570 571##################################### 572# read_runtime_log_tags(domain) 573# ability to directly map the runtime event log tags 574define(`read_runtime_log_tags', ` 575allow $1 runtime_event_log_tags_file:file r_file_perms; 576') 577 578##################################### 579# control_logd(domain) 580# Ability to control 581# android log daemon via sockets 582define(`control_logd', ` 583# Group AID_LOG checked by filesystem & logd 584# to permit control commands 585unix_socket_connect($1, logd, logd) 586') 587 588##################################### 589# use_keystore(domain) 590# Ability to use keystore. 591# Keystore is requires the following permissions 592# to call getpidcon. 593define(`use_keystore', ` 594 allow keystore $1:dir search; 595 allow keystore $1:file { read open }; 596 allow keystore $1:process getattr; 597 allow $1 keystore_service:service_manager find; 598 binder_call($1, keystore) 599 binder_call(keystore, $1) 600') 601 602##################################### 603# use_credstore(domain) 604# Ability to use credstore. 605define(`use_credstore', ` 606 allow credstore $1:dir search; 607 allow credstore $1:file { read open }; 608 allow credstore $1:process getattr; 609 allow $1 credstore_service:service_manager find; 610 binder_call($1, credstore) 611 binder_call(credstore, $1) 612') 613 614########################################### 615# use_drmservice(domain) 616# Ability to use DrmService which requires 617# DrmService to call getpidcon. 618define(`use_drmservice', ` 619 allow drmserver $1:dir search; 620 allow drmserver $1:file { read open }; 621 allow drmserver $1:process getattr; 622') 623 624########################################### 625# add_service(domain, service) 626# Ability for domain to add a service to service_manager 627# and find it. It also creates a neverallow preventing 628# others from adding it. 629define(`add_service', ` 630 allow $1 $2:service_manager { add find }; 631 neverallow { domain -$1 } $2:service_manager add; 632') 633 634########################################### 635# add_hwservice(domain, service) 636# Ability for domain to add a service to hwservice_manager 637# and find it. It also creates a neverallow preventing 638# others from adding it. 639define(`add_hwservice', ` 640 allow $1 $2:hwservice_manager { add find }; 641 allow $1 hidl_base_hwservice:hwservice_manager add; 642 neverallow { domain -$1 } $2:hwservice_manager add; 643') 644 645########################################### 646# hal_attribute_hwservice(attribute, service) 647# Ability for domain to get a service to hwservice_manager 648# and find it. It also creates a neverallow preventing 649# others from adding it. 650# 651# Used to pair hal_foo_client with hal_foo_hwservice 652define(`hal_attribute_hwservice', ` 653 allow $1_client $2:hwservice_manager find; 654 add_hwservice($1_server, $2) 655 656 build_test_only(` 657 neverallow { domain -$1_client -$1_server } $2:hwservice_manager find; 658 ') 659') 660 661################################### 662# can_profile_heap(domain) 663# Allow processes within the domain to have their heap profiled by heapprofd. 664# 665# Note that profiling is performed differently between debug and user builds. 666# There are two modes for profiling: 667# * forked 668# * central. 669# On user builds, the default is to allow only forked mode. If it is desired 670# to allow central mode as well for a domain, use can_profile_heap_central. 671# On userdebug, this macro allows both forked and central. 672define(`can_profile_heap', ` 673 # Allow central daemon to send signal for client initialization. 674 allow heapprofd $1:process signal; 675 676 # Allow executing a private heapprofd process to handle profiling on 677 # user builds (also debug builds for testing & development purposes). 678 allow $1 heapprofd_exec:file rx_file_perms; 679 680 # Allow directory & file read to the central heapprofd daemon, as it scans 681 # /proc/[pid]/cmdline for by-process-name profiling configs. 682 # Note that this excludes /proc/[pid]/mem, as it requires ptrace capabilities. 683 allow heapprofd $1:file r_file_perms; 684 allow heapprofd $1:dir r_dir_perms; 685 686 # Profilability on user implies profilability on userdebug and eng. 687 userdebug_or_eng(` 688 can_profile_heap_central($1) 689 ') 690') 691 692################################### 693# can_profile_heap_central(domain) 694# Allow processes within the domain to have their heap profiled by central 695# heapprofd. 696define(`can_profile_heap_central', ` 697 # Allow central daemon to send signal for client initialization. 698 allow heapprofd $1:process signal; 699 # Allow connecting to the daemon. 700 unix_socket_connect($1, heapprofd, heapprofd) 701 # Allow daemon to use the passed fds. 702 allow heapprofd $1:fd use; 703 # Allow to read and write to heapprofd shmem. 704 # The client needs to read the read and write pointers in order to write. 705 allow $1 heapprofd_tmpfs:file { read write getattr map }; 706 # Use shared memory received over the unix socket. 707 allow $1 heapprofd:fd use; 708 709 # To read and write from the received file descriptors. 710 # /proc/[pid]/maps and /proc/[pid]/mem have the same SELinux label as the 711 # process they relate to. 712 # We need to write to /proc/$PID/page_idle to find idle allocations. 713 # The client only opens /proc/self/page_idle with RDWR, everything else 714 # with RDONLY. 715 # heapprofd cannot open /proc/$PID/mem itself, as it does not have 716 # sys_ptrace. 717 allow heapprofd $1:file rw_file_perms; 718 # Allow searching the /proc/[pid] directory for cmdline. 719 allow heapprofd $1:dir r_dir_perms; 720') 721 722################################### 723# never_profile_heap(domain) 724# Opt out of heap profiling by heapprofd. 725define(`never_profile_heap', ` 726 neverallow heapprofd $1:file read; 727 neverallow heapprofd $1:process signal; 728') 729 730################################### 731# can_profile_perf(domain) 732# Allow processes within the domain to be profiled, and have their stacks 733# sampled, by traced_perf. 734define(`can_profile_perf', ` 735 # Allow directory & file read to traced_perf, as it stat(2)s /proc/[pid], and 736 # reads /proc/[pid]/cmdline. 737 allow traced_perf $1:file r_file_perms; 738 allow traced_perf $1:dir r_dir_perms; 739 740 # Allow central daemon to send signal to request /proc/[pid]/maps and 741 # /proc/[pid]/mem fds from this process. 742 allow traced_perf $1:process signal; 743 744 # Allow connecting to the daemon. 745 unix_socket_connect($1, traced_perf, traced_perf) 746 # Allow daemon to use the passed fds. 747 allow traced_perf $1:fd use; 748') 749 750################################### 751# never_profile_perf(domain) 752# Opt out of profiling by traced_perf. 753define(`never_profile_perf', ` 754 neverallow traced_perf $1:file read; 755 neverallow traced_perf $1:process signal; 756') 757 758################################### 759# perfetto_producer(domain) 760# Allow processes within the domain to write data to Perfetto. 761# When applying this macro, you might need to also allow traced to use the 762# producer tmpfs domain, if the producer will be the one creating the shared 763# memory. 764define(`perfetto_producer', ` 765 allow $1 traced:fd use; 766 allow $1 traced_tmpfs:file { read write getattr map }; 767 unix_socket_connect($1, traced_producer, traced) 768 769 # Also allow the service to use the producer file descriptors. This is 770 # necessary when the producer is creating the shared memory, as it will be 771 # passed to the service as a file descriptor (obtained from memfd_create). 772 allow traced $1:fd use; 773') 774 775########################################### 776# dump_hal(hal_type) 777# Ability to dump the hal debug info 778# 779define(`dump_hal', ` 780 hal_client_domain(dumpstate, $1); 781 allow $1_server dumpstate:fifo_file write; 782 allow $1_server dumpstate:fd use; 783') 784 785##################################### 786# treble_sysprop_neverallow(rules) 787# SELinux neverallow rules which enforces the owner of each property and accessibility 788# outside the owner. 789# 790# For devices launching with R or later, all properties must be explicitly marked as one of: 791# system_property_type, vendor_property_type, or product_property_type. 792# Also, exported properties must be explicitly marked as "restricted" or "public", 793# depending on the accessibility outside the owner. 794# For devices launching with Q or eariler, this neverallow rules can be relaxed with defining 795# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true on BoardConfig.mk. 796# See {partition}_{accessibility}_prop macros below. 797# 798# CTS uses these rules only for devices launching with R or later. 799# 800define(`treble_sysprop_neverallow', ifelse(target_treble_sysprop_neverallow, `true', $1, 801ifelse(target_treble_sysprop_neverallow, `cts', 802# BEGIN_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify 803$1 804# END_LAUNCHING_WITH_R_ONLY -- this marker is used by CTS -- do not modify 805, ))) 806 807########################################### 808# define_prop(name, owner, scope) 809# Define a property with given owner and scope 810# 811define(`define_prop', ` 812 type $1, property_type, $2_property_type, $2_$3_property_type; 813') 814 815########################################### 816# system_internal_prop(name) 817# Define a /system-owned property used only in /system 818# For devices launching with Q or eariler, this restriction can be relaxed with 819# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true 820# 821define(`system_internal_prop', ` 822 define_prop($1, system, internal) 823 treble_sysprop_neverallow(` 824 neverallow { domain -coredomain } $1:file no_rw_file_perms; 825 ') 826') 827 828########################################### 829# system_restricted_prop(name) 830# Define a /system-owned property which can't be written outside /system 831# For devices launching with Q or eariler, this restriction can be relaxed with 832# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true 833# 834define(`system_restricted_prop', ` 835 define_prop($1, system, restricted) 836 treble_sysprop_neverallow(` 837 neverallow { domain -coredomain } $1:property_service set; 838 ') 839') 840 841########################################### 842# system_public_prop(name) 843# Define a /system-owned property with no restrictions 844# 845define(`system_public_prop', `define_prop($1, system, public)') 846 847########################################### 848# system_vendor_config_prop(name) 849# Define a /system-owned property which can only be written by vendor_init 850# This is a macro for vendor-specific configuration properties which is meant 851# to be set once from vendor_init. 852# 853define(`system_vendor_config_prop', ` 854 system_public_prop($1) 855 set_prop(vendor_init, $1) 856 neverallow { domain -init -vendor_init } $1:property_service set; 857') 858 859########################################### 860# product_internal_prop(name) 861# Define a /product-owned property used only in /product 862# For devices launching with Q or eariler, this restriction can be relaxed with 863# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true 864# 865define(`product_internal_prop', ` 866 define_prop($1, product, internal) 867 treble_sysprop_neverallow(` 868 neverallow { domain -coredomain } $1:file no_rw_file_perms; 869 ') 870') 871 872########################################### 873# product_restricted_prop(name) 874# Define a /product-owned property which can't be written outside /product 875# For devices launching with Q or eariler, this restriction can be relaxed with 876# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true 877# 878define(`product_restricted_prop', ` 879 define_prop($1, product, restricted) 880 treble_sysprop_neverallow(` 881 neverallow { domain -coredomain } $1:property_service set; 882 ') 883') 884 885########################################### 886# product_public_prop(name) 887# Define a /product-owned property with no restrictions 888# 889define(`product_public_prop', `define_prop($1, product, public)') 890 891########################################### 892# vendor_internal_prop(name) 893# Define a /vendor-owned property used only in /vendor 894# For devices launching with Q or eariler, this restriction can be relaxed with 895# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true 896# 897define(`vendor_internal_prop', ` 898 define_prop($1, vendor, internal) 899 treble_sysprop_neverallow(` 900# init and dumpstate are in coredomain, but should be able to read all props. 901 neverallow { coredomain -init -dumpstate } $1:file no_rw_file_perms; 902 ') 903') 904 905########################################### 906# vendor_restricted_prop(name) 907# Define a /vendor-owned property which can't be written outside /vendor 908# For devices launching with Q or eariler, this restriction can be relaxed with 909# BUILD_BROKEN_TREBLE_SYSPROP_NEVERALLOW := true 910# 911define(`vendor_restricted_prop', ` 912 define_prop($1, vendor, restricted) 913 treble_sysprop_neverallow(` 914# init is in coredomain, but should be able to write all props. 915 neverallow { coredomain -init } $1:property_service set; 916 ') 917') 918 919########################################### 920# vendor_public_prop(name) 921# Define a /vendor-owned property with no restrictions 922# 923define(`vendor_public_prop', `define_prop($1, vendor, public)') 924