1### 2### neverallow rules for untrusted app domains 3### 4 5# Only allow domains in AOSP to use the untrusted_app_all attribute. 6neverallow { untrusted_app_all -untrusted_app -untrusted_app_25 } domain:process fork; 7 8define(`all_untrusted_apps',`{ untrusted_app_all untrusted_app_25 untrusted_app ephemeral_app isolated_app }') 9# Receive or send uevent messages. 10neverallow all_untrusted_apps domain:netlink_kobject_uevent_socket *; 11 12# Receive or send generic netlink messages 13neverallow all_untrusted_apps domain:netlink_socket *; 14 15# Too much leaky information in debugfs. It's a security 16# best practice to ensure these files aren't readable. 17neverallow all_untrusted_apps debugfs_type:file read; 18 19# Do not allow untrusted apps to register services. 20# Only trusted components of Android should be registering 21# services. 22neverallow all_untrusted_apps service_manager_type:service_manager add; 23 24# Do not allow untrusted apps to use VendorBinder 25neverallow all_untrusted_apps vndbinder_device:chr_file *; 26neverallow all_untrusted_apps vndservice_manager_type:service_manager *; 27 28# Do not allow untrusted apps to connect to the property service 29# or set properties. b/10243159 30neverallow all_untrusted_apps property_socket:sock_file write; 31neverallow all_untrusted_apps init:unix_stream_socket connectto; 32neverallow all_untrusted_apps property_type:property_service set; 33 34# Do not allow untrusted apps to be assigned mlstrustedsubject. 35# This would undermine the per-user isolation model being 36# enforced via levelFrom=user in seapp_contexts and the mls 37# constraints. As there is no direct way to specify a neverallow 38# on attribute assignment, this relies on the fact that fork 39# permission only makes sense within a domain (hence should 40# never be granted to any other domain within mlstrustedsubject) 41# and an untrusted app is allowed fork permission to itself. 42neverallow all_untrusted_apps mlstrustedsubject:process fork; 43 44# Do not allow untrusted apps to hard link to any files. 45# In particular, if an untrusted app links to other app data 46# files, installd will not be able to guarantee the deletion 47# of the linked to file. Hard links also contribute to security 48# bugs, so we want to ensure untrusted apps never have this 49# capability. 50neverallow all_untrusted_apps file_type:file link; 51 52# Do not allow untrusted apps to access network MAC address file 53neverallow all_untrusted_apps sysfs_mac_address:file no_rw_file_perms; 54 55# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the 56# ioctl permission, or 3. disallow the socket class. 57neverallowxperm all_untrusted_apps domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls; 58neverallow all_untrusted_apps *:{ netlink_route_socket netlink_selinux_socket } ioctl; 59neverallow all_untrusted_apps *:{ 60 socket netlink_socket packet_socket key_socket appletalk_socket 61 netlink_tcpdiag_socket netlink_nflog_socket 62 netlink_xfrm_socket netlink_audit_socket 63 netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket 64 netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket 65 netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket 66 netlink_rdma_socket netlink_crypto_socket 67} *; 68 69# Do not allow untrusted apps access to /cache 70neverallow all_untrusted_apps { cache_file cache_recovery_file }:dir ~{ r_dir_perms }; 71neverallow all_untrusted_apps { cache_file cache_recovery_file }:file ~{ read getattr }; 72 73# Do not allow untrusted apps to create/unlink files outside of its sandbox, 74# internal storage or sdcard. 75# World accessible data locations allow application to fill the device 76# with unaccounted for data. This data will not get removed during 77# application un-installation. 78neverallow all_untrusted_apps { 79 fs_type 80 -fuse # sdcard 81 -sdcardfs # sdcard 82 -vfat 83 file_type 84 -app_data_file # The apps sandbox itself 85 -media_rw_data_file # Internal storage. Known that apps can 86 # leave artfacts here after uninstall. 87 -user_profile_data_file # Access to profile files 88 userdebug_or_eng(` 89 -method_trace_data_file # only on ro.debuggable=1 90 -coredump_file # userdebug/eng only 91 ') 92}:dir_file_class_set { create unlink }; 93 94# No untrusted component should be touching /dev/fuse 95neverallow all_untrusted_apps fuse_device:chr_file *; 96 97# Do not allow untrusted apps to directly open tun_device 98neverallow all_untrusted_apps tun_device:chr_file open; 99 100# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553) 101neverallow all_untrusted_apps anr_data_file:file ~{ open append }; 102neverallow all_untrusted_apps anr_data_file:dir ~search; 103 104# Avoid reads from generically labeled /proc files 105# Create a more specific label if needed 106neverallow all_untrusted_apps proc:file { no_rw_file_perms no_x_file_perms }; 107 108# Avoid all access to kernel configuration 109neverallow all_untrusted_apps config_gz:file { no_rw_file_perms no_x_file_perms }; 110 111# Do not allow untrusted apps access to preloads data files 112neverallow all_untrusted_apps preloads_data_file:file no_rw_file_perms; 113 114# Locking of files on /system could lead to denial of service attacks 115# against privileged system components 116neverallow all_untrusted_apps system_file:file lock; 117 118# Do not permit untrusted apps to perform actions on HwBinder service_manager 119# other than find actions for services listed below 120neverallow all_untrusted_apps *:hwservice_manager ~find; 121 122# Do not permit access from apps which host arbitrary code to HwBinder services, 123# except those considered sufficiently safe for access from such apps. 124# The two main reasons for this are: 125# 1. HwBinder servers do not perform client authentication because HIDL 126# currently does not expose caller UID information and, even if it did, many 127# HwBinder services either operate at a level below that of apps (e.g., HALs) 128# or must not rely on app identity for authorization. Thus, to be safe, the 129# default assumption is that every HwBinder service treats all its clients as 130# equally authorized to perform operations offered by the service. 131# 2. HAL servers (a subset of HwBinder services) contain code with higher 132# incidence rate of security issues than system/core components and have 133# access to lower layes of the stack (all the way down to hardware) thus 134# increasing opportunities for bypassing the Android security model. 135# 136# Safe services include: 137# - same process services: because they by definition run in the process 138# of the client and thus have the same access as the client domain in which 139# the process runs 140# - coredomain_hwservice: are considered safe because they do not pose risks 141# associated with reason #2 above. 142# - hal_configstore_ISurfaceFlingerConfigs: becuase it has specifically been 143# designed for use by any domain. 144# - hal_graphics_allocator_hwservice: because these operations are also offered 145# by surfaceflinger Binder service, which apps are permitted to access 146# - hal_omx_hwservice: because this is a HwBinder version of the mediacodec 147# Binder service which apps were permitted to access. 148neverallow all_untrusted_apps { 149 hwservice_manager_type 150 -same_process_hwservice 151 -coredomain_hwservice 152 -hal_configstore_ISurfaceFlingerConfigs 153 -hal_graphics_allocator_hwservice 154 -hal_omx_hwservice 155 -untrusted_app_visible_hwservice 156}:hwservice_manager find; 157neverallow untrusted_app_visible_hwservice unlabeled:service_manager list; #TODO: b/62658302 158# Make sure that the following services are never accessible by untrusted_apps 159neverallow all_untrusted_apps { 160 default_android_hwservice 161 hal_audio_hwservice 162 hal_bluetooth_hwservice 163 hal_bootctl_hwservice 164 hal_camera_hwservice 165 hal_contexthub_hwservice 166 hal_drm_hwservice 167 hal_dumpstate_hwservice 168 hal_fingerprint_hwservice 169 hal_gatekeeper_hwservice 170 hal_gnss_hwservice 171 hal_graphics_composer_hwservice 172 hal_health_hwservice 173 hal_ir_hwservice 174 hal_keymaster_hwservice 175 hal_light_hwservice 176 hal_memtrack_hwservice 177 hal_nfc_hwservice 178 hal_oemlock_hwservice 179 hal_power_hwservice 180 hal_sensors_hwservice 181 hal_telephony_hwservice 182 hal_thermal_hwservice 183 hal_tv_cec_hwservice 184 hal_tv_input_hwservice 185 hal_usb_hwservice 186 hal_vibrator_hwservice 187 hal_vr_hwservice 188 hal_weaver_hwservice 189 hal_wifi_hwservice 190 hal_wifi_supplicant_hwservice 191 hidl_base_hwservice 192}:hwservice_manager find; 193# HwBinder services offered by core components (as opposed to vendor components) 194# are considered somewhat safer due to point #2 above. 195neverallow all_untrusted_apps { 196 coredomain_hwservice 197 -same_process_hwservice 198 -hidl_allocator_hwservice # Designed for use by any domain 199 -hidl_manager_hwservice # Designed for use by any domain 200 -hidl_memory_hwservice # Designed for use by any domain 201 -hidl_token_hwservice # Designed for use by any domain 202}:hwservice_manager find; 203 204# Restrict *Binder access from apps to HAL domains. We can only do this on full 205# Treble devices where *Binder communications between apps and HALs are tightly 206# restricted. 207full_treble_only(` 208 neverallow all_untrusted_apps { 209 halserverdomain 210 -coredomain 211 -hal_configstore_server 212 -hal_graphics_allocator_server 213 -binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone 214 }:binder { call transfer }; 215') 216