1### 2### neverallow rules for untrusted app domains 3### 4 5define(`all_untrusted_apps',`{ 6 ephemeral_app 7 isolated_app 8 mediaprovider 9 untrusted_app 10 untrusted_app_25 11 untrusted_app_all 12 untrusted_v2_app 13}') 14# Receive or send uevent messages. 15neverallow all_untrusted_apps domain:netlink_kobject_uevent_socket *; 16 17# Receive or send generic netlink messages 18neverallow all_untrusted_apps domain:netlink_socket *; 19 20# Too much leaky information in debugfs. It's a security 21# best practice to ensure these files aren't readable. 22neverallow all_untrusted_apps debugfs_type:file read; 23 24# Do not allow untrusted apps to register services. 25# Only trusted components of Android should be registering 26# services. 27neverallow all_untrusted_apps service_manager_type:service_manager add; 28 29# Do not allow untrusted apps to use VendorBinder 30neverallow all_untrusted_apps vndbinder_device:chr_file *; 31neverallow all_untrusted_apps vndservice_manager_type:service_manager *; 32 33# Do not allow untrusted apps to connect to the property service 34# or set properties. b/10243159 35neverallow { all_untrusted_apps -mediaprovider } property_socket:sock_file write; 36neverallow { all_untrusted_apps -mediaprovider } init:unix_stream_socket connectto; 37neverallow { all_untrusted_apps -mediaprovider } property_type:property_service set; 38 39# Do not allow untrusted apps to be assigned mlstrustedsubject. 40# This would undermine the per-user isolation model being 41# enforced via levelFrom=user in seapp_contexts and the mls 42# constraints. As there is no direct way to specify a neverallow 43# on attribute assignment, this relies on the fact that fork 44# permission only makes sense within a domain (hence should 45# never be granted to any other domain within mlstrustedsubject) 46# and an untrusted app is allowed fork permission to itself. 47neverallow all_untrusted_apps mlstrustedsubject:process fork; 48 49# Do not allow untrusted apps to hard link to any files. 50# In particular, if an untrusted app links to other app data 51# files, installd will not be able to guarantee the deletion 52# of the linked to file. Hard links also contribute to security 53# bugs, so we want to ensure untrusted apps never have this 54# capability. 55neverallow all_untrusted_apps file_type:file link; 56 57# Do not allow untrusted apps to access network MAC address file 58neverallow all_untrusted_apps sysfs_mac_address:file no_rw_file_perms; 59 60# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the 61# ioctl permission, or 3. disallow the socket class. 62neverallowxperm all_untrusted_apps domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls; 63neverallow all_untrusted_apps *:{ netlink_route_socket netlink_selinux_socket } ioctl; 64neverallow all_untrusted_apps *:{ 65 socket netlink_socket packet_socket key_socket appletalk_socket 66 netlink_tcpdiag_socket netlink_nflog_socket 67 netlink_xfrm_socket netlink_audit_socket 68 netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket 69 netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket 70 netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket 71 netlink_rdma_socket netlink_crypto_socket 72} *; 73 74# Do not allow untrusted apps access to /cache 75neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:dir ~{ r_dir_perms }; 76neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:file ~{ read getattr }; 77 78# Do not allow untrusted apps to create/unlink files outside of its sandbox, 79# internal storage or sdcard. 80# World accessible data locations allow application to fill the device 81# with unaccounted for data. This data will not get removed during 82# application un-installation. 83neverallow { all_untrusted_apps -mediaprovider } { 84 fs_type 85 -fuse # sdcard 86 -sdcardfs # sdcard 87 -vfat 88 file_type 89 -app_data_file # The apps sandbox itself 90 -media_rw_data_file # Internal storage. Known that apps can 91 # leave artfacts here after uninstall. 92 -user_profile_data_file # Access to profile files 93 userdebug_or_eng(` 94 -method_trace_data_file # only on ro.debuggable=1 95 -coredump_file # userdebug/eng only 96 ') 97}:dir_file_class_set { create unlink }; 98 99# No untrusted component should be touching /dev/fuse 100neverallow all_untrusted_apps fuse_device:chr_file *; 101 102# Do not allow untrusted apps to directly open tun_device 103neverallow all_untrusted_apps tun_device:chr_file open; 104 105# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553) 106neverallow all_untrusted_apps anr_data_file:file ~{ open append }; 107neverallow all_untrusted_apps anr_data_file:dir ~search; 108 109# Avoid reads from generically labeled /proc files 110# Create a more specific label if needed 111neverallow all_untrusted_apps proc:file { no_rw_file_perms no_x_file_perms }; 112 113# Avoid all access to kernel configuration 114neverallow all_untrusted_apps config_gz:file { no_rw_file_perms no_x_file_perms }; 115 116# Do not allow untrusted apps access to preloads data files 117neverallow all_untrusted_apps preloads_data_file:file no_rw_file_perms; 118 119# Locking of files on /system could lead to denial of service attacks 120# against privileged system components 121neverallow all_untrusted_apps system_file:file lock; 122 123# Do not permit untrusted apps to perform actions on HwBinder service_manager 124# other than find actions for services listed below 125neverallow all_untrusted_apps *:hwservice_manager ~find; 126 127# Do not permit access from apps which host arbitrary code to HwBinder services, 128# except those considered sufficiently safe for access from such apps. 129# The two main reasons for this are: 130# 1. HwBinder servers do not perform client authentication because HIDL 131# currently does not expose caller UID information and, even if it did, many 132# HwBinder services either operate at a level below that of apps (e.g., HALs) 133# or must not rely on app identity for authorization. Thus, to be safe, the 134# default assumption is that every HwBinder service treats all its clients as 135# equally authorized to perform operations offered by the service. 136# 2. HAL servers (a subset of HwBinder services) contain code with higher 137# incidence rate of security issues than system/core components and have 138# access to lower layes of the stack (all the way down to hardware) thus 139# increasing opportunities for bypassing the Android security model. 140# 141# Safe services include: 142# - same process services: because they by definition run in the process 143# of the client and thus have the same access as the client domain in which 144# the process runs 145# - coredomain_hwservice: are considered safe because they do not pose risks 146# associated with reason #2 above. 147# - hal_configstore_ISurfaceFlingerConfigs: becuase it has specifically been 148# designed for use by any domain. 149# - hal_graphics_allocator_hwservice: because these operations are also offered 150# by surfaceflinger Binder service, which apps are permitted to access 151# - hal_omx_hwservice: because this is a HwBinder version of the mediacodec 152# Binder service which apps were permitted to access. 153neverallow all_untrusted_apps { 154 hwservice_manager_type 155 -same_process_hwservice 156 -coredomain_hwservice 157 -hal_configstore_ISurfaceFlingerConfigs 158 -hal_graphics_allocator_hwservice 159 -hal_omx_hwservice 160 -hal_cas_hwservice 161 -untrusted_app_visible_hwservice 162}:hwservice_manager find; 163 164# Make sure that the following services are never accessible by untrusted_apps 165neverallow all_untrusted_apps { 166 default_android_hwservice 167 hal_audio_hwservice 168 hal_bluetooth_hwservice 169 hal_bootctl_hwservice 170 hal_camera_hwservice 171 hal_contexthub_hwservice 172 hal_drm_hwservice 173 hal_dumpstate_hwservice 174 hal_fingerprint_hwservice 175 hal_gatekeeper_hwservice 176 hal_gnss_hwservice 177 hal_graphics_composer_hwservice 178 hal_health_hwservice 179 hal_ir_hwservice 180 hal_keymaster_hwservice 181 hal_light_hwservice 182 hal_memtrack_hwservice 183 hal_neuralnetworks_hwservice 184 hal_nfc_hwservice 185 hal_oemlock_hwservice 186 hal_power_hwservice 187 hal_sensors_hwservice 188 hal_telephony_hwservice 189 hal_thermal_hwservice 190 hal_tv_cec_hwservice 191 hal_tv_input_hwservice 192 hal_usb_hwservice 193 hal_vibrator_hwservice 194 hal_vr_hwservice 195 hal_weaver_hwservice 196 hal_wifi_hwservice 197 hal_wifi_offload_hwservice 198 hal_wifi_supplicant_hwservice 199 hidl_base_hwservice 200 system_net_netd_hwservice 201 thermalcallback_hwservice 202}:hwservice_manager find; 203# HwBinder services offered by core components (as opposed to vendor components) 204# are considered somewhat safer due to point #2 above. 205neverallow all_untrusted_apps { 206 coredomain_hwservice 207 -same_process_hwservice 208 -hidl_allocator_hwservice # Designed for use by any domain 209 -hidl_manager_hwservice # Designed for use by any domain 210 -hidl_memory_hwservice # Designed for use by any domain 211 -hidl_token_hwservice # Designed for use by any domain 212}:hwservice_manager find; 213 214# SELinux is not an API for untrusted apps to use 215neverallow all_untrusted_apps selinuxfs:file no_rw_file_perms; 216 217# Restrict *Binder access from apps to HAL domains. We can only do this on full 218# Treble devices where *Binder communications between apps and HALs are tightly 219# restricted. 220full_treble_only(` 221 neverallow all_untrusted_apps { 222 halserverdomain 223 -coredomain 224 -hal_configstore_server 225 -hal_graphics_allocator_server 226 -hal_cas_server 227 -binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone 228 -untrusted_app_visible_halserver 229 }:binder { call transfer }; 230') 231