1### 2### Services with isolatedProcess=true in their manifest. 3### 4### This file defines the rules for isolated apps. An "isolated 5### app" is an APP with UID between AID_ISOLATED_START (99000) 6### and AID_ISOLATED_END (99999). 7### 8 9typeattribute isolated_app coredomain; 10 11app_domain(isolated_app) 12 13# Access already open app data files received over Binder or local socket IPC. 14allow isolated_app { app_data_file privapp_data_file }:file { append read write getattr lock map }; 15 16allow isolated_app activity_service:service_manager find; 17allow isolated_app display_service:service_manager find; 18allow isolated_app webviewupdate_service:service_manager find; 19 20# Google Breakpad (crash reporter for Chrome) relies on ptrace 21# functionality. Without the ability to ptrace, the crash reporter 22# tool is broken. 23# b/20150694 24# https://code.google.com/p/chromium/issues/detail?id=475270 25allow isolated_app self:process ptrace; 26 27# b/32896414: Allow accessing sdcard file descriptors passed to isolated_apps 28# by other processes. Open should never be allowed, and is blocked by 29# neverallow rules below. 30# media_rw_data_file is included for sdcardfs, and can be removed if sdcardfs 31# is modified to change the secontext when accessing the lower filesystem. 32allow isolated_app { sdcard_type media_rw_data_file }:file { read write append getattr lock map }; 33 34# For webviews, isolated_app processes can be forked from the webview_zygote 35# in addition to the zygote. Allow access to resources inherited from the 36# webview_zygote process. These rules are specialized copies of the ones in app.te. 37# Inherit FDs from the webview_zygote. 38allow isolated_app webview_zygote:fd use; 39# Notify webview_zygote of child death. 40allow isolated_app webview_zygote:process sigchld; 41# Inherit logd write socket. 42allow isolated_app webview_zygote:unix_dgram_socket write; 43# Read system properties managed by webview_zygote. 44allow isolated_app webview_zygote_tmpfs:file read; 45 46# Inherit FDs from the app_zygote. 47allow isolated_app app_zygote:fd use; 48# Notify app_zygote of child death. 49allow isolated_app app_zygote:process sigchld; 50# Inherit logd write socket. 51allow isolated_app app_zygote:unix_dgram_socket write; 52 53# TODO (b/63631799) fix this access 54# suppress denials to /data/local/tmp 55dontaudit isolated_app shell_data_file:dir search; 56 57# Write app-specific trace data to the Perfetto traced damon. This requires 58# connecting to its producer socket and obtaining a (per-process) tmpfs fd. 59allow isolated_app traced:fd use; 60allow isolated_app traced_tmpfs:file { read write getattr map }; 61unix_socket_connect(isolated_app, traced_producer, traced) 62 63# Allow heap profiling if the main app has been marked as profileable or 64# debuggable. 65can_profile_heap(isolated_app) 66 67allow isolated_app ashmem_device:chr_file { getattr read ioctl lock map append write }; 68 69##### 70##### Neverallow 71##### 72 73# Isolated apps should not directly open app data files themselves. 74neverallow isolated_app { app_data_file privapp_data_file }:file open; 75 76# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553) 77# TODO: are there situations where isolated_apps write to this file? 78# TODO: should we tighten these restrictions further? 79neverallow isolated_app anr_data_file:file ~{ open append }; 80neverallow isolated_app anr_data_file:dir ~search; 81 82# Isolated apps must not be permitted to use HwBinder 83neverallow isolated_app hwbinder_device:chr_file *; 84neverallow isolated_app *:hwservice_manager *; 85 86# Isolated apps must not be permitted to use VndBinder 87neverallow isolated_app vndbinder_device:chr_file *; 88 89# Isolated apps must not be permitted to perform actions on Binder and VndBinder service_manager 90# except the find actions for services allowlisted below. 91neverallow isolated_app *:service_manager ~find; 92 93# b/17487348 94# Isolated apps can only access three services, 95# activity_service, display_service, webviewupdate_service, and 96# ashmem_device_service. 97neverallow isolated_app { 98 service_manager_type 99 -activity_service 100 -ashmem_device_service 101 -display_service 102 -webviewupdate_service 103}:service_manager find; 104 105# Isolated apps shouldn't be able to access the driver directly. 106neverallow isolated_app gpu_device:chr_file { rw_file_perms execute }; 107 108# Do not allow isolated_app access to /cache 109neverallow isolated_app cache_file:dir ~{ r_dir_perms }; 110neverallow isolated_app cache_file:file ~{ read getattr }; 111 112# Do not allow isolated_app to access external storage, except for files passed 113# via file descriptors (b/32896414). 114neverallow isolated_app { storage_file mnt_user_file sdcard_type }:dir ~getattr; 115neverallow isolated_app { storage_file mnt_user_file }:file_class_set *; 116neverallow isolated_app sdcard_type:{ devfile_class_set lnk_file sock_file fifo_file } *; 117neverallow isolated_app sdcard_type:file ~{ read write append getattr lock map }; 118 119# Do not allow USB access 120neverallow isolated_app { usb_device usbaccessory_device }:chr_file *; 121 122# Restrict the webview_zygote control socket. 123neverallow isolated_app webview_zygote:sock_file write; 124 125# Limit the /sys files which isolated_app can access. This is important 126# for controlling isolated_app attack surface. 127neverallow isolated_app { 128 sysfs_type 129 -sysfs_devices_system_cpu 130 -sysfs_transparent_hugepage 131 -sysfs_usb # TODO: check with audio team if needed for isolated_app (b/28417852) 132}:file no_rw_file_perms; 133 134# No creation of sockets families other than AF_UNIX sockets. 135# List taken from system/sepolicy/public/global_macros - socket_class_set 136# excluding unix_stream_socket and unix_dgram_socket. 137# Many of these are socket families which have never and will never 138# be compiled into the Android kernel. 139neverallow isolated_app self:{ 140 socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket 141 key_socket appletalk_socket netlink_route_socket 142 netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket 143 netlink_selinux_socket netlink_audit_socket netlink_dnrt_socket 144 netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket 145 netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket 146 netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket 147 netlink_crypto_socket sctp_socket icmp_socket ax25_socket ipx_socket 148 netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket atmsvc_socket 149 rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket 150 bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket 151 ieee802154_socket caif_socket alg_socket nfc_socket vsock_socket kcm_socket 152 qipcrtr_socket smc_socket xdp_socket 153} create; 154