1### 2### A domain for further sandboxing privileged apps. 3### 4 5typeattribute priv_app coredomain; 6app_domain(priv_app) 7 8# Access the network. 9net_domain(priv_app) 10# Access bluetooth. 11bluetooth_domain(priv_app) 12 13# Allow the allocation and use of ptys 14# Used by: https://play.privileged.com/store/apps/details?id=jackpal.androidterm 15create_pty(priv_app) 16 17# Allow loading executable code from writable priv-app home 18# directories. This is a W^X violation, however, it needs 19# to be supported for now for the following reasons. 20# * /data/user_*/0/*/code_cache/* POSSIBLE uses (b/117841367) 21# 1) com.android.opengl.shaders_cache 22# 2) com.android.skia.shaders_cache 23# 3) com.android.renderscript.cache 24# * /data/user_de/0/com.google.android.gms/app_chimera 25# TODO: Tighten (b/112357170) 26allow priv_app privapp_data_file:file execute; 27 28# Chrome Crashpad uses the the dynamic linker to load native executables 29# from an APK (b/112050209, crbug.com/928422) 30allow priv_app system_linker_exec:file execute_no_trans; 31 32allow priv_app privapp_data_file:lnk_file create_file_perms; 33 34# Priv apps can find services that expose both @SystemAPI and normal APIs. 35allow priv_app app_api_service:service_manager find; 36allow priv_app system_api_service:service_manager find; 37 38allow priv_app audioserver_service:service_manager find; 39allow priv_app cameraserver_service:service_manager find; 40allow priv_app drmserver_service:service_manager find; 41allow priv_app mediadrmserver_service:service_manager find; 42allow priv_app mediaextractor_service:service_manager find; 43allow priv_app mediametrics_service:service_manager find; 44allow priv_app mediaserver_service:service_manager find; 45allow priv_app music_recognition_service:service_manager find; 46allow priv_app network_watchlist_service:service_manager find; 47allow priv_app nfc_service:service_manager find; 48allow priv_app oem_lock_service:service_manager find; 49allow priv_app persistent_data_block_service:service_manager find; 50allow priv_app radio_service:service_manager find; 51allow priv_app recovery_service:service_manager find; 52allow priv_app stats_service:service_manager find; 53 54# Write to /cache. 55allow priv_app { cache_file cache_recovery_file }:dir create_dir_perms; 56allow priv_app { cache_file cache_recovery_file }:file create_file_perms; 57# /cache is a symlink to /data/cache on some devices. Allow reading the link. 58allow priv_app cache_file:lnk_file r_file_perms; 59 60# Access to /data/media. 61allow priv_app media_rw_data_file:dir create_dir_perms; 62allow priv_app media_rw_data_file:file create_file_perms; 63 64# Used by Finsky / Android "Verify Apps" functionality when 65# running "adb install foo.apk". 66allow priv_app shell_data_file:file r_file_perms; 67allow priv_app shell_data_file:dir r_dir_perms; 68 69# Allow traceur to pass file descriptors through a content provider to betterbug 70allow priv_app trace_data_file:file { getattr read }; 71 72# Allow betterbug to read profile reports generated by profcollect. 73userdebug_or_eng(` 74 allow priv_app profcollectd_data_file:file r_file_perms; 75') 76 77# Allow the bug reporting frontend to read the presence and timestamp of the 78# trace attached to the bugreport (but not its contents, which will go in the 79# usual bugreport .zip file). This is used by the bug reporting UI to tell if 80# the bugreport will contain a system trace or not while the bugreport is still 81# in progress. 82allow priv_app perfetto_traces_bugreport_data_file:dir r_dir_perms; 83allow priv_app perfetto_traces_bugreport_data_file:file { getattr }; 84# Required to traverse the parent dir (/data/misc/perfetto-traces). 85allow priv_app perfetto_traces_data_file:dir { search }; 86 87# Allow verifier to access staged apks. 88allow priv_app { apk_tmp_file apk_private_tmp_file }:dir r_dir_perms; 89allow priv_app { apk_tmp_file apk_private_tmp_file }:file r_file_perms; 90 91# For AppFuse. 92allow priv_app vold:fd use; 93allow priv_app fuse_device:chr_file { read write }; 94 95# /proc access 96allow priv_app { 97 proc_vmstat 98}:file r_file_perms; 99 100allow priv_app sysfs_type:dir search; 101# Read access to /sys/class/net/wlan*/address 102r_dir_file(priv_app, sysfs_net) 103# Read access to /sys/block/zram*/mm_stat 104r_dir_file(priv_app, sysfs_zram) 105 106r_dir_file(priv_app, rootfs) 107 108# access the mac address 109allowxperm priv_app self:udp_socket ioctl SIOCGIFHWADDR; 110 111# Allow com.android.vending to communicate with statsd. 112binder_call(priv_app, statsd) 113 114# Allow Phone to read/write cached ringtones (opened by system). 115allow priv_app ringtone_file:file { getattr read write }; 116 117# Access to /data/preloads 118allow priv_app preloads_data_file:file r_file_perms; 119allow priv_app preloads_data_file:dir r_dir_perms; 120allow priv_app preloads_media_file:file r_file_perms; 121allow priv_app preloads_media_file:dir r_dir_perms; 122 123read_runtime_log_tags(priv_app) 124 125# Write app-specific trace data to the Perfetto traced damon. This requires 126# connecting to its producer socket and obtaining a (per-process) tmpfs fd. 127perfetto_producer(priv_app) 128 129# Allow priv_apps to request and collect incident reports. 130# (Also requires DUMP and PACKAGE_USAGE_STATS permissions) 131allow priv_app incident_service:service_manager find; 132binder_call(priv_app, incidentd) 133allow priv_app incidentd:fifo_file { read write }; 134 135# Allow profiling if the app opts in by being marked profileable/debuggable. 136can_profile_heap(priv_app) 137can_profile_perf(priv_app) 138 139# Allow priv_apps to check whether Dynamic System Update is enabled 140get_prop(priv_app, dynamic_system_prop) 141 142# suppress denials for non-API accesses. 143dontaudit priv_app exec_type:file getattr; 144dontaudit priv_app device:dir read; 145dontaudit priv_app fs_bpf:dir search; 146dontaudit priv_app net_dns_prop:file read; 147dontaudit priv_app proc:file read; 148dontaudit priv_app proc_interrupts:file read; 149dontaudit priv_app proc_modules:file read; 150dontaudit priv_app proc_net:file read; 151dontaudit priv_app proc_stat:file read; 152dontaudit priv_app proc_version:file read; 153dontaudit priv_app sysfs:dir read; 154dontaudit priv_app sysfs:file read; 155dontaudit priv_app sysfs_android_usb:file read; 156dontaudit priv_app sysfs_dm:file r_file_perms; 157dontaudit priv_app { wifi_prop wifi_hal_prop }:file read; 158 159# allow privileged apps to use UDP sockets provided by the system server but not 160# modify them other than to connect 161allow priv_app system_server:udp_socket { 162 connect getattr read recvfrom sendto write getopt setopt }; 163 164# allow apps like Phonesky to check the file signature of an apk installed on 165# the Incremental File System, fill missing blocks and get the app status and loading progress 166allowxperm priv_app apk_data_file:file ioctl { 167 INCFS_IOCTL_READ_SIGNATURE 168 INCFS_IOCTL_FILL_BLOCKS 169 INCFS_IOCTL_GET_BLOCK_COUNT 170 INCFS_IOCTL_GET_FILLED_BLOCKS 171}; 172 173# allow privileged data loader apps (e.g. com.android.vending) to read logs from Incremental File System 174allow priv_app incremental_control_file:file { read getattr ioctl }; 175 176# allow apps like Phonesky to request permission to fill blocks of an apk file 177# on the Incremental File System. 178allowxperm priv_app incremental_control_file:file ioctl INCFS_IOCTL_PERMIT_FILL; 179 180# allow privileged apps to read the vendor property that indicates if Incremental File System is enabled 181get_prop(priv_app, incremental_prop) 182 183# Required for Phonesky to be able to read APEX files under /data/apex/active/. 184allow priv_app apex_data_file:dir search; 185allow priv_app staging_data_file:file r_file_perms; 186# Required for Phonesky to be able to read staged files under /data/app-staging. 187allow priv_app staging_data_file:dir r_dir_perms; 188 189# allow priv app to access the system app data files for ContentProvider case. 190allow priv_app system_app_data_file:file { read getattr }; 191 192# Allow the renderscript compiler to be run. 193domain_auto_trans(priv_app, rs_exec, rs) 194 195# Allow loading and deleting executable shared libraries 196# within an application home directory. Such shared libraries would be 197# created by things like renderscript or via other mechanisms. 198allow priv_app app_exec_data_file:file { r_file_perms execute unlink }; 199 200### 201### neverallow rules 202### 203 204# Receive or send uevent messages. 205neverallow priv_app domain:netlink_kobject_uevent_socket *; 206 207# Receive or send generic netlink messages 208neverallow priv_app domain:netlink_socket *; 209 210# Read or write kernel printk buffer 211neverallow priv_app kmsg_device:chr_file no_rw_file_perms; 212 213# Too much leaky information in debugfs. It's a security 214# best practice to ensure these files aren't readable. 215neverallow priv_app debugfs:file read; 216 217# Do not allow privileged apps to register services. 218# Only trusted components of Android should be registering 219# services. 220neverallow priv_app service_manager_type:service_manager add; 221 222# Do not allow privileged apps to connect to the property service 223# or set properties. b/10243159 224neverallow priv_app property_socket:sock_file write; 225neverallow priv_app init:unix_stream_socket connectto; 226neverallow priv_app property_type:property_service set; 227 228# Do not allow priv_app to be assigned mlstrustedsubject. 229# This would undermine the per-user isolation model being 230# enforced via levelFrom=user in seapp_contexts and the mls 231# constraints. As there is no direct way to specify a neverallow 232# on attribute assignment, this relies on the fact that fork 233# permission only makes sense within a domain (hence should 234# never be granted to any other domain within mlstrustedsubject) 235# and priv_app is allowed fork permission to itself. 236neverallow priv_app mlstrustedsubject:process fork; 237 238# Do not allow priv_app to hard link to any files. 239# In particular, if priv_app links to other app data 240# files, installd will not be able to guarantee the deletion 241# of the linked to file. Hard links also contribute to security 242# bugs, so we want to ensure priv_app never has this 243# capability. 244neverallow priv_app file_type:file link; 245 246# priv apps should not be able to open trace data files, they should depend 247# upon traceur to pass a file descriptor which they can then read 248neverallow priv_app trace_data_file:dir *; 249neverallow priv_app trace_data_file:file { no_w_file_perms open }; 250 251# Do not allow priv_app access to cgroups. 252neverallow priv_app cgroup:file *; 253neverallow priv_app cgroup_v2:file *; 254 255# Do not allow loading executable code from non-privileged 256# application home directories. Code loading across a security boundary 257# is dangerous and allows a full compromise of a privileged process 258# by an unprivileged process. b/112357170 259neverallow priv_app app_data_file:file no_x_file_perms; 260 261# Do not follow untrusted app provided symlinks 262neverallow priv_app app_data_file:lnk_file { open read getattr }; 263