1# only HALs responsible for network hardware should have privileged 2# network capabilities 3neverallow { 4 halserverdomain 5 -hal_bluetooth_server 6 -hal_can_controller_server 7 -hal_wifi_server 8 -hal_wifi_hostapd_server 9 -hal_wifi_supplicant_server 10 -hal_telephony_server 11} self:global_capability_class_set { net_admin net_raw }; 12 13# Unless a HAL's job is to communicate over the network, or control network 14# hardware, it should not be using network sockets. 15# NOTE: HALs for automotive devices have an exemption from this rule because in 16# a car it is common to have external modules and HALs need to communicate to 17# those modules using network. Using this exemption for non-automotive builds 18# will result in CTS failure. 19neverallow { 20 halserverdomain 21 -hal_automotive_socket_exemption 22 -hal_can_controller_server 23 -hal_tetheroffload_server 24 -hal_wifi_server 25 -hal_wifi_hostapd_server 26 -hal_wifi_supplicant_server 27 -hal_telephony_server 28} domain:{ tcp_socket udp_socket rawip_socket } *; 29 30### 31# HALs are defined as an attribute and so a given domain could hypothetically 32# have multiple HALs in it (or even all of them) with the subsequent policy of 33# the domain comprised of the union of all the HALs. 34# 35# This is a problem because 36# 1) Security sensitive components should only be accessed by specific HALs. 37# 2) hwbinder_call and the restrictions it provides cannot be reasoned about in 38# the platform. 39# 3) The platform cannot reason about defense in depth if there are 40# monolithic domains etc. 41# 42# As an example, hal_keymaster and hal_gatekeeper can access the TEE and while 43# its OK for them to share a process its not OK with them to share processes 44# with other hals. 45# 46# The following neverallow rules, in conjuntion with CTS tests, assert that 47# these security principles are adhered to. 48# 49# Do not allow a hal to exec another process without a domain transition. 50# TODO remove exemptions. 51neverallow { 52 halserverdomain 53 -hal_dumpstate_server 54 -hal_telephony_server 55} { file_type fs_type }:file execute_no_trans; 56# Do not allow a process other than init to transition into a HAL domain. 57neverallow { domain -init } halserverdomain:process transition; 58# Only allow transitioning to a domain by running its executable. Do not 59# allow transitioning into a HAL domain by use of seclabel in an 60# init.*.rc script. 61neverallow * halserverdomain:process dyntransition; 62