1typeattribute apexd coredomain; 2 3init_daemon_domain(apexd) 4 5# Allow creating, reading and writing of APEX files/dirs in the APEX data dir 6allow apexd apex_data_file:dir create_dir_perms; 7allow apexd apex_data_file:file create_file_perms; 8# Allow relabeling file created in /data/apex/decompressed 9allow apexd apex_data_file:file relabelfrom; 10 11# Allow creating, reading and writing of APEX files/dirs in the APEX metadata dir 12allow apexd metadata_file:dir search; 13allow apexd apex_metadata_file:dir create_dir_perms; 14allow apexd apex_metadata_file:file create_file_perms; 15 16# Allow creating and writing APEX files/dirs in the SEPolicy metadata dir 17allow apexd sepolicy_metadata_file:dir create_dir_perms; 18allow apexd sepolicy_metadata_file:file create_file_perms; 19# Allow apexd to setup fs-verity for SEPolicy files in metadata 20allowxperm apexd sepolicy_metadata_file:file ioctl { 21 FS_IOC_ENABLE_VERITY FS_IOC_MEASURE_VERITY 22}; 23 24# Allow reserving space on /data/apex/ota_reserved for apex decompression 25allow apexd apex_ota_reserved_file:dir create_dir_perms; 26allow apexd apex_ota_reserved_file:file create_file_perms; 27 28# Allow apexd to create files and directories for snapshots of apex data 29allow apexd apex_data_file_type:dir { create_dir_perms relabelto }; 30allow apexd apex_data_file_type:file { create_file_perms relabelto }; 31allow apexd apex_module_data_file:dir { create_dir_perms relabelfrom }; 32allow apexd apex_module_data_file:file { create_file_perms relabelfrom }; 33allow apexd apex_rollback_data_file:dir create_dir_perms; 34allow apexd apex_rollback_data_file:file create_file_perms; 35 36# Allow apexd to read /data/misc_de and the directories under it, in order to 37# snapshot and restore apex data for all users. 38allow apexd { 39 system_userdir_file 40 system_data_file 41}:dir r_dir_perms; 42 43# allow apexd to create loop devices with /dev/loop-control 44allow apexd loop_control_device:chr_file rw_file_perms; 45# allow apexd to access loop devices 46allow apexd loop_device:blk_file rw_file_perms; 47allowxperm apexd loop_device:blk_file ioctl { 48 LOOP_GET_STATUS64 49 LOOP_SET_STATUS64 50 LOOP_SET_FD 51 LOOP_SET_BLOCK_SIZE 52 LOOP_SET_DIRECT_IO 53 LOOP_CLR_FD 54 BLKFLSBUF 55 LOOP_CONFIGURE 56}; 57# Allow apexd to access /dev/block 58allow apexd dev_type:dir r_dir_perms; 59allow apexd dev_type:blk_file getattr; 60 61#allow apexd to access virtual disks 62allow apexd vd_device:blk_file r_file_perms; 63 64# allow apexd to access /dev/block/dm-* (device-mapper entries) 65allow apexd dm_device:chr_file rw_file_perms; 66allow apexd dm_device:blk_file rw_file_perms; 67 68# sys_admin is required to access the device-mapper and mount 69# dac_override, chown, and fowner are needed for snapshot and restore 70allow apexd self:global_capability_class_set { sys_admin chown dac_override dac_read_search fowner }; 71 72# Note: fsetid is deliberately not included above. fsetid checks are 73# triggered by chmod on a directory or file owned by a group other 74# than one of the groups assigned to the current process to see if 75# the setgid bit should be cleared, regardless of whether the setgid 76# bit was even set. We do not appear to truly need this capability 77# for apexd to operate. 78dontaudit apexd self:global_capability_class_set fsetid; 79 80# allow apexd to create a mount point in /apex 81allow apexd apex_mnt_dir:dir create_dir_perms; 82# allow apexd to mount in /apex 83allow apexd apex_mnt_dir:filesystem { mount unmount }; 84allow apexd apex_mnt_dir:dir mounton; 85# allow apexd to create symlinks in /apex 86allow apexd apex_mnt_dir:lnk_file create_file_perms; 87# allow apexd to create /apex/apex-info-list.xml and relabel to apex_info_file 88allow apexd apex_mnt_dir:file { create_file_perms relabelfrom mounton }; 89allow apexd apex_info_file:file relabelto; 90# apexd needs to update /apex/apex-info-list.xml after non-staged APEX update. 91allow apexd apex_info_file:file rw_file_perms; 92 93# allow apexd to unlink apex files in /data/apex/active 94# note that apexd won't be able to unlink files in /data/app-staging/session_XXXX, 95# because it doesn't have write permission for staging_data_file object. 96allow apexd staging_data_file:file unlink; 97 98# allow apexd to read files from /data/app-staging and hardlink them to /data/apex. 99allow apexd staging_data_file:dir r_dir_perms; 100allow apexd staging_data_file:file { r_file_perms link }; 101# # Allow relabeling file created in /data/apex/decompressed 102allow apexd staging_data_file:file relabelto; 103 104# allow apexd to read files from /vendor/apex 105allow apexd vendor_apex_file:dir r_dir_perms; 106allow apexd vendor_apex_file:file r_file_perms; 107 108# Unmount and mount filesystems 109allow apexd labeledfs:filesystem { mount unmount }; 110 111# /sys directory tree traversal 112allow apexd sysfs_type:dir search; 113# Access to /sys/class/block 114allow apexd sysfs_type:dir r_dir_perms; 115allow apexd sysfs_type:file r_file_perms; 116# Configure read-ahead of dm-verity and loop devices 117# for dm-X 118allow apexd sysfs_dm:dir r_dir_perms; 119allow apexd sysfs_dm:file rw_file_perms; 120# for loopX 121allow apexd sysfs_loop:dir r_dir_perms; 122allow apexd sysfs_loop:file rw_file_perms; 123 124# Allow apexd to log to the kernel. 125allow apexd kmsg_device:chr_file w_file_perms; 126 127# Allow apexd to reboot device. Required for rollbacks of apexes that are 128# not covered by rollback manager. 129set_prop(apexd, powerctl_prop) 130 131# Allow apexd to stop itself 132set_prop(apexd, ctl_apexd_prop) 133 134# Allow apexd to send control messages to load/unload apex from init 135set_prop(apexd, ctl_apex_load_prop) 136 137# Find the vold service, and call into vold to manage FS checkpoints 138allow apexd vold_service:service_manager find; 139binder_call(apexd, vold) 140 141# apexd is using bootstrap bionic 142use_bootstrap_libs(apexd) 143 144# Allow apexd to be invoked with logwrapper from init during userspace reboot. 145allow apexd devpts:chr_file { read write }; 146 147# Allow apexd to create pts files via logwrap_fork_exec for its own use, to pass to 148# other processes 149create_pty(apexd) 150 151# Allow apexd to read file contexts when performing restorecon of snapshots. 152allow apexd file_contexts_file:file r_file_perms; 153 154# Allow apexd to execute toybox for snapshot & restore 155allow apexd toolbox_exec:file rx_file_perms; 156 157# Allow apexd to release compressed blocks in case /data is f2fs-compressed fs. 158allowxperm apexd staging_data_file:file ioctl { 159 FS_IOC_GETFLAGS 160 F2FS_IOC_RELEASE_COMPRESS_BLOCKS 161}; 162 163# Allow apexd to read ro.cold_boot_done prop. 164# apexd uses it to decide whether it needs to keep retrying polling for loop device. 165get_prop(apexd, cold_boot_done_prop) 166 167# Allow apexd to read per-device configuration properties. 168get_prop(apexd, apexd_config_prop) 169 170# Allow apexd to read apex selection properties. 171# These are used to choose between multi-installed APEXes at activation time. 172get_prop(apexd, apexd_select_prop) 173# 174# Allow apexd to read apexd_payload_metadata_prop 175get_prop(apexd, apexd_payload_metadata_prop) 176 177neverallow { domain -apexd -init } apex_data_file:dir no_w_dir_perms; 178neverallow { domain -apexd -init } apex_metadata_file:dir no_w_dir_perms; 179neverallow { domain -apexd -init -kernel } apex_data_file:file no_w_file_perms; 180neverallow { domain -apexd -init -kernel } apex_metadata_file:file no_w_file_perms; 181neverallow { domain -apexd } apex_mnt_dir:lnk_file no_w_file_perms; 182 183neverallow { domain -apexd -init -vold_prepare_subdirs } apex_module_data_file:dir no_w_dir_perms; 184neverallow { domain -apexd -init -vold_prepare_subdirs } apex_module_data_file:file no_w_file_perms; 185 186neverallow { domain -apexd -init -vold_prepare_subdirs } apex_rollback_data_file:dir no_w_dir_perms; 187neverallow { domain -apexd -init -vold_prepare_subdirs } apex_rollback_data_file:file no_w_file_perms; 188 189# only apexd can set apexd sysprop 190set_prop(apexd, apexd_prop) 191neverallow { domain -apexd -init } apexd_prop:property_service set; 192 193# only apexd can write apex-info-list.xml 194neverallow { domain -apexd } apex_info_file:file no_w_file_perms; 195 196# Only apexd and init should be allowed to manage /apex mounts 197# A note on otapreopt_chroot. It used to mount APEXes during postainstall stage of A/B OTAs, 198# but starting from S it just calls into apexd to prepare /apex for otapreoprt. Once the sepolicies 199# around otapreopt_chroot are cleaned up we should be able to remove it from the lists below. 200neverallow { domain -apexd -init -otapreopt_chroot } apex_mnt_dir:filesystem { mount unmount }; 201neverallow { domain -apexd -init -otapreopt_chroot } apex_mnt_dir:dir { mounton }; 202 203# Allow for use in postinstall 204allow apexd otapreopt_chroot:fd use; 205allow apexd postinstall_apex_mnt_dir:dir { create_dir_perms mounton }; 206allow apexd postinstall_apex_mnt_dir:file { create_file_perms relabelfrom }; 207allow apexd postinstall_apex_mnt_dir:lnk_file create; 208allow apexd proc_filesystems:file r_file_perms; 209 210# Allow calling derive_classpath to gather BCP information for staged sessions 211domain_auto_trans(apexd, derive_classpath_exec, apexd_derive_classpath); 212 213# Allow set apex ready property 214set_prop(apexd, apex_ready_prop) 215