1# vendor_init is its own domain. 2type vendor_init, domain, mlstrustedsubject; 3 4# Communication to the main init process 5allow vendor_init init:unix_stream_socket { read write }; 6 7# Logging to kmsg 8allow vendor_init kmsg_device:chr_file { open getattr write }; 9 10# Mount on /dev/usb-ffs/adb. 11allow vendor_init device:dir mounton; 12 13# Create and remove symlinks in /. 14allow vendor_init rootfs:lnk_file { create unlink }; 15 16# Create cgroups mount points in tmpfs and mount cgroups on them. 17allow vendor_init cgroup:dir create_dir_perms; 18allow vendor_init cgroup:file w_file_perms; 19allow vendor_init cgroup_v2:dir create_dir_perms; 20allow vendor_init cgroup_v2:file w_file_perms; 21 22# /config 23allow vendor_init configfs:dir mounton; 24allow vendor_init configfs:dir create_dir_perms; 25allow vendor_init configfs:{ file lnk_file } create_file_perms; 26 27# Create directories under /dev/cpuctl after chowning it to system. 28allow vendor_init self:global_capability_class_set { dac_override dac_read_search }; 29 30# mkdir, symlink, write, rm/rmdir, chown/chmod, restorecon/restorecon_recursive from init.rc files. 31# chown/chmod require open+read+setattr required for open()+fchown/fchmod(). 32# system/core/init.rc requires at least cache_file and data_file_type. 33# init.<board>.rc files often include device-specific types, so 34# we just allow all file types except /system files here. 35allow vendor_init self:global_capability_class_set { chown fowner fsetid }; 36 37# mkdir with FBE requires reading /data/unencrypted/{ref,mode}. 38allow vendor_init unencrypted_data_file:dir search; 39allow vendor_init unencrypted_data_file:file r_file_perms; 40 41# Set encryption policy on dirs in /data 42allowxperm vendor_init data_file_type:dir ioctl { 43 FS_IOC_GET_ENCRYPTION_POLICY 44 FS_IOC_SET_ENCRYPTION_POLICY 45}; 46 47allow vendor_init system_data_file:dir getattr; 48 49allow vendor_init { 50 file_type 51 -bpffs_type 52 -core_data_file_type 53 -exec_type 54 -system_dlkm_file_type 55 -system_file_type 56 -mnt_product_file 57 -password_slot_metadata_file 58 -ota_metadata_file 59 -unlabeled 60 -vendor_file_type 61 -vold_metadata_file 62 -gsi_metadata_file_type 63 -apex_metadata_file 64 -userspace_reboot_metadata_file 65}:dir { create search getattr open read setattr ioctl write add_name remove_name rmdir relabelfrom }; 66 67allow vendor_init unlabeled:{ dir notdevfile_class_set } { getattr relabelfrom }; 68 69allow vendor_init { 70 file_type 71 -bpffs_type 72 -core_data_file_type 73 -exec_type 74 -password_slot_metadata_file 75 -ota_metadata_file 76 -runtime_event_log_tags_file 77 -system_dlkm_file_type 78 -system_file_type 79 -unlabeled 80 -vendor_file_type 81 -vold_metadata_file 82 -gsi_metadata_file_type 83 -apex_metadata_file 84 -apex_info_file 85 -userspace_reboot_metadata_file 86 enforce_debugfs_restriction(`-debugfs_type') 87}:file { create getattr open read write setattr relabelfrom unlink map }; 88 89allow vendor_init { 90 file_type 91 -bpffs_type 92 -core_data_file_type 93 -exec_type 94 -password_slot_metadata_file 95 -ota_metadata_file 96 -system_dlkm_file_type 97 -system_file_type 98 -unlabeled 99 -vendor_file_type 100 -vold_metadata_file 101 -gsi_metadata_file_type 102 -apex_metadata_file 103 -userspace_reboot_metadata_file 104}:{ sock_file fifo_file } { create getattr open read setattr relabelfrom unlink }; 105 106allow vendor_init { 107 file_type 108 -apex_mnt_dir 109 -bpffs_type 110 -core_data_file_type 111 -exec_type 112 -password_slot_metadata_file 113 -ota_metadata_file 114 -system_dlkm_file_type 115 -system_file_type 116 -unlabeled 117 -vendor_file_type 118 -vold_metadata_file 119 -gsi_metadata_file_type 120 -apex_metadata_file 121 -userspace_reboot_metadata_file 122}:lnk_file { create getattr setattr relabelfrom unlink }; 123 124allow vendor_init { 125 file_type 126 -bpffs_type 127 -core_data_file_type 128 -exec_type 129 -mnt_product_file 130 -password_slot_metadata_file 131 -ota_metadata_file 132 -system_dlkm_file_type 133 -system_file_type 134 -vendor_file_type 135 -vold_metadata_file 136 -gsi_metadata_file_type 137 -apex_metadata_file 138 -userspace_reboot_metadata_file 139}:dir_file_class_set relabelto; 140 141allow vendor_init dev_type:dir create_dir_perms; 142allow vendor_init dev_type:lnk_file create; 143 144# Disable tracing by writing to /sys/kernel/debug/tracing/tracing_on 145allow vendor_init debugfs_tracing:file w_file_perms; 146 147# chown/chmod on pseudo files. 148allow vendor_init { 149 fs_type 150 -bpffs_type 151 -contextmount_type 152 -keychord_device 153 -sdcard_type 154 -fusefs_type 155 -rootfs 156 -proc_uid_time_in_state 157 -proc_uid_concurrent_active_time 158 -proc_uid_concurrent_policy_time 159 enforce_debugfs_restriction(`-debugfs_type') 160}:file { open read setattr map }; 161 162allow vendor_init tracefs_type:file { open read setattr map }; 163 164allow vendor_init { 165 fs_type 166 -bpffs_type 167 -contextmount_type 168 -sdcard_type 169 -fusefs_type 170 -rootfs 171 -proc_uid_time_in_state 172 -proc_uid_concurrent_active_time 173 -proc_uid_concurrent_policy_time 174}:dir { open read setattr search }; 175 176allow vendor_init dev_type:blk_file getattr; 177 178# Write to /proc/sys/net/ping_group_range and other /proc/sys/net files. 179r_dir_file(vendor_init, proc_net_type) 180allow vendor_init proc_net_type:file w_file_perms; 181allow vendor_init self:global_capability_class_set net_admin; 182 183# Write to /proc/sys/vm/page-cluster 184allow vendor_init proc_page_cluster:file w_file_perms; 185 186# Write to sysfs nodes. 187allow vendor_init sysfs_type:dir r_dir_perms; 188allow vendor_init sysfs_type:lnk_file read; 189allow vendor_init { sysfs_type -sysfs_usermodehelper }:file rw_file_perms; 190 191# setfscreatecon() for labeling directories and socket files. 192allow vendor_init self:process { setfscreate }; 193 194r_dir_file(vendor_init, vendor_file_type) 195 196# Vendor init can read properties 197allow vendor_init serialno_prop:file { getattr open read map }; 198 199# Vendor init can perform operations on trusted and security Extended Attributes 200allow vendor_init self:global_capability_class_set sys_admin; 201 202# Raw writes to misc block device 203allow vendor_init misc_block_device:blk_file w_file_perms; 204 205# vendor_init is using bootstrap bionic 206use_bootstrap_libs(vendor_init) 207 208# allow filesystem tuning 209allow vendor_init userdata_sysdev:file create_file_perms; 210 211# Everything is labeled as rootfs in recovery mode. Vendor init has to execute 212# the dynamic linker and shared libraries. 213recovery_only(` 214 allow vendor_init rootfs:file { r_file_perms execute }; 215') 216 217not_compatible_property(` 218 set_prop(vendor_init, { 219 property_type 220 -system_internal_property_type 221 -system_restricted_property_type 222 }) 223') 224 225# Get file context 226allow vendor_init file_contexts_file:file r_file_perms; 227 228# Allow vendor_init to (re)set nice 229allow vendor_init self:capability sys_nice; 230 231set_prop(vendor_init, apk_verity_prop) 232set_prop(vendor_init, bluetooth_a2dp_offload_prop) 233set_prop(vendor_init, bluetooth_audio_hal_prop) 234set_prop(vendor_init, bluetooth_config_prop) 235set_prop(vendor_init, camera2_extensions_prop) 236set_prop(vendor_init, camerax_extensions_prop) 237set_prop(vendor_init, cpu_variant_prop) 238set_prop(vendor_init, dalvik_config_prop) 239set_prop(vendor_init, dalvik_dynamic_config_prop) 240set_prop(vendor_init, dalvik_runtime_prop) 241set_prop(vendor_init, debug_prop) 242set_prop(vendor_init, exported_bluetooth_prop) 243set_prop(vendor_init, exported_camera_prop) 244set_prop(vendor_init, exported_config_prop) 245set_prop(vendor_init, exported_default_prop) 246set_prop(vendor_init, exported_overlay_prop) 247set_prop(vendor_init, exported_pm_prop) 248set_prop(vendor_init, ffs_control_prop) 249set_prop(vendor_init, hw_timeout_multiplier_prop) 250set_prop(vendor_init, incremental_prop) 251set_prop(vendor_init, lmkd_prop) 252set_prop(vendor_init, logd_prop) 253set_prop(vendor_init, log_tag_prop) 254set_prop(vendor_init, log_prop) 255set_prop(vendor_init, graphics_config_writable_prop) 256set_prop(vendor_init, qemu_hw_prop) 257set_prop(vendor_init, radio_control_prop) 258set_prop(vendor_init, rebootescrow_hal_prop) 259set_prop(vendor_init, serialno_prop) 260set_prop(vendor_init, soc_prop) 261set_prop(vendor_init, surfaceflinger_color_prop) 262set_prop(vendor_init, usb_control_prop) 263set_prop(vendor_init, userspace_reboot_config_prop) 264set_prop(vendor_init, vehicle_hal_prop) 265set_prop(vendor_init, vendor_default_prop) 266set_prop(vendor_init, keystore_config_prop) 267set_prop(vendor_init, vendor_security_patch_level_prop) 268set_prop(vendor_init, vndk_prop) 269set_prop(vendor_init, virtual_ab_prop) 270set_prop(vendor_init, vold_post_fs_data_prop) 271set_prop(vendor_init, wifi_hal_prop) 272set_prop(vendor_init, wifi_log_prop) 273set_prop(vendor_init, zram_control_prop) 274 275get_prop(vendor_init, boot_status_prop) 276get_prop(vendor_init, exported3_system_prop) 277get_prop(vendor_init, ota_prop) 278get_prop(vendor_init, power_debug_prop) 279get_prop(vendor_init, provisioned_prop) 280get_prop(vendor_init, retaildemo_prop) 281get_prop(vendor_init, surfaceflinger_display_prop) 282get_prop(vendor_init, test_harness_prop) 283get_prop(vendor_init, theme_prop) 284set_prop(vendor_init, dck_prop) 285 286# Allow vendor_init to read vendor_system_native device config changes 287get_prop(vendor_init, device_config_vendor_system_native_prop) 288get_prop(vendor_init, device_config_vendor_system_native_boot_prop) 289 290### 291### neverallow rules 292### 293 294# Vendor init shouldn't communicate with any vendor process, nor most system processes. 295neverallow_establish_socket_comms(vendor_init, { 296 domain -init -logd -prng_seeder -su -vendor_init }); 297 298# The vendor_init domain is only entered via an exec based transition from the 299# init domain, never via setcon(). 300neverallow domain vendor_init:process dyntransition; 301neverallow { domain -init } vendor_init:process transition; 302neverallow vendor_init { file_type fs_type -init_exec }:file entrypoint; 303 304# Never read/follow symlinks created by shell or untrusted apps. 305neverallow vendor_init { app_data_file privapp_data_file }:lnk_file read; 306neverallow vendor_init shell_data_file:lnk_file read; 307# Init should not be creating subdirectories in /data/local/tmp 308neverallow vendor_init shell_data_file:dir { write add_name remove_name }; 309 310# init should never execute a program without changing to another domain. 311neverallow vendor_init { file_type fs_type }:file execute_no_trans; 312 313# Init never adds or uses services via service_manager. 314neverallow vendor_init service_manager_type:service_manager { add find }; 315neverallow vendor_init servicemanager:service_manager list; 316 317# vendor_init should never be ptraced 318neverallow * vendor_init:process ptrace; 319