1### 2### Ephemeral apps. 3### 4### This file defines the security policy for apps with the ephemeral 5### feature. 6### 7### The ephemeral_app domain is a reduced permissions sandbox allowing 8### ephemeral applications to be safely installed and run. Non ephemeral 9### applications may also opt-in to ephemeral to take advantage of the 10### additional security features. 11### 12### PackageManager flags an app as ephemeral at install time. 13 14typeattribute ephemeral_app coredomain; 15 16net_domain(ephemeral_app) 17app_domain(ephemeral_app) 18 19# Allow ephemeral apps to read/write files in visible storage if provided fds 20allow ephemeral_app { sdcard_type media_rw_data_file }:file {read write getattr ioctl lock append}; 21 22# Some apps ship with shared libraries and binaries that they write out 23# to their sandbox directory and then execute. 24allow ephemeral_app privapp_data_file:file { r_file_perms execute }; 25allow ephemeral_app app_data_file:file { r_file_perms execute }; 26 27# Follow priv-app symlinks. This is used for dynamite functionality. 28allow ephemeral_app privapp_data_file:lnk_file r_file_perms; 29 30# Allow the renderscript compiler to be run. 31domain_auto_trans(ephemeral_app, rs_exec, rs) 32 33# Allow loading and deleting shared libraries created by trusted system 34# components within an application home directory. 35allow ephemeral_app app_exec_data_file:file { r_file_perms execute unlink }; 36 37# services 38allow ephemeral_app audioserver_service:service_manager find; 39allow ephemeral_app cameraserver_service:service_manager find; 40allow ephemeral_app mediaserver_service:service_manager find; 41allow ephemeral_app mediaextractor_service:service_manager find; 42allow ephemeral_app mediametrics_service:service_manager find; 43allow ephemeral_app mediadrmserver_service:service_manager find; 44allow ephemeral_app drmserver_service:service_manager find; 45allow ephemeral_app radio_service:service_manager find; 46allow ephemeral_app ephemeral_app_api_service:service_manager find; 47 48# Write app-specific trace data to the Perfetto traced damon. This requires 49# connecting to its producer socket and obtaining a (per-process) tmpfs fd. 50perfetto_producer(ephemeral_app) 51 52# Allow profiling if the app opts in by being marked profileable/debuggable. 53can_profile_heap(ephemeral_app) 54can_profile_perf(ephemeral_app) 55 56# allow ephemeral apps to use UDP sockets provided by the system server but not 57# modify them other than to connect 58allow ephemeral_app system_server:udp_socket { 59 connect getattr read recvfrom sendto write getopt setopt }; 60 61allow ephemeral_app ashmem_device:chr_file rw_file_perms; 62 63### 64### neverallow rules 65### 66 67neverallow ephemeral_app { app_data_file privapp_data_file }:file execute_no_trans; 68 69# Receive or send uevent messages. 70neverallow ephemeral_app domain:netlink_kobject_uevent_socket *; 71 72# Receive or send generic netlink messages 73neverallow ephemeral_app domain:netlink_socket *; 74 75# Too much leaky information in debugfs. It's a security 76# best practice to ensure these files aren't readable. 77neverallow ephemeral_app debugfs:file read; 78 79# execute gpu_device 80neverallow ephemeral_app gpu_device:chr_file execute; 81 82# access files in /sys with the default sysfs label 83neverallow ephemeral_app sysfs:file *; 84 85# Avoid reads from generically labeled /proc files 86# Create a more specific label if needed 87neverallow ephemeral_app proc:file { no_rw_file_perms no_x_file_perms }; 88 89# Directly access external storage 90neverallow ephemeral_app { sdcard_type media_rw_data_file }:file {open create}; 91neverallow ephemeral_app { sdcard_type media_rw_data_file }:dir search; 92 93# Avoid reads to proc_net, it contains too much device wide information about 94# ongoing connections. 95neverallow ephemeral_app proc_net:file no_rw_file_perms; 96