1# Creating files on sysfs is impossible so this isn't a threat 2# Sometimes we have to write to non-existent files to avoid conditional 3# init behavior. See b/35303861 for an example. 4dontaudit vendor_init sysfs:dir write; 5 6# TODO(b/140259336) We want to remove vendor_init in the long term but allow for now 7allow vendor_init system_data_root_file:dir rw_dir_perms; 8 9# Let vendor_init set service.adb.tcp.port. 10set_prop(vendor_init, adbd_config_prop) 11 12# Let vendor_init react to AVF device config changes 13get_prop(vendor_init, device_config_virtualization_framework_native_prop) 14 15# Let vendor_init use apex.<name>.ready to start services from vendor APEX 16get_prop(vendor_init, apex_ready_prop) 17 18# Let vendor_init read ro.fstype.data to process init.rc triggers 19# for this property 20get_prop(vendor_init, fstype_prop) 21 22# chown/chmod on devices, e.g. /dev/ttyHS0 23allow vendor_init { 24 dev_type 25 -keychord_device 26 -vm_manager_device_type 27 -port_device 28 -lowpan_device 29 -hw_random_device 30}:chr_file setattr; 31 32# Communication to the main init process 33allow vendor_init init:unix_stream_socket { read write }; 34 35# Logging to kmsg 36allow vendor_init kmsg_device:chr_file { open getattr write }; 37 38# Mount on /dev/usb-ffs/adb. 39allow vendor_init device:dir mounton; 40 41# Create and remove symlinks in /. 42allow vendor_init rootfs:lnk_file { create unlink }; 43 44# Create cgroups mount points in tmpfs and mount cgroups on them. 45allow vendor_init cgroup:dir create_dir_perms; 46allow vendor_init cgroup:file w_file_perms; 47allow vendor_init cgroup_v2:dir create_dir_perms; 48allow vendor_init cgroup_v2:file w_file_perms; 49 50# /config 51allow vendor_init configfs:dir mounton; 52allow vendor_init configfs:dir create_dir_perms; 53allow vendor_init configfs:{ file lnk_file } create_file_perms; 54 55# Create directories under /dev/cpuctl after chowning it to system. 56allow vendor_init self:global_capability_class_set { dac_override dac_read_search }; 57 58# mkdir, symlink, write, rm/rmdir, chown/chmod, restorecon/restorecon_recursive from init.rc files. 59# chown/chmod require open+read+setattr required for open()+fchown/fchmod(). 60# system/core/init.rc requires at least cache_file and data_file_type. 61# init.<board>.rc files often include device-specific types, so 62# we just allow all file types except /system files here. 63allow vendor_init self:global_capability_class_set { chown fowner fsetid }; 64 65# mkdir with FBE requires reading /data/unencrypted/{ref,mode}. 66allow vendor_init unencrypted_data_file:dir search; 67allow vendor_init unencrypted_data_file:file r_file_perms; 68 69# Set encryption policy on dirs in /data 70allowxperm vendor_init data_file_type:dir ioctl { 71 FS_IOC_GET_ENCRYPTION_POLICY 72 FS_IOC_SET_ENCRYPTION_POLICY 73}; 74 75allow vendor_init system_data_file:dir getattr; 76 77allow vendor_init { 78 file_type 79 -bpffs_type 80 -core_data_file_type 81 -exec_type 82 -system_dlkm_file_type 83 -system_file_type 84 -mnt_product_file 85 -password_slot_metadata_file 86 -ota_metadata_file 87 -unlabeled 88 -vendor_file_type 89 -vold_metadata_file 90 -gsi_metadata_file_type 91 -apex_metadata_file 92 -userspace_reboot_metadata_file 93 -aconfig_storage_metadata_file 94 -aconfig_storage_flags_metadata_file 95}:dir { create search getattr open read setattr ioctl write add_name remove_name rmdir relabelfrom }; 96 97allow vendor_init unlabeled:{ dir notdevfile_class_set } { getattr relabelfrom }; 98 99allow vendor_init { 100 file_type 101 -bpffs_type 102 -core_data_file_type 103 -exec_type 104 -password_slot_metadata_file 105 -ota_metadata_file 106 -runtime_event_log_tags_file 107 -system_dlkm_file_type 108 -system_file_type 109 -unlabeled 110 -vendor_file_type 111 -vold_metadata_file 112 -gsi_metadata_file_type 113 -apex_metadata_file 114 -apex_info_file 115 -userspace_reboot_metadata_file 116 -aconfig_storage_metadata_file 117 -aconfig_storage_flags_metadata_file 118 -tradeinmode_metadata_file 119 -proc_kallsyms 120 enforce_debugfs_restriction(`-debugfs_type') 121}:file { create getattr open read write setattr relabelfrom unlink map }; 122 123allow vendor_init { 124 file_type 125 -bpffs_type 126 -core_data_file_type 127 -exec_type 128 -password_slot_metadata_file 129 -ota_metadata_file 130 -system_dlkm_file_type 131 -system_file_type 132 -unlabeled 133 -vendor_file_type 134 -vold_metadata_file 135 -gsi_metadata_file_type 136 -apex_metadata_file 137 -userspace_reboot_metadata_file 138 -aconfig_storage_metadata_file 139 -aconfig_storage_flags_metadata_file 140}:{ sock_file fifo_file } { create getattr open read setattr relabelfrom unlink }; 141 142allow vendor_init { 143 file_type 144 -apex_mnt_dir 145 -bpffs_type 146 -core_data_file_type 147 -exec_type 148 -password_slot_metadata_file 149 -ota_metadata_file 150 -system_dlkm_file_type 151 -system_file_type 152 -unlabeled 153 -vendor_file_type 154 -vold_metadata_file 155 -gsi_metadata_file_type 156 -apex_metadata_file 157 -userspace_reboot_metadata_file 158 -aconfig_storage_metadata_file 159 -aconfig_storage_flags_metadata_file 160}:lnk_file { create getattr setattr relabelfrom unlink }; 161 162allow vendor_init { 163 file_type 164 -bpffs_type 165 -core_data_file_type 166 -exec_type 167 -mnt_product_file 168 -password_slot_metadata_file 169 -ota_metadata_file 170 -system_dlkm_file_type 171 -system_file_type 172 -vendor_file_type 173 -vold_metadata_file 174 -gsi_metadata_file_type 175 -apex_metadata_file 176 -userspace_reboot_metadata_file 177 -aconfig_storage_metadata_file 178 -aconfig_storage_flags_metadata_file 179}:dir_file_class_set relabelto; 180 181allow vendor_init dev_type:dir create_dir_perms; 182allow vendor_init dev_type:lnk_file create; 183 184# Disable tracing by writing to /sys/kernel/debug/tracing/tracing_on 185allow vendor_init debugfs_tracing:file w_file_perms; 186 187# chown/chmod on pseudo files. 188allow vendor_init { 189 fs_type 190 -bpffs_type 191 -contextmount_type 192 -keychord_device 193 -sdcard_type 194 -fusefs_type 195 -rootfs 196 -proc_uid_time_in_state 197 -proc_uid_concurrent_active_time 198 -proc_uid_concurrent_policy_time 199 -proc_kallsyms 200 enforce_debugfs_restriction(`-debugfs_type') 201}:file { open read setattr map }; 202 203allow vendor_init tracefs_type:file { open read setattr map }; 204 205allow vendor_init { 206 fs_type 207 -bpffs_type 208 -contextmount_type 209 -sdcard_type 210 -fusefs_type 211 -rootfs 212 -proc_uid_time_in_state 213 -proc_uid_concurrent_active_time 214 -proc_uid_concurrent_policy_time 215}:dir { open read setattr search }; 216 217allow vendor_init dev_type:blk_file getattr; 218 219# Write to /proc/sys/net/ping_group_range and other /proc/sys/net files. 220r_dir_file(vendor_init, proc_net_type) 221allow vendor_init proc_net_type:file w_file_perms; 222allow vendor_init self:global_capability_class_set net_admin; 223 224# Write to /proc/sys/vm/page-cluster 225allow vendor_init proc_page_cluster:file w_file_perms; 226 227# Write to sysfs nodes. 228allow vendor_init sysfs_type:dir r_dir_perms; 229allow vendor_init sysfs_type:lnk_file read; 230allow vendor_init { sysfs_type -sysfs_usermodehelper }:file rw_file_perms; 231 232# setfscreatecon() for labeling directories and socket files. 233allow vendor_init self:process { setfscreate }; 234 235r_dir_file(vendor_init, vendor_file_type) 236 237# Vendor init can read properties 238allow vendor_init serialno_prop:file { getattr open read map }; 239 240# Vendor init can perform operations on trusted and security Extended Attributes 241allow vendor_init self:global_capability_class_set sys_admin; 242 243# Raw writes to misc block device 244allow vendor_init misc_block_device:blk_file w_file_perms; 245 246# vendor_init is using bootstrap bionic 247use_bootstrap_libs(vendor_init) 248 249# allow filesystem tuning 250allow vendor_init userdata_sysdev:file create_file_perms; 251 252# Everything is labeled as rootfs in recovery mode. Vendor init has to execute 253# the dynamic linker and shared libraries. 254recovery_only(` 255 allow vendor_init rootfs:file { r_file_perms execute }; 256') 257 258not_compatible_property(` 259 set_prop(vendor_init, { 260 property_type 261 -system_internal_property_type 262 -system_restricted_property_type 263 }) 264') 265 266# Get file context 267allow vendor_init file_contexts_file:file r_file_perms; 268 269# Allow vendor_init to (re)set nice 270allow vendor_init self:capability sys_nice; 271 272set_prop(vendor_init, apk_verity_prop) 273set_prop(vendor_init, bluetooth_a2dp_offload_prop) 274set_prop(vendor_init, bluetooth_audio_hal_prop) 275set_prop(vendor_init, bluetooth_config_prop) 276set_prop(vendor_init, camera2_extensions_prop) 277set_prop(vendor_init, camerax_extensions_prop) 278set_prop(vendor_init, cpu_variant_prop) 279set_prop(vendor_init, dalvik_config_prop) 280set_prop(vendor_init, dalvik_dynamic_config_prop) 281set_prop(vendor_init, dalvik_runtime_prop) 282set_prop(vendor_init, debug_prop) 283set_prop(vendor_init, exported_bluetooth_prop) 284set_prop(vendor_init, exported_camera_prop) 285set_prop(vendor_init, exported_config_prop) 286set_prop(vendor_init, exported_default_prop) 287set_prop(vendor_init, exported_overlay_prop) 288set_prop(vendor_init, exported_pm_prop) 289set_prop(vendor_init, ffs_control_prop) 290set_prop(vendor_init, hw_timeout_multiplier_prop) 291set_prop(vendor_init, incremental_prop) 292set_prop(vendor_init, lmkd_prop) 293set_prop(vendor_init, logd_prop) 294set_prop(vendor_init, log_tag_prop) 295set_prop(vendor_init, log_prop) 296set_prop(vendor_init, graphics_config_writable_prop) 297set_prop(vendor_init, prefetch_boot_prop); 298set_prop(vendor_init, qemu_hw_prop) 299set_prop(vendor_init, radio_control_prop) 300set_prop(vendor_init, rebootescrow_hal_prop) 301set_prop(vendor_init, serialno_prop) 302set_prop(vendor_init, soc_prop) 303set_prop(vendor_init, surfaceflinger_color_prop) 304set_prop(vendor_init, usb_control_prop) 305set_prop(vendor_init, userspace_reboot_config_prop) 306set_prop(vendor_init, vehicle_hal_prop) 307set_prop(vendor_init, vendor_default_prop) 308set_prop(vendor_init, keystore_config_prop) 309set_prop(vendor_init, vendor_security_patch_level_prop) 310set_prop(vendor_init, vndk_prop) 311set_prop(vendor_init, virtual_ab_prop) 312set_prop(vendor_init, vold_post_fs_data_prop) 313set_prop(vendor_init, wifi_hal_prop) 314set_prop(vendor_init, wifi_log_prop) 315set_prop(vendor_init, zram_control_prop) 316 317get_prop(vendor_init, boot_status_prop) 318get_prop(vendor_init, exported3_system_prop) 319get_prop(vendor_init, mmd_shared_status_prop) 320get_prop(vendor_init, ota_prop) 321get_prop(vendor_init, power_debug_prop) 322get_prop(vendor_init, provisioned_prop) 323get_prop(vendor_init, retaildemo_prop) 324get_prop(vendor_init, surfaceflinger_display_prop) 325get_prop(vendor_init, test_harness_prop) 326get_prop(vendor_init, theme_prop) 327set_prop(vendor_init, dck_prop) 328 329# Allow vendor_init to read vendor_system_native device config changes 330get_prop(vendor_init, device_config_vendor_system_native_prop) 331get_prop(vendor_init, device_config_vendor_system_native_boot_prop) 332 333userdebug_or_eng(` 334get_prop(vendor_init, profcollectd_etr_prop) 335') 336 337### 338### neverallow rules 339### 340 341# Vendor init shouldn't communicate with any vendor process, nor most system processes. 342neverallow_establish_socket_comms(vendor_init, { 343 domain -init -logd -prng_seeder -su -vendor_init }); 344 345# The vendor_init domain is only entered via an exec based transition from the 346# init domain, never via setcon(). 347neverallow domain vendor_init:process dyntransition; 348neverallow { domain -init } vendor_init:process transition; 349neverallow vendor_init { file_type fs_type -init_exec }:file entrypoint; 350 351# Never read/follow symlinks created by shell or untrusted apps. 352neverallow vendor_init app_data_file_type:lnk_file read; 353neverallow vendor_init shell_data_file:lnk_file read; 354# Init should not be creating subdirectories in /data/local/tmp 355neverallow vendor_init shell_data_file:dir { write add_name remove_name }; 356 357# init should never execute a program without changing to another domain. 358neverallow vendor_init { file_type fs_type }:file execute_no_trans; 359 360# Init never adds or uses services via service_manager. 361neverallow vendor_init service_manager_type:service_manager { add find }; 362neverallow vendor_init servicemanager:service_manager list; 363 364# vendor_init should never be ptraced 365neverallow * vendor_init:process ptrace; 366