2017-01-27 15:53:38 -08:00
|
|
|
###
|
|
|
|
### neverallow rules for untrusted app domains
|
|
|
|
###
|
|
|
|
|
2017-04-26 16:14:40 -07:00
|
|
|
define(`all_untrusted_apps',`{
|
|
|
|
ephemeral_app
|
|
|
|
isolated_app
|
|
|
|
mediaprovider
|
|
|
|
untrusted_app
|
|
|
|
untrusted_app_25
|
2018-04-03 11:22:38 -07:00
|
|
|
untrusted_app_27
|
2017-04-26 16:14:40 -07:00
|
|
|
untrusted_app_all
|
|
|
|
}')
|
2017-01-27 15:53:38 -08:00
|
|
|
# Receive or send uevent messages.
|
2017-02-06 10:31:45 -08:00
|
|
|
neverallow all_untrusted_apps domain:netlink_kobject_uevent_socket *;
|
2017-01-27 15:53:38 -08:00
|
|
|
|
|
|
|
# Receive or send generic netlink messages
|
2017-02-06 10:31:45 -08:00
|
|
|
neverallow all_untrusted_apps domain:netlink_socket *;
|
2017-01-27 15:53:38 -08:00
|
|
|
|
|
|
|
# Too much leaky information in debugfs. It's a security
|
|
|
|
# best practice to ensure these files aren't readable.
|
2018-11-29 10:37:18 -08:00
|
|
|
neverallow all_untrusted_apps { debugfs_type -debugfs_kcov }:file read;
|
2019-02-04 10:07:15 -08:00
|
|
|
neverallow {all_untrusted_apps userdebug_or_eng(`-domain')} debugfs_type:{ file lnk_file } read;
|
2017-01-27 15:53:38 -08:00
|
|
|
|
|
|
|
# Do not allow untrusted apps to register services.
|
|
|
|
# Only trusted components of Android should be registering
|
|
|
|
# services.
|
2017-02-06 10:31:45 -08:00
|
|
|
neverallow all_untrusted_apps service_manager_type:service_manager add;
|
2017-01-27 15:53:38 -08:00
|
|
|
|
2017-04-25 09:27:54 -07:00
|
|
|
# Do not allow untrusted apps to use VendorBinder
|
|
|
|
neverallow all_untrusted_apps vndbinder_device:chr_file *;
|
|
|
|
neverallow all_untrusted_apps vndservice_manager_type:service_manager *;
|
|
|
|
|
2017-01-27 15:53:38 -08:00
|
|
|
# Do not allow untrusted apps to connect to the property service
|
|
|
|
# or set properties. b/10243159
|
2017-04-10 16:57:48 -07:00
|
|
|
neverallow { all_untrusted_apps -mediaprovider } property_socket:sock_file write;
|
|
|
|
neverallow { all_untrusted_apps -mediaprovider } init:unix_stream_socket connectto;
|
|
|
|
neverallow { all_untrusted_apps -mediaprovider } property_type:property_service set;
|
2017-01-27 15:53:38 -08:00
|
|
|
|
2018-03-28 15:34:37 -07:00
|
|
|
# net.dns properties are not a public API. Temporarily exempt pre-Oreo apps,
|
|
|
|
# but otherwise disallow untrusted apps from reading this property.
|
|
|
|
neverallow { all_untrusted_apps -untrusted_app_25 } net_dns_prop:file read;
|
|
|
|
|
2019-01-11 09:37:46 -08:00
|
|
|
# Shared libraries created by trusted components within an app home
|
|
|
|
# directory can be dlopen()ed. To maintain the W^X property, these files
|
2018-12-12 09:06:05 -08:00
|
|
|
# must never be writable to the app.
|
2019-01-11 09:37:46 -08:00
|
|
|
neverallow all_untrusted_apps app_exec_data_file:file
|
2018-12-12 09:06:05 -08:00
|
|
|
{ append create link relabelfrom relabelto rename setattr write };
|
|
|
|
|
2018-12-21 10:03:50 -08:00
|
|
|
# Block calling execve() on files in an apps home directory.
|
2018-11-02 11:12:43 -07:00
|
|
|
# This is a W^X violation (loading executable code from a writable
|
|
|
|
# home directory). For compatibility, allow for targetApi <= 28.
|
|
|
|
# b/112357170
|
|
|
|
neverallow {
|
|
|
|
all_untrusted_apps
|
|
|
|
-untrusted_app_25
|
|
|
|
-untrusted_app_27
|
2018-11-02 14:34:06 -07:00
|
|
|
-runas_app
|
2018-11-02 11:12:43 -07:00
|
|
|
} { app_data_file privapp_data_file }:file execute_no_trans;
|
|
|
|
|
2018-11-19 15:02:49 -08:00
|
|
|
# Do not allow untrusted apps to invoke dex2oat. This was historically required
|
|
|
|
# by ART for compiling secondary dex files but has been removed in Q.
|
|
|
|
# Exempt legacy apps (targetApi<=28) for compatibility.
|
|
|
|
neverallow {
|
|
|
|
all_untrusted_apps
|
|
|
|
-untrusted_app_25
|
|
|
|
-untrusted_app_27
|
|
|
|
} dex2oat_exec:file no_x_file_perms;
|
|
|
|
|
2017-01-27 15:53:38 -08:00
|
|
|
# Do not allow untrusted apps to be assigned mlstrustedsubject.
|
|
|
|
# This would undermine the per-user isolation model being
|
|
|
|
# enforced via levelFrom=user in seapp_contexts and the mls
|
|
|
|
# constraints. As there is no direct way to specify a neverallow
|
|
|
|
# on attribute assignment, this relies on the fact that fork
|
|
|
|
# permission only makes sense within a domain (hence should
|
|
|
|
# never be granted to any other domain within mlstrustedsubject)
|
|
|
|
# and an untrusted app is allowed fork permission to itself.
|
2017-02-06 10:31:45 -08:00
|
|
|
neverallow all_untrusted_apps mlstrustedsubject:process fork;
|
2017-01-27 15:53:38 -08:00
|
|
|
|
|
|
|
# Do not allow untrusted apps to hard link to any files.
|
|
|
|
# In particular, if an untrusted app links to other app data
|
|
|
|
# files, installd will not be able to guarantee the deletion
|
|
|
|
# of the linked to file. Hard links also contribute to security
|
|
|
|
# bugs, so we want to ensure untrusted apps never have this
|
|
|
|
# capability.
|
2017-02-06 10:31:45 -08:00
|
|
|
neverallow all_untrusted_apps file_type:file link;
|
2017-01-27 15:53:38 -08:00
|
|
|
|
|
|
|
# Do not allow untrusted apps to access network MAC address file
|
2017-02-06 10:31:45 -08:00
|
|
|
neverallow all_untrusted_apps sysfs_mac_address:file no_rw_file_perms;
|
2017-01-27 15:53:38 -08:00
|
|
|
|
2017-10-04 13:12:25 -07:00
|
|
|
# Do not allow any write access to files in /sys
|
2018-03-28 15:34:37 -07:00
|
|
|
neverallow all_untrusted_apps sysfs_type:file { no_w_file_perms no_x_file_perms };
|
|
|
|
|
|
|
|
# Apps may never access the default sysfs label.
|
|
|
|
neverallow all_untrusted_apps sysfs:file no_rw_file_perms;
|
2017-10-04 13:12:25 -07:00
|
|
|
|
2017-01-27 15:53:38 -08:00
|
|
|
# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the
|
|
|
|
# ioctl permission, or 3. disallow the socket class.
|
2018-06-21 16:57:58 -07:00
|
|
|
neverallowxperm all_untrusted_apps domain:{ icmp_socket rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
|
2017-02-06 10:31:45 -08:00
|
|
|
neverallow all_untrusted_apps *:{ netlink_route_socket netlink_selinux_socket } ioctl;
|
|
|
|
neverallow all_untrusted_apps *:{
|
2017-01-27 15:53:38 -08:00
|
|
|
socket netlink_socket packet_socket key_socket appletalk_socket
|
2017-02-06 11:14:58 -08:00
|
|
|
netlink_tcpdiag_socket netlink_nflog_socket
|
|
|
|
netlink_xfrm_socket netlink_audit_socket
|
2017-01-27 15:53:38 -08:00
|
|
|
netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
|
|
|
|
netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
|
|
|
|
netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
|
2018-06-21 16:57:58 -07:00
|
|
|
netlink_rdma_socket netlink_crypto_socket sctp_socket
|
|
|
|
ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket
|
|
|
|
atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket
|
|
|
|
bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket
|
2018-11-16 02:48:03 -08:00
|
|
|
alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket xdp_socket
|
2017-01-27 15:53:38 -08:00
|
|
|
} *;
|
|
|
|
|
|
|
|
# Do not allow untrusted apps access to /cache
|
2017-04-10 16:57:48 -07:00
|
|
|
neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:dir ~{ r_dir_perms };
|
|
|
|
neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:file ~{ read getattr };
|
2017-01-27 15:53:38 -08:00
|
|
|
|
|
|
|
# Do not allow untrusted apps to create/unlink files outside of its sandbox,
|
|
|
|
# internal storage or sdcard.
|
|
|
|
# World accessible data locations allow application to fill the device
|
|
|
|
# with unaccounted for data. This data will not get removed during
|
|
|
|
# application un-installation.
|
2017-04-10 16:57:48 -07:00
|
|
|
neverallow { all_untrusted_apps -mediaprovider } {
|
2017-01-27 15:53:38 -08:00
|
|
|
fs_type
|
2018-03-30 11:22:54 -07:00
|
|
|
-sdcard_type
|
2017-01-27 15:53:38 -08:00
|
|
|
file_type
|
|
|
|
-app_data_file # The apps sandbox itself
|
2018-08-02 15:54:23 -07:00
|
|
|
-privapp_data_file
|
2019-01-11 09:37:46 -08:00
|
|
|
-app_exec_data_file # stored within the app sandbox directory
|
2017-01-27 15:53:38 -08:00
|
|
|
-media_rw_data_file # Internal storage. Known that apps can
|
|
|
|
# leave artfacts here after uninstall.
|
|
|
|
-user_profile_data_file # Access to profile files
|
|
|
|
userdebug_or_eng(`
|
|
|
|
-method_trace_data_file # only on ro.debuggable=1
|
|
|
|
-coredump_file # userdebug/eng only
|
|
|
|
')
|
|
|
|
}:dir_file_class_set { create unlink };
|
|
|
|
|
2017-04-26 11:40:48 -07:00
|
|
|
# No untrusted component should be touching /dev/fuse
|
|
|
|
neverallow all_untrusted_apps fuse_device:chr_file *;
|
|
|
|
|
2018-11-15 06:14:07 -08:00
|
|
|
# Do not allow untrusted apps to directly open the tun_device
|
|
|
|
neverallow all_untrusted_apps tun_device:chr_file open;
|
|
|
|
# The tun_device ioctls below are not allowed, to prove equivalence
|
|
|
|
# to the kernel patch at
|
2018-10-30 20:12:41 -07:00
|
|
|
# https://android.googlesource.com/kernel/common/+/11cee2be0c2062ba88f04eb51196506f870a3b5d%5E%21
|
|
|
|
neverallowxperm all_untrusted_apps tun_device:chr_file ioctl {
|
|
|
|
SIOCGIFHWADDR
|
|
|
|
SIOCSIFHWADDR
|
|
|
|
TUNATTACHFILTER
|
|
|
|
TUNDETACHFILTER
|
|
|
|
TUNGETFEATURES
|
|
|
|
TUNGETFILTER
|
|
|
|
TUNGETSNDBUF
|
|
|
|
TUNGETVNETHDRSZ
|
|
|
|
TUNSETDEBUG
|
|
|
|
TUNSETGROUP
|
|
|
|
TUNSETIFF
|
|
|
|
TUNSETLINK
|
|
|
|
TUNSETNOCSUM
|
|
|
|
TUNSETOFFLOAD
|
|
|
|
TUNSETOWNER
|
|
|
|
TUNSETPERSIST
|
|
|
|
TUNSETQUEUE
|
|
|
|
TUNSETSNDBUF
|
|
|
|
TUNSETTXFILTER
|
|
|
|
TUNSETVNETHDRSZ
|
|
|
|
};
|
2017-01-27 15:53:38 -08:00
|
|
|
|
|
|
|
# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553)
|
2017-02-06 10:31:45 -08:00
|
|
|
neverallow all_untrusted_apps anr_data_file:file ~{ open append };
|
|
|
|
neverallow all_untrusted_apps anr_data_file:dir ~search;
|
2017-01-27 15:53:38 -08:00
|
|
|
|
|
|
|
# Avoid reads from generically labeled /proc files
|
|
|
|
# Create a more specific label if needed
|
2017-09-26 12:58:29 -07:00
|
|
|
neverallow all_untrusted_apps {
|
|
|
|
proc
|
2017-10-06 10:20:53 -07:00
|
|
|
proc_asound
|
2017-09-26 12:58:29 -07:00
|
|
|
proc_filesystems
|
|
|
|
proc_kmsg
|
|
|
|
proc_loadavg
|
|
|
|
proc_mounts
|
|
|
|
proc_pagetypeinfo
|
2018-06-14 07:34:19 -07:00
|
|
|
proc_slabinfo
|
2018-03-28 15:34:37 -07:00
|
|
|
proc_stat
|
2017-09-26 12:58:29 -07:00
|
|
|
proc_swaps
|
2018-03-28 15:34:37 -07:00
|
|
|
proc_uptime
|
2017-09-26 12:58:29 -07:00
|
|
|
proc_version
|
|
|
|
proc_vmallocinfo
|
2018-03-28 15:34:37 -07:00
|
|
|
proc_vmstat
|
2017-09-26 12:58:29 -07:00
|
|
|
}:file { no_rw_file_perms no_x_file_perms };
|
2017-03-14 11:42:03 -07:00
|
|
|
|
2017-04-21 11:25:29 -07:00
|
|
|
# Avoid all access to kernel configuration
|
|
|
|
neverallow all_untrusted_apps config_gz:file { no_rw_file_perms no_x_file_perms };
|
|
|
|
|
2017-03-14 11:42:03 -07:00
|
|
|
# Do not allow untrusted apps access to preloads data files
|
|
|
|
neverallow all_untrusted_apps preloads_data_file:file no_rw_file_perms;
|
2017-03-22 10:35:24 -07:00
|
|
|
|
|
|
|
# Locking of files on /system could lead to denial of service attacks
|
|
|
|
# against privileged system components
|
|
|
|
neverallow all_untrusted_apps system_file:file lock;
|
2017-04-21 17:06:43 -07:00
|
|
|
|
2017-04-24 15:09:19 -07:00
|
|
|
# Do not permit untrusted apps to perform actions on HwBinder service_manager
|
|
|
|
# other than find actions for services listed below
|
|
|
|
neverallow all_untrusted_apps *:hwservice_manager ~find;
|
|
|
|
|
2017-04-21 17:06:43 -07:00
|
|
|
# Do not permit access from apps which host arbitrary code to HwBinder services,
|
|
|
|
# except those considered sufficiently safe for access from such apps.
|
|
|
|
# The two main reasons for this are:
|
|
|
|
# 1. HwBinder servers do not perform client authentication because HIDL
|
|
|
|
# currently does not expose caller UID information and, even if it did, many
|
|
|
|
# HwBinder services either operate at a level below that of apps (e.g., HALs)
|
|
|
|
# or must not rely on app identity for authorization. Thus, to be safe, the
|
|
|
|
# default assumption is that every HwBinder service treats all its clients as
|
|
|
|
# equally authorized to perform operations offered by the service.
|
|
|
|
# 2. HAL servers (a subset of HwBinder services) contain code with higher
|
|
|
|
# incidence rate of security issues than system/core components and have
|
|
|
|
# access to lower layes of the stack (all the way down to hardware) thus
|
|
|
|
# increasing opportunities for bypassing the Android security model.
|
2017-06-21 10:00:32 -07:00
|
|
|
#
|
|
|
|
# Safe services include:
|
|
|
|
# - same process services: because they by definition run in the process
|
|
|
|
# of the client and thus have the same access as the client domain in which
|
|
|
|
# the process runs
|
|
|
|
# - coredomain_hwservice: are considered safe because they do not pose risks
|
|
|
|
# associated with reason #2 above.
|
|
|
|
# - hal_configstore_ISurfaceFlingerConfigs: becuase it has specifically been
|
|
|
|
# designed for use by any domain.
|
|
|
|
# - hal_graphics_allocator_hwservice: because these operations are also offered
|
|
|
|
# by surfaceflinger Binder service, which apps are permitted to access
|
|
|
|
# - hal_omx_hwservice: because this is a HwBinder version of the mediacodec
|
|
|
|
# Binder service which apps were permitted to access.
|
2018-03-28 21:09:23 -07:00
|
|
|
# - hal_codec2_hwservice: because this is a newer version of hal_omx_hwservice.
|
2017-04-21 17:06:43 -07:00
|
|
|
neverallow all_untrusted_apps {
|
|
|
|
hwservice_manager_type
|
|
|
|
-same_process_hwservice
|
2017-06-21 10:00:32 -07:00
|
|
|
-coredomain_hwservice
|
2018-03-28 21:09:23 -07:00
|
|
|
-hal_codec2_hwservice
|
2017-06-21 10:00:32 -07:00
|
|
|
-hal_configstore_ISurfaceFlingerConfigs
|
2017-04-21 17:06:43 -07:00
|
|
|
-hal_graphics_allocator_hwservice
|
|
|
|
-hal_omx_hwservice
|
2017-09-26 12:58:29 -07:00
|
|
|
-hal_cas_hwservice
|
2017-12-15 14:16:25 -08:00
|
|
|
-hal_neuralnetworks_hwservice
|
2018-07-28 16:48:06 -07:00
|
|
|
-untrusted_app_visible_hwservice_violators
|
2017-06-21 10:00:32 -07:00
|
|
|
}:hwservice_manager find;
|
2017-09-26 12:58:29 -07:00
|
|
|
|
2017-06-21 10:00:32 -07:00
|
|
|
# Make sure that the following services are never accessible by untrusted_apps
|
|
|
|
neverallow all_untrusted_apps {
|
|
|
|
default_android_hwservice
|
2018-09-19 16:06:28 -07:00
|
|
|
hal_atrace_hwservice
|
2017-06-21 10:00:32 -07:00
|
|
|
hal_audio_hwservice
|
2018-01-10 08:11:46 -08:00
|
|
|
hal_authsecret_hwservice
|
2017-06-21 10:00:32 -07:00
|
|
|
hal_bluetooth_hwservice
|
|
|
|
hal_bootctl_hwservice
|
|
|
|
hal_camera_hwservice
|
2018-01-09 14:42:53 -08:00
|
|
|
hal_confirmationui_hwservice
|
2017-06-21 10:00:32 -07:00
|
|
|
hal_contexthub_hwservice
|
|
|
|
hal_drm_hwservice
|
|
|
|
hal_dumpstate_hwservice
|
|
|
|
hal_fingerprint_hwservice
|
|
|
|
hal_gatekeeper_hwservice
|
|
|
|
hal_gnss_hwservice
|
|
|
|
hal_graphics_composer_hwservice
|
|
|
|
hal_health_hwservice
|
2018-01-17 12:27:06 -08:00
|
|
|
hal_input_classifier_hwservice
|
2017-06-21 10:00:32 -07:00
|
|
|
hal_ir_hwservice
|
|
|
|
hal_keymaster_hwservice
|
|
|
|
hal_light_hwservice
|
|
|
|
hal_memtrack_hwservice
|
|
|
|
hal_nfc_hwservice
|
|
|
|
hal_oemlock_hwservice
|
|
|
|
hal_power_hwservice
|
2018-12-10 14:59:57 -08:00
|
|
|
hal_power_stats_hwservice
|
2018-01-04 10:33:20 -08:00
|
|
|
hal_secure_element_hwservice
|
2017-06-21 10:00:32 -07:00
|
|
|
hal_sensors_hwservice
|
|
|
|
hal_telephony_hwservice
|
|
|
|
hal_thermal_hwservice
|
|
|
|
hal_tv_cec_hwservice
|
|
|
|
hal_tv_input_hwservice
|
|
|
|
hal_usb_hwservice
|
|
|
|
hal_vibrator_hwservice
|
|
|
|
hal_vr_hwservice
|
|
|
|
hal_weaver_hwservice
|
|
|
|
hal_wifi_hwservice
|
2017-09-26 12:58:29 -07:00
|
|
|
hal_wifi_offload_hwservice
|
2017-06-21 10:00:32 -07:00
|
|
|
hal_wifi_supplicant_hwservice
|
|
|
|
hidl_base_hwservice
|
2017-09-26 12:58:29 -07:00
|
|
|
system_net_netd_hwservice
|
|
|
|
thermalcallback_hwservice
|
2017-04-21 17:06:43 -07:00
|
|
|
}:hwservice_manager find;
|
|
|
|
# HwBinder services offered by core components (as opposed to vendor components)
|
|
|
|
# are considered somewhat safer due to point #2 above.
|
|
|
|
neverallow all_untrusted_apps {
|
|
|
|
coredomain_hwservice
|
|
|
|
-same_process_hwservice
|
2019-01-04 19:14:07 -08:00
|
|
|
-fwk_bufferhub_hwservice # Designed for use by any domain
|
2017-04-21 17:06:43 -07:00
|
|
|
-hidl_allocator_hwservice # Designed for use by any domain
|
|
|
|
-hidl_manager_hwservice # Designed for use by any domain
|
|
|
|
-hidl_memory_hwservice # Designed for use by any domain
|
|
|
|
-hidl_token_hwservice # Designed for use by any domain
|
|
|
|
}:hwservice_manager find;
|
|
|
|
|
2017-09-26 12:58:29 -07:00
|
|
|
# SELinux is not an API for untrusted apps to use
|
|
|
|
neverallow all_untrusted_apps selinuxfs:file no_rw_file_perms;
|
|
|
|
|
2017-04-21 17:06:43 -07:00
|
|
|
# Restrict *Binder access from apps to HAL domains. We can only do this on full
|
|
|
|
# Treble devices where *Binder communications between apps and HALs are tightly
|
|
|
|
# restricted.
|
|
|
|
full_treble_only(`
|
|
|
|
neverallow all_untrusted_apps {
|
|
|
|
halserverdomain
|
|
|
|
-coredomain
|
|
|
|
-hal_configstore_server
|
|
|
|
-hal_graphics_allocator_server
|
2017-09-26 12:58:29 -07:00
|
|
|
-hal_cas_server
|
2017-12-15 14:16:25 -08:00
|
|
|
-hal_neuralnetworks_server
|
2018-05-25 16:23:37 -07:00
|
|
|
-hal_omx_server
|
2017-04-21 17:06:43 -07:00
|
|
|
-binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone
|
2018-07-28 16:48:06 -07:00
|
|
|
-untrusted_app_visible_halserver_violators
|
2017-04-21 17:06:43 -07:00
|
|
|
}:binder { call transfer };
|
|
|
|
')
|
2017-11-06 11:19:07 -08:00
|
|
|
|
|
|
|
# Untrusted apps are not allowed to find mediaextractor update service.
|
|
|
|
neverallow all_untrusted_apps mediaextractor_update_service:service_manager find;
|
2018-09-07 07:39:28 -07:00
|
|
|
|
|
|
|
# Access to /proc/tty/drivers, to allow apps to determine if they
|
|
|
|
# are running in an emulated environment.
|
|
|
|
# b/33214085 b/33814662 b/33791054 b/33211769
|
|
|
|
# https://github.com/strazzere/anti-emulator/blob/master/AntiEmulator/src/diff/strazzere/anti/emulator/FindEmulator.java
|
|
|
|
# This will go away in a future Android release
|
|
|
|
neverallow { all_untrusted_apps -untrusted_app_25 } proc_tty_drivers:file r_file_perms;
|
|
|
|
neverallow all_untrusted_apps proc_tty_drivers:file ~r_file_perms;
|
2018-10-10 15:48:15 -07:00
|
|
|
|
|
|
|
# Untrusted apps are not allowed to use cgroups.
|
|
|
|
neverallow all_untrusted_apps cgroup:file *;
|
2019-01-27 13:39:19 -08:00
|
|
|
|
|
|
|
# Untrusted apps targetting >= Q are not allowed to open /dev/ashmem directly.
|
2019-02-12 14:14:30 -08:00
|
|
|
# They must use ASharedMemory NDK API instead.
|
|
|
|
neverallow {
|
|
|
|
all_untrusted_apps
|
|
|
|
-untrusted_app_25
|
|
|
|
-untrusted_app_27
|
|
|
|
} ashmem_device:chr_file open;
|