From ff91d5d605fd55c6f6a357b23ad3e72699e5f15f Mon Sep 17 00:00:00 2001 From: Jeff Vander Stoep Date: Thu, 28 Jun 2018 14:47:52 -0700 Subject: [PATCH] vendor_init: enforce similar restrictions as init Test: build aosp_taimen-userdebug Change-Id: Ie35ffcb8d2e3b83b6592f863caca946270aa4032 --- public/vendor_init.te | 29 ++++++++++++++++++++++++++--- 1 file changed, 26 insertions(+), 3 deletions(-) diff --git a/public/vendor_init.te b/public/vendor_init.te index fda80f416..81124743e 100644 --- a/public/vendor_init.te +++ b/public/vendor_init.te @@ -4,9 +4,6 @@ type vendor_init, domain, mlstrustedsubject; # Communication to the main init process allow vendor_init init:unix_stream_socket { read write }; -# Vendor init shouldn't communicate with any vendor process, nor most system processes. -neverallow_establish_socket_comms(vendor_init, { domain -init -logd -su -vendor_init }); - # Logging to kmsg allow vendor_init kmsg_device:chr_file { open write }; @@ -202,3 +199,29 @@ set_prop(vendor_init, wifi_log_prop) get_prop(vendor_init, exported2_radio_prop) get_prop(vendor_init, exported3_system_prop) + +### +### neverallow rules +### + +# Vendor init shouldn't communicate with any vendor process, nor most system processes. +neverallow_establish_socket_comms(vendor_init, { domain -init -logd -su -vendor_init }); + +# The vendor_init domain is only entered via an exec based transition from the +# init domain, never via setcon(). +neverallow domain vendor_init:process dyntransition; +neverallow { domain -init } vendor_init:process transition; +neverallow vendor_init { file_type fs_type -init_exec }:file entrypoint; + +# Never read/follow symlinks created by shell or untrusted apps. +neverallow vendor_init app_data_file:lnk_file read; +neverallow vendor_init shell_data_file:lnk_file read; +# Init should not be creating subdirectories in /data/local/tmp +neverallow vendor_init shell_data_file:dir { write add_name remove_name }; + +# init should never execute a program without changing to another domain. +neverallow vendor_init { file_type fs_type }:file execute_no_trans; + +# Init never adds or uses services via service_manager. +neverallow vendor_init service_manager_type:service_manager { add find }; +neverallow vendor_init servicemanager:service_manager list;