36fb1f1bf3
Netlink uevent sockets are used by the kernel to inform userspace
when certain events occur, for example, when new hardware is added
or removed. This allows userspace to take some action based on those
messages.
Relax the neverallow rule for NETLINK_KOBJECT_UEVENT sockets.
Certain device specific app domains, such as system_app, may have a
need to receive messages from this socket type.
Continue to neverallow NETLINK_KOBJECT_UEVENT sockets for untrusted_app.
These sockets have been the source of rooting attacks in Android
in the past, and it doesn't make sense to expose this to untrusted_apps.
No new SELinux rules are introduced by this change. This is an
adjustment of compile time assertions only.
Bug: 17525863
(cherry picked from commit 642b80427e)
Change-Id: I35f3dc8b1ead9f427645a13fb202e760d1e68e64
104 lines
3.7 KiB
Plaintext
104 lines
3.7 KiB
Plaintext
###
|
|
### Untrusted apps.
|
|
###
|
|
### This file defines the rules for untrusted apps.
|
|
### Apps are labeled based on mac_permissions.xml (maps signer and
|
|
### optionally package name to seinfo value) and seapp_contexts (maps UID
|
|
### and optionally seinfo value to domain for process and type for data
|
|
### directory). The untrusted_app domain is the default assignment in
|
|
### seapp_contexts for any app with UID between APP_AID (10000)
|
|
### and AID_ISOLATED_START (99000) if the app has no specific seinfo
|
|
### value as determined from mac_permissions.xml. In current AOSP, this
|
|
### domain is assigned to all non-system apps as well as to any system apps
|
|
### that are not signed by the platform key. To move
|
|
### a system app into a specific domain, add a signer entry for it to
|
|
### mac_permissions.xml and assign it one of the pre-existing seinfo values
|
|
### or define and use a new seinfo value in both mac_permissions.xml and
|
|
### seapp_contexts.
|
|
###
|
|
### untrusted_app includes all the appdomain rules, plus the
|
|
### additional following rules:
|
|
###
|
|
|
|
type untrusted_app, domain;
|
|
app_domain(untrusted_app)
|
|
net_domain(untrusted_app)
|
|
bluetooth_domain(untrusted_app)
|
|
|
|
# Some apps ship with shared libraries and binaries that they write out
|
|
# to their sandbox directory and then execute.
|
|
allow untrusted_app app_data_file:file { rx_file_perms execmod };
|
|
|
|
allow untrusted_app tun_device:chr_file rw_file_perms;
|
|
|
|
# ASEC
|
|
allow untrusted_app asec_apk_file:dir { getattr };
|
|
allow untrusted_app asec_apk_file:file r_file_perms;
|
|
# Execute libs in asec containers.
|
|
allow untrusted_app asec_public_file:file { execute execmod };
|
|
|
|
# Allow the allocation and use of ptys
|
|
# Used by: https://play.google.com/store/apps/details?id=jackpal.androidterm
|
|
create_pty(untrusted_app)
|
|
|
|
# Used by Finsky / Android "Verify Apps" functionality when
|
|
# running "adb install foo.apk".
|
|
# TODO: Long term, we don't want apps probing into shell data files.
|
|
# Figure out a way to remove these rules.
|
|
allow untrusted_app shell_data_file:file r_file_perms;
|
|
allow untrusted_app shell_data_file:dir r_dir_perms;
|
|
|
|
#
|
|
# Rules migrated from old app domains coalesced into untrusted_app.
|
|
# This includes what used to be media_app, shared_app, and release_app.
|
|
#
|
|
|
|
# Access /dev/mtp_usb.
|
|
allow untrusted_app mtp_device:chr_file rw_file_perms;
|
|
|
|
# Access to /data/media.
|
|
allow untrusted_app media_rw_data_file:dir create_dir_perms;
|
|
allow untrusted_app media_rw_data_file:file create_file_perms;
|
|
|
|
# Write to /cache.
|
|
allow untrusted_app cache_file:dir create_dir_perms;
|
|
allow untrusted_app cache_file:file create_file_perms;
|
|
|
|
# Audited locally.
|
|
service_manager_local_audit_domain(untrusted_app)
|
|
auditallow untrusted_app {
|
|
service_manager_type
|
|
-drmserver_service
|
|
-keystore_service
|
|
-mediaserver_service
|
|
-nfc_service
|
|
-radio_service
|
|
-surfaceflinger_service
|
|
-system_server_service
|
|
}:service_manager find;
|
|
|
|
###
|
|
### neverallow rules
|
|
###
|
|
|
|
# Receive or send uevent messages.
|
|
neverallow untrusted_app self:netlink_kobject_uevent_socket *;
|
|
|
|
# Too much leaky information in debugfs. It's a security
|
|
# best practice to ensure these files aren't readable.
|
|
neverallow untrusted_app debugfs:file read;
|
|
|
|
# Do not allow untrusted apps to register services.
|
|
# Only trusted components of Android should be registering
|
|
# services.
|
|
neverallow untrusted_app service_manager_type:service_manager add;
|
|
|
|
# Do not allow untrusted_apps to connect to the property service
|
|
# or set properties. b/10243159
|
|
neverallow untrusted_app property_socket:sock_file write;
|
|
neverallow untrusted_app init:unix_stream_socket connectto;
|
|
neverallow untrusted_app property_type:property_service set;
|
|
|
|
# Allow verifier to access staged apks.
|
|
allow untrusted_app { apk_tmp_file apk_private_tmp_file }:dir r_dir_perms;
|
|
allow untrusted_app { apk_tmp_file apk_private_tmp_file }:file r_file_perms; |