Merge "VmTerminalApp: Merge with LinuxInstaller" into main
diff --git a/Android.bp b/Android.bp
index 7d36b86..6a123ae 100644
--- a/Android.bp
+++ b/Android.bp
@@ -1162,3 +1162,142 @@
default: [],
}),
}
+
+phony {
+ name: "selinux_policy",
+ required: [
+ // Runs checkfc against merged service_contexts files
+ "merged_hwservice_contexts_test",
+ "merged_service_contexts_test",
+ "selinux_policy_nonsystem",
+ "selinux_policy_system",
+ ],
+}
+
+// selinux_policy is a main goal and triggers lots of tests.
+// Most tests are FAKE modules, so aren'triggered on normal builds. (e.g. 'm')
+// By setting as droidcore's dependency, tests will run on normal builds.
+phony_rule {
+ name: "droidcore",
+ phony_deps: ["selinux_policy"],
+}
+
+//-----------------------------------------------------------------------------
+// TODO - remove this. Keep around until we get the filesystem creation stuff
+// taken care of.
+//
+// The file_contexts.bin is built in the following way:
+// 1. Collect all file_contexts files in THIS repository and process them with
+// m4 into a tmp file called file_contexts.local.tmp.
+// 2. Collect all device specific file_contexts files and process them with m4
+// into a tmp file called file_contexts.device.tmp.
+// 3. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on
+// file_contexts.device.tmp and output to file_contexts.device.sorted.tmp.
+// 4. Concatenate file_contexts.local.tmp and file_contexts.device.sorted.tmp
+// into file_contexts.concat.tmp.
+// 5. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce
+// file_contexts.bin.
+//
+// Note: That a newline file is placed between each file_context file found to
+// ensure a proper build when an fc file is missing an ending newline.
+//---
+// 1. Collect all file_contexts files in THIS repository and process them with
+// m4 into a tmp file called file_contexts.local.tmp.
+genrule {
+ name: "file_contexts.local.tmp",
+ srcs: [
+ ":plat_file_contexts",
+ ":system_ext_file_contexts",
+ ":product_file_contexts",
+ ],
+ tools: [
+ "m4",
+ ],
+ out: ["file_contexts.local.tmp"],
+ cmd: "$(location m4) --fatal-warnings " +
+ "-s $(in) > $(out)",
+}
+
+// 2. Collect all device specific file_contexts files and process them with m4
+// into a tmp file called file_contexts.device.tmp.
+PRIVATE_ADDITIONAL_M4DEFS = select(soong_config_variable("ANDROID", "ADDITIONAL_M4DEFS"), {
+ any @ m4defs: m4defs,
+ default: "",
+})
+genrule {
+ name: "file_contexts.device.tmp",
+ srcs: [
+ ":vendor_file_contexts",
+ ":odm_file_contexts",
+ ],
+ tools: [
+ "m4",
+ ],
+ out: ["file_contexts.device.tmp"],
+ cmd: "$(location m4) --fatal-warnings " +
+ "-s " + PRIVATE_ADDITIONAL_M4DEFS +
+ " $(in) > $(out)",
+}
+
+// 3. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on
+// file_contexts.device.tmp and output to file_contexts.device.sorted.tmp.
+genrule {
+ name: "file_contexts.device.sorted.tmp",
+ srcs: [
+ ":file_contexts.device.tmp",
+ ":precompiled_sepolicy",
+ ],
+ tools: [
+ "checkfc",
+ "fc_sort",
+ ],
+ out: ["file_contexts.device.sorted.tmp"],
+ cmd: "$(location checkfc) " +
+ "-e $(location :precompiled_sepolicy) " +
+ "$(location :file_contexts.device.tmp) && " +
+ "$(location fc_sort) " +
+ "-i $(location :file_contexts.device.tmp) " +
+ "-o $(out)",
+}
+
+// 4. Concatenate file_contexts.local.tmp and file_contexts.device.sorted.tmp
+// into file_contexts.concat.tmp.
+genrule {
+ name: "file_contexts.concat.tmp",
+ srcs: [
+ ":file_contexts.local.tmp",
+ ":file_contexts.device.sorted.tmp",
+ ],
+ tools: [
+ "m4",
+ ],
+ out: ["file_contexts.concat.tmp"],
+ cmd: "$(location m4) --fatal-warnings " +
+ "-s $(location :file_contexts.local.tmp) " +
+ "$(location :file_contexts.device.sorted.tmp) > $(out)",
+}
+
+// 5. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce
+// file_contexts.bin.
+genrule {
+ name: "file_contexts_bin_gen",
+ srcs: [
+ ":file_contexts.concat.tmp",
+ ":precompiled_sepolicy",
+ ],
+ tools: [
+ "checkfc",
+ "sefcontext_compile",
+ ],
+ out: ["file_contexts.bin"],
+ cmd: "$(location checkfc) " +
+ "$(location :precompiled_sepolicy) " +
+ "$(location :file_contexts.concat.tmp) && " +
+ "$(location sefcontext_compile) " +
+ "-o $(out) $(location :file_contexts.concat.tmp)",
+}
+
+prebuilt_etc {
+ name: "file_contexts.bin",
+ src: ":file_contexts_bin_gen",
+}
diff --git a/Android.mk b/Android.mk
index 9dfc531..6474b2a 100644
--- a/Android.mk
+++ b/Android.mk
@@ -6,12 +6,6 @@
$(warning BOARD_SEPOLICY_UNION is no longer required - all files found in BOARD_SEPOLICY_DIRS are implicitly unioned; please remove from your BoardConfig.mk or other .mk file.)
endif
-ifdef BOARD_SEPOLICY_M4DEFS
-LOCAL_ADDITIONAL_M4DEFS := $(addprefix -D, $(BOARD_SEPOLICY_M4DEFS))
-else
-LOCAL_ADDITIONAL_M4DEFS :=
-endif
-
# sepolicy is now divided into multiple portions:
# public - policy exported on which non-platform policy developers may write
# additional policy. types and attributes are versioned and included in
@@ -178,137 +172,7 @@
#################################
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := selinux_policy
-LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
-LOCAL_LICENSE_CONDITIONS := notice unencumbered
-LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
-LOCAL_MODULE_TAGS := optional
-LOCAL_REQUIRED_MODULES += \
- selinux_policy_nonsystem \
- selinux_policy_system \
-
-# Runs checkfc against merged service_contexts files
-LOCAL_REQUIRED_MODULES += \
- merged_service_contexts_test \
- merged_hwservice_contexts_test
-
-include $(BUILD_PHONY_PACKAGE)
-
-# selinux_policy is a main goal and triggers lots of tests.
-# Most tests are FAKE modules, so aren'triggered on normal builds. (e.g. 'm')
-# By setting as droidcore's dependency, tests will run on normal builds.
-droidcore: selinux_policy
-
-##################################
-# Policy files are now built with Android.bp. Grab them from intermediate.
-# See Android.bp for details of policy files.
-#
-built_sepolicy := $(call intermediates-dir-for,ETC,precompiled_sepolicy)/precompiled_sepolicy
-
-##################################
-# TODO - remove this. Keep around until we get the filesystem creation stuff taken care of.
-#
-include $(CLEAR_VARS)
-
-LOCAL_MODULE := file_contexts.bin
-LOCAL_LICENSE_KINDS := SPDX-license-identifier-Apache-2.0 legacy_unencumbered
-LOCAL_LICENSE_CONDITIONS := notice unencumbered
-LOCAL_NOTICE_FILE := $(LOCAL_PATH)/NOTICE
-LOCAL_MODULE_CLASS := ETC
-LOCAL_MODULE_TAGS := optional
-LOCAL_MODULE_PATH := $(TARGET_ROOT_OUT)
-
-include $(BUILD_SYSTEM)/base_rules.mk
-
-# The file_contexts.bin is built in the following way:
-# 1. Collect all file_contexts files in THIS repository and process them with
-# m4 into a tmp file called file_contexts.local.tmp.
-# 2. Collect all device specific file_contexts files and process them with m4
-# into a tmp file called file_contexts.device.tmp.
-# 3. Run checkfc -e (allow no device fc entries ie empty) and fc_sort on
-# file_contexts.device.tmp and output to file_contexts.device.sorted.tmp.
-# 4. Concatenate file_contexts.local.tmp and file_contexts.device.sorted.tmp
-# into file_contexts.concat.tmp.
-# 5. Run checkfc and sefcontext_compile on file_contexts.concat.tmp to produce
-# file_contexts.bin.
-#
-# Note: That a newline file is placed between each file_context file found to
-# ensure a proper build when an fc file is missing an ending newline.
-
-local_fc_files := $(call intermediates-dir-for,ETC,plat_file_contexts)/plat_file_contexts
-
-ifdef HAS_SYSTEM_EXT_SEPOLICY_DIR
-local_fc_files += $(call intermediates-dir-for,ETC,system_ext_file_contexts)/system_ext_file_contexts
-endif
-
-ifdef HAS_PRODUCT_SEPOLICY_DIR
-local_fc_files += $(call intermediates-dir-for,ETC,product_file_contexts)/product_file_contexts
-endif
-
-###########################################################
-## Collect file_contexts files into a single tmp file with m4
-##
-## $(1): list of file_contexts files
-## $(2): filename into which file_contexts files are merged
-###########################################################
-
-define _merge-fc-files
-$(2): $(1) $(M4)
- $(hide) mkdir -p $$(dir $$@)
- $(hide) $(M4) --fatal-warnings -s $(1) > $$@
-endef
-
-define merge-fc-files
-$(eval $(call _merge-fc-files,$(1),$(2)))
-endef
-
-file_contexts.local.tmp := $(intermediates)/file_contexts.local.tmp
-$(call merge-fc-files,$(local_fc_files),$(file_contexts.local.tmp))
-
-device_fc_files += $(call intermediates-dir-for,ETC,vendor_file_contexts)/vendor_file_contexts
-
-ifdef BOARD_ODM_SEPOLICY_DIRS
-device_fc_files += $(call intermediates-dir-for,ETC,odm_file_contexts)/odm_file_contexts
-endif
-
-file_contexts.device.tmp := $(intermediates)/file_contexts.device.tmp
-$(file_contexts.device.tmp): PRIVATE_ADDITIONAL_M4DEFS := $(LOCAL_ADDITIONAL_M4DEFS)
-$(file_contexts.device.tmp): PRIVATE_DEVICE_FC_FILES := $(device_fc_files)
-$(file_contexts.device.tmp): $(device_fc_files) $(M4)
- @mkdir -p $(dir $@)
- $(hide) $(M4) --fatal-warnings -s $(PRIVATE_ADDITIONAL_M4DEFS) $(PRIVATE_DEVICE_FC_FILES) > $@
-
-file_contexts.device.sorted.tmp := $(intermediates)/file_contexts.device.sorted.tmp
-$(file_contexts.device.sorted.tmp): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(file_contexts.device.sorted.tmp): $(file_contexts.device.tmp) $(built_sepolicy) \
- $(HOST_OUT_EXECUTABLES)/fc_sort $(HOST_OUT_EXECUTABLES)/checkfc
- @mkdir -p $(dir $@)
- $(hide) $(HOST_OUT_EXECUTABLES)/checkfc -e $(PRIVATE_SEPOLICY) $<
- $(hide) $(HOST_OUT_EXECUTABLES)/fc_sort -i $< -o $@
-
-file_contexts.concat.tmp := $(intermediates)/file_contexts.concat.tmp
-$(call merge-fc-files,\
- $(file_contexts.local.tmp) $(file_contexts.device.sorted.tmp),$(file_contexts.concat.tmp))
-
-$(LOCAL_BUILT_MODULE): PRIVATE_SEPOLICY := $(built_sepolicy)
-$(LOCAL_BUILT_MODULE): $(file_contexts.concat.tmp) $(built_sepolicy) $(HOST_OUT_EXECUTABLES)/sefcontext_compile $(HOST_OUT_EXECUTABLES)/checkfc
- @mkdir -p $(dir $@)
- $(hide) $(HOST_OUT_EXECUTABLES)/checkfc $(PRIVATE_SEPOLICY) $<
- $(hide) $(HOST_OUT_EXECUTABLES)/sefcontext_compile -o $@ $<
-
-local_fc_files :=
-device_fc_files :=
-file_contexts.concat.tmp :=
-file_contexts.device.sorted.tmp :=
-file_contexts.device.tmp :=
-file_contexts.local.tmp :=
-
-#################################
-
build_policy :=
-built_sepolicy :=
sepolicy_build_files :=
with_asan :=
diff --git a/apex/Android.bp b/apex/Android.bp
index a6d0853..304eb85 100644
--- a/apex/Android.bp
+++ b/apex/Android.bp
@@ -314,3 +314,10 @@
"com.android.biometrics.virtual.face-file_contexts",
],
}
+
+filegroup {
+ name: "com.android.documentsuibundle-file_contexts",
+ srcs: [
+ "com.android.documentsuibundle-file_contexts",
+ ],
+}
diff --git a/apex/com.android.documentsuibundle-file_contexts b/apex/com.android.documentsuibundle-file_contexts
new file mode 100644
index 0000000..f6b21da
--- /dev/null
+++ b/apex/com.android.documentsuibundle-file_contexts
@@ -0,0 +1,2 @@
+(/.*)? u:object_r:system_file:s0
+/lib(64)?(/.*) u:object_r:system_lib_file:s0
diff --git a/private/aconfigd.te b/private/aconfigd.te
index 97e7493..1601e61 100644
--- a/private/aconfigd.te
+++ b/private/aconfigd.te
@@ -1,15 +1,9 @@
# aconfigd -- manager for aconfig flags
-type aconfigd, domain;
+type aconfigd, domain, coredomain;
type aconfigd_exec, exec_type, file_type, system_file_type;
-typeattribute aconfigd coredomain;
-
init_daemon_domain(aconfigd)
-# only init is allowed to enter the aconfigd domain
-neverallow { domain -init } aconfigd:process transition;
-neverallow * aconfigd:process dyntransition;
-
allow aconfigd metadata_file:dir search;
allow aconfigd {
@@ -22,17 +16,15 @@
aconfig_storage_flags_metadata_file
}:file create_file_perms;
-allow aconfigd aconfigd_socket:unix_stream_socket { accept listen getattr read write };
-allow aconfigd aconfigd_socket:sock_file rw_file_perms;
-
# allow aconfigd to access shell_data_file for atest
userdebug_or_eng(`
allow aconfigd shell_data_file:dir search;
allow aconfigd shell_data_file:file { getattr read open map };
')
-# allow aconfigd to log to the kernel.
-allow aconfigd kmsg_device:chr_file w_file_perms;
+# allow aconfigd to log to the kernel dmesg via a file descriptor
+# passed from init to aconfigd
+allow aconfigd kmsg_device:chr_file write;
# allow aconfigd to read vendor partition storage files
allow aconfigd vendor_aconfig_storage_file:file r_file_perms;
@@ -41,3 +33,11 @@
# allow aconfigd to read /apex dir
allow aconfigd apex_mnt_dir:dir r_dir_perms;
allow aconfigd apex_mnt_dir:file r_file_perms;
+
+###
+### Neverallow assertions
+###
+
+# only init is allowed to enter the aconfigd domain
+neverallow { domain -init } aconfigd:process transition;
+neverallow * aconfigd:process dyntransition;
diff --git a/private/adbd.te b/private/adbd.te
index a298f08..b87b319 100644
--- a/private/adbd.te
+++ b/private/adbd.te
@@ -2,13 +2,17 @@
typeattribute adbd coredomain;
typeattribute adbd mlstrustedsubject;
+typeattribute adbd adbd_common;
init_daemon_domain(adbd)
domain_auto_trans(adbd, shell_exec, shell)
+# Allow adb to setcon() to tradeinmode.
+allow adbd self:process setcurrent;
+allow adbd adbd_tradeinmode:process dyntransition;
+
userdebug_or_eng(`
- allow adbd self:process setcurrent;
allow adbd su:process dyntransition;
')
@@ -78,6 +82,7 @@
set_prop(adbd, powerctl_prop)
get_prop(adbd, ffs_config_prop)
set_prop(adbd, ffs_control_prop)
+set_prop(adbd, adbd_tradeinmode_prop)
# Allow adbd start/stop mdnsd via ctl.start
set_prop(adbd, ctl_mdnsd_prop)
@@ -182,6 +187,10 @@
allow adbd shell:unix_stream_socket { read write shutdown };
allow adbd shell:fd use;
+# adb push/pull /data/local/tmp.
+allow adbd shell_data_file:dir create_dir_perms;
+allow adbd shell_data_file:file create_file_perms;
+
# Allow pull /vendor/apex files for CTS tests
r_dir_file(adbd, vendor_apex_file)
@@ -206,10 +215,15 @@
###
# No transitions from adbd to non-shell, non-crash_dump domains. adbd only ever
-# transitions to the shell domain (except when it crashes). In particular, we
-# never want to see a transition from adbd to su (aka "adb root")
-neverallow adbd { domain -crash_dump -shell }:process transition;
-neverallow adbd { domain userdebug_or_eng(`-su') recovery_only(`-shell') }:process dyntransition;
+# transitions to the shell or tradeinmode domain (except when it crashes). In
+# particular, we never want to see a transition from adbd to su (aka "adb root")
+neverallow adbd { domain -crash_dump -shell -adbd_tradeinmode }:process transition;
+neverallow adbd {
+ domain
+ userdebug_or_eng(`-su')
+ recovery_only(`-shell')
+ -adbd_tradeinmode
+}:process dyntransition;
# Only init is allowed to enter the adbd domain via exec()
neverallow { domain -init } adbd:process transition;
diff --git a/private/adbd_common.te b/private/adbd_common.te
index 6cf8e49..c24b029 100644
--- a/private/adbd_common.te
+++ b/private/adbd_common.te
@@ -2,34 +2,30 @@
### Put things here that are needed for both adbd proper and adbd in trade-in mode.
# Connect to mdnsd via mdnsd socket.
-unix_socket_connect(adbd, mdnsd, mdnsd)
+unix_socket_connect(adbd_common, mdnsd, mdnsd)
# adbd probes for vsock support. Do not generate denials when
# this occurs. (b/123569840)
-dontaudit { adbd } self:{ socket vsock_socket } create;
+dontaudit adbd_common self:{ socket vsock_socket } create;
# Allow adbd inside vm to forward vm's vsock.
-allow { adbd } self:vsock_socket { create_socket_perms_no_ioctl listen accept };
+allow adbd_common self:vsock_socket { create_socket_perms_no_ioctl listen accept };
# Access device logging gating property
-get_prop(adbd, device_logging_prop)
+get_prop(adbd_common, device_logging_prop)
# Use a pseudo tty.
-allow { adbd } devpts:chr_file rw_file_perms;
-
-# adb push/pull /data/local/tmp.
-allow { adbd } shell_data_file:dir create_dir_perms;
-allow { adbd } shell_data_file:file create_file_perms;
+allow adbd_common devpts:chr_file rw_file_perms;
# Read persist.adb.tls_server.enable property
-get_prop(adbd, system_adbd_prop)
+get_prop(adbd_common, system_adbd_prop)
# Read whether or not Test Harness Mode is enabled
-get_prop(adbd, test_harness_prop)
+get_prop(adbd_common, test_harness_prop)
# Set service.adb.tcp.port, service.adb.tls.port, persist.adb.wifi.* properties
-set_prop(adbd, adbd_prop)
-set_prop(adbd, adbd_config_prop)
+set_prop(adbd_common, adbd_prop)
+set_prop(adbd_common, adbd_config_prop)
# Read device's serial number from system properties
-get_prop(adbd, serialno_prop)
+get_prop(adbd_common, serialno_prop)
diff --git a/private/adbd_tradeinmode.te b/private/adbd_tradeinmode.te
new file mode 100644
index 0000000..2eae26a
--- /dev/null
+++ b/private/adbd_tradeinmode.te
@@ -0,0 +1,23 @@
+### ADB in trade-in mode
+type adbd_tradeinmode, domain, coredomain, adbd_common;
+
+# Create and use network sockets.
+net_domain(adbd_tradeinmode)
+
+# Baseline rules to make adbd work after setcon().
+allow adbd_tradeinmode adbd:unix_stream_socket {
+ rw_socket_perms_no_ioctl
+ listen
+ accept
+};
+allow adbd_tradeinmode adbd:fd use;
+allow adbd_tradeinmode adbd:unix_dgram_socket { connect write };
+allow adbd_tradeinmode functionfs:dir r_dir_perms;
+allow adbd_tradeinmode functionfs:file rw_file_perms;
+allow adbd_tradeinmode proc_uptime:file r_file_perms;
+allow adbd_tradeinmode rootfs:dir r_dir_perms;
+
+set_prop(adbd_tradeinmode, ffs_control_prop)
+
+# Allow changing persist.adb.tradeinmode when testing.
+userdebug_or_eng(`set_prop(adbd_tradeinmode, shell_prop)')
diff --git a/private/attributes b/private/attributes
index fe50b0d..2d6181d 100644
--- a/private/attributes
+++ b/private/attributes
@@ -15,3 +15,5 @@
attribute sdk_sandbox_all;
# The SDK sandbox domains for the current SDK level.
attribute sdk_sandbox_current;
+# Common to adbd and adbd_tradeinmode.
+attribute adbd_common;
diff --git a/private/coredomain.te b/private/coredomain.te
index 93cbff5..8a46a08 100644
--- a/private/coredomain.te
+++ b/private/coredomain.te
@@ -220,6 +220,7 @@
neverallow {
coredomain
-adbd
+ -adbd_tradeinmode
-init
-mediaprovider
-system_server
diff --git a/private/domain.te b/private/domain.te
index 03bcb85..ceab2dd 100644
--- a/private/domain.te
+++ b/private/domain.te
@@ -816,6 +816,7 @@
neverallow {
domain
-adbd
+ -adbd_tradeinmode
-dumpstate
-fastbootd
-hal_camera_server
diff --git a/private/property.te b/private/property.te
index 40beca5..8199b4f 100644
--- a/private/property.te
+++ b/private/property.te
@@ -1,5 +1,6 @@
# Properties used only in /system
system_internal_prop(adbd_prop)
+system_internal_prop(adbd_tradeinmode_prop)
system_internal_prop(apexd_payload_metadata_prop)
system_internal_prop(ctl_snapuserd_prop)
system_internal_prop(crashrecovery_prop)
@@ -20,6 +21,7 @@
system_internal_prop(device_config_tethering_u_or_later_native_prop)
system_internal_prop(dmesgd_start_prop)
system_internal_prop(bert_collector_start_prop)
+system_internal_prop(desktop_ec_crash_collector_start_prop)
system_internal_prop(fastbootd_protocol_prop)
system_internal_prop(gsid_prop)
system_internal_prop(init_perf_lsm_hooks_prop)
@@ -509,6 +511,7 @@
-init
-vendor_init
-adbd
+ -adbd_tradeinmode
-system_server
} {
adbd_config_prop
@@ -519,6 +522,7 @@
domain
-init
-adbd
+ -adbd_tradeinmode
} {
adbd_prop
}:property_service set;
diff --git a/private/property_contexts b/private/property_contexts
index 999a69a..fc5162e 100644
--- a/private/property_contexts
+++ b/private/property_contexts
@@ -51,6 +51,7 @@
security.lower_kptr_restrict u:object_r:lower_kptr_restrict_prop:s0
service.adb.root u:object_r:shell_prop:s0
service.adb.tls.port u:object_r:adbd_prop:s0
+persist.adb.tradeinmode u:object_r:adbd_tradeinmode_prop:s0
persist.adb.wifi. u:object_r:adbd_prop:s0
persist.adb.tls_server.enable u:object_r:system_adbd_prop:s0
@@ -872,6 +873,8 @@
acpi.bert_collector.start u:object_r:bert_collector_start_prop:s0 exact bool
+desktop.ec.crash_collector.start u:object_r:desktop_ec_crash_collector_start_prop:s0 exact bool
+
odsign.key.done u:object_r:odsign_prop:s0 exact bool
odsign.verification.done u:object_r:odsign_prop:s0 exact bool
odsign.verification.success u:object_r:odsign_prop:s0 exact bool
diff --git a/private/sdk_sandbox_all.te b/private/sdk_sandbox_all.te
index b4c655b..41b2799 100644
--- a/private/sdk_sandbox_all.te
+++ b/private/sdk_sandbox_all.te
@@ -124,3 +124,25 @@
# Only dirs should be created at sdk_sandbox_all_system_data_file level
neverallow { domain -init } sdk_sandbox_system_data_file:file *;
+# Restrict unix stream sockets for IPC.
+neverallow sdk_sandbox_all {
+ domain
+ -sdk_sandbox_all
+ -netd
+ -logd
+ -adbd
+ userdebug_or_eng(`-su')
+ # needed for profiling
+ -traced
+ -traced_perf
+ -heapprofd
+ # fallback crash handling for processes that can't exec crash_dump.
+ -tombstoned
+ # needed to connect to PRNG seeder daemon.
+ -prng_seeder
+}:unix_stream_socket connectto;
+neverallow {
+ domain
+ -adbd
+ -sdk_sandbox_all
+} sdk_sandbox_all:unix_stream_socket connectto;
diff --git a/private/shell.te b/private/shell.te
index a6e9975..839178c 100644
--- a/private/shell.te
+++ b/private/shell.te
@@ -273,12 +273,6 @@
# TODO (b/350628688): Remove this once it's safe to do so.
allow shell oatdump_exec:file rx_file_perms;
-# Allow shell access to socket for test
-userdebug_or_eng(`
- allow shell aconfigd_socket:sock_file write;
- allow shell aconfigd:unix_stream_socket connectto;
-')
-
# Create and use network sockets.
net_domain(shell)
diff --git a/private/system_server.te b/private/system_server.te
index fc4faef..063c2ed 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -1134,9 +1134,9 @@
# Connect to adbd and use a socket transferred from it.
# Used for e.g. jdwp.
-allow system_server adbd:unix_stream_socket connectto;
-allow system_server adbd:fd use;
-allow system_server adbd:unix_stream_socket { getattr getopt ioctl read write shutdown };
+allow system_server adbd_common:unix_stream_socket connectto;
+allow system_server adbd_common:fd use;
+allow system_server adbd_common:unix_stream_socket { getattr getopt ioctl read write shutdown };
# Read service.adb.tls.port, persist.adb.wifi. properties
get_prop(system_server, adbd_prop)
diff --git a/private/vmlauncher_app.te b/private/vmlauncher_app.te
index 3244e65..71c9f3f 100644
--- a/private/vmlauncher_app.te
+++ b/private/vmlauncher_app.te
@@ -11,6 +11,8 @@
allow vmlauncher_app shell_data_file:file { read open write };
virtualizationservice_use(vmlauncher_app)
+allow vmlauncher_app fsck_exec:file { r_file_perms execute execute_no_trans };
+
is_flag_enabled(RELEASE_AVF_SUPPORT_CUSTOM_VM_WITH_PARAVIRTUALIZED_DEVICES, `
# TODO(b/332677707): remove them when display service uses binder RPC.
allow vmlauncher_app virtualization_service:service_manager find;