add links to docs explaining motivations behind neverallow assertions.
Test: comments only. Policy compiles.
Change-Id: Ic51533d37fff6c553950a122f33a48e3c119c67c
diff --git a/private/system_server.te b/private/system_server.te
index 750ee3e..de62eef 100644
--- a/private/system_server.te
+++ b/private/system_server.te
@@ -880,7 +880,8 @@
neverallow system_server dex2oat_exec:file no_x_file_perms;
# system_server should never execute or load executable shared libraries
-# in /data
+# in /data. Executable files in /data are a persistence vector.
+# https://bugs.chromium.org/p/project-zero/issues/detail?id=955 for example.
neverallow system_server data_file_type:file no_x_file_perms;
# The only block device system_server should be accessing is
@@ -889,6 +890,8 @@
neverallow system_server { dev_type -frp_block_device }:blk_file no_rw_file_perms;
# system_server should never use JIT functionality
+# See https://googleprojectzero.blogspot.com/2016/12/bitunmap-attacking-android-ashmem.html
+# in the section titled "A Short ROP Chain" for why.
neverallow system_server self:process execmem;
neverallow system_server ashmem_device:chr_file execute;
diff --git a/private/zygote.te b/private/zygote.te
index 3a8e793..610916e 100644
--- a/private/zygote.te
+++ b/private/zygote.te
@@ -43,7 +43,9 @@
allow zygote resourcecache_data_file:file create_file_perms;
# When WITH_DEXPREOPT is true, the zygote does not load executable content from
-# /data/dalvik-cache.
+# /data/dalvik-cache. Executable files loaded from /data is a persistence vector
+# we want to avoid. See
+# https://bugs.chromium.org/p/project-zero/issues/detail?id=955 for example.
allow { zygote with_dexpreopt(`-zygote') } dalvikcache_data_file:file execute;
# Execute idmap and dex2oat within zygote's own domain.