untrusted_app: policy versioning based on targetSdkVersion
Motivation:
Provide the ability to phase in new security policies by
applying them to apps with a minimum targetSdkVersion.
Place untrusted apps with targetSdkVersion<=25 into the
untrustd_app_25 domain. Apps with targetSdkVersion>=26 are placed
into the untrusted_app domain. Common rules are included in the
untrusted_app_all attribute. Apps with a more recent targetSdkVersion
are granted fewer permissions.
Test: Marlin builds and boots. Apps targeting targetSdkVersion<=25
run in untrusted_app_25 domain. Apps targeting the current development
build >=26 run in the untrusted_app domain with fewer permissions. No
new denials observed during testing.
Bug: 34115651
Bug: 35323421
Change-Id: Ie6a015566fac07c44ea06c963c40793fcdc9a083
diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 33670aa..a881d52 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -2,26 +2,33 @@
### neverallow rules for untrusted app domains
###
+# Only allow domains in AOSP to use the untrusted_app_all attribute.
+neverallow { untrusted_app_all -untrusted_app -untrusted_app_25 } domain:process fork;
+
# Receive or send uevent messages.
-neverallow { untrusted_app ephemeral_app isolated_app } domain:netlink_kobject_uevent_socket *;
+neverallow { untrusted_app_all ephemeral_app isolated_app } domain:netlink_kobject_uevent_socket *;
# Receive or send generic netlink messages
-neverallow { untrusted_app ephemeral_app isolated_app } domain:netlink_socket *;
+neverallow { untrusted_app_all ephemeral_app isolated_app } domain:netlink_socket *;
# Too much leaky information in debugfs. It's a security
# best practice to ensure these files aren't readable.
-neverallow { untrusted_app ephemeral_app isolated_app } debugfs_type:file read;
+neverallow { untrusted_app_all ephemeral_app isolated_app } debugfs_type:file read;
# Do not allow untrusted apps to register services.
# Only trusted components of Android should be registering
# services.
-neverallow { untrusted_app ephemeral_app isolated_app } service_manager_type:service_manager add;
+neverallow { untrusted_app_all ephemeral_app isolated_app } service_manager_type:service_manager add;
# Do not allow untrusted apps to connect to the property service
# or set properties. b/10243159
-neverallow { untrusted_app ephemeral_app isolated_app } property_socket:sock_file write;
-neverallow { untrusted_app ephemeral_app isolated_app } init:unix_stream_socket connectto;
-neverallow { untrusted_app ephemeral_app isolated_app } property_type:property_service set;
+neverallow { untrusted_app_all ephemeral_app isolated_app } property_socket:sock_file write;
+neverallow { untrusted_app_all ephemeral_app isolated_app } init:unix_stream_socket connectto;
+neverallow { untrusted_app_all ephemeral_app isolated_app } property_type:property_service set;
+
+# b/34115651 - net.dns* properties read
+# This will go away in a future Android release
+neverallow { appdomain -untrusted_app_25 } net_dns_prop:file r_file_perms;
# Do not allow untrusted apps to be assigned mlstrustedsubject.
# This would undermine the per-user isolation model being
@@ -31,7 +38,7 @@
# permission only makes sense within a domain (hence should
# never be granted to any other domain within mlstrustedsubject)
# and an untrusted app is allowed fork permission to itself.
-neverallow { untrusted_app ephemeral_app isolated_app } mlstrustedsubject:process fork;
+neverallow { untrusted_app_all ephemeral_app isolated_app } mlstrustedsubject:process fork;
# Do not allow untrusted apps to hard link to any files.
# In particular, if an untrusted app links to other app data
@@ -39,16 +46,16 @@
# of the linked to file. Hard links also contribute to security
# bugs, so we want to ensure untrusted apps never have this
# capability.
-neverallow { untrusted_app ephemeral_app isolated_app } file_type:file link;
+neverallow { untrusted_app_all ephemeral_app isolated_app } file_type:file link;
# Do not allow untrusted apps to access network MAC address file
-neverallow { untrusted_app ephemeral_app isolated_app } sysfs_mac_address:file no_rw_file_perms;
+neverallow { untrusted_app_all ephemeral_app isolated_app } sysfs_mac_address:file no_rw_file_perms;
# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the
# ioctl permission, or 3. disallow the socket class.
-neverallowxperm { untrusted_app ephemeral_app isolated_app } domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
-neverallow { untrusted_app ephemeral_app isolated_app } *:{ netlink_route_socket netlink_selinux_socket } ioctl;
-neverallow { untrusted_app ephemeral_app isolated_app } *:{
+neverallowxperm { untrusted_app_all ephemeral_app isolated_app } domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
+neverallow { untrusted_app_all ephemeral_app isolated_app } *:{ netlink_route_socket netlink_selinux_socket } ioctl;
+neverallow { untrusted_app_all ephemeral_app isolated_app } *:{
socket netlink_socket packet_socket key_socket appletalk_socket
netlink_tcpdiag_socket netlink_nflog_socket
netlink_xfrm_socket netlink_audit_socket
@@ -59,15 +66,15 @@
} *;
# Do not allow untrusted apps access to /cache
-neverallow { untrusted_app ephemeral_app isolated_app } { cache_file cache_recovery_file }:dir ~{ r_dir_perms };
-neverallow { untrusted_app ephemeral_app isolated_app } { cache_file cache_recovery_file }:file ~{ read getattr };
+neverallow { untrusted_app_all ephemeral_app isolated_app } { cache_file cache_recovery_file }:dir ~{ r_dir_perms };
+neverallow { untrusted_app_all ephemeral_app isolated_app } { cache_file cache_recovery_file }:file ~{ read getattr };
# Do not allow untrusted apps to create/unlink files outside of its sandbox,
# internal storage or sdcard.
# World accessible data locations allow application to fill the device
# with unaccounted for data. This data will not get removed during
# application un-installation.
-neverallow { untrusted_app ephemeral_app isolated_app } {
+neverallow { untrusted_app_all ephemeral_app isolated_app } {
fs_type
-fuse # sdcard
-sdcardfs # sdcard
@@ -85,12 +92,12 @@
}:dir_file_class_set { create unlink };
# Do not allow untrusted apps to directly open tun_device
-neverallow { untrusted_app ephemeral_app isolated_app } tun_device:chr_file open;
+neverallow { untrusted_app_all ephemeral_app isolated_app } tun_device:chr_file open;
# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553)
-neverallow { untrusted_app ephemeral_app isolated_app } anr_data_file:file ~{ open append };
-neverallow { untrusted_app ephemeral_app isolated_app } anr_data_file:dir ~search;
+neverallow { untrusted_app_all ephemeral_app isolated_app } anr_data_file:file ~{ open append };
+neverallow { untrusted_app_all ephemeral_app isolated_app } anr_data_file:dir ~search;
# Avoid reads from generically labeled /proc files
# Create a more specific label if needed
-neverallow { untrusted_app ephemeral_app isolated_app } proc:file { no_rw_file_perms no_x_file_perms };
+neverallow { untrusted_app_all ephemeral_app isolated_app } proc:file { no_rw_file_perms no_x_file_perms };