Constrain cgroups access.
What changed:
- Removed cgroup access from untrusted and priv apps.
- Settings app writes to /dev/stune/foreground/tasks, so system_app domain
retains access to cgroup.
- libcutils exports API to /dev/{cpuset, stune}/*. This API seems to be used
abundantly in native code. So added a blanket allow rule for (coredomain - apps)
to access cgroups.
- For now, only audit cgroup access from vendor domains. Ultimately, we want to
either constrain vendor access to individual domains or, even better, remove
vendor access and have platform manage cgroups exclusively.
Changes from original aosp/692189 which was reverted:
- There seem to be spurious denials from vendor-specific apps. So added
back access from { appdomain -all_untrusted_apps -priv_app } to cgroup.
Audit this access with intent to write explicit per-domain rules for it.
Bug: 110043362
Test: adb shell setprop ro.config.per_app_memcg true, device correctly populates
/dev/memcg on a per app basis on a device that supports that.
Test: aosp_sailfish, wahoo boot without cgroup denials
This reverts commit cacea25ed0fe4850d50d12640c7ee47ae1e2ef7a.
Change-Id: I05ab404f348a864e8409d811346c8a0bf49bc47a
diff --git a/private/app_neverallows.te b/private/app_neverallows.te
index 344ecd5..1e82404 100644
--- a/private/app_neverallows.te
+++ b/private/app_neverallows.te
@@ -274,3 +274,6 @@
# This will go away in a future Android release
neverallow { all_untrusted_apps -untrusted_app_25 } proc_tty_drivers:file r_file_perms;
neverallow all_untrusted_apps proc_tty_drivers:file ~r_file_perms;
+
+# Untrusted apps are not allowed to use cgroups.
+neverallow all_untrusted_apps cgroup:file *;
diff --git a/private/priv_app.te b/private/priv_app.te
index e12cce7..192221d 100644
--- a/private/priv_app.te
+++ b/private/priv_app.te
@@ -218,3 +218,6 @@
# upon traceur to pass a file descriptor which they can then read
neverallow priv_app trace_data_file:dir *;
neverallow priv_app trace_data_file:file { no_w_file_perms open };
+
+# Do not allow priv_app access to cgroups.
+neverallow priv_app cgroup:file *;
diff --git a/private/system_app.te b/private/system_app.te
index 40fec6a..4bfcc18 100644
--- a/private/system_app.te
+++ b/private/system_app.te
@@ -122,6 +122,9 @@
proc_version
}:file r_file_perms;
+# Settings app writes to /dev/stune/foreground/tasks.
+allow system_app cgroup:file w_file_perms;
+
control_logd(system_app)
read_runtime_log_tags(system_app)
get_prop(system_app, device_logging_prop)
diff --git a/public/app.te b/public/app.te
index 5a82152..800e891 100644
--- a/public/app.te
+++ b/public/app.te
@@ -22,10 +22,6 @@
# Notify zygote of death;
allow appdomain zygote:process sigchld;
-# Place process into foreground / background
-allow appdomain cgroup:dir { search write };
-allow appdomain cgroup:file rw_file_perms;
-
# Read /data/dalvik-cache.
allow appdomain dalvikcache_data_file:dir { search getattr };
allow appdomain dalvikcache_data_file:file r_file_perms;
diff --git a/public/domain.te b/public/domain.te
index e9bdb6d..244e089 100644
--- a/public/domain.te
+++ b/public/domain.te
@@ -258,9 +258,34 @@
allow domain sysfs:dir search;
allow domain selinuxfs:filesystem getattr;
-# For /acct/uid/*/tasks.
-allow domain cgroup:dir { search write };
-allow domain cgroup:file w_file_perms;
+# Path resolution access in cgroups.
+allow domain cgroup:dir search;
+allow { coredomain -appdomain } cgroup:dir w_dir_perms;
+allow { coredomain -appdomain } cgroup:file w_file_perms;
+
+# TODO(b/110043362): Clean up cgroup access from app domains.
+allow {
+ # Can not use all_untrusted_apps macro here, so expanding inline.
+ # This list is essentially { appdomain -all_untrusted_apps -priv_app }
+ appdomain
+ -ephemeral_app
+ -isolated_app
+ -mediaprovider
+ -untrusted_app
+ -untrusted_app_25
+ -untrusted_app_27
+ -untrusted_app_all
+ -priv_app
+} cgroup:file w_file_perms;
+auditallow appdomain cgroup:file w_file_perms;
+
+# TODO(b/110043362): Clean up cgroup access from non-system domains.
+allow { domain -coredomain } cgroup:file w_file_perms;
+auditallow {
+ domain
+ -coredomain
+ -vendor_init
+} cgroup:file w_file_perms;
# Almost all processes log tracing information to
# /sys/kernel/debug/tracing/trace_marker
diff --git a/public/init.te b/public/init.te
index 02a0dfe..eb27dbd 100644
--- a/public/init.te
+++ b/public/init.te
@@ -93,7 +93,7 @@
allow init tmpfs:dir create_dir_perms;
allow init tmpfs:dir mounton;
allow init cgroup:dir create_dir_perms;
-r_dir_file(init, cgroup)
+allow init cgroup:file rw_file_perms;
allow init cpuctl_device:dir { create mounton };
# /config
diff --git a/public/vendor_init.te b/public/vendor_init.te
index 01c2f17..8cd9b47 100644
--- a/public/vendor_init.te
+++ b/public/vendor_init.te
@@ -15,6 +15,7 @@
# Create cgroups mount points in tmpfs and mount cgroups on them.
allow vendor_init cgroup:dir create_dir_perms;
+allow vendor_init cgroup:file w_file_perms;
# /config
allow vendor_init configfs:dir mounton;