| Bram Bonne | b93f26f | 2022-03-15 18:28:02 +0100 | [diff] [blame] | 1 | ### |
| 2 | ### SDK Sandbox process. |
| 3 | ### |
| 4 | ### This file defines the security policy for the sdk sandbox processes. |
| 5 | |
| 6 | type sdk_sandbox, domain; |
| 7 | |
| 8 | typeattribute sdk_sandbox coredomain; |
| 9 | |
| 10 | net_domain(sdk_sandbox) |
| 11 | app_domain(sdk_sandbox) |
| 12 | |
| 13 | # Allow finding services. This is different from ephemeral_app policy. |
| 14 | # Adding services manually to the allowlist is preferred hence app_api_service is not used. |
| Bram Bonne | b93f26f | 2022-03-15 18:28:02 +0100 | [diff] [blame] | 15 | # Audit the access to signal that we are still investigating whether sdk_sandbox |
| 16 | # should have access to audio_service |
| 17 | # TODO(b/211632068): remove this line |
| 18 | auditallow sdk_sandbox audio_service:service_manager find; |
| Shiwangi Shah | 48b2b33 | 2022-04-01 13:24:20 +0000 | [diff] [blame] | 19 | |
| 20 | allow sdk_sandbox activity_service:service_manager find; |
| 21 | allow sdk_sandbox activity_task_service:service_manager find; |
| 22 | allow sdk_sandbox appops_service:service_manager find; |
| 23 | allow sdk_sandbox audio_service:service_manager find; |
| 24 | allow sdk_sandbox audioserver_service:service_manager find; |
| 25 | allow sdk_sandbox batteryproperties_service:service_manager find; |
| 26 | allow sdk_sandbox batterystats_service:service_manager find; |
| 27 | allow sdk_sandbox connectivity_service:service_manager find; |
| 28 | allow sdk_sandbox connmetrics_service:service_manager find; |
| 29 | allow sdk_sandbox deviceidle_service:service_manager find; |
| 30 | allow sdk_sandbox display_service:service_manager find; |
| 31 | allow sdk_sandbox dropbox_service:service_manager find; |
| 32 | allow sdk_sandbox font_service:service_manager find; |
| 33 | allow sdk_sandbox game_service:service_manager find; |
| 34 | allow sdk_sandbox gpu_service:service_manager find; |
| 35 | allow sdk_sandbox graphicsstats_service:service_manager find; |
| Shiwangi Shah | 13bdca2 | 2022-04-27 15:13:19 +0000 | [diff] [blame^] | 36 | allow sdk_sandbox hardware_properties_service:service_manager find; |
| Bram Bonne | b93f26f | 2022-03-15 18:28:02 +0100 | [diff] [blame] | 37 | allow sdk_sandbox hint_service:service_manager find; |
| Shiwangi Shah | 48b2b33 | 2022-04-01 13:24:20 +0000 | [diff] [blame] | 38 | allow sdk_sandbox imms_service:service_manager find; |
| 39 | allow sdk_sandbox input_method_service:service_manager find; |
| 40 | allow sdk_sandbox input_service:service_manager find; |
| 41 | allow sdk_sandbox IProxyService_service:service_manager find; |
| 42 | allow sdk_sandbox ipsec_service:service_manager find; |
| 43 | allow sdk_sandbox launcherapps_service:service_manager find; |
| 44 | allow sdk_sandbox legacy_permission_service:service_manager find; |
| 45 | allow sdk_sandbox light_service:service_manager find; |
| 46 | allow sdk_sandbox locale_service:service_manager find; |
| 47 | allow sdk_sandbox media_communication_service:service_manager find; |
| 48 | allow sdk_sandbox mediaextractor_service:service_manager find; |
| 49 | allow sdk_sandbox mediametrics_service:service_manager find; |
| 50 | allow sdk_sandbox media_projection_service:service_manager find; |
| 51 | allow sdk_sandbox media_router_service:service_manager find; |
| 52 | allow sdk_sandbox mediaserver_service:service_manager find; |
| 53 | allow sdk_sandbox media_session_service:service_manager find; |
| 54 | allow sdk_sandbox memtrackproxy_service:service_manager find; |
| 55 | allow sdk_sandbox midi_service:service_manager find; |
| 56 | allow sdk_sandbox netpolicy_service:service_manager find; |
| 57 | allow sdk_sandbox netstats_service:service_manager find; |
| 58 | allow sdk_sandbox network_management_service:service_manager find; |
| 59 | allow sdk_sandbox notification_service:service_manager find; |
| 60 | allow sdk_sandbox package_service:service_manager find; |
| 61 | allow sdk_sandbox permission_checker_service:service_manager find; |
| 62 | allow sdk_sandbox permission_service:service_manager find; |
| 63 | allow sdk_sandbox permissionmgr_service:service_manager find; |
| 64 | allow sdk_sandbox platform_compat_service:service_manager find; |
| 65 | allow sdk_sandbox power_service:service_manager find; |
| 66 | allow sdk_sandbox procstats_service:service_manager find; |
| 67 | allow sdk_sandbox registry_service:service_manager find; |
| 68 | allow sdk_sandbox restrictions_service:service_manager find; |
| 69 | allow sdk_sandbox rttmanager_service:service_manager find; |
| 70 | allow sdk_sandbox search_service:service_manager find; |
| 71 | allow sdk_sandbox selection_toolbar_service:service_manager find; |
| 72 | allow sdk_sandbox sensor_privacy_service:service_manager find; |
| 73 | allow sdk_sandbox sensorservice_service:service_manager find; |
| 74 | allow sdk_sandbox servicediscovery_service:service_manager find; |
| 75 | allow sdk_sandbox settings_service:service_manager find; |
| 76 | allow sdk_sandbox speech_recognition_service:service_manager find; |
| 77 | allow sdk_sandbox statusbar_service:service_manager find; |
| 78 | allow sdk_sandbox storagestats_service:service_manager find; |
| Bram Bonne | b93f26f | 2022-03-15 18:28:02 +0100 | [diff] [blame] | 79 | allow sdk_sandbox surfaceflinger_service:service_manager find; |
| Shiwangi Shah | 48b2b33 | 2022-04-01 13:24:20 +0000 | [diff] [blame] | 80 | allow sdk_sandbox telecom_service:service_manager find; |
| 81 | allow sdk_sandbox tethering_service:service_manager find; |
| 82 | allow sdk_sandbox textclassification_service:service_manager find; |
| 83 | allow sdk_sandbox textservices_service:service_manager find; |
| 84 | allow sdk_sandbox texttospeech_service:service_manager find; |
| Shiwangi Shah | 155d318 | 2022-03-24 12:52:32 +0000 | [diff] [blame] | 85 | allow sdk_sandbox thermal_service:service_manager find; |
| Shiwangi Shah | 48b2b33 | 2022-04-01 13:24:20 +0000 | [diff] [blame] | 86 | allow sdk_sandbox translation_service:service_manager find; |
| 87 | allow sdk_sandbox tv_iapp_service:service_manager find; |
| 88 | allow sdk_sandbox tv_input_service:service_manager find; |
| Bram Bonne | b93f26f | 2022-03-15 18:28:02 +0100 | [diff] [blame] | 89 | allow sdk_sandbox uimode_service:service_manager find; |
| Shiwangi Shah | 48b2b33 | 2022-04-01 13:24:20 +0000 | [diff] [blame] | 90 | allow sdk_sandbox vcn_management_service:service_manager find; |
| Bram Bonne | b93f26f | 2022-03-15 18:28:02 +0100 | [diff] [blame] | 91 | allow sdk_sandbox webviewupdate_service:service_manager find; |
| 92 | |
| Shiwangi Shah | 13bdca2 | 2022-04-27 15:13:19 +0000 | [diff] [blame^] | 93 | allow sdk_sandbox system_linker_exec:file execute_no_trans; |
| 94 | |
| Bram Bonne | b93f26f | 2022-03-15 18:28:02 +0100 | [diff] [blame] | 95 | # Write app-specific trace data to the Perfetto traced damon. This requires |
| 96 | # connecting to its producer socket and obtaining a (per-process) tmpfs fd. |
| 97 | perfetto_producer(sdk_sandbox) |
| 98 | |
| 99 | # Allow profiling if the app opts in by being marked profileable/debuggable. |
| 100 | can_profile_heap(sdk_sandbox) |
| 101 | can_profile_perf(sdk_sandbox) |
| 102 | |
| 103 | # allow sdk sandbox to use UDP sockets provided by the system server but not |
| 104 | # modify them other than to connect |
| 105 | allow sdk_sandbox system_server:udp_socket { |
| 106 | connect getattr read recvfrom sendto write getopt setopt }; |
| 107 | |
| 108 | # allow access to sdksandbox data directory |
| 109 | allow sdk_sandbox sdk_sandbox_data_file:dir create_dir_perms; |
| 110 | allow sdk_sandbox sdk_sandbox_data_file:file create_file_perms; |
| 111 | |
| 112 | ### |
| 113 | ### neverallow rules |
| 114 | ### |
| 115 | |
| 116 | neverallow sdk_sandbox { app_data_file privapp_data_file }:file { execute execute_no_trans }; |
| 117 | |
| 118 | # Receive or send uevent messages. |
| 119 | neverallow sdk_sandbox domain:netlink_kobject_uevent_socket *; |
| 120 | |
| 121 | # Receive or send generic netlink messages |
| 122 | neverallow sdk_sandbox domain:netlink_socket *; |
| 123 | |
| 124 | # Too much leaky information in debugfs. It's a security |
| 125 | # best practice to ensure these files aren't readable. |
| 126 | neverallow sdk_sandbox debugfs:file read; |
| 127 | |
| 128 | # execute gpu_device |
| 129 | neverallow sdk_sandbox gpu_device:chr_file execute; |
| 130 | |
| 131 | # access files in /sys with the default sysfs label |
| 132 | neverallow sdk_sandbox sysfs:file *; |
| 133 | |
| 134 | # Avoid reads from generically labeled /proc files |
| 135 | # Create a more specific label if needed |
| 136 | neverallow sdk_sandbox proc:file { no_rw_file_perms no_x_file_perms }; |
| 137 | |
| 138 | # Directly access external storage |
| 139 | neverallow sdk_sandbox { sdcard_type media_rw_data_file }:file {open create}; |
| 140 | neverallow sdk_sandbox { sdcard_type media_rw_data_file }:dir search; |
| 141 | |
| 142 | # Avoid reads to proc_net, it contains too much device wide information about |
| 143 | # ongoing connections. |
| 144 | neverallow sdk_sandbox proc_net:file no_rw_file_perms; |
| 145 | |
| 146 | # SDK sandbox processes have their own storage not related to app_data_file or privapp_data_file |
| 147 | neverallow sdk_sandbox { app_data_file privapp_data_file }:dir no_rw_file_perms; |
| 148 | neverallow sdk_sandbox { app_data_file privapp_data_file }:file no_rw_file_perms; |
| 149 | |
| 150 | # SDK sandbox processes don't have any access to external storage |
| 151 | neverallow sdk_sandbox { media_rw_data_file }:dir no_rw_file_perms; |
| 152 | neverallow sdk_sandbox { media_rw_data_file }:file no_rw_file_perms; |
| 153 | |
| 154 | neverallow { sdk_sandbox } tmpfs:dir no_rw_file_perms; |
| Bram Bonne | 85dfe31 | 2022-03-23 17:48:48 +0100 | [diff] [blame] | 155 | |
| 156 | neverallow sdk_sandbox hal_drm_service:service_manager find; |