blob: 895024040003f28088dd4dc391e54ac0e926be77 [file] [log] [blame]
Alex Klyubin59322f12017-02-06 15:39:36 -08001#
2# System Server aka system_server spawned by zygote.
3# Most of the framework services run in this process.
4#
5
Alex Klyubinf5446eb2017-03-23 14:27:32 -07006typeattribute system_server coredomain;
Alex Klyubin59322f12017-02-06 15:39:36 -08007typeattribute system_server mlstrustedsubject;
8
dcashmancc39f632016-07-22 13:13:11 -07009# Define a type for tmpfs-backed ashmem regions.
10tmpfs_domain(system_server)
Alex Klyubin59322f12017-02-06 15:39:36 -080011
Josh Gaocb3eb4e2016-10-19 14:39:30 -070012# Create a socket for connections from crash_dump.
dcashmancc39f632016-07-22 13:13:11 -070013type_transition system_server system_data_file:sock_file system_ndebug_socket "ndebugsocket";
dcashman2e00e632016-10-12 14:58:09 -070014
15allow system_server zygote_tmpfs:file read;
16
Alex Klyubin59322f12017-02-06 15:39:36 -080017# For art.
18allow system_server dalvikcache_data_file:dir r_dir_perms;
Dan Cashman91d398d2017-09-26 12:58:29 -070019allow system_server dalvikcache_data_file:file r_file_perms;
20
21# When running system server under --invoke-with, we'll try to load the boot image under the
22# system server domain, following links to the system partition.
23with_asan(`allow system_server dalvikcache_data_file:lnk_file r_file_perms;')
Alex Klyubin59322f12017-02-06 15:39:36 -080024
Alex Klyubin59322f12017-02-06 15:39:36 -080025# /data/resource-cache
26allow system_server resourcecache_data_file:file r_file_perms;
27allow system_server resourcecache_data_file:dir r_dir_perms;
28
29# ptrace to processes in the same domain for debugging crashes.
30allow system_server self:process ptrace;
31
32# Child of the zygote.
33allow system_server zygote:fd use;
34allow system_server zygote:process sigchld;
35
36# May kill zygote on crashes.
37allow system_server zygote:process sigkill;
38allow system_server crash_dump:process sigkill;
Robert Sesekfebdfa42018-01-30 10:54:33 -050039allow system_server webview_zygote:process sigkill;
Alex Klyubin59322f12017-02-06 15:39:36 -080040
41# Read /system/bin/app_process.
42allow system_server zygote_exec:file r_file_perms;
43
44# Needed to close the zygote socket, which involves getopt / getattr
45allow system_server zygote:unix_stream_socket { getopt getattr };
46
47# system server gets network and bluetooth permissions.
48net_domain(system_server)
49# in addition to ioctls whitelisted for all domains, also allow system_server
50# to use privileged ioctls commands. Needed to set up VPNs.
51allowxperm system_server self:udp_socket ioctl priv_sock_ioctls;
52bluetooth_domain(system_server)
53
54# These are the capabilities assigned by the zygote to the
55# system server.
Benjamin Gordon9b2e0cb2017-11-09 15:51:26 -070056allow system_server self:global_capability_class_set {
Alex Klyubin59322f12017-02-06 15:39:36 -080057 ipc_lock
58 kill
59 net_admin
60 net_bind_service
61 net_broadcast
62 net_raw
63 sys_boot
64 sys_nice
Nick Kralevich44866952017-02-15 15:04:43 -080065 sys_ptrace
Alex Klyubin59322f12017-02-06 15:39:36 -080066 sys_time
67 sys_tty_config
68};
69
70wakelock_use(system_server)
71
Alex Klyubin59322f12017-02-06 15:39:36 -080072# Trigger module auto-load.
73allow system_server kernel:system module_request;
74
75# Allow alarmtimers to be set
Benjamin Gordon9b2e0cb2017-11-09 15:51:26 -070076allow system_server self:global_capability2_class_set wake_alarm;
Alex Klyubin59322f12017-02-06 15:39:36 -080077
Dan Cashman91d398d2017-09-26 12:58:29 -070078# Create and share netlink_netfilter_sockets for tetheroffload.
79allow system_server self:netlink_netfilter_socket create_socket_perms_no_ioctl;
80
Alex Klyubin59322f12017-02-06 15:39:36 -080081# Use netlink uevent sockets.
82allow system_server self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
83
84# Use generic netlink sockets.
85allow system_server self:netlink_socket create_socket_perms_no_ioctl;
86allow system_server self:netlink_generic_socket create_socket_perms_no_ioctl;
87
Michael Schwartzbc3150a2017-05-18 09:59:05 -070088# libvintf reads the kernel config to verify vendor interface compatibility.
89allow system_server config_gz:file { read open };
90
Alex Klyubin59322f12017-02-06 15:39:36 -080091# Use generic "sockets" where the address family is not known
92# to the kernel. The ioctl permission is specifically omitted here, but may
93# be added to device specific policy along with the ioctl commands to be
94# whitelisted.
95allow system_server self:socket create_socket_perms_no_ioctl;
96
97# Set and get routes directly via netlink.
98allow system_server self:netlink_route_socket nlmsg_write;
99
100# Kill apps.
Tom Cherryc59eb4d2017-06-13 14:49:17 -0700101allow system_server appdomain:process { getpgid sigkill signal };
Alex Klyubin59322f12017-02-06 15:39:36 -0800102
103# Set scheduling info for apps.
104allow system_server appdomain:process { getsched setsched };
105allow system_server audioserver:process { getsched setsched };
106allow system_server hal_audio:process { getsched setsched };
Philip Cuadra3c46d2f2017-03-23 10:03:49 -0700107allow system_server hal_bluetooth:process { getsched setsched };
Steven Moreland7baf7252018-05-25 16:23:37 -0700108allow system_server hal_omx_server:process { getsched setsched };
Alex Klyubin59322f12017-02-06 15:39:36 -0800109allow system_server cameraserver:process { getsched setsched };
Eino-Ville Talvala6d53c9e2017-02-15 13:38:25 -0800110allow system_server hal_camera:process { getsched setsched };
Alex Klyubin59322f12017-02-06 15:39:36 -0800111allow system_server mediaserver:process { getsched setsched };
112allow system_server bootanim:process { getsched setsched };
113
Jeff Vander Stoep5c41d402017-07-28 16:04:21 -0700114# Allow system_server to write to /proc/<pid>/timerslack_ns
115allow system_server appdomain:file w_file_perms;
116allow system_server audioserver:file w_file_perms;
Max Bires655599a2017-07-18 10:18:35 -0700117allow system_server cameraserver:file w_file_perms;
Mikhail Naganove6293b12018-03-22 12:21:40 -0700118allow system_server hal_audio_server:file w_file_perms;
Steven Moreland7baf7252018-05-25 16:23:37 -0700119allow system_server hal_omx_server:file w_file_perms;
Max Bires655599a2017-07-18 10:18:35 -0700120
Alex Klyubin59322f12017-02-06 15:39:36 -0800121# Read /proc/pid data for all domains. This is used by ProcessCpuTracker
122# within system_server to keep track of memory and CPU usage for
123# all processes on the device. In addition, /proc/pid files access is needed
124# for dumping stack traces of native processes.
125r_dir_file(system_server, domain)
126
Alex Klyubin59322f12017-02-06 15:39:36 -0800127# Write /proc/uid_cputime/remove_uid_range.
128allow system_server proc_uid_cputime_removeuid:file { w_file_perms getattr };
129
130# Write /proc/uid_procstat/set.
131allow system_server proc_uid_procstat_set:file { w_file_perms getattr };
132
133# Write to /proc/sysrq-trigger.
134allow system_server proc_sysrq:file rw_file_perms;
135
yro36dd2a42018-03-29 11:07:13 -0700136# Delete /data/misc/stats-data/ and /data/misc/stats-service/ directories.
137allow system_server stats_data_file:dir { open read remove_name search write };
138allow system_server stats_data_file:file unlink;
139
Alex Klyubin59322f12017-02-06 15:39:36 -0800140# Read /sys/kernel/debug/wakeup_sources.
141allow system_server debugfs:file r_file_perms;
Jeff Vander Stoep72edbb32018-04-27 13:46:34 -0700142auditallow system_server debugfs:file r_file_perms;
Yi Jinbc24ba72018-01-22 14:00:46 -0800143allow system_server debugfs_wakeup_sources:file r_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800144
145# The DhcpClient and WifiWatchdog use packet_sockets
146allow system_server self:packet_socket create_socket_perms_no_ioctl;
147
148# NetworkDiagnostics requires explicit bind() calls to ping sockets. These aren't actually the same
149# as raw sockets, but the kernel doesn't yet distinguish between the two.
150allow system_server node:rawip_socket node_bind;
151
152# 3rd party VPN clients require a tun_socket to be created
153allow system_server self:tun_socket create_socket_perms_no_ioctl;
154
155# Talk to init and various daemons via sockets.
156unix_socket_connect(system_server, lmkd, lmkd)
157unix_socket_connect(system_server, mtpd, mtp)
158unix_socket_connect(system_server, netd, netd)
159unix_socket_connect(system_server, vold, vold)
Alex Klyubin59322f12017-02-06 15:39:36 -0800160unix_socket_connect(system_server, zygote, zygote)
161unix_socket_connect(system_server, racoon, racoon)
Alex Klyubin59322f12017-02-06 15:39:36 -0800162unix_socket_connect(system_server, uncrypt, uncrypt)
163
164# Communicate over a socket created by surfaceflinger.
165allow system_server surfaceflinger:unix_stream_socket { read write setopt };
166
Robert Sesek869562e2018-01-30 10:54:33 -0500167# Communicate over a socket created by webview_zygote.
168allow system_server webview_zygote:unix_stream_socket { read write connectto setopt };
169
Alex Klyubin59322f12017-02-06 15:39:36 -0800170# Perform Binder IPC.
171binder_use(system_server)
172binder_call(system_server, appdomain)
173binder_call(system_server, binderservicedomain)
174binder_call(system_server, dumpstate)
175binder_call(system_server, fingerprintd)
Alex Klyubin59322f12017-02-06 15:39:36 -0800176binder_call(system_server, gatekeeperd)
177binder_call(system_server, installd)
Joe Onorato41f93db2016-11-20 23:23:04 -0800178binder_call(system_server, incidentd)
Alex Klyubin59322f12017-02-06 15:39:36 -0800179binder_call(system_server, netd)
yro29708452017-12-18 15:14:33 -0800180binder_call(system_server, statsd)
Jin Qian81d8b0e2017-10-16 16:39:13 -0700181binder_call(system_server, storaged)
Dan Cashman91d398d2017-09-26 12:58:29 -0700182binder_call(system_server, vold)
Alex Klyubin59322f12017-02-06 15:39:36 -0800183binder_call(system_server, wificond)
Robert Quattlebaumfd03d512017-08-04 14:51:36 -0700184binder_call(system_server, wpantund)
Andreas Gampe986b9af2018-04-30 12:23:20 -0700185userdebug_or_eng(`
186 binder_call(system_server, perfprofd)
187')
Alex Klyubin59322f12017-02-06 15:39:36 -0800188binder_service(system_server)
189
Alex Klyubin53656c12017-04-13 19:05:27 -0700190# Use HALs
Alex Klyubin7cda44f2017-03-21 14:28:53 -0700191hal_client_domain(system_server, hal_allocator)
Andrew Scull64f35fa2018-01-10 16:11:46 +0000192hal_client_domain(system_server, hal_authsecret)
Tomasz Wasilczyk26ff5eb2017-08-07 17:06:06 -0700193hal_client_domain(system_server, hal_broadcastradio)
Dan Cashman91d398d2017-09-26 12:58:29 -0700194hal_client_domain(system_server, hal_configstore)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700195hal_client_domain(system_server, hal_contexthub)
Alex Klyubinf98650e2017-02-21 15:35:16 -0800196hal_client_domain(system_server, hal_fingerprint)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700197hal_client_domain(system_server, hal_gnss)
Alex Klyubin5007c102017-04-17 12:53:40 -0700198hal_client_domain(system_server, hal_graphics_allocator)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700199hal_client_domain(system_server, hal_ir)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700200hal_client_domain(system_server, hal_light)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700201hal_client_domain(system_server, hal_memtrack)
Dan Cashman91d398d2017-09-26 12:58:29 -0700202hal_client_domain(system_server, hal_neuralnetworks)
Andrew Scull0e9b2202017-05-12 15:37:39 +0100203hal_client_domain(system_server, hal_oemlock)
Steven Moreland7baf7252018-05-25 16:23:37 -0700204hal_client_domain(system_server, hal_omx)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700205hal_client_domain(system_server, hal_power)
Alex Klyubin41518be2017-03-13 15:13:52 -0700206hal_client_domain(system_server, hal_sensors)
pkanwarc67fa9b2017-05-21 16:49:37 -0700207hal_client_domain(system_server, hal_tetheroffload)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700208hal_client_domain(system_server, hal_thermal)
Donghyun Chof81dd0c2017-04-05 11:20:48 +0900209hal_client_domain(system_server, hal_tv_cec)
Shubangc76e1582017-03-29 15:03:59 -0700210hal_client_domain(system_server, hal_tv_input)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700211hal_client_domain(system_server, hal_usb)
Badhri Jagan Sridharan7bee33e2018-01-08 09:29:40 -0800212hal_client_domain(system_server, hal_usb_gadget)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700213hal_client_domain(system_server, hal_vibrator)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700214hal_client_domain(system_server, hal_vr)
Andrew Scull3c90eaf2017-05-12 15:58:03 +0100215hal_client_domain(system_server, hal_weaver)
Alex Klyubin1d2a1472017-02-22 15:12:19 -0800216hal_client_domain(system_server, hal_wifi)
Roshan Piusd7b34a42017-12-22 15:03:15 -0800217hal_client_domain(system_server, hal_wifi_hostapd)
Sohani Rao325bf722017-03-01 10:25:44 -0800218hal_client_domain(system_server, hal_wifi_offload)
Roshan Pius2a9595e2017-02-18 21:32:32 -0800219hal_client_domain(system_server, hal_wifi_supplicant)
Alex Klyubin59322f12017-02-06 15:39:36 -0800220
Martijn Coenende2e79c2017-04-14 15:55:20 -0700221# Talk with graphics composer fences
222allow system_server hal_graphics_composer:fd use;
223
Alex Klyubin53656c12017-04-13 19:05:27 -0700224# Use RenderScript always-passthrough HAL
225allow system_server hal_renderscript_hwservice:hwservice_manager find;
226
227# Offer HwBinder services
228add_hwservice(system_server, fwk_scheduler_hwservice)
229add_hwservice(system_server, fwk_sensor_hwservice)
230
Alex Klyubin59322f12017-02-06 15:39:36 -0800231# Talk to tombstoned to get ANR traces.
232unix_socket_connect(system_server, tombstoned_intercept, tombstoned)
233
Chia-I Wue4d21462017-04-20 14:34:00 -0700234# List HAL interfaces to get ANR traces.
235allow system_server hwservicemanager:hwservice_manager list;
236
Alex Klyubin59322f12017-02-06 15:39:36 -0800237# Send signals to trigger ANR traces.
Alex Klyubin59322f12017-02-06 15:39:36 -0800238allow system_server {
Steven Morelandfac31442017-03-24 09:37:17 -0700239 # This is derived from the list that system server defines as interesting native processes
240 # to dump during ANRs or watchdog aborts, defined in NATIVE_STACKS_OF_INTEREST in
241 # frameworks/base/services/core/java/com/android/server/Watchdog.java.
Alex Klyubin59322f12017-02-06 15:39:36 -0800242 audioserver
243 cameraserver
244 drmserver
245 inputflinger
Alex Klyubin59322f12017-02-06 15:39:36 -0800246 mediadrmserver
247 mediaextractor
248 mediaserver
249 mediametrics
250 sdcardd
Andreas Gampe7468db62018-01-24 17:56:25 -0800251 statsd
Alex Klyubin59322f12017-02-06 15:39:36 -0800252 surfaceflinger
Steven Morelandfac31442017-03-24 09:37:17 -0700253
254 # This list comes from HAL_INTERFACES_OF_INTEREST in
255 # frameworks/base/services/core/java/com/android/server/Watchdog.java.
256 hal_audio_server
257 hal_bluetooth_server
258 hal_camera_server
Chia-I Wue4d21462017-04-20 14:34:00 -0700259 hal_graphics_composer_server
Steven Moreland7baf7252018-05-25 16:23:37 -0700260 hal_omx_server
Dan Cashman91d398d2017-09-26 12:58:29 -0700261 hal_sensors_server
Steven Morelandfac31442017-03-24 09:37:17 -0700262 hal_vr_server
Alex Klyubin59322f12017-02-06 15:39:36 -0800263}:process { signal };
264
265# Use sockets received over binder from various services.
266allow system_server audioserver:tcp_socket rw_socket_perms;
267allow system_server audioserver:udp_socket rw_socket_perms;
268allow system_server mediaserver:tcp_socket rw_socket_perms;
269allow system_server mediaserver:udp_socket rw_socket_perms;
270
271# Use sockets received over binder from various services.
272allow system_server mediadrmserver:tcp_socket rw_socket_perms;
273allow system_server mediadrmserver:udp_socket rw_socket_perms;
274
Sandeep Patilc9cf7362017-03-24 15:02:13 -0700275# Get file context
276allow system_server file_contexts_file:file r_file_perms;
Sandeep Patilbb24f3a2017-03-27 12:06:04 -0700277# access for mac_permissions
278allow system_server mac_perms_file: file r_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800279# Check SELinux permissions.
280selinux_check_access(system_server)
281
Tri Voce8bc8b2017-12-19 13:23:11 -0800282allow system_server sysfs_type:dir search;
283
Tri Vo19602152017-10-09 20:39:34 -0700284r_dir_file(system_server, sysfs_android_usb)
285allow system_server sysfs_android_usb:file w_file_perms;
286
287r_dir_file(system_server, sysfs_ipv4)
288allow system_server sysfs_ipv4:file w_file_perms;
289
290r_dir_file(system_server, sysfs_rtc)
291r_dir_file(system_server, sysfs_switch)
292r_dir_file(system_server, sysfs_wakeup_reasons)
293
Alex Klyubin59322f12017-02-06 15:39:36 -0800294allow system_server sysfs_nfc_power_writable:file rw_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800295allow system_server sysfs_mac_address:file r_file_perms;
Max Biresaed69d62017-10-17 12:40:02 -0700296allow system_server sysfs_power:dir search;
Tri Vo19602152017-10-09 20:39:34 -0700297allow system_server sysfs_power:file rw_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800298allow system_server sysfs_thermal:dir search;
299allow system_server sysfs_thermal:file r_file_perms;
300
301# TODO: Remove when HALs are forced into separate processes
302allow system_server sysfs_vibrator:file { write append };
303
304# TODO: added to match above sysfs rule. Remove me?
305allow system_server sysfs_usb:file w_file_perms;
306
307# Access devices.
308allow system_server device:dir r_dir_perms;
309allow system_server mdns_socket:sock_file rw_file_perms;
310allow system_server alarm_device:chr_file rw_file_perms;
311allow system_server gpu_device:chr_file rw_file_perms;
312allow system_server iio_device:chr_file rw_file_perms;
313allow system_server input_device:dir r_dir_perms;
314allow system_server input_device:chr_file rw_file_perms;
315allow system_server radio_device:chr_file r_file_perms;
316allow system_server tty_device:chr_file rw_file_perms;
317allow system_server usbaccessory_device:chr_file rw_file_perms;
318allow system_server video_device:dir r_dir_perms;
319allow system_server video_device:chr_file rw_file_perms;
320allow system_server adbd_socket:sock_file rw_file_perms;
321allow system_server rtc_device:chr_file rw_file_perms;
322allow system_server audio_device:dir r_dir_perms;
323
324# write access needed for MIDI
325allow system_server audio_device:chr_file rw_file_perms;
326
327# tun device used for 3rd party vpn apps
328allow system_server tun_device:chr_file rw_file_perms;
329
330# Manage system data files.
331allow system_server system_data_file:dir create_dir_perms;
332allow system_server system_data_file:notdevfile_class_set create_file_perms;
333allow system_server keychain_data_file:dir create_dir_perms;
334allow system_server keychain_data_file:file create_file_perms;
335allow system_server keychain_data_file:lnk_file create_file_perms;
336
337# Manage /data/app.
338allow system_server apk_data_file:dir create_dir_perms;
339allow system_server apk_data_file:{ file lnk_file } { create_file_perms link };
340allow system_server apk_tmp_file:dir create_dir_perms;
341allow system_server apk_tmp_file:file create_file_perms;
342
Jeff Vander Stoep9e335652018-02-28 08:19:48 -0800343# Access /vendor/{app,framework,overlay}
Sandeep Patil277a20e2017-04-01 17:17:12 -0700344r_dir_file(system_server, vendor_app_file)
Jeff Vander Stoep9e335652018-02-28 08:19:48 -0800345r_dir_file(system_server, vendor_framework_file)
Sandeep Patil90756992017-04-05 16:16:13 -0700346r_dir_file(system_server, vendor_overlay_file)
347
Alex Klyubin59322f12017-02-06 15:39:36 -0800348# Manage /data/app-private.
349allow system_server apk_private_data_file:dir create_dir_perms;
350allow system_server apk_private_data_file:file create_file_perms;
351allow system_server apk_private_tmp_file:dir create_dir_perms;
352allow system_server apk_private_tmp_file:file create_file_perms;
353
354# Manage files within asec containers.
355allow system_server asec_apk_file:dir create_dir_perms;
356allow system_server asec_apk_file:file create_file_perms;
357allow system_server asec_public_file:file create_file_perms;
358
359# Manage /data/anr.
Narayan Kamathf194aad2017-05-15 18:39:16 +0100360#
361# TODO: Some of these permissions can be withdrawn once we've switched to the
362# new stack dumping mechanism, see b/32064548 and the rules below. In particular,
363# the system_server should never need to create a new anr_data_file:file or write
364# to one, but it will still need to read and append to existing files.
Alex Klyubin59322f12017-02-06 15:39:36 -0800365allow system_server anr_data_file:dir create_dir_perms;
366allow system_server anr_data_file:file create_file_perms;
367
Narayan Kamathf194aad2017-05-15 18:39:16 +0100368# New stack dumping scheme : request an output FD from tombstoned via a unix
369# domain socket.
370#
371# Allow system_server to connect and write to the tombstoned java trace socket in
Narayan Kamatha34781a2017-05-30 17:52:46 +0100372# order to dump its traces. Also allow the system server to write its traces to
Kweku Adams985db6d2018-03-12 16:21:40 -0700373# dumpstate during bugreport capture and incidentd during incident collection.
Narayan Kamathf194aad2017-05-15 18:39:16 +0100374unix_socket_connect(system_server, tombstoned_java_trace, tombstoned)
375allow system_server tombstoned:fd use;
Narayan Kamatha34781a2017-05-30 17:52:46 +0100376allow system_server dumpstate:fifo_file append;
Kweku Adams985db6d2018-03-12 16:21:40 -0700377allow system_server incidentd:fifo_file append;
Josh Gao5ca755e2018-07-17 12:46:01 -0700378# Write to a pipe created from `adb shell` (for debuggerd -j `pidof system_server`)
379userdebug_or_eng(`
380 allow system_server su:fifo_file append;
381')
Narayan Kamathf194aad2017-05-15 18:39:16 +0100382
Joe Onorato41f93db2016-11-20 23:23:04 -0800383# Read /data/misc/incidents - only read. The fd will be sent over binder,
384# with no DAC access to it, for dropbox to read.
385allow system_server incident_data_file:file read;
386
Primiano Tucci1a9f4f72018-01-24 16:07:09 +0000387# Allow dropbox to read /data/misc/perfetto-traces. Only the fd is sent over
388# binder.
389allow system_server perfetto_traces_data_file:file read;
390allow system_server perfetto:fd use;
391
Andreas Gampec9df8432018-03-19 13:31:38 -0700392# Allow dropbox to read /data/misc/perfprofd. Only the fd is sent over binder.
393userdebug_or_eng(`
Andreas Gampe835881a2018-05-10 15:07:09 -0700394 allow system_server perfprofd_data_file:file { getattr read };
Andreas Gampec9df8432018-03-19 13:31:38 -0700395 allow system_server perfprofd:fd use;
396')
397
Alex Klyubin59322f12017-02-06 15:39:36 -0800398# Manage /data/backup.
399allow system_server backup_data_file:dir create_dir_perms;
400allow system_server backup_data_file:file create_file_perms;
401
Jeff Vander Stoep4d3ee1a2018-04-16 07:49:49 -0700402# Write to /data/system/dropbox
403allow system_server dropbox_data_file:dir create_dir_perms;
404allow system_server dropbox_data_file:file create_file_perms;
405
Alex Klyubin59322f12017-02-06 15:39:36 -0800406# Write to /data/system/heapdump
407allow system_server heapdump_data_file:dir rw_dir_perms;
408allow system_server heapdump_data_file:file create_file_perms;
409
410# Manage /data/misc/adb.
411allow system_server adb_keys_file:dir create_dir_perms;
412allow system_server adb_keys_file:file create_file_perms;
413
Ricky Waiff3b9572017-12-14 09:56:32 +0000414# Manage /data/misc/network_watchlist
415allow system_server network_watchlist_data_file:dir create_dir_perms;
416allow system_server network_watchlist_data_file:file create_file_perms;
417
Alex Klyubin59322f12017-02-06 15:39:36 -0800418# Manage /data/misc/sms.
419# TODO: Split into a separate type?
420allow system_server radio_data_file:dir create_dir_perms;
421allow system_server radio_data_file:file create_file_perms;
422
423# Manage /data/misc/systemkeys.
424allow system_server systemkeys_data_file:dir create_dir_perms;
425allow system_server systemkeys_data_file:file create_file_perms;
426
Abodunrinwa Tokiadfc5db2017-04-26 21:20:20 +0100427# Manage /data/misc/textclassifier.
428allow system_server textclassifier_data_file:dir create_dir_perms;
429allow system_server textclassifier_data_file:file create_file_perms;
430
Alex Klyubin59322f12017-02-06 15:39:36 -0800431# Access /data/tombstones.
432allow system_server tombstone_data_file:dir r_dir_perms;
433allow system_server tombstone_data_file:file r_file_perms;
434
435# Manage /data/misc/vpn.
436allow system_server vpn_data_file:dir create_dir_perms;
437allow system_server vpn_data_file:file create_file_perms;
438
439# Manage /data/misc/wifi.
440allow system_server wifi_data_file:dir create_dir_perms;
441allow system_server wifi_data_file:file create_file_perms;
442
443# Manage /data/misc/zoneinfo.
444allow system_server zoneinfo_data_file:dir create_dir_perms;
445allow system_server zoneinfo_data_file:file create_file_perms;
446
447# Walk /data/data subdirectories.
448# Types extracted from seapp_contexts type= fields.
Nick Kralevich23c9d912018-08-02 15:54:23 -0700449allow system_server {
450 system_app_data_file
451 bluetooth_data_file
452 nfc_data_file
453 radio_data_file
454 shell_data_file
455 app_data_file
456 privapp_data_file
457}:dir { getattr read search };
458
Alex Klyubin59322f12017-02-06 15:39:36 -0800459# Also permit for unlabeled /data/data subdirectories and
460# for unlabeled asec containers on upgrades from 4.2.
461allow system_server unlabeled:dir r_dir_perms;
462# Read pkg.apk file before it has been relabeled by vold.
463allow system_server unlabeled:file r_file_perms;
464
465# Populate com.android.providers.settings/databases/settings.db.
466allow system_server system_app_data_file:dir create_dir_perms;
467allow system_server system_app_data_file:file create_file_perms;
468
469# Receive and use open app data files passed over binder IPC.
470# Types extracted from seapp_contexts type= fields.
Nick Kralevich23c9d912018-08-02 15:54:23 -0700471allow system_server {
472 system_app_data_file
473 bluetooth_data_file
474 nfc_data_file
475 radio_data_file
476 shell_data_file
477 app_data_file
478 privapp_data_file
479}:file { getattr read write append };
Alex Klyubin59322f12017-02-06 15:39:36 -0800480
481# Access to /data/media for measuring disk usage.
482allow system_server media_rw_data_file:dir { search getattr open read };
483
484# Receive and use open /data/media files passed over binder IPC.
485# Also used for measuring disk usage.
486allow system_server media_rw_data_file:file { getattr read write append };
487
488# Relabel apk files.
489allow system_server { apk_tmp_file apk_private_tmp_file }:{ dir file } { relabelfrom relabelto };
490allow system_server { apk_data_file apk_private_data_file }:{ dir file } { relabelfrom relabelto };
491
492# Relabel wallpaper.
493allow system_server system_data_file:file relabelfrom;
494allow system_server wallpaper_file:file relabelto;
495allow system_server wallpaper_file:file { rw_file_perms rename unlink };
496
497# Backup of wallpaper imagery uses temporary hard links to avoid data churn
498allow system_server { system_data_file wallpaper_file }:file link;
499
500# ShortcutManager icons
501allow system_server system_data_file:dir relabelfrom;
502allow system_server shortcut_manager_icons:dir { create_dir_perms relabelto };
503allow system_server shortcut_manager_icons:file create_file_perms;
504
505# Manage ringtones.
506allow system_server ringtone_file:dir { create_dir_perms relabelto };
507allow system_server ringtone_file:file create_file_perms;
508
509# Relabel icon file.
510allow system_server icon_file:file relabelto;
511allow system_server icon_file:file { rw_file_perms unlink };
512
513# FingerprintService.java does a restorecon of the directory /data/system/users/[0-9]+/fpdata(/.*)?
514allow system_server system_data_file:dir relabelfrom;
515
516# Property Service write
517set_prop(system_server, system_prop)
Jaekyun Seoke4971452017-10-19 16:54:49 +0900518set_prop(system_server, exported_system_prop)
519set_prop(system_server, exported2_system_prop)
520set_prop(system_server, exported3_system_prop)
Alex Klyubin59322f12017-02-06 15:39:36 -0800521set_prop(system_server, safemode_prop)
522set_prop(system_server, dhcp_prop)
523set_prop(system_server, net_radio_prop)
Nick Kralevich4e404292017-02-09 16:08:11 -0800524set_prop(system_server, net_dns_prop)
Alex Klyubin59322f12017-02-06 15:39:36 -0800525set_prop(system_server, system_radio_prop)
Jaekyun Seoke4971452017-10-19 16:54:49 +0900526set_prop(system_server, exported_system_radio_prop)
Alex Klyubin59322f12017-02-06 15:39:36 -0800527set_prop(system_server, debug_prop)
528set_prop(system_server, powerctl_prop)
529set_prop(system_server, fingerprint_prop)
Jaekyun Seokf9d27882018-01-12 10:19:48 +0900530set_prop(system_server, exported_fingerprint_prop)
Alex Klyubin59322f12017-02-06 15:39:36 -0800531set_prop(system_server, device_logging_prop)
Alex Klyubin59322f12017-02-06 15:39:36 -0800532set_prop(system_server, dumpstate_options_prop)
533set_prop(system_server, overlay_prop)
Jaekyun Seoke4971452017-10-19 16:54:49 +0900534set_prop(system_server, exported_overlay_prop)
Victor Hsiehd1cf3a42017-11-07 13:21:22 -0800535set_prop(system_server, pm_prop)
Jaekyun Seoke4971452017-10-19 16:54:49 +0900536set_prop(system_server, exported_pm_prop)
Alex Klyubin59322f12017-02-06 15:39:36 -0800537userdebug_or_eng(`set_prop(system_server, wifi_log_prop)')
538
539# ctl interface
540set_prop(system_server, ctl_default_prop)
541set_prop(system_server, ctl_bugreport_prop)
542
543# cppreopt property
544set_prop(system_server, cppreopt_prop)
545
Mark Salyzyn006c2e92017-08-14 14:25:10 -0700546# BootReceiver to read ro.boot.bootreason
547get_prop(system_server, bootloader_boot_reason_prop)
Mark Salyzyna1bce772018-06-05 09:41:59 -0700548# PowerManager to read sys.boot.reason
549get_prop(system_server, system_boot_reason_prop)
Mark Salyzyn006c2e92017-08-14 14:25:10 -0700550
Alex Klyubin59322f12017-02-06 15:39:36 -0800551# Collect metrics on boot time created by init
552get_prop(system_server, boottime_prop)
553
554# Read device's serial number from system properties
555get_prop(system_server, serialno_prop)
556
557# Read/write the property which keeps track of whether this is the first start of system_server
558set_prop(system_server, firstboot_prop)
559
Eino-Ville Talvala3ac71f82018-06-20 14:08:02 -0700560# Audio service in system server can read exported audio properties,
561# such as camera shutter enforcement
562get_prop(system_server, exported_audio_prop)
563
Alex Klyubin59322f12017-02-06 15:39:36 -0800564# Create a socket for connections from debuggerd.
565allow system_server system_ndebug_socket:sock_file create_file_perms;
566
567# Manage cache files.
Jeff Vander Stoepa4cada72017-07-26 09:54:36 -0700568allow system_server cache_file:lnk_file r_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800569allow system_server { cache_file cache_recovery_file }:dir { relabelfrom create_dir_perms };
570allow system_server { cache_file cache_recovery_file }:file { relabelfrom create_file_perms };
571allow system_server { cache_file cache_recovery_file }:fifo_file create_file_perms;
572
573allow system_server system_file:dir r_dir_perms;
574allow system_server system_file:lnk_file r_file_perms;
575
576# LocationManager(e.g, GPS) needs to read and write
577# to uart driver and ctrl proc entry
578allow system_server gps_control:file rw_file_perms;
579
580# Allow system_server to use app-created sockets and pipes.
581allow system_server appdomain:{ tcp_socket udp_socket } { getattr getopt setopt read write shutdown };
582allow system_server appdomain:{ fifo_file unix_stream_socket } { getattr read write };
583
Alex Klyubin59322f12017-02-06 15:39:36 -0800584# BackupManagerService needs to manipulate backup data files
585allow system_server cache_backup_file:dir rw_dir_perms;
586allow system_server cache_backup_file:file create_file_perms;
587# LocalTransport works inside /cache/backup
588allow system_server cache_private_backup_file:dir create_dir_perms;
589allow system_server cache_private_backup_file:file create_file_perms;
590
591# Allow system to talk to usb device
592allow system_server usb_device:chr_file rw_file_perms;
593allow system_server usb_device:dir r_dir_perms;
594
Alex Klyubin59322f12017-02-06 15:39:36 -0800595# Read from HW RNG (needed by EntropyMixer).
596allow system_server hw_random_device:chr_file r_file_perms;
597
598# Read and delete files under /dev/fscklogs.
599r_dir_file(system_server, fscklogs)
600allow system_server fscklogs:dir { write remove_name };
601allow system_server fscklogs:file unlink;
602
603# logd access, system_server inherit logd write socket
604# (urge is to deprecate this long term)
605allow system_server zygote:unix_dgram_socket write;
606
607# Read from log daemon.
608read_logd(system_server)
609read_runtime_log_tags(system_server)
610
611# Be consistent with DAC permissions. Allow system_server to write to
612# /sys/module/lowmemorykiller/parameters/adj
613# /sys/module/lowmemorykiller/parameters/minfree
614allow system_server sysfs_lowmemorykiller:file { getattr w_file_perms };
615
616# Read /sys/fs/pstore/console-ramoops
617# Don't worry about overly broad permissions for now, as there's
618# only one file in /sys/fs/pstore
619allow system_server pstorefs:dir r_dir_perms;
620allow system_server pstorefs:file r_file_perms;
621
622# /sys access
623allow system_server sysfs_zram:dir search;
624allow system_server sysfs_zram:file r_file_perms;
625
626add_service(system_server, system_server_service);
627allow system_server audioserver_service:service_manager find;
628allow system_server batteryproperties_service:service_manager find;
629allow system_server cameraserver_service:service_manager find;
630allow system_server drmserver_service:service_manager find;
631allow system_server dumpstate_service:service_manager find;
632allow system_server fingerprintd_service:service_manager find;
633allow system_server hal_fingerprint_service:service_manager find;
634allow system_server gatekeeper_service:service_manager find;
Joe Onorato41f93db2016-11-20 23:23:04 -0800635allow system_server incident_service:service_manager find;
Alex Klyubin59322f12017-02-06 15:39:36 -0800636allow system_server installd_service:service_manager find;
637allow system_server keystore_service:service_manager find;
638allow system_server mediaserver_service:service_manager find;
639allow system_server mediametrics_service:service_manager find;
640allow system_server mediaextractor_service:service_manager find;
641allow system_server mediacodec_service:service_manager find;
642allow system_server mediadrmserver_service:service_manager find;
643allow system_server netd_service:service_manager find;
644allow system_server nfc_service:service_manager find;
645allow system_server radio_service:service_manager find;
yro29708452017-12-18 15:14:33 -0800646allow system_server stats_service:service_manager find;
Jin Qian81d8b0e2017-10-16 16:39:13 -0700647allow system_server storaged_service:service_manager find;
Alex Klyubin59322f12017-02-06 15:39:36 -0800648allow system_server surfaceflinger_service:service_manager find;
Dan Cashman91d398d2017-09-26 12:58:29 -0700649allow system_server vold_service:service_manager find;
Alex Klyubin59322f12017-02-06 15:39:36 -0800650allow system_server wificond_service:service_manager find;
Andreas Gampe986b9af2018-04-30 12:23:20 -0700651userdebug_or_eng(`
652 allow system_server perfprofd_service:service_manager find;
653')
Alex Klyubin59322f12017-02-06 15:39:36 -0800654
655allow system_server keystore:keystore_key {
656 get_state
657 get
658 insert
659 delete
660 exist
661 list
662 reset
663 password
664 lock
665 unlock
666 is_empty
667 sign
668 verify
669 grant
670 duplicate
671 clear_uid
672 add_auth
673 user_changed
674};
675
676# Allow system server to search and write to the persistent factory reset
677# protection partition. This block device does not get wiped in a factory reset.
678allow system_server block_device:dir search;
679allow system_server frp_block_device:blk_file rw_file_perms;
680
681# Clean up old cgroups
682allow system_server cgroup:dir { remove_name rmdir };
683
684# /oem access
685r_dir_file(system_server, oemfs)
686
687# Allow resolving per-user storage symlinks
688allow system_server { mnt_user_file storage_file }:dir { getattr search };
689allow system_server { mnt_user_file storage_file }:lnk_file { getattr read };
690
691# Allow statfs() on storage devices, which happens fast enough that
692# we shouldn't be killed during unsafe removal
693allow system_server sdcard_type:dir { getattr search };
694
695# Traverse into expanded storage
696allow system_server mnt_expand_file:dir r_dir_perms;
697
698# Allow system process to relabel the fingerprint directory after mkdir
699# and delete the directory and files when no longer needed
700allow system_server fingerprintd_data_file:dir { r_dir_perms remove_name rmdir relabelto write };
701allow system_server fingerprintd_data_file:file { getattr unlink };
702
703# Allow system process to read network MAC address
704allow system_server sysfs_mac_address:file r_file_perms;
705
706userdebug_or_eng(`
707 # Allow system server to create and write method traces in /data/misc/trace.
708 allow system_server method_trace_data_file:dir w_dir_perms;
709 allow system_server method_trace_data_file:file { create w_file_perms };
710
711 # Allow system server to read dmesg
712 allow system_server kernel:system syslog_read;
Vishnu Nair2d6942d2017-11-17 08:23:32 -0800713
Vishnu Nairdf8d4b82017-11-20 15:21:56 -0800714 # Allow writing and removing window traces in /data/misc/wmtrace.
Vishnu Nair2d6942d2017-11-17 08:23:32 -0800715 allow system_server wm_trace_data_file:dir rw_dir_perms;
Vishnu Nairdf8d4b82017-11-20 15:21:56 -0800716 allow system_server wm_trace_data_file:file { getattr setattr create unlink w_file_perms };
Alex Klyubin59322f12017-02-06 15:39:36 -0800717')
718
719# For AppFuse.
720allow system_server vold:fd use;
721allow system_server fuse_device:chr_file { read write ioctl getattr };
722allow system_server app_fuse_file:dir rw_dir_perms;
723allow system_server app_fuse_file:file { read write open getattr append };
724
725# For configuring sdcardfs
726allow system_server configfs:dir { create_dir_perms };
Niklas Brunlid8e0086a2017-12-01 11:18:31 +0100727allow system_server configfs:file { getattr open create unlink write };
Alex Klyubin59322f12017-02-06 15:39:36 -0800728
729# Connect to adbd and use a socket transferred from it.
730# Used for e.g. jdwp.
731allow system_server adbd:unix_stream_socket connectto;
732allow system_server adbd:fd use;
733allow system_server adbd:unix_stream_socket { getattr getopt ioctl read write shutdown };
734
735# Allow invoking tools like "timeout"
736allow system_server toolbox_exec:file rx_file_perms;
737
738# Postinstall
739#
740# For OTA dexopt, allow calls coming from postinstall.
741binder_call(system_server, postinstall)
742
743allow system_server postinstall:fifo_file write;
744allow system_server update_engine:fd use;
745allow system_server update_engine:fifo_file write;
746
747# Access to /data/preloads
748allow system_server preloads_data_file:file { r_file_perms unlink };
749allow system_server preloads_data_file:dir { r_dir_perms write remove_name rmdir };
Fyodor Kupolovb238fe62017-03-14 11:42:03 -0700750allow system_server preloads_media_file:file { r_file_perms unlink };
751allow system_server preloads_media_file:dir { r_dir_perms write remove_name rmdir };
Alex Klyubin59322f12017-02-06 15:39:36 -0800752
753r_dir_file(system_server, cgroup)
754allow system_server ion_device:chr_file r_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800755
Tri Vo464f59a2017-10-06 10:20:53 -0700756r_dir_file(system_server, proc_asound)
Jeff Vander Stoep7a4af302018-04-10 12:47:48 -0700757r_dir_file(system_server, proc_net_type)
Jeff Vander Stoep43303c82018-01-02 13:10:46 -0800758r_dir_file(system_server, proc_qtaguid_stat)
Tri Voe7f49342017-11-14 16:32:36 -0800759allow system_server {
760 proc_loadavg
761 proc_meminfo
762 proc_pagetypeinfo
763 proc_pipe_conf
764 proc_stat
765 proc_uid_cputime_showstat
766 proc_uid_time_in_state
Marissa Wall80ee23f2017-11-10 14:10:19 -0800767 proc_uid_concurrent_active_time
768 proc_uid_concurrent_policy_time
Tri Voe7f49342017-11-14 16:32:36 -0800769 proc_version
770 proc_vmallocinfo
771}:file r_file_perms;
772
Connor O'Brienac3c61e2017-11-17 15:40:51 -0800773allow system_server proc_uid_time_in_state:dir r_dir_perms;
Marissa Walldfe063c2018-01-19 13:48:31 -0800774allow system_server proc_uid_cpupower:file r_file_perms;
Connor O'Brienac3c61e2017-11-17 15:40:51 -0800775
Alex Klyubin59322f12017-02-06 15:39:36 -0800776r_dir_file(system_server, rootfs)
Alex Klyubin59322f12017-02-06 15:39:36 -0800777
mukesh agrawal723364f2017-02-22 18:01:00 -0800778# Allow WifiService to start, stop, and read wifi-specific trace events.
779allow system_server debugfs_tracing_instances:dir search;
Joel Galenson27c0aa72017-07-26 16:22:50 -0700780allow system_server debugfs_wifi_tracing:dir search;
mukesh agrawal723364f2017-02-22 18:01:00 -0800781allow system_server debugfs_wifi_tracing:file rw_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800782
Dan Cashman91d398d2017-09-26 12:58:29 -0700783# allow system_server to exec shell, asanwrapper & zygote(app_process) on ASAN builds. Needed to run
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700784# asanwrapper.
785with_asan(`
786 allow system_server shell_exec:file rx_file_perms;
Dan Cashman91d398d2017-09-26 12:58:29 -0700787 allow system_server asanwrapper_exec:file rx_file_perms;
788 allow system_server zygote_exec:file rx_file_perms;
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700789')
790
Chenbo Feng756dd572017-11-21 10:53:01 -0800791# allow system_server to read the eBPF maps that stores the traffic stats information amd clean up
792# the map after snapshot is recorded
Chenbo Fengf83bbd12018-03-23 16:01:10 -0700793allow system_server fs_bpf:dir search;
Chenbo Fengbfa95fc2018-03-05 20:43:45 -0800794allow system_server fs_bpf:file read;
795allow system_server netd:bpf map_read;
Chenbo Feng756dd572017-11-21 10:53:01 -0800796
Calin Juravle15da30b2017-11-22 00:09:25 -0800797# ART Profiles.
798# Allow system_server to open profile snapshots for read.
799# System server never reads the actual content. It passes the descriptor to
800# to privileged apps which acquire the permissions to inspect the profiles.
Calin Juravle71d84672018-05-03 20:14:51 -0700801allow system_server user_profile_data_file:dir { getattr search };
Calin Juravleacbda502017-11-29 18:35:04 -0800802allow system_server user_profile_data_file:file { getattr open read };
Calin Juravle15da30b2017-11-22 00:09:25 -0800803
Calin Juravle6ff0f492018-05-04 17:44:33 -0700804# System server may dump profile data for debuggable apps in the /data/misc/profman.
805# As such it needs to be able create files but it should never read from them.
806allow system_server profman_dump_data_file:file { create getattr setattr w_file_perms};
807allow system_server profman_dump_data_file:dir w_dir_perms;
808
Calin Juravle71d84672018-05-03 20:14:51 -0700809# On userdebug build we may profile system server. Allow it to write and create its own profile.
810userdebug_or_eng(`
811 allow system_server user_profile_data_file:file create_file_perms;
812')
813
Dongwon Kang1134bd02017-11-06 11:19:07 -0800814userdebug_or_eng(`
815 # Allow system server to notify mediaextractor of the plugin update.
816 allow system_server mediaextractor_update_service:service_manager find;
817')
818
Jerry Zhang1d401542017-12-06 16:13:59 -0800819# UsbDeviceManager uses /dev/usb-ffs
820allow system_server functionfs:dir search;
821allow system_server functionfs:file rw_file_perms;
822
Neil Fullerb794ad02018-06-25 15:36:51 +0100823# system_server contains time / time zone detection logic so reads the associated properties.
824get_prop(system_server, time_prop)
825
Alex Klyubin59322f12017-02-06 15:39:36 -0800826###
827### Neverallow rules
828###
829### system_server should NEVER do any of this
830
831# Do not allow opening files from external storage as unsafe ejection
832# could cause the kernel to kill the system_server.
833neverallow system_server sdcard_type:dir { open read write };
834neverallow system_server sdcard_type:file rw_file_perms;
835
836# system server should never be operating on zygote spawned app data
837# files directly. Rather, they should always be passed via a
838# file descriptor.
839# Types extracted from seapp_contexts type= fields, excluding
840# those types that system_server needs to open directly.
Nick Kralevich23c9d912018-08-02 15:54:23 -0700841neverallow system_server {
842 bluetooth_data_file
843 nfc_data_file
844 shell_data_file
845 app_data_file
846 privapp_data_file
847}:file { open create unlink link };
Alex Klyubin59322f12017-02-06 15:39:36 -0800848
849# Forking and execing is inherently dangerous and racy. See, for
850# example, https://www.linuxprogrammingblog.com/threads-and-fork-think-twice-before-using-them
851# Prevent the addition of new file execs to stop the problem from
852# getting worse. b/28035297
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700853neverallow system_server {
854 file_type
855 -toolbox_exec
856 -logcat_exec
Dan Cashman91d398d2017-09-26 12:58:29 -0700857 with_asan(`-shell_exec -asanwrapper_exec -zygote_exec')
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700858}:file execute_no_trans;
Alex Klyubin59322f12017-02-06 15:39:36 -0800859
860# Ensure that system_server doesn't perform any domain transitions other than
861# transitioning to the crash_dump domain when a crash occurs.
862neverallow system_server { domain -crash_dump }:process transition;
863neverallow system_server *:process dyntransition;
864
865# Only allow crash_dump to connect to system_ndebug_socket.
866neverallow { domain -init -system_server -crash_dump } system_ndebug_socket:sock_file { open write };
867
868# system_server should never be executing dex2oat. This is either
869# a bug (for example, bug 16317188), or represents an attempt by
870# system server to dynamically load a dex file, something we do not
871# want to allow.
872neverallow system_server dex2oat_exec:file no_x_file_perms;
873
874# system_server should never execute or load executable shared libraries
Nick Kralevich2ec15e52017-10-20 13:27:26 -0700875# in /data
876neverallow system_server data_file_type:file no_x_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800877
878# The only block device system_server should be accessing is
879# the frp_block_device. This helps avoid a system_server to root
880# escalation by writing to raw block devices.
881neverallow system_server { dev_type -frp_block_device }:blk_file no_rw_file_perms;
882
883# system_server should never use JIT functionality
884neverallow system_server self:process execmem;
885neverallow system_server ashmem_device:chr_file execute;
886
dcashman2e00e632016-10-12 14:58:09 -0700887# TODO: deal with tmpfs_domain pub/priv split properly
Nick Kralevichb56e6ef2016-12-09 20:14:31 -0800888neverallow system_server system_server_tmpfs:file execute;
Calin Juravlee5a1f642017-01-17 20:31:31 -0800889
890# dexoptanalyzer is currently used only for secondary dex files which
891# system_server should never access.
892neverallow system_server dexoptanalyzer_exec:file no_x_file_perms;
Nick Kralevich44866952017-02-15 15:04:43 -0800893
894# No ptracing others
895neverallow system_server { domain -system_server }:process ptrace;
896
897# CAP_SYS_RESOURCE was traditionally needed for sensitive /proc/PID
898# file read access. However, that is now unnecessary (b/34951864)
Nick Kralevichdf642be2017-11-22 09:59:08 -0800899neverallow system_server system_server:global_capability_class_set sys_resource;