blob: cd1591009aa0ecf758c421efca0a6d130efa134a [file] [log] [blame]
Jeff Vander Stoepf9be7652017-03-13 13:32:51 -07001# only HALs responsible for network hardware should have privileged
2# network capabilities
3neverallow {
4 halserverdomain
5 -hal_bluetooth_server
Tomasz Wasilczyk602b3032019-07-23 17:38:51 -07006 -hal_can_controller_server
Jeff Vander Stoepf9be7652017-03-13 13:32:51 -07007 -hal_wifi_server
Roshan Piusd7b34a42017-12-22 15:03:15 -08008 -hal_wifi_hostapd_server
Jeff Vander Stoepf9be7652017-03-13 13:32:51 -07009 -hal_wifi_supplicant_server
Amit Mahajan30073442018-03-12 17:12:09 +000010 -hal_telephony_server
Roshan Pius329b0c82021-10-27 12:41:38 -070011 -hal_uwb_server
12 # TODO(b/196225233): Remove hal_uwb_vendor_server
Roshan Pius37ee61f2021-08-24 13:59:07 -070013 -hal_uwb_vendor_server
Benjamin Gordon9b2e0cb2017-11-09 15:51:26 -070014} self:global_capability_class_set { net_admin net_raw };
Jeff Vander Stoepf9be7652017-03-13 13:32:51 -070015
Jeff Vander Stoepd75a2c02017-06-21 12:46:21 -070016# Unless a HAL's job is to communicate over the network, or control network
17# hardware, it should not be using network sockets.
Pavel Maltsev8d7f5032018-05-15 14:16:57 -070018# NOTE: HALs for automotive devices have an exemption from this rule because in
19# a car it is common to have external modules and HALs need to communicate to
20# those modules using network. Using this exemption for non-automotive builds
21# will result in CTS failure.
Jeff Vander Stoepf9be7652017-03-13 13:32:51 -070022neverallow {
23 halserverdomain
Pavel Maltsev8d7f5032018-05-15 14:16:57 -070024 -hal_automotive_socket_exemption
Tomasz Wasilczyk602b3032019-07-23 17:38:51 -070025 -hal_can_controller_server
Jeff Vander Stoepd75a2c02017-06-21 12:46:21 -070026 -hal_tetheroffload_server
Jeff Vander Stoepf9be7652017-03-13 13:32:51 -070027 -hal_wifi_server
Roshan Piusd7b34a42017-12-22 15:03:15 -080028 -hal_wifi_hostapd_server
Jeff Vander Stoepf9be7652017-03-13 13:32:51 -070029 -hal_wifi_supplicant_server
Amit Mahajan30073442018-03-12 17:12:09 +000030 -hal_telephony_server
Roshan Pius329b0c82021-10-27 12:41:38 -070031 -hal_uwb_server
32 # TODO(b/196225233): Remove hal_uwb_vendor_server
Roshan Pius37ee61f2021-08-24 13:59:07 -070033 -hal_uwb_vendor_server
Yifan Hongbe04b092021-06-07 12:37:31 -070034} domain:{ udp_socket rawip_socket } *;
35
36neverallow {
37 halserverdomain
38 -hal_automotive_socket_exemption
39 -hal_can_controller_server
40 -hal_tetheroffload_server
41 -hal_wifi_server
42 -hal_wifi_hostapd_server
43 -hal_wifi_supplicant_server
44 -hal_telephony_server
45} {
46 domain
47 userdebug_or_eng(`-su')
48}:tcp_socket *;
Jeff Vander Stoep84b96a62017-03-20 14:52:58 -070049
Michael Ayoubic3af6622021-06-24 02:02:07 +000050# The UWB HAL is not actually a networking HAL but may need to bring up and down
51# interfaces. Restrict it to only these networking operations.
Roshan Pius37ee61f2021-08-24 13:59:07 -070052neverallow hal_uwb_vendor_server self:global_capability_class_set { net_raw };
Michael Ayoubic3af6622021-06-24 02:02:07 +000053
54# Subset of socket_class_set likely to be usable for communication or accessible through net_admin.
55# udp_socket is required to use interface ioctls.
Roshan Pius37ee61f2021-08-24 13:59:07 -070056neverallow hal_uwb_vendor_server domain:{ socket rawip_socket netlink_socket packet_socket key_socket netlink_route_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_selinux_socket netlink_audit_socket netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket netlink_scsitransport_socket netlink_rdma_socket netlink_crypto_socket qipcrtr_socket xdp_socket } *;
Michael Ayoubic3af6622021-06-24 02:02:07 +000057
Jeff Vander Stoep84b96a62017-03-20 14:52:58 -070058###
59# HALs are defined as an attribute and so a given domain could hypothetically
60# have multiple HALs in it (or even all of them) with the subsequent policy of
61# the domain comprised of the union of all the HALs.
62#
63# This is a problem because
64# 1) Security sensitive components should only be accessed by specific HALs.
65# 2) hwbinder_call and the restrictions it provides cannot be reasoned about in
66# the platform.
67# 3) The platform cannot reason about defense in depth if there are
68# monolithic domains etc.
69#
70# As an example, hal_keymaster and hal_gatekeeper can access the TEE and while
71# its OK for them to share a process its not OK with them to share processes
72# with other hals.
73#
74# The following neverallow rules, in conjuntion with CTS tests, assert that
75# these security principles are adhered to.
76#
77# Do not allow a hal to exec another process without a domain transition.
78# TODO remove exemptions.
79neverallow {
80 halserverdomain
81 -hal_dumpstate_server
Amit Mahajan30073442018-03-12 17:12:09 +000082 -hal_telephony_server
Jeff Vander Stoep84b96a62017-03-20 14:52:58 -070083} { file_type fs_type }:file execute_no_trans;
84# Do not allow a process other than init to transition into a HAL domain.
85neverallow { domain -init } halserverdomain:process transition;
86# Only allow transitioning to a domain by running its executable. Do not
87# allow transitioning into a HAL domain by use of seclabel in an
88# init.*.rc script.
89neverallow * halserverdomain:process dyntransition;