blob: 6537233cdb6bdc259053c01a3ffcb338e3d724d6 [file] [log] [blame]
Alex Klyubin59322f12017-02-06 15:39:36 -08001#
2# System Server aka system_server spawned by zygote.
3# Most of the framework services run in this process.
4#
5
Alex Klyubinf5446eb2017-03-23 14:27:32 -07006typeattribute system_server coredomain;
Alex Klyubin59322f12017-02-06 15:39:36 -08007typeattribute system_server domain_deprecated;
8typeattribute system_server mlstrustedsubject;
9
dcashmancc39f632016-07-22 13:13:11 -070010# Define a type for tmpfs-backed ashmem regions.
11tmpfs_domain(system_server)
Alex Klyubin59322f12017-02-06 15:39:36 -080012
Josh Gaocb3eb4e2016-10-19 14:39:30 -070013# Create a socket for connections from crash_dump.
dcashmancc39f632016-07-22 13:13:11 -070014type_transition system_server system_data_file:sock_file system_ndebug_socket "ndebugsocket";
dcashman2e00e632016-10-12 14:58:09 -070015
16allow system_server zygote_tmpfs:file read;
17
Alex Klyubin59322f12017-02-06 15:39:36 -080018# For art.
19allow system_server dalvikcache_data_file:dir r_dir_perms;
20allow system_server dalvikcache_data_file:file { r_file_perms execute };
Jorge Lucangeli Obes62a1b232017-04-11 10:34:23 -040021userdebug_or_eng(`
22 # Report dalvikcache_data_file:file execute violations.
23 auditallow system_server dalvikcache_data_file:file execute;
24')
Alex Klyubin59322f12017-02-06 15:39:36 -080025
Alex Klyubin59322f12017-02-06 15:39:36 -080026# /data/resource-cache
27allow system_server resourcecache_data_file:file r_file_perms;
28allow system_server resourcecache_data_file:dir r_dir_perms;
29
30# ptrace to processes in the same domain for debugging crashes.
31allow system_server self:process ptrace;
32
Salvador Martinezf306d372017-04-11 10:34:16 -070033# Read and delete last_reboot_reason file
34allow system_server reboot_data_file:file { rename r_file_perms unlink };
35allow system_server reboot_data_file:dir { write search open remove_name };
36
Alex Klyubin59322f12017-02-06 15:39:36 -080037# Child of the zygote.
38allow system_server zygote:fd use;
39allow system_server zygote:process sigchld;
40
41# May kill zygote on crashes.
42allow system_server zygote:process sigkill;
43allow system_server crash_dump:process sigkill;
44
45# Read /system/bin/app_process.
46allow system_server zygote_exec:file r_file_perms;
47
48# Needed to close the zygote socket, which involves getopt / getattr
49allow system_server zygote:unix_stream_socket { getopt getattr };
50
51# system server gets network and bluetooth permissions.
52net_domain(system_server)
53# in addition to ioctls whitelisted for all domains, also allow system_server
54# to use privileged ioctls commands. Needed to set up VPNs.
55allowxperm system_server self:udp_socket ioctl priv_sock_ioctls;
56bluetooth_domain(system_server)
57
58# These are the capabilities assigned by the zygote to the
59# system server.
60allow system_server self:capability {
61 ipc_lock
62 kill
63 net_admin
64 net_bind_service
65 net_broadcast
66 net_raw
67 sys_boot
68 sys_nice
Nick Kralevich44866952017-02-15 15:04:43 -080069 sys_ptrace
Alex Klyubin59322f12017-02-06 15:39:36 -080070 sys_time
71 sys_tty_config
72};
73
74wakelock_use(system_server)
75
Alex Klyubin59322f12017-02-06 15:39:36 -080076# Trigger module auto-load.
77allow system_server kernel:system module_request;
78
79# Allow alarmtimers to be set
80allow system_server self:capability2 wake_alarm;
81
82# Use netlink uevent sockets.
83allow system_server self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
84
85# Use generic netlink sockets.
86allow system_server self:netlink_socket create_socket_perms_no_ioctl;
87allow system_server self:netlink_generic_socket create_socket_perms_no_ioctl;
88
89# Use generic "sockets" where the address family is not known
90# to the kernel. The ioctl permission is specifically omitted here, but may
91# be added to device specific policy along with the ioctl commands to be
92# whitelisted.
93allow system_server self:socket create_socket_perms_no_ioctl;
94
95# Set and get routes directly via netlink.
96allow system_server self:netlink_route_socket nlmsg_write;
97
98# Kill apps.
99allow system_server appdomain:process { sigkill signal };
100
101# Set scheduling info for apps.
102allow system_server appdomain:process { getsched setsched };
103allow system_server audioserver:process { getsched setsched };
104allow system_server hal_audio:process { getsched setsched };
Philip Cuadra3c46d2f2017-03-23 10:03:49 -0700105allow system_server hal_bluetooth:process { getsched setsched };
Alex Klyubin59322f12017-02-06 15:39:36 -0800106allow system_server cameraserver:process { getsched setsched };
Eino-Ville Talvala6d53c9e2017-02-15 13:38:25 -0800107allow system_server hal_camera:process { getsched setsched };
Alex Klyubin59322f12017-02-06 15:39:36 -0800108allow system_server mediaserver:process { getsched setsched };
109allow system_server bootanim:process { getsched setsched };
110
111# Read /proc/pid data for all domains. This is used by ProcessCpuTracker
112# within system_server to keep track of memory and CPU usage for
113# all processes on the device. In addition, /proc/pid files access is needed
114# for dumping stack traces of native processes.
115r_dir_file(system_server, domain)
116
117# Read/Write to /proc/net/xt_qtaguid/ctrl and and /dev/xt_qtaguid.
118allow system_server qtaguid_proc:file rw_file_perms;
119allow system_server qtaguid_device:chr_file rw_file_perms;
120
121# Read /proc/uid_cputime/show_uid_stat.
122allow system_server proc_uid_cputime_showstat:file r_file_perms;
123
124# Write /proc/uid_cputime/remove_uid_range.
125allow system_server proc_uid_cputime_removeuid:file { w_file_perms getattr };
126
127# Write /proc/uid_procstat/set.
128allow system_server proc_uid_procstat_set:file { w_file_perms getattr };
129
130# Write to /proc/sysrq-trigger.
131allow system_server proc_sysrq:file rw_file_perms;
132
133# Read /proc/stat for CPU usage statistics
134allow system_server proc_stat:file r_file_perms;
135
136# Read /sys/kernel/debug/wakeup_sources.
137allow system_server debugfs:file r_file_perms;
138
139# The DhcpClient and WifiWatchdog use packet_sockets
140allow system_server self:packet_socket create_socket_perms_no_ioctl;
141
142# NetworkDiagnostics requires explicit bind() calls to ping sockets. These aren't actually the same
143# as raw sockets, but the kernel doesn't yet distinguish between the two.
144allow system_server node:rawip_socket node_bind;
145
146# 3rd party VPN clients require a tun_socket to be created
147allow system_server self:tun_socket create_socket_perms_no_ioctl;
148
149# Talk to init and various daemons via sockets.
150unix_socket_connect(system_server, lmkd, lmkd)
151unix_socket_connect(system_server, mtpd, mtp)
152unix_socket_connect(system_server, netd, netd)
153unix_socket_connect(system_server, vold, vold)
154unix_socket_connect(system_server, webview_zygote, webview_zygote)
155unix_socket_connect(system_server, zygote, zygote)
156unix_socket_connect(system_server, racoon, racoon)
Alex Klyubin59322f12017-02-06 15:39:36 -0800157unix_socket_connect(system_server, uncrypt, uncrypt)
158
159# Communicate over a socket created by surfaceflinger.
160allow system_server surfaceflinger:unix_stream_socket { read write setopt };
161
162# Perform Binder IPC.
163binder_use(system_server)
164binder_call(system_server, appdomain)
165binder_call(system_server, binderservicedomain)
166binder_call(system_server, dumpstate)
167binder_call(system_server, fingerprintd)
Alex Klyubin59322f12017-02-06 15:39:36 -0800168binder_call(system_server, gatekeeperd)
169binder_call(system_server, installd)
Joe Onorato41f93db2016-11-20 23:23:04 -0800170binder_call(system_server, incidentd)
Alex Klyubin59322f12017-02-06 15:39:36 -0800171binder_call(system_server, netd)
172binder_call(system_server, wificond)
173binder_service(system_server)
174
Alex Klyubin53656c12017-04-13 19:05:27 -0700175# Use HALs
Alex Klyubin7cda44f2017-03-21 14:28:53 -0700176hal_client_domain(system_server, hal_allocator)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700177hal_client_domain(system_server, hal_contexthub)
Alex Klyubinf98650e2017-02-21 15:35:16 -0800178hal_client_domain(system_server, hal_fingerprint)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700179hal_client_domain(system_server, hal_gnss)
Alex Klyubin5007c102017-04-17 12:53:40 -0700180hal_client_domain(system_server, hal_graphics_allocator)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700181hal_client_domain(system_server, hal_ir)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700182hal_client_domain(system_server, hal_light)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700183hal_client_domain(system_server, hal_memtrack)
Andrew Scull0e9b2202017-05-12 15:37:39 +0100184hal_client_domain(system_server, hal_oemlock)
Alex Klyubin53656c12017-04-13 19:05:27 -0700185allow system_server hal_omx_hwservice:hwservice_manager find;
186allow system_server hidl_token_hwservice:hwservice_manager find;
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700187hal_client_domain(system_server, hal_power)
Alex Klyubin41518be2017-03-13 15:13:52 -0700188hal_client_domain(system_server, hal_sensors)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700189hal_client_domain(system_server, hal_thermal)
Donghyun Chof81dd0c2017-04-05 11:20:48 +0900190hal_client_domain(system_server, hal_tv_cec)
Shubangc76e1582017-03-29 15:03:59 -0700191hal_client_domain(system_server, hal_tv_input)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700192hal_client_domain(system_server, hal_usb)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700193hal_client_domain(system_server, hal_vibrator)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700194hal_client_domain(system_server, hal_vr)
Alex Klyubin1d2a1472017-02-22 15:12:19 -0800195hal_client_domain(system_server, hal_wifi)
Roshan Pius2a9595e2017-02-18 21:32:32 -0800196hal_client_domain(system_server, hal_wifi_supplicant)
Alex Klyubin59322f12017-02-06 15:39:36 -0800197
Martijn Coenenfc80f482017-04-15 08:09:08 -0700198binder_call(system_server, mediacodec)
199
Martijn Coenende2e79c2017-04-14 15:55:20 -0700200# Talk with graphics composer fences
201allow system_server hal_graphics_composer:fd use;
202
Alex Klyubin53656c12017-04-13 19:05:27 -0700203# Use RenderScript always-passthrough HAL
204allow system_server hal_renderscript_hwservice:hwservice_manager find;
205
206# Offer HwBinder services
207add_hwservice(system_server, fwk_scheduler_hwservice)
208add_hwservice(system_server, fwk_sensor_hwservice)
209
Alex Klyubin59322f12017-02-06 15:39:36 -0800210# Talk to tombstoned to get ANR traces.
211unix_socket_connect(system_server, tombstoned_intercept, tombstoned)
212
Chia-I Wue4d21462017-04-20 14:34:00 -0700213# List HAL interfaces to get ANR traces.
214allow system_server hwservicemanager:hwservice_manager list;
215
Alex Klyubin59322f12017-02-06 15:39:36 -0800216# Send signals to trigger ANR traces.
Alex Klyubin59322f12017-02-06 15:39:36 -0800217allow system_server {
Steven Morelandfac31442017-03-24 09:37:17 -0700218 # This is derived from the list that system server defines as interesting native processes
219 # to dump during ANRs or watchdog aborts, defined in NATIVE_STACKS_OF_INTEREST in
220 # frameworks/base/services/core/java/com/android/server/Watchdog.java.
Alex Klyubin59322f12017-02-06 15:39:36 -0800221 audioserver
222 cameraserver
223 drmserver
224 inputflinger
Alex Klyubin59322f12017-02-06 15:39:36 -0800225 mediadrmserver
226 mediaextractor
227 mediaserver
228 mediametrics
229 sdcardd
230 surfaceflinger
Steven Morelandfac31442017-03-24 09:37:17 -0700231
232 # This list comes from HAL_INTERFACES_OF_INTEREST in
233 # frameworks/base/services/core/java/com/android/server/Watchdog.java.
234 hal_audio_server
235 hal_bluetooth_server
236 hal_camera_server
Chia-I Wue4d21462017-04-20 14:34:00 -0700237 hal_graphics_composer_server
Steven Morelandfac31442017-03-24 09:37:17 -0700238 hal_vr_server
239 mediacodec # TODO(b/36375899): hal_omx_server
Alex Klyubin59322f12017-02-06 15:39:36 -0800240}:process { signal };
241
242# Use sockets received over binder from various services.
243allow system_server audioserver:tcp_socket rw_socket_perms;
244allow system_server audioserver:udp_socket rw_socket_perms;
245allow system_server mediaserver:tcp_socket rw_socket_perms;
246allow system_server mediaserver:udp_socket rw_socket_perms;
247
248# Use sockets received over binder from various services.
249allow system_server mediadrmserver:tcp_socket rw_socket_perms;
250allow system_server mediadrmserver:udp_socket rw_socket_perms;
251
Sandeep Patilc9cf7362017-03-24 15:02:13 -0700252# Get file context
253allow system_server file_contexts_file:file r_file_perms;
Sandeep Patilbb24f3a2017-03-27 12:06:04 -0700254# access for mac_permissions
255allow system_server mac_perms_file: file r_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800256# Check SELinux permissions.
257selinux_check_access(system_server)
258
259# XXX Label sysfs files with a specific type?
260allow system_server sysfs:file rw_file_perms;
261allow system_server sysfs_nfc_power_writable:file rw_file_perms;
262allow system_server sysfs_devices_system_cpu:file w_file_perms;
263allow system_server sysfs_mac_address:file r_file_perms;
264allow system_server sysfs_thermal:dir search;
265allow system_server sysfs_thermal:file r_file_perms;
266
267# TODO: Remove when HALs are forced into separate processes
268allow system_server sysfs_vibrator:file { write append };
269
270# TODO: added to match above sysfs rule. Remove me?
271allow system_server sysfs_usb:file w_file_perms;
272
273# Access devices.
274allow system_server device:dir r_dir_perms;
275allow system_server mdns_socket:sock_file rw_file_perms;
276allow system_server alarm_device:chr_file rw_file_perms;
277allow system_server gpu_device:chr_file rw_file_perms;
278allow system_server iio_device:chr_file rw_file_perms;
279allow system_server input_device:dir r_dir_perms;
280allow system_server input_device:chr_file rw_file_perms;
281allow system_server radio_device:chr_file r_file_perms;
282allow system_server tty_device:chr_file rw_file_perms;
283allow system_server usbaccessory_device:chr_file rw_file_perms;
284allow system_server video_device:dir r_dir_perms;
285allow system_server video_device:chr_file rw_file_perms;
286allow system_server adbd_socket:sock_file rw_file_perms;
287allow system_server rtc_device:chr_file rw_file_perms;
288allow system_server audio_device:dir r_dir_perms;
289
290# write access needed for MIDI
291allow system_server audio_device:chr_file rw_file_perms;
292
293# tun device used for 3rd party vpn apps
294allow system_server tun_device:chr_file rw_file_perms;
295
296# Manage system data files.
297allow system_server system_data_file:dir create_dir_perms;
298allow system_server system_data_file:notdevfile_class_set create_file_perms;
299allow system_server keychain_data_file:dir create_dir_perms;
300allow system_server keychain_data_file:file create_file_perms;
301allow system_server keychain_data_file:lnk_file create_file_perms;
302
303# Manage /data/app.
304allow system_server apk_data_file:dir create_dir_perms;
305allow system_server apk_data_file:{ file lnk_file } { create_file_perms link };
306allow system_server apk_tmp_file:dir create_dir_perms;
307allow system_server apk_tmp_file:file create_file_perms;
308
Sandeep Patil277a20e2017-04-01 17:17:12 -0700309# Access /vendor/app
310r_dir_file(system_server, vendor_app_file)
311
Sandeep Patil90756992017-04-05 16:16:13 -0700312# Access /vendor/app
313r_dir_file(system_server, vendor_overlay_file)
314
Alex Klyubin59322f12017-02-06 15:39:36 -0800315# Manage /data/app-private.
316allow system_server apk_private_data_file:dir create_dir_perms;
317allow system_server apk_private_data_file:file create_file_perms;
318allow system_server apk_private_tmp_file:dir create_dir_perms;
319allow system_server apk_private_tmp_file:file create_file_perms;
320
321# Manage files within asec containers.
322allow system_server asec_apk_file:dir create_dir_perms;
323allow system_server asec_apk_file:file create_file_perms;
324allow system_server asec_public_file:file create_file_perms;
325
326# Manage /data/anr.
327allow system_server anr_data_file:dir create_dir_perms;
328allow system_server anr_data_file:file create_file_perms;
329
Joe Onorato41f93db2016-11-20 23:23:04 -0800330# Read /data/misc/incidents - only read. The fd will be sent over binder,
331# with no DAC access to it, for dropbox to read.
332allow system_server incident_data_file:file read;
333
Alex Klyubin59322f12017-02-06 15:39:36 -0800334# Manage /data/backup.
335allow system_server backup_data_file:dir create_dir_perms;
336allow system_server backup_data_file:file create_file_perms;
337
338# Write to /data/system/heapdump
339allow system_server heapdump_data_file:dir rw_dir_perms;
340allow system_server heapdump_data_file:file create_file_perms;
341
342# Manage /data/misc/adb.
343allow system_server adb_keys_file:dir create_dir_perms;
344allow system_server adb_keys_file:file create_file_perms;
345
346# Manage /data/misc/sms.
347# TODO: Split into a separate type?
348allow system_server radio_data_file:dir create_dir_perms;
349allow system_server radio_data_file:file create_file_perms;
350
351# Manage /data/misc/systemkeys.
352allow system_server systemkeys_data_file:dir create_dir_perms;
353allow system_server systemkeys_data_file:file create_file_perms;
354
Abodunrinwa Tokiadfc5db2017-04-26 21:20:20 +0100355# Manage /data/misc/textclassifier.
356allow system_server textclassifier_data_file:dir create_dir_perms;
357allow system_server textclassifier_data_file:file create_file_perms;
358
Alex Klyubin59322f12017-02-06 15:39:36 -0800359# Access /data/tombstones.
360allow system_server tombstone_data_file:dir r_dir_perms;
361allow system_server tombstone_data_file:file r_file_perms;
362
363# Manage /data/misc/vpn.
364allow system_server vpn_data_file:dir create_dir_perms;
365allow system_server vpn_data_file:file create_file_perms;
366
367# Manage /data/misc/wifi.
368allow system_server wifi_data_file:dir create_dir_perms;
369allow system_server wifi_data_file:file create_file_perms;
370
371# Manage /data/misc/zoneinfo.
372allow system_server zoneinfo_data_file:dir create_dir_perms;
373allow system_server zoneinfo_data_file:file create_file_perms;
374
375# Walk /data/data subdirectories.
376# Types extracted from seapp_contexts type= fields.
377allow system_server { system_app_data_file bluetooth_data_file nfc_data_file radio_data_file shell_data_file app_data_file }:dir { getattr read search };
378# Also permit for unlabeled /data/data subdirectories and
379# for unlabeled asec containers on upgrades from 4.2.
380allow system_server unlabeled:dir r_dir_perms;
381# Read pkg.apk file before it has been relabeled by vold.
382allow system_server unlabeled:file r_file_perms;
383
384# Populate com.android.providers.settings/databases/settings.db.
385allow system_server system_app_data_file:dir create_dir_perms;
386allow system_server system_app_data_file:file create_file_perms;
387
388# Receive and use open app data files passed over binder IPC.
389# Types extracted from seapp_contexts type= fields.
390allow system_server { system_app_data_file bluetooth_data_file nfc_data_file radio_data_file shell_data_file app_data_file }:file { getattr read write append };
391
392# Access to /data/media for measuring disk usage.
393allow system_server media_rw_data_file:dir { search getattr open read };
394
395# Receive and use open /data/media files passed over binder IPC.
396# Also used for measuring disk usage.
397allow system_server media_rw_data_file:file { getattr read write append };
398
399# Relabel apk files.
400allow system_server { apk_tmp_file apk_private_tmp_file }:{ dir file } { relabelfrom relabelto };
401allow system_server { apk_data_file apk_private_data_file }:{ dir file } { relabelfrom relabelto };
402
403# Relabel wallpaper.
404allow system_server system_data_file:file relabelfrom;
405allow system_server wallpaper_file:file relabelto;
406allow system_server wallpaper_file:file { rw_file_perms rename unlink };
407
408# Backup of wallpaper imagery uses temporary hard links to avoid data churn
409allow system_server { system_data_file wallpaper_file }:file link;
410
411# ShortcutManager icons
412allow system_server system_data_file:dir relabelfrom;
413allow system_server shortcut_manager_icons:dir { create_dir_perms relabelto };
414allow system_server shortcut_manager_icons:file create_file_perms;
415
416# Manage ringtones.
417allow system_server ringtone_file:dir { create_dir_perms relabelto };
418allow system_server ringtone_file:file create_file_perms;
419
420# Relabel icon file.
421allow system_server icon_file:file relabelto;
422allow system_server icon_file:file { rw_file_perms unlink };
423
424# FingerprintService.java does a restorecon of the directory /data/system/users/[0-9]+/fpdata(/.*)?
425allow system_server system_data_file:dir relabelfrom;
426
427# Property Service write
428set_prop(system_server, system_prop)
429set_prop(system_server, safemode_prop)
430set_prop(system_server, dhcp_prop)
431set_prop(system_server, net_radio_prop)
Nick Kralevich4e404292017-02-09 16:08:11 -0800432set_prop(system_server, net_dns_prop)
Alex Klyubin59322f12017-02-06 15:39:36 -0800433set_prop(system_server, system_radio_prop)
434set_prop(system_server, debug_prop)
435set_prop(system_server, powerctl_prop)
436set_prop(system_server, fingerprint_prop)
437set_prop(system_server, device_logging_prop)
Alex Klyubin59322f12017-02-06 15:39:36 -0800438set_prop(system_server, dumpstate_options_prop)
439set_prop(system_server, overlay_prop)
440userdebug_or_eng(`set_prop(system_server, wifi_log_prop)')
441
442# ctl interface
443set_prop(system_server, ctl_default_prop)
444set_prop(system_server, ctl_bugreport_prop)
445
446# cppreopt property
447set_prop(system_server, cppreopt_prop)
448
449# Collect metrics on boot time created by init
450get_prop(system_server, boottime_prop)
451
452# Read device's serial number from system properties
453get_prop(system_server, serialno_prop)
454
455# Read/write the property which keeps track of whether this is the first start of system_server
456set_prop(system_server, firstboot_prop)
457
Alex Klyubin59322f12017-02-06 15:39:36 -0800458# Create a socket for connections from debuggerd.
459allow system_server system_ndebug_socket:sock_file create_file_perms;
460
461# Manage cache files.
462allow system_server { cache_file cache_recovery_file }:dir { relabelfrom create_dir_perms };
463allow system_server { cache_file cache_recovery_file }:file { relabelfrom create_file_perms };
464allow system_server { cache_file cache_recovery_file }:fifo_file create_file_perms;
465
466allow system_server system_file:dir r_dir_perms;
467allow system_server system_file:lnk_file r_file_perms;
468
469# LocationManager(e.g, GPS) needs to read and write
470# to uart driver and ctrl proc entry
471allow system_server gps_control:file rw_file_perms;
472
473# Allow system_server to use app-created sockets and pipes.
474allow system_server appdomain:{ tcp_socket udp_socket } { getattr getopt setopt read write shutdown };
475allow system_server appdomain:{ fifo_file unix_stream_socket } { getattr read write };
476
Alex Klyubin59322f12017-02-06 15:39:36 -0800477# BackupManagerService needs to manipulate backup data files
478allow system_server cache_backup_file:dir rw_dir_perms;
479allow system_server cache_backup_file:file create_file_perms;
480# LocalTransport works inside /cache/backup
481allow system_server cache_private_backup_file:dir create_dir_perms;
482allow system_server cache_private_backup_file:file create_file_perms;
483
484# Allow system to talk to usb device
485allow system_server usb_device:chr_file rw_file_perms;
486allow system_server usb_device:dir r_dir_perms;
487
Alex Klyubin59322f12017-02-06 15:39:36 -0800488# Read from HW RNG (needed by EntropyMixer).
489allow system_server hw_random_device:chr_file r_file_perms;
490
491# Read and delete files under /dev/fscklogs.
492r_dir_file(system_server, fscklogs)
493allow system_server fscklogs:dir { write remove_name };
494allow system_server fscklogs:file unlink;
495
496# logd access, system_server inherit logd write socket
497# (urge is to deprecate this long term)
498allow system_server zygote:unix_dgram_socket write;
499
500# Read from log daemon.
501read_logd(system_server)
502read_runtime_log_tags(system_server)
503
504# Be consistent with DAC permissions. Allow system_server to write to
505# /sys/module/lowmemorykiller/parameters/adj
506# /sys/module/lowmemorykiller/parameters/minfree
507allow system_server sysfs_lowmemorykiller:file { getattr w_file_perms };
508
509# Read /sys/fs/pstore/console-ramoops
510# Don't worry about overly broad permissions for now, as there's
511# only one file in /sys/fs/pstore
512allow system_server pstorefs:dir r_dir_perms;
513allow system_server pstorefs:file r_file_perms;
514
515# /sys access
516allow system_server sysfs_zram:dir search;
517allow system_server sysfs_zram:file r_file_perms;
518
519add_service(system_server, system_server_service);
520allow system_server audioserver_service:service_manager find;
521allow system_server batteryproperties_service:service_manager find;
522allow system_server cameraserver_service:service_manager find;
523allow system_server drmserver_service:service_manager find;
524allow system_server dumpstate_service:service_manager find;
525allow system_server fingerprintd_service:service_manager find;
526allow system_server hal_fingerprint_service:service_manager find;
527allow system_server gatekeeper_service:service_manager find;
Joe Onorato41f93db2016-11-20 23:23:04 -0800528allow system_server incident_service:service_manager find;
Alex Klyubin59322f12017-02-06 15:39:36 -0800529allow system_server installd_service:service_manager find;
530allow system_server keystore_service:service_manager find;
531allow system_server mediaserver_service:service_manager find;
532allow system_server mediametrics_service:service_manager find;
533allow system_server mediaextractor_service:service_manager find;
534allow system_server mediacodec_service:service_manager find;
535allow system_server mediadrmserver_service:service_manager find;
Chong Zhang72916412016-10-31 17:02:32 -0700536allow system_server mediacasserver_service:service_manager find;
Alex Klyubin59322f12017-02-06 15:39:36 -0800537allow system_server netd_service:service_manager find;
538allow system_server nfc_service:service_manager find;
539allow system_server radio_service:service_manager find;
540allow system_server surfaceflinger_service:service_manager find;
541allow system_server wificond_service:service_manager find;
542
543allow system_server keystore:keystore_key {
544 get_state
545 get
546 insert
547 delete
548 exist
549 list
550 reset
551 password
552 lock
553 unlock
554 is_empty
555 sign
556 verify
557 grant
558 duplicate
559 clear_uid
560 add_auth
561 user_changed
562};
563
564# Allow system server to search and write to the persistent factory reset
565# protection partition. This block device does not get wiped in a factory reset.
566allow system_server block_device:dir search;
567allow system_server frp_block_device:blk_file rw_file_perms;
568
569# Clean up old cgroups
570allow system_server cgroup:dir { remove_name rmdir };
571
572# /oem access
573r_dir_file(system_server, oemfs)
574
575# Allow resolving per-user storage symlinks
576allow system_server { mnt_user_file storage_file }:dir { getattr search };
577allow system_server { mnt_user_file storage_file }:lnk_file { getattr read };
578
579# Allow statfs() on storage devices, which happens fast enough that
580# we shouldn't be killed during unsafe removal
581allow system_server sdcard_type:dir { getattr search };
582
583# Traverse into expanded storage
584allow system_server mnt_expand_file:dir r_dir_perms;
585
586# Allow system process to relabel the fingerprint directory after mkdir
587# and delete the directory and files when no longer needed
588allow system_server fingerprintd_data_file:dir { r_dir_perms remove_name rmdir relabelto write };
589allow system_server fingerprintd_data_file:file { getattr unlink };
590
591# Allow system process to read network MAC address
592allow system_server sysfs_mac_address:file r_file_perms;
593
594userdebug_or_eng(`
595 # Allow system server to create and write method traces in /data/misc/trace.
596 allow system_server method_trace_data_file:dir w_dir_perms;
597 allow system_server method_trace_data_file:file { create w_file_perms };
598
599 # Allow system server to read dmesg
600 allow system_server kernel:system syslog_read;
601')
602
603# For AppFuse.
604allow system_server vold:fd use;
605allow system_server fuse_device:chr_file { read write ioctl getattr };
606allow system_server app_fuse_file:dir rw_dir_perms;
607allow system_server app_fuse_file:file { read write open getattr append };
608
609# For configuring sdcardfs
610allow system_server configfs:dir { create_dir_perms };
611allow system_server configfs:file { getattr open unlink write };
612
613# Connect to adbd and use a socket transferred from it.
614# Used for e.g. jdwp.
615allow system_server adbd:unix_stream_socket connectto;
616allow system_server adbd:fd use;
617allow system_server adbd:unix_stream_socket { getattr getopt ioctl read write shutdown };
618
619# Allow invoking tools like "timeout"
620allow system_server toolbox_exec:file rx_file_perms;
621
622# Postinstall
623#
624# For OTA dexopt, allow calls coming from postinstall.
625binder_call(system_server, postinstall)
626
627allow system_server postinstall:fifo_file write;
628allow system_server update_engine:fd use;
629allow system_server update_engine:fifo_file write;
630
631# Access to /data/preloads
632allow system_server preloads_data_file:file { r_file_perms unlink };
633allow system_server preloads_data_file:dir { r_dir_perms write remove_name rmdir };
Fyodor Kupolovb238fe62017-03-14 11:42:03 -0700634allow system_server preloads_media_file:file { r_file_perms unlink };
635allow system_server preloads_media_file:dir { r_dir_perms write remove_name rmdir };
Alex Klyubin59322f12017-02-06 15:39:36 -0800636
637r_dir_file(system_server, cgroup)
638allow system_server ion_device:chr_file r_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800639
640r_dir_file(system_server, proc)
641r_dir_file(system_server, proc_meminfo)
642r_dir_file(system_server, proc_net)
643r_dir_file(system_server, rootfs)
644r_dir_file(system_server, sysfs_type)
645
Alex Klyubin59322f12017-02-06 15:39:36 -0800646### Rules needed when Light HAL runs inside system_server process.
647### These rules should eventually be granted only when needed.
648allow system_server sysfs_leds:lnk_file read;
649allow system_server sysfs_leds:file rw_file_perms;
650allow system_server sysfs_leds:dir r_dir_perms;
651###
652
mukesh agrawal723364f2017-02-22 18:01:00 -0800653# Allow WifiService to start, stop, and read wifi-specific trace events.
654allow system_server debugfs_tracing_instances:dir search;
655allow system_server debugfs_wifi_tracing:file rw_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800656
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700657# allow system_server to exec shell on ASAN builds. Needed to run
658# asanwrapper.
659with_asan(`
660 allow system_server shell_exec:file rx_file_perms;
661')
662
Alex Klyubin59322f12017-02-06 15:39:36 -0800663###
664### Neverallow rules
665###
666### system_server should NEVER do any of this
667
668# Do not allow opening files from external storage as unsafe ejection
669# could cause the kernel to kill the system_server.
670neverallow system_server sdcard_type:dir { open read write };
671neverallow system_server sdcard_type:file rw_file_perms;
672
673# system server should never be operating on zygote spawned app data
674# files directly. Rather, they should always be passed via a
675# file descriptor.
676# Types extracted from seapp_contexts type= fields, excluding
677# those types that system_server needs to open directly.
678neverallow system_server { bluetooth_data_file nfc_data_file shell_data_file app_data_file }:file { open create unlink link };
679
680# Forking and execing is inherently dangerous and racy. See, for
681# example, https://www.linuxprogrammingblog.com/threads-and-fork-think-twice-before-using-them
682# Prevent the addition of new file execs to stop the problem from
683# getting worse. b/28035297
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700684neverallow system_server {
685 file_type
686 -toolbox_exec
687 -logcat_exec
688 with_asan(`-shell_exec')
689}:file execute_no_trans;
Alex Klyubin59322f12017-02-06 15:39:36 -0800690
691# Ensure that system_server doesn't perform any domain transitions other than
692# transitioning to the crash_dump domain when a crash occurs.
693neverallow system_server { domain -crash_dump }:process transition;
694neverallow system_server *:process dyntransition;
695
696# Only allow crash_dump to connect to system_ndebug_socket.
697neverallow { domain -init -system_server -crash_dump } system_ndebug_socket:sock_file { open write };
698
699# system_server should never be executing dex2oat. This is either
700# a bug (for example, bug 16317188), or represents an attempt by
701# system server to dynamically load a dex file, something we do not
702# want to allow.
703neverallow system_server dex2oat_exec:file no_x_file_perms;
704
705# system_server should never execute or load executable shared libraries
706# in /data except for /data/dalvik-cache files.
707neverallow system_server {
708 data_file_type
709 -dalvikcache_data_file #mapping with PROT_EXEC
710}:file no_x_file_perms;
711
712# The only block device system_server should be accessing is
713# the frp_block_device. This helps avoid a system_server to root
714# escalation by writing to raw block devices.
715neverallow system_server { dev_type -frp_block_device }:blk_file no_rw_file_perms;
716
717# system_server should never use JIT functionality
718neverallow system_server self:process execmem;
719neverallow system_server ashmem_device:chr_file execute;
720
dcashman2e00e632016-10-12 14:58:09 -0700721# TODO: deal with tmpfs_domain pub/priv split properly
Nick Kralevichb56e6ef2016-12-09 20:14:31 -0800722neverallow system_server system_server_tmpfs:file execute;
Calin Juravlee5a1f642017-01-17 20:31:31 -0800723
724# dexoptanalyzer is currently used only for secondary dex files which
725# system_server should never access.
726neverallow system_server dexoptanalyzer_exec:file no_x_file_perms;
Nick Kralevich44866952017-02-15 15:04:43 -0800727
728# No ptracing others
729neverallow system_server { domain -system_server }:process ptrace;
730
731# CAP_SYS_RESOURCE was traditionally needed for sensitive /proc/PID
732# file read access. However, that is now unnecessary (b/34951864)
733# This neverallow can be removed after b/34951864 is fixed.
734neverallow system_server system_server:capability sys_resource;