| Jeff Vander Stoep | d22987b | 2015-11-03 09:54:39 -0800 | [diff] [blame] | 1 | # rules removed from the domain attribute |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 2 | |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 3 | # Search /storage/emulated tmpfs mount. |
| 4 | allow domain_deprecated tmpfs:dir r_dir_perms; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 5 | auditallow { domain_deprecated -appdomain -init -sdcardd -surfaceflinger -system_server -vold -zygote } tmpfs:dir r_dir_perms; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 6 | |
| 7 | # Inherit or receive open files from others. |
| 8 | allow domain_deprecated system_server:fd use; |
| Jeff Vander Stoep | 3a0721a | 2016-10-01 05:26:15 -0700 | [diff] [blame] | 9 | auditallow { domain_deprecated -appdomain -netd -surfaceflinger } system_server:fd use; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 10 | |
| 11 | # Connect to adbd and use a socket transferred from it. |
| 12 | # This is used for e.g. adb backup/restore. |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 13 | allow domain_deprecated adbd:fd use; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 14 | auditallow { domain_deprecated -appdomain -system_server } adbd:fd use; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 15 | |
| 16 | # Root fs. |
| 17 | allow domain_deprecated rootfs:dir r_dir_perms; |
| 18 | allow domain_deprecated rootfs:file r_file_perms; |
| 19 | allow domain_deprecated rootfs:lnk_file r_file_perms; |
| Jeff Vander Stoep | 108677c | 2016-09-11 21:18:05 -0700 | [diff] [blame] | 20 | auditallow { domain_deprecated -healthd -init -installd -priv_app -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:dir { open getattr read ioctl lock }; # search granted in domain |
| 21 | auditallow { domain_deprecated -healthd -init -installd -priv_app -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:file r_file_perms; |
| 22 | auditallow { domain_deprecated -appdomain -healthd -init -installd -priv_app -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:lnk_file { getattr open ioctl lock }; # read granted in domain |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 23 | |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 24 | # System file accesses. |
| 25 | allow domain_deprecated system_file:dir r_dir_perms; |
| 26 | allow domain_deprecated system_file:file r_file_perms; |
| Nick Kralevich | 68f2336 | 2016-11-07 16:14:28 -0800 | [diff] [blame] | 27 | auditallow { |
| 28 | domain_deprecated |
| 29 | -appdomain |
| 30 | -init |
| 31 | -installd |
| 32 | -rild |
| 33 | -surfaceflinger |
| 34 | -system_server |
| 35 | -zygote |
| 36 | } system_file:dir { open read ioctl lock }; # search getattr in domain |
| 37 | auditallow { |
| 38 | domain_deprecated |
| 39 | -appdomain |
| 40 | -init |
| 41 | -rild |
| 42 | -surfaceflinger |
| 43 | -system_server |
| 44 | -zygote |
| 45 | } system_file:file { ioctl lock }; # read open getattr in domain |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 46 | |
| 47 | # Read files already opened under /data. |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 48 | allow domain_deprecated system_data_file:file { getattr read }; |
| 49 | allow domain_deprecated system_data_file:lnk_file r_file_perms; |
| Jeff Vander Stoep | 5c4435a | 2016-09-24 14:26:45 -0700 | [diff] [blame] | 50 | auditallow { domain_deprecated -appdomain -init -sdcardd -system_server -tee } system_data_file:file { getattr read }; |
| 51 | auditallow { domain_deprecated -appdomain -init -system_server -tee } system_data_file:lnk_file r_file_perms; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 52 | |
| 53 | # Read apk files under /data/app. |
| 54 | allow domain_deprecated apk_data_file:dir { getattr search }; |
| 55 | allow domain_deprecated apk_data_file:file r_file_perms; |
| 56 | allow domain_deprecated apk_data_file:lnk_file r_file_perms; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 57 | auditallow { domain_deprecated -appdomain -dex2oat -init -installd -system_server } apk_data_file:dir { getattr search }; |
| 58 | auditallow { domain_deprecated -appdomain -dex2oat -installd -system_server } apk_data_file:file r_file_perms; |
| 59 | auditallow { domain_deprecated -appdomain -dex2oat -installd -system_server } apk_data_file:lnk_file r_file_perms; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 60 | |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 61 | # Read already opened /cache files. |
| Nick Kralevich | d546473 | 2016-01-16 08:15:52 -0800 | [diff] [blame] | 62 | allow domain_deprecated cache_file:dir r_dir_perms; |
| 63 | allow domain_deprecated cache_file:file { getattr read }; |
| Nick Kralevich | dc37ea7 | 2016-01-07 12:56:54 -0800 | [diff] [blame] | 64 | allow domain_deprecated cache_file:lnk_file r_file_perms; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 65 | auditallow { domain_deprecated -init -priv_app -system_server -vold } cache_file:dir { open read search ioctl lock }; |
| 66 | auditallow { domain_deprecated -appdomain -init -priv_app -system_server -vold } cache_file:dir getattr; |
| 67 | auditallow { domain_deprecated -init -priv_app -system_server -vold } cache_file:file { getattr read }; |
| 68 | auditallow { domain_deprecated -init -system_server -vold } cache_file:lnk_file r_file_perms; |
| Felipe Leme | 549ccf7 | 2015-12-22 12:37:17 -0800 | [diff] [blame] | 69 | |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 70 | #Allow access to ion memory allocation device |
| 71 | allow domain_deprecated ion_device:chr_file rw_file_perms; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 72 | # split this auditallow into read and write perms since most domains seem to |
| 73 | # only require read |
| Jeff Vander Stoep | 24ad514 | 2016-10-01 20:47:01 -0700 | [diff] [blame] | 74 | auditallow { domain_deprecated -appdomain -fingerprintd -keystore -surfaceflinger -system_server -tee -vold -zygote } ion_device:chr_file r_file_perms; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 75 | auditallow domain_deprecated ion_device:chr_file { write append }; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 76 | |
| 77 | # Read access to pseudo filesystems. |
| 78 | r_dir_file(domain_deprecated, proc) |
| Jeff Vander Stoep | a2c4055 | 2016-09-13 11:03:36 -0700 | [diff] [blame] | 79 | r_dir_file(domain_deprecated, sysfs) |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 80 | r_dir_file(domain_deprecated, cgroup) |
| Nick Kralevich | 7a35c13 | 2016-03-31 14:11:50 -0700 | [diff] [blame] | 81 | allow domain_deprecated proc_meminfo:file r_file_perms; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 82 | r_dir_file(domain_deprecated, proc_net) |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 83 | #auditallow domain_deprecated proc:dir r_dir_perms; # r_dir_perms granted in domain |
| Jeff Vander Stoep | 5c4435a | 2016-09-24 14:26:45 -0700 | [diff] [blame] | 84 | auditallow { domain_deprecated -fsck -fsck_untrusted -init -priv_app -rild -system_server -vold } proc:file r_file_perms; |
| 85 | auditallow { domain_deprecated -fsck -fsck_untrusted -init -priv_app -rild -system_server -vold } proc:lnk_file { open ioctl lock }; # getattr read granted in domain |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 86 | auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -priv_app -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:dir { open getattr read ioctl lock }; # search granted in domain |
| 87 | auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -priv_app -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:file r_file_perms; |
| 88 | auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -priv_app -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:lnk_file { getattr open ioctl lock }; # read granted in domain |
| Nick Kralevich | 2c8ea36 | 2016-10-29 08:07:12 -0700 | [diff] [blame] | 89 | auditallow { |
| 90 | domain_deprecated |
| 91 | -appdomain |
| 92 | -dumpstate |
| 93 | -fingerprintd |
| 94 | -healthd |
| 95 | -init |
| 96 | -inputflinger |
| 97 | -installd |
| 98 | -keystore |
| 99 | -netd |
| 100 | -rild |
| 101 | -surfaceflinger |
| 102 | -system_server |
| 103 | -zygote |
| 104 | } cgroup:dir r_dir_perms; |
| 105 | auditallow { |
| 106 | domain_deprecated |
| 107 | -appdomain |
| 108 | -dumpstate |
| 109 | -fingerprintd |
| 110 | -healthd |
| 111 | -init |
| 112 | -inputflinger |
| 113 | -installd |
| 114 | -keystore |
| 115 | -netd |
| 116 | -rild |
| 117 | -surfaceflinger |
| 118 | -system_server |
| 119 | -zygote |
| 120 | } cgroup:{ file lnk_file } r_file_perms; |
| Jeff Vander Stoep | 5c4435a | 2016-09-24 14:26:45 -0700 | [diff] [blame] | 121 | auditallow { domain_deprecated -appdomain -init -priv_app -surfaceflinger -system_server -vold } proc_meminfo:file r_file_perms; |
| 122 | auditallow { domain_deprecated -appdomain -clatd -init -netd -system_server -vold -wpa -zygote } proc_net:dir { open getattr read ioctl lock }; # search granted in domain |
| Nick Kralevich | 79a08e1 | 2016-10-28 11:18:43 -0700 | [diff] [blame] | 123 | auditallow { |
| 124 | domain_deprecated |
| 125 | -appdomain |
| 126 | -clatd |
| 127 | -dumpstate |
| 128 | -init |
| 129 | -netd |
| 130 | -system_server |
| 131 | -vold |
| 132 | -wpa |
| 133 | -zygote |
| 134 | } proc_net:{ file lnk_file } r_file_perms; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 135 | |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 136 | # Get SELinux enforcing status. |
| 137 | allow domain_deprecated selinuxfs:dir r_dir_perms; |
| 138 | allow domain_deprecated selinuxfs:file r_file_perms; |
| Jeff Vander Stoep | 3a0721a | 2016-10-01 05:26:15 -0700 | [diff] [blame] | 139 | auditallow { domain_deprecated -appdomain -debuggerd -init -installd -keystore -postinstall_dexopt -runas -servicemanager -system_server -ueventd -zygote } selinuxfs:dir { open getattr read ioctl lock }; # search granted in domain |
| 140 | auditallow { domain_deprecated -appdomain -debuggerd -init -installd -keystore -postinstall_dexopt -runas -servicemanager -system_server -ueventd -zygote } selinuxfs:file { open read ioctl lock }; # getattr granted in domain |