Jeff Vander Stoep | bacb6d7 | 2017-02-13 13:33:27 -0800 | [diff] [blame] | 1 | ### |
| 2 | ### Untrusted_app_all. |
| 3 | ### |
Chad Brubaker | b93f049 | 2017-03-29 14:53:09 -0700 | [diff] [blame] | 4 | ### This file defines the rules shared by all untrusted app domains except |
Steven Moreland | 826b92f | 2020-09-17 17:15:26 +0000 | [diff] [blame] | 5 | ### ephemeral_app for instant apps and isolated_app (which has a reduced |
| 6 | ### permission set). |
Jeff Vander Stoep | bacb6d7 | 2017-02-13 13:33:27 -0800 | [diff] [blame] | 7 | ### Apps are labeled based on mac_permissions.xml (maps signer and |
| 8 | ### optionally package name to seinfo value) and seapp_contexts (maps UID |
| 9 | ### and optionally seinfo value to domain for process and type for data |
| 10 | ### directory). The untrusted_app_all attribute is assigned to all default |
| 11 | ### seapp_contexts for any app with UID between APP_AID (10000) |
| 12 | ### and AID_ISOLATED_START (99000) if the app has no specific seinfo |
| 13 | ### value as determined from mac_permissions.xml. In current AOSP, this |
| 14 | ### attribute is assigned to all non-system apps as well as to any system apps |
| 15 | ### that are not signed by the platform key. To move |
| 16 | ### a system app into a specific domain, add a signer entry for it to |
| 17 | ### mac_permissions.xml and assign it one of the pre-existing seinfo values |
| 18 | ### or define and use a new seinfo value in both mac_permissions.xml and |
| 19 | ### seapp_contexts. |
| 20 | ### |
Chad Brubaker | eda4b88 | 2017-04-26 12:32:51 -0700 | [diff] [blame] | 21 | ### Note that rules that should apply to all untrusted apps must be in app.te or also |
Nick Kralevich | 41b21ee | 2018-08-06 12:36:20 -0700 | [diff] [blame] | 22 | ### added to ephemeral_app.te. |
Jeff Vander Stoep | bacb6d7 | 2017-02-13 13:33:27 -0800 | [diff] [blame] | 23 | |
Jeff Vander Stoep | bacb6d7 | 2017-02-13 13:33:27 -0800 | [diff] [blame] | 24 | # Some apps ship with shared libraries and binaries that they write out |
| 25 | # to their sandbox directory and then execute. |
Nick Kralevich | 0eb0a16 | 2018-12-12 09:06:05 -0800 | [diff] [blame] | 26 | allow untrusted_app_all privapp_data_file:file { r_file_perms execute }; |
Nick Kralevich | 65a89c1 | 2018-12-21 10:03:50 -0800 | [diff] [blame] | 27 | allow untrusted_app_all app_data_file:file { r_file_perms execute }; |
Alan Stokes | 931623e | 2019-02-27 18:07:09 +0000 | [diff] [blame] | 28 | auditallow untrusted_app_all app_data_file:file execute; |
Nick Kralevich | 0eb0a16 | 2018-12-12 09:06:05 -0800 | [diff] [blame] | 29 | |
Nick Kralevich | 9ea8c07 | 2019-02-06 13:19:19 -0800 | [diff] [blame] | 30 | # Chrome Crashpad uses the the dynamic linker to load native executables |
| 31 | # from an APK (b/112050209, crbug.com/928422) |
| 32 | allow untrusted_app_all system_linker_exec:file execute_no_trans; |
| 33 | |
Nick Kralevich | 87e9123 | 2019-01-24 13:05:03 -0800 | [diff] [blame] | 34 | # Follow priv-app symlinks. This is used for dynamite functionality. |
| 35 | allow untrusted_app_all privapp_data_file:lnk_file r_file_perms; |
| 36 | |
| 37 | # Allow handling of less common filesystem objects |
| 38 | allow untrusted_app_all app_data_file:{ lnk_file sock_file fifo_file } create_file_perms; |
| 39 | |
Nick Kralevich | fb66c6f | 2019-01-11 09:37:46 -0800 | [diff] [blame] | 40 | # Allow loading and deleting executable shared libraries |
| 41 | # within an application home directory. Such shared libraries would be |
| 42 | # created by things like renderscript or via other mechanisms. |
| 43 | allow untrusted_app_all app_exec_data_file:file { r_file_perms execute unlink }; |
Jeff Vander Stoep | bacb6d7 | 2017-02-13 13:33:27 -0800 | [diff] [blame] | 44 | |
| 45 | # ASEC |
| 46 | allow untrusted_app_all asec_apk_file:file r_file_perms; |
| 47 | allow untrusted_app_all asec_apk_file:dir r_dir_perms; |
| 48 | # Execute libs in asec containers. |
Nick Kralevich | f3eb985 | 2018-08-07 15:14:34 -0700 | [diff] [blame] | 49 | allow untrusted_app_all asec_public_file:file { execute }; |
Jeff Vander Stoep | bacb6d7 | 2017-02-13 13:33:27 -0800 | [diff] [blame] | 50 | |
| 51 | # Used by Finsky / Android "Verify Apps" functionality when |
| 52 | # running "adb install foo.apk". |
| 53 | # TODO: Long term, we don't want apps probing into shell data files. |
| 54 | # Figure out a way to remove these rules. |
| 55 | allow untrusted_app_all shell_data_file:file r_file_perms; |
| 56 | allow untrusted_app_all shell_data_file:dir r_dir_perms; |
| 57 | |
Max Bires | 278147e | 2018-01-23 12:32:55 -0800 | [diff] [blame] | 58 | # Allow traceur to pass file descriptors through a content provider to untrusted apps |
| 59 | # for the purpose of sharing files through e.g. gmail |
| 60 | allow untrusted_app_all trace_data_file:file { getattr read }; |
| 61 | |
| 62 | # untrusted apps should not be able to open trace data files, they should depend |
| 63 | # upon traceur to pass a file descriptor |
| 64 | neverallow untrusted_app_all trace_data_file:dir *; |
| 65 | neverallow untrusted_app_all trace_data_file:file { no_w_file_perms open }; |
| 66 | |
Adam Shih | 2543715 | 2020-12-07 16:30:29 +0800 | [diff] [blame] | 67 | # neverallow untrusted apps accessing debugfs_tracing |
| 68 | neverallow untrusted_app_all debugfs_tracing:file no_rw_file_perms; |
| 69 | |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 70 | # Allow to read staged apks. |
| 71 | allow untrusted_app_all { apk_tmp_file apk_private_tmp_file }:file {read getattr}; |
| 72 | |
Jeff Vander Stoep | bacb6d7 | 2017-02-13 13:33:27 -0800 | [diff] [blame] | 73 | # Read and write system app data files passed over Binder. |
| 74 | # Motivating case was /data/data/com.android.settings/cache/*.jpg for |
| 75 | # cropping or taking user photos. |
| 76 | allow untrusted_app_all system_app_data_file:file { read write getattr }; |
| 77 | |
| 78 | # |
| 79 | # Rules migrated from old app domains coalesced into untrusted_app. |
| 80 | # This includes what used to be media_app, shared_app, and release_app. |
| 81 | # |
| 82 | |
| 83 | # Access to /data/media. |
| 84 | allow untrusted_app_all media_rw_data_file:dir create_dir_perms; |
| 85 | allow untrusted_app_all media_rw_data_file:file create_file_perms; |
| 86 | |
Jeff Vander Stoep | bacb6d7 | 2017-02-13 13:33:27 -0800 | [diff] [blame] | 87 | # allow cts to query all services |
| 88 | allow untrusted_app_all servicemanager:service_manager list; |
| 89 | |
| 90 | allow untrusted_app_all audioserver_service:service_manager find; |
| 91 | allow untrusted_app_all cameraserver_service:service_manager find; |
| 92 | allow untrusted_app_all drmserver_service:service_manager find; |
| 93 | allow untrusted_app_all mediaserver_service:service_manager find; |
| 94 | allow untrusted_app_all mediaextractor_service:service_manager find; |
Jeff Vander Stoep | bacb6d7 | 2017-02-13 13:33:27 -0800 | [diff] [blame] | 95 | allow untrusted_app_all mediametrics_service:service_manager find; |
| 96 | allow untrusted_app_all mediadrmserver_service:service_manager find; |
Jeff Vander Stoep | bacb6d7 | 2017-02-13 13:33:27 -0800 | [diff] [blame] | 97 | allow untrusted_app_all nfc_service:service_manager find; |
| 98 | allow untrusted_app_all radio_service:service_manager find; |
Jeff Vander Stoep | bacb6d7 | 2017-02-13 13:33:27 -0800 | [diff] [blame] | 99 | allow untrusted_app_all app_api_service:service_manager find; |
| 100 | allow untrusted_app_all vr_manager_service:service_manager find; |
| 101 | |
Jeff Vander Stoep | bacb6d7 | 2017-02-13 13:33:27 -0800 | [diff] [blame] | 102 | # gdbserver for ndk-gdb ptrace attaches to app process. |
| 103 | allow untrusted_app_all self:process ptrace; |
| 104 | |
Nick Kralevich | 3e5668f | 2019-01-23 14:39:43 -0800 | [diff] [blame] | 105 | # Android Studio Instant Run has the application connect to a |
| 106 | # runas_app socket listening in the abstract namespace. |
| 107 | # https://developer.android.com/studio/run/ |
| 108 | # b/123297648 |
| 109 | allow untrusted_app_all runas_app:unix_stream_socket connectto; |
| 110 | |
Nick Kralevich | 337f564 | 2019-01-30 13:19:36 -0800 | [diff] [blame] | 111 | # Untrusted apps need to be able to send a SIGCHLD to runas_app |
| 112 | # when running under a debugger (b/123612207) |
| 113 | allow untrusted_app_all runas_app:process sigchld; |
| 114 | |
Jeff Vander Stoep | bacb6d7 | 2017-02-13 13:33:27 -0800 | [diff] [blame] | 115 | # Cts: HwRngTest |
| 116 | allow untrusted_app_all sysfs_hwrandom:dir search; |
| 117 | allow untrusted_app_all sysfs_hwrandom:file r_file_perms; |
| 118 | |
Fyodor Kupolov | b238fe6 | 2017-03-14 11:42:03 -0700 | [diff] [blame] | 119 | # Allow apps to view preloaded media content |
| 120 | allow untrusted_app_all preloads_media_file:dir r_dir_perms; |
| 121 | allow untrusted_app_all preloads_media_file:file r_file_perms; |
| 122 | allow untrusted_app_all preloads_data_file:dir search; |
Sandeep Patil | ef7b210 | 2017-04-28 13:17:26 -0700 | [diff] [blame] | 123 | |
| 124 | # Allow untrusted apps read / execute access to /vendor/app for there can |
| 125 | # be pre-installed vendor apps that package a library within themselves. |
| 126 | # TODO (b/37784178) Consider creating a special type for /vendor/app installed |
| 127 | # apps. |
| 128 | allow untrusted_app_all vendor_app_file:dir { open getattr read search }; |
Nick Kralevich | 0bfa7b5 | 2018-10-26 13:11:52 -0700 | [diff] [blame] | 129 | allow untrusted_app_all vendor_app_file:file { r_file_perms execute }; |
Sandeep Patil | ef7b210 | 2017-04-28 13:17:26 -0700 | [diff] [blame] | 130 | allow untrusted_app_all vendor_app_file:lnk_file { open getattr read }; |
Primiano Tucci | c80f9e0 | 2017-12-21 03:51:15 +0100 | [diff] [blame] | 131 | |
| 132 | # Write app-specific trace data to the Perfetto traced damon. This requires |
| 133 | # connecting to its producer socket and obtaining a (per-process) tmpfs fd. |
Florian Mayer | 5e52281 | 2019-10-08 16:15:14 +0100 | [diff] [blame] | 134 | perfetto_producer(untrusted_app_all) |
Nathan Harold | ee26864 | 2017-12-14 18:20:30 -0800 | [diff] [blame] | 135 | |
Ryan Savitski | 67a8248 | 2020-01-22 19:16:13 +0000 | [diff] [blame] | 136 | # Allow profiling if the app opts in by being marked profileable/debuggable. |
Ryan Savitski | ca0690e | 2019-01-16 16:29:43 +0000 | [diff] [blame] | 137 | can_profile_heap(untrusted_app_all) |
Ryan Savitski | 67a8248 | 2020-01-22 19:16:13 +0000 | [diff] [blame] | 138 | can_profile_perf(untrusted_app_all) |
Ryan Savitski | ca0690e | 2019-01-16 16:29:43 +0000 | [diff] [blame] | 139 | |
Nathan Harold | ee26864 | 2017-12-14 18:20:30 -0800 | [diff] [blame] | 140 | # allow untrusted apps to use UDP sockets provided by the system server but not |
| 141 | # modify them other than to connect |
Nathan Harold | 252b015 | 2018-03-27 06:34:54 -0700 | [diff] [blame] | 142 | allow untrusted_app_all system_server:udp_socket { |
| 143 | connect getattr read recvfrom sendto write getopt setopt }; |
Joel Galenson | d93ef54 | 2018-03-26 16:37:42 -0700 | [diff] [blame] | 144 | |
Nick Kralevich | 0eb0a16 | 2018-12-12 09:06:05 -0800 | [diff] [blame] | 145 | # Allow the renderscript compiler to be run. |
| 146 | domain_auto_trans(untrusted_app_all, rs_exec, rs) |
| 147 | |
Adam Shih | 2543715 | 2020-12-07 16:30:29 +0800 | [diff] [blame] | 148 | # suppress denials caused by debugfs_tracing |
| 149 | dontaudit untrusted_app_all debugfs_tracing:file rw_file_perms; |
| 150 | |
Joel Galenson | d93ef54 | 2018-03-26 16:37:42 -0700 | [diff] [blame] | 151 | # This is allowed for targetSdkVersion <= 25 but disallowed on newer versions. |
| 152 | dontaudit untrusted_app_all net_dns_prop:file read; |
| 153 | |
| 154 | # These have been disallowed since Android O. |
| 155 | # For P, we assume that apps are safely handling the denial. |
| 156 | dontaudit untrusted_app_all proc_stat:file read; |
| 157 | dontaudit untrusted_app_all proc_vmstat:file read; |
| 158 | dontaudit untrusted_app_all proc_uptime:file read; |
Jeff Vander Stoep | 3aa7ca5 | 2018-04-03 11:22:38 -0700 | [diff] [blame] | 159 | |
| 160 | # Allow the allocation and use of ptys |
| 161 | # Used by: https://play.google.com/store/apps/details?id=jackpal.androidterm |
| 162 | create_pty(untrusted_app_all) |
Jeff Vander Stoep | 7a4af30 | 2018-04-10 12:47:48 -0700 | [diff] [blame] | 163 | |
Dan Austin | 55d9096 | 2018-11-29 10:37:18 -0800 | [diff] [blame] | 164 | # Allow access to kcov via its ioctl interface for coverage |
| 165 | # guided kernel fuzzing. |
| 166 | userdebug_or_eng(` |
| 167 | allow untrusted_app_all debugfs_kcov:file rw_file_perms; |
| 168 | allowxperm untrusted_app_all debugfs_kcov:file ioctl { KCOV_INIT_TRACE KCOV_ENABLE KCOV_DISABLE }; |
ThiƩbaud Weksteen | bcfca1a | 2021-03-17 07:57:19 +0100 | [diff] [blame] | 169 | # The use of debugfs kcov is considered a breach of the kernel integrity |
| 170 | # according to the heuristic of lockdown. |
| 171 | allow untrusted_app_all self:lockdown integrity; |
Dan Austin | 55d9096 | 2018-11-29 10:37:18 -0800 | [diff] [blame] | 172 | ') |
Alan Stokes | 39f4970 | 2021-09-02 11:10:59 +0100 | [diff] [blame] | 173 | |
Yabin Cui | dd2079d | 2021-09-07 17:10:21 +0000 | [diff] [blame] | 174 | # Allow signalling simpleperf domain, which is the domain that the simpleperf |
| 175 | # profiler runs as when executed by the app. The signals are used to control |
| 176 | # the profiler (which would be profiling the app that is sending the signal). |
| 177 | allow untrusted_app_all simpleperf:process signal; |
| 178 | |
Pirama Arumuga Nainar | 0612731 | 2021-09-03 15:11:07 -0700 | [diff] [blame] | 179 | with_native_coverage(` |
| 180 | # Allow writing coverage information to /data/misc/trace |
| 181 | allow domain method_trace_data_file:dir create_dir_perms; |
| 182 | allow domain method_trace_data_file:file create_file_perms; |
| 183 | ') |