| Jeff Vander Stoep | d22987b | 2015-11-03 09:54:39 -0800 | [diff] [blame] | 1 | # rules removed from the domain attribute |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 2 | |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 3 | # Search /storage/emulated tmpfs mount. |
| 4 | allow domain_deprecated tmpfs:dir r_dir_perms; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 5 | auditallow { domain_deprecated -appdomain -init -sdcardd -surfaceflinger -system_server -vold -zygote } tmpfs:dir r_dir_perms; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 6 | |
| 7 | # Inherit or receive open files from others. |
| 8 | allow domain_deprecated system_server:fd use; |
| Jeff Vander Stoep | 3a0721a | 2016-10-01 05:26:15 -0700 | [diff] [blame] | 9 | auditallow { domain_deprecated -appdomain -netd -surfaceflinger } system_server:fd use; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 10 | |
| 11 | # Connect to adbd and use a socket transferred from it. |
| 12 | # This is used for e.g. adb backup/restore. |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 13 | allow domain_deprecated adbd:fd use; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 14 | auditallow { domain_deprecated -appdomain -system_server } adbd:fd use; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 15 | |
| 16 | # Root fs. |
| 17 | allow domain_deprecated rootfs:dir r_dir_perms; |
| 18 | allow domain_deprecated rootfs:file r_file_perms; |
| 19 | allow domain_deprecated rootfs:lnk_file r_file_perms; |
| Jeff Vander Stoep | a1b4560 | 2017-02-10 09:39:37 -0800 | [diff] [blame^] | 20 | auditallow { |
| 21 | domain_deprecated |
| 22 | -fsck |
| 23 | -healthd |
| 24 | -init |
| 25 | -installd |
| 26 | -servicemanager |
| 27 | -system_server |
| 28 | -ueventd |
| 29 | -uncrypt |
| 30 | -vold |
| 31 | -zygote |
| 32 | } rootfs:dir { open getattr read ioctl lock }; # search granted in domain |
| Nick Kralevich | 164af10 | 2017-01-06 16:25:41 -0800 | [diff] [blame] | 33 | auditallow { domain_deprecated -healthd -init -installd -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:file r_file_perms; |
| 34 | auditallow { domain_deprecated -appdomain -healthd -init -installd -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:lnk_file { getattr open ioctl lock }; # read granted in domain |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 35 | |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 36 | # System file accesses. |
| 37 | allow domain_deprecated system_file:dir r_dir_perms; |
| 38 | allow domain_deprecated system_file:file r_file_perms; |
| Nick Kralevich | 68f2336 | 2016-11-07 16:14:28 -0800 | [diff] [blame] | 39 | auditallow { |
| 40 | domain_deprecated |
| 41 | -appdomain |
| Nick Kralevich | 49e3588 | 2016-11-25 18:00:38 -0800 | [diff] [blame] | 42 | -fingerprintd |
| Nick Kralevich | 68f2336 | 2016-11-07 16:14:28 -0800 | [diff] [blame] | 43 | -init |
| 44 | -installd |
| Jeff Vander Stoep | a1b4560 | 2017-02-10 09:39:37 -0800 | [diff] [blame^] | 45 | -keystore |
| Nick Kralevich | 68f2336 | 2016-11-07 16:14:28 -0800 | [diff] [blame] | 46 | -rild |
| 47 | -surfaceflinger |
| 48 | -system_server |
| Jeff Vander Stoep | a1b4560 | 2017-02-10 09:39:37 -0800 | [diff] [blame^] | 49 | -update_engine |
| 50 | -vold |
| Nick Kralevich | 68f2336 | 2016-11-07 16:14:28 -0800 | [diff] [blame] | 51 | -zygote |
| 52 | } system_file:dir { open read ioctl lock }; # search getattr in domain |
| 53 | auditallow { |
| 54 | domain_deprecated |
| 55 | -appdomain |
| 56 | -init |
| 57 | -rild |
| 58 | -surfaceflinger |
| 59 | -system_server |
| 60 | -zygote |
| 61 | } system_file:file { ioctl lock }; # read open getattr in domain |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 62 | |
| 63 | # Read files already opened under /data. |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 64 | allow domain_deprecated system_data_file:file { getattr read }; |
| 65 | allow domain_deprecated system_data_file:lnk_file r_file_perms; |
| Jeff Vander Stoep | 5c4435a | 2016-09-24 14:26:45 -0700 | [diff] [blame] | 66 | auditallow { domain_deprecated -appdomain -init -sdcardd -system_server -tee } system_data_file:file { getattr read }; |
| 67 | auditallow { domain_deprecated -appdomain -init -system_server -tee } system_data_file:lnk_file r_file_perms; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 68 | |
| 69 | # Read apk files under /data/app. |
| 70 | allow domain_deprecated apk_data_file:dir { getattr search }; |
| 71 | allow domain_deprecated apk_data_file:file r_file_perms; |
| 72 | allow domain_deprecated apk_data_file:lnk_file r_file_perms; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 73 | auditallow { domain_deprecated -appdomain -dex2oat -init -installd -system_server } apk_data_file:dir { getattr search }; |
| Nick Kralevich | 5ee3151 | 2017-02-10 02:33:25 -0800 | [diff] [blame] | 74 | auditallow { domain_deprecated -appdomain -dex2oat -init -installd -system_server } apk_data_file:file r_file_perms; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 75 | auditallow { domain_deprecated -appdomain -dex2oat -installd -system_server } apk_data_file:lnk_file r_file_perms; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 76 | |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 77 | # Read already opened /cache files. |
| Nick Kralevich | d546473 | 2016-01-16 08:15:52 -0800 | [diff] [blame] | 78 | allow domain_deprecated cache_file:dir r_dir_perms; |
| 79 | allow domain_deprecated cache_file:file { getattr read }; |
| Nick Kralevich | dc37ea7 | 2016-01-07 12:56:54 -0800 | [diff] [blame] | 80 | allow domain_deprecated cache_file:lnk_file r_file_perms; |
| Nick Kralevich | 164af10 | 2017-01-06 16:25:41 -0800 | [diff] [blame] | 81 | auditallow { domain_deprecated -init -system_server -vold } cache_file:dir { open read search ioctl lock }; |
| 82 | auditallow { domain_deprecated -appdomain -init -system_server -vold } cache_file:dir getattr; |
| 83 | auditallow { domain_deprecated -init -system_server -vold } cache_file:file { getattr read }; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 84 | auditallow { domain_deprecated -init -system_server -vold } cache_file:lnk_file r_file_perms; |
| Felipe Leme | 549ccf7 | 2015-12-22 12:37:17 -0800 | [diff] [blame] | 85 | |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 86 | #Allow access to ion memory allocation device |
| 87 | allow domain_deprecated ion_device:chr_file rw_file_perms; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 88 | # split this auditallow into read and write perms since most domains seem to |
| 89 | # only require read |
| Jeff Vander Stoep | 24ad514 | 2016-10-01 20:47:01 -0700 | [diff] [blame] | 90 | auditallow { domain_deprecated -appdomain -fingerprintd -keystore -surfaceflinger -system_server -tee -vold -zygote } ion_device:chr_file r_file_perms; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 91 | auditallow domain_deprecated ion_device:chr_file { write append }; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 92 | |
| 93 | # Read access to pseudo filesystems. |
| 94 | r_dir_file(domain_deprecated, proc) |
| Jeff Vander Stoep | a2c4055 | 2016-09-13 11:03:36 -0700 | [diff] [blame] | 95 | r_dir_file(domain_deprecated, sysfs) |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 96 | r_dir_file(domain_deprecated, cgroup) |
| Nick Kralevich | 7a35c13 | 2016-03-31 14:11:50 -0700 | [diff] [blame] | 97 | allow domain_deprecated proc_meminfo:file r_file_perms; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 98 | #auditallow domain_deprecated proc:dir r_dir_perms; # r_dir_perms granted in domain |
| Jeff Vander Stoep | a1b4560 | 2017-02-10 09:39:37 -0800 | [diff] [blame^] | 99 | auditallow { |
| 100 | domain_deprecated |
| 101 | -fsck |
| 102 | -fsck_untrusted |
| 103 | -init |
| 104 | -rild |
| 105 | -sdcardd |
| 106 | -system_server |
| 107 | -update_engine |
| 108 | -vold |
| 109 | } proc:file r_file_perms; |
| Nick Kralevich | 164af10 | 2017-01-06 16:25:41 -0800 | [diff] [blame] | 110 | auditallow { domain_deprecated -fsck -fsck_untrusted -init -rild -system_server -vold } proc:lnk_file { open ioctl lock }; # getattr read granted in domain |
| 111 | auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:dir { open getattr read ioctl lock }; # search granted in domain |
| 112 | auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:file r_file_perms; |
| 113 | auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:lnk_file { getattr open ioctl lock }; # read granted in domain |
| Nick Kralevich | 2c8ea36 | 2016-10-29 08:07:12 -0700 | [diff] [blame] | 114 | auditallow { |
| 115 | domain_deprecated |
| 116 | -appdomain |
| 117 | -dumpstate |
| 118 | -fingerprintd |
| 119 | -healthd |
| 120 | -init |
| 121 | -inputflinger |
| 122 | -installd |
| 123 | -keystore |
| 124 | -netd |
| 125 | -rild |
| 126 | -surfaceflinger |
| 127 | -system_server |
| 128 | -zygote |
| 129 | } cgroup:dir r_dir_perms; |
| 130 | auditallow { |
| 131 | domain_deprecated |
| 132 | -appdomain |
| 133 | -dumpstate |
| 134 | -fingerprintd |
| 135 | -healthd |
| 136 | -init |
| 137 | -inputflinger |
| 138 | -installd |
| 139 | -keystore |
| 140 | -netd |
| 141 | -rild |
| 142 | -surfaceflinger |
| 143 | -system_server |
| 144 | -zygote |
| 145 | } cgroup:{ file lnk_file } r_file_perms; |
| Nick Kralevich | 164af10 | 2017-01-06 16:25:41 -0800 | [diff] [blame] | 146 | auditallow { domain_deprecated -appdomain -init -surfaceflinger -system_server -vold } proc_meminfo:file r_file_perms; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 147 | |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 148 | # Get SELinux enforcing status. |
| 149 | allow domain_deprecated selinuxfs:dir r_dir_perms; |
| 150 | allow domain_deprecated selinuxfs:file r_file_perms; |
| Josh Gao | cb3eb4e | 2016-10-19 14:39:30 -0700 | [diff] [blame] | 151 | auditallow { domain_deprecated -appdomain -init -installd -keystore -postinstall_dexopt -runas -servicemanager -system_server -ueventd -zygote } selinuxfs:dir { open getattr read ioctl lock }; # search granted in domain |
| 152 | auditallow { domain_deprecated -appdomain -init -installd -keystore -postinstall_dexopt -runas -servicemanager -system_server -ueventd -zygote } selinuxfs:file { open read ioctl lock }; # getattr granted in domain |