blob: 1b8fb8a4a0d047dfb75f403e6be6e028cc2f594a [file] [log] [blame]
Alan Stokes81e4e872020-02-11 14:43:05 +00001typeattribute shell coredomain, mlstrustedsubject;
Alex Klyubinf5446eb2017-03-23 14:27:32 -07002
Siarhei Vishniakou2a7f5712017-05-10 19:37:06 -07003# allow shell input injection
4allow shell uhid_device:chr_file rw_file_perms;
5
dcashman2e00e632016-10-12 14:58:09 -07006# systrace support - allow atrace to run
Carmen Jackson2c8ca452018-01-30 18:14:45 -08007allow shell debugfs_tracing_debug:dir r_dir_perms;
dcashman2e00e632016-10-12 14:58:09 -07008allow shell debugfs_tracing:dir r_dir_perms;
Joel Galenson27c0aa72017-07-26 16:22:50 -07009allow shell debugfs_tracing:file rw_file_perms;
dcashman2e00e632016-10-12 14:58:09 -070010allow shell debugfs_trace_marker:file getattr;
11allow shell atrace_exec:file rx_file_perms;
12
Carmen Jackson25788df2017-04-14 12:12:50 -070013userdebug_or_eng(`
Joel Galenson47966ce2017-07-27 09:50:25 -070014 allow shell debugfs_tracing_debug:file rw_file_perms;
Carmen Jackson25788df2017-04-14 12:12:50 -070015')
16
Carmen Jackson2c8ca452018-01-30 18:14:45 -080017# read config.gz for CTS purposes
18allow shell config_gz:file r_file_perms;
19
Florian Mayer6c689e82024-02-14 10:54:58 -080020# allow reading tombstones. users can already use bugreports to get those.
21allow shell tombstone_data_file:dir r_dir_perms;
22allow shell tombstone_data_file:file r_file_perms;
23
dcashman3e8dbf02016-12-08 11:23:34 -080024# Run app_process.
25# XXX Transition into its own domain?
26app_domain(shell)
Jin Qiana239f302017-03-23 12:28:20 -070027
28# allow shell to call dumpsys storaged
29binder_call(shell, storaged)
Nick Kralevich14e2e922017-05-08 09:51:59 -070030
31# Perform SELinux access checks, needed for CTS
32selinux_check_access(shell)
33selinux_check_context(shell)
Primiano Tuccic80f9e02017-12-21 03:51:15 +010034
35# Control Perfetto traced and obtain traces from it.
36# Needed for Studio and debugging.
37unix_socket_connect(shell, traced_consumer, traced)
38
39# Allow shell binaries to write trace data to Perfetto. Used for testing and
40# cmdline utils.
Florian Mayer5e522812019-10-08 16:15:14 +010041perfetto_producer(shell)
Yifan Hong00ab5d82018-01-11 11:01:30 -080042
43domain_auto_trans(shell, vendor_shell_exec, vendor_shell)
Primiano Tucci1a9f4f72018-01-24 16:07:09 +000044
David Andersonbad9ca12024-10-28 15:23:35 -070045# Allow shell to execute tradeinmode on userdebug builds, for testing.
46userdebug_or_eng(`
47 domain_auto_trans(shell, tradeinmode_exec, tradeinmode)
48')
49
Primiano Tucci1a9f4f72018-01-24 16:07:09 +000050# Allow shell binaries to exec the perfetto cmdline util and have that
51# transition into its own domain, so that it behaves consistently to
52# when exec()-d by statsd.
53domain_auto_trans(shell, perfetto_exec, perfetto)
Florian Mayeraeca04b2018-12-06 13:28:01 +000054# Allow to send SIGINT to perfetto when daemonized.
55allow shell perfetto:process signal;
Primiano Tucci1a9f4f72018-01-24 16:07:09 +000056
Bookatz022ab0e2018-02-13 09:33:36 -080057# Allow shell to run adb shell cmd stats commands. Needed for CTS.
58binder_call(shell, statsd);
59
Hongming Jin58f83412021-02-09 12:03:40 -080060# Allow shell to read and unlink traces stored in /data/misc/a11ytraces.
61userdebug_or_eng(`
62 allow shell accessibility_trace_data_file:dir rw_dir_perms;
63 allow shell accessibility_trace_data_file:file { r_file_perms unlink };
64')
65
Primiano Tucci1a9f4f72018-01-24 16:07:09 +000066# Allow shell to read and unlink traces stored in /data/misc/perfetto-traces.
67allow shell perfetto_traces_data_file:dir rw_dir_perms;
Florian Mayerc069bc12019-09-30 11:09:45 +010068allow shell perfetto_traces_data_file:file { r_file_perms unlink };
Primiano Tucci2bb85872021-01-18 09:26:57 +000069# ... and /data/misc/perfetto-traces/bugreport/ .
70allow shell perfetto_traces_bugreport_data_file:dir rw_dir_perms;
71allow shell perfetto_traces_bugreport_data_file:file { r_file_perms unlink };
Fan Xu26fa9142018-09-17 17:06:19 -070072
Primiano Tucci512bdb92020-10-13 21:13:09 +010073# Allow shell to create/remove configs stored in /data/misc/perfetto-configs.
74allow shell perfetto_configs_data_file:dir rw_dir_perms;
75allow shell perfetto_configs_data_file:file create_file_perms;
76
Yiwei Zhangff0f79c2018-11-27 15:21:43 -080077# Allow shell to run adb shell cmd gpu commands.
78binder_call(shell, gpuservice);
79
Wei Wangbc71a612018-09-19 16:06:28 -070080# Allow shell to use atrace HAL
81hal_client_domain(shell, hal_atrace)
Jeff Vander Stoep42451772018-09-28 10:55:14 -070082
83# For hostside tests such as CTS listening ports test.
84allow shell proc_net_tcp_udp:file r_file_perms;
Nick Kralevich905b4002019-02-25 15:11:40 -080085
86# The dl.exec_linker* tests need to execute /system/bin/linker
87# b/124789393
88allow shell system_linker_exec:file rx_file_perms;
Nick Kralevich68e27ca2019-02-26 12:30:42 -080089
90# Renderscript host side tests depend on being able to execute
91# /system/bin/bcc (b/126388046)
92allow shell rs_exec:file rx_file_perms;
Yifan Hong18ade862019-03-14 15:45:03 -070093
Roland Levillain06bee182020-11-02 13:52:54 +000094# Allow (host-driven) ART run-tests to execute dex2oat, in order to
95# check ART's compiler.
96allow shell dex2oat_exec:file rx_file_perms;
Martin Stjernholm1e0b4a52022-04-14 17:42:11 +010097allow shell dex2oat_exec:lnk_file read;
Roland Levillain06bee182020-11-02 13:52:54 +000098
Yifan Hong18ade862019-03-14 15:45:03 -070099# Allow shell to start and comminicate with lpdumpd.
100set_prop(shell, lpdumpd_prop);
101binder_call(shell, lpdumpd)
Kiyoung Kim82c87ed2019-08-09 14:20:34 +0900102
Nikita Ioffe91c37952020-03-12 14:45:00 +0000103# Allow shell to set and read value of properties used for CTS tests of
104# userspace reboot
105set_prop(shell, userspace_reboot_test_prop)
106
Michael Rosenfeld5425c872021-11-17 15:48:47 -0800107# Allow shell to set this property to disable charging.
108set_prop(shell, power_debug_prop)
109
JW Wang0f8cf042021-02-24 14:29:06 +0800110# Allow shell to set this property used for rollback tests
111set_prop(shell, rollback_test_prop)
112
Seth Moored3bd6862023-02-24 11:50:51 -0800113# Allow shell to set RKP properties for testing purposes
114set_prop(shell, remote_prov_prop)
115
Eric Biggersb57af5d2019-09-27 13:33:27 -0700116# Allow shell to get encryption policy of /data/local/tmp/, for CTS
117allowxperm shell shell_data_file:dir ioctl {
118 FS_IOC_GET_ENCRYPTION_POLICY
119 FS_IOC_GET_ENCRYPTION_POLICY_EX
120};
Ryan Savitskiffa0dd92020-01-10 19:02:43 +0000121
122# Allow shell to execute simpleperf without a domain transition.
123allow shell simpleperf_exec:file rx_file_perms;
124
Yi Kongb7bb6492021-07-27 17:06:50 +0800125userdebug_or_eng(`
126 # Allow shell to execute profcollectctl without a domain transition.
127 allow shell profcollectd_exec:file rx_file_perms;
128
129 # Allow shell to read profcollectd data files.
130 r_dir_file(shell, profcollectd_data_file)
131
132 # Allow to issue control commands to profcollectd binder service.
133 allow shell profcollectd:binder call;
134')
Yi Kong45551232020-09-01 01:54:01 +0800135
Yi-Yo Chiang686d7792022-11-01 15:08:09 +0800136# Allow shell to run remount command.
137allow shell remount_exec:file rx_file_perms;
138
Ryan Savitskiffa0dd92020-01-10 19:02:43 +0000139# Allow shell to call perf_event_open for profiling other shell processes, but
140# not the whole system.
141allow shell self:perf_event { open read write kernel };
Inseob Kim55e5c9b2020-03-04 17:20:35 +0900142
Seungjae Yood2a08922023-11-15 17:59:30 +0900143# Allow shell to read microdroid vendor image
144r_dir_file(shell, vendor_microdroid_file)
145
Jiyong Parkabdc9732021-06-14 08:30:43 +0900146# Allow shell to read /apex/apex-info-list.xml and the vendor apexes
Tej Singh75385ef2021-06-07 13:27:52 -0700147allow shell apex_info_file:file r_file_perms;
Jiyong Parkabdc9732021-06-14 08:30:43 +0900148allow shell vendor_apex_file:file r_file_perms;
149allow shell vendor_apex_file:dir r_dir_perms;
Jooyung Hanb6211b82023-05-31 17:51:14 +0900150allow shell vendor_apex_metadata_file:dir r_dir_perms;
Tej Singh75385ef2021-06-07 13:27:52 -0700151
Alan Stokes54907522022-02-25 11:59:25 +0000152# Allow shell to read updated APEXes under /data/apex
153allow shell apex_data_file:dir search;
154allow shell staging_data_file:file r_file_perms;
155
Inseob Kim55e5c9b2020-03-04 17:20:35 +0900156# Set properties.
157set_prop(shell, shell_prop)
158set_prop(shell, ctl_bugreport_prop)
159set_prop(shell, ctl_dumpstate_prop)
160set_prop(shell, dumpstate_prop)
161set_prop(shell, exported_dumpstate_prop)
162set_prop(shell, debug_prop)
Michael Rosenfeld3ccbebb2021-02-10 18:45:35 -0800163set_prop(shell, perf_drop_caches_prop)
Inseob Kim55e5c9b2020-03-04 17:20:35 +0900164set_prop(shell, powerctl_prop)
165set_prop(shell, log_tag_prop)
166set_prop(shell, wifi_log_prop)
167# Allow shell to start/stop traced via the persist.traced.enable
168# property (which also takes care of /data/misc initialization).
169set_prop(shell, traced_enabled_prop)
Snild Dolkowef0f3692023-11-10 10:58:01 +0100170# adjust SELinux audit rates
171set_prop(shell, logd_auditrate_prop)
Inseob Kim55e5c9b2020-03-04 17:20:35 +0900172# adjust is_loggable properties
173userdebug_or_eng(`set_prop(shell, log_prop)')
174# logpersist script
175userdebug_or_eng(`set_prop(shell, logpersistd_logging_prop)')
176# Allow shell to start/stop heapprofd via the persist.heapprofd.enable
177# property.
178set_prop(shell, heapprofd_enabled_prop)
179# Allow shell to start/stop traced_perf via the persist.traced_perf.enable
180# property.
181set_prop(shell, traced_perf_enabled_prop)
182# Allow shell to start/stop gsid via ctl.start|stop|restart gsid.
183set_prop(shell, ctl_gsid_prop)
David Anderson09bb9442020-11-13 00:45:59 -0800184set_prop(shell, ctl_snapuserd_prop)
Inseob Kim55e5c9b2020-03-04 17:20:35 +0900185# Allow shell to enable Dynamic System Update
186set_prop(shell, dynamic_system_prop)
187# Allow shell to mock an OTA using persist.pm.mock-upgrade
188set_prop(shell, mock_ota_prop)
189
190# Read device's serial number from system properties
191get_prop(shell, serialno_prop)
192
193# Allow shell to read the vendor security patch level for CTS
194get_prop(shell, vendor_security_patch_level_prop)
195
196# Read state of logging-related properties
197get_prop(shell, device_logging_prop)
198
199# Read state of boot reason properties
200get_prop(shell, bootloader_boot_reason_prop)
201get_prop(shell, last_boot_reason_prop)
202get_prop(shell, system_boot_reason_prop)
203
Max Bires4d3dcd62022-10-07 12:51:15 -0700204# Allow shell to execute the remote key provisioning factory tool
205binder_call(shell, hal_keymint)
Alice Wang4877bed2024-06-27 14:12:10 +0000206# Allow shell to run the AVF RKP HAL during the execution of the remote key
207# provisioning factory tool.
208# TODO(b/351113293): Remove this once the AVF RKP HAL registration is moved to
209# a separate process.
210binder_call(shell, virtualizationservice)
Alice Wang6d3e6132024-08-05 09:55:16 +0000211# Allow the shell to inspect whether AVF remote attestation is supported
212# through the system property.
213get_prop(shell, avf_virtualizationservice_prop)
Max Bires4d3dcd62022-10-07 12:51:15 -0700214
Inseob Kim55e5c9b2020-03-04 17:20:35 +0900215# Allow reading the outcome of perf_event_open LSM support test for CTS.
216get_prop(shell, init_perf_lsm_hooks_prop)
217
Yifan Hong6bb5a762020-10-06 17:52:17 -0700218# Allow shell to read boot image timestamps and fingerprints.
219get_prop(shell, build_bootimage_prop)
220
Martijn Coenenfd6d7082021-08-05 15:11:04 +0200221# Allow shell to read odsign verification properties
222get_prop(shell, odsign_prop)
223
Inseob Kim55e5c9b2020-03-04 17:20:35 +0900224userdebug_or_eng(`set_prop(shell, persist_debug_prop)')
Peiyong Lin37dea072020-06-03 12:20:41 -0700225
Janis Danisevskis47f37612020-07-27 13:07:39 -0700226# Allow shell to read the keystore key contexts files. Used by native tests to test label lookup.
227allow shell keystore2_key_contexts_file:file r_file_perms;
228
229# Allow shell to access the keystore2_key namespace shell_key. Mainly used for native tests.
Janis Danisevskised96f5c2020-09-24 08:55:28 -0700230allow shell shell_key:keystore2_key { delete rebind use get_info update };
Inseob Kim0cef0fe2020-11-17 13:54:52 +0900231
Allen Webbcda514a2021-07-19 14:32:41 -0700232# Allow shell to open and execute memfd files for minijail unit tests.
233userdebug_or_eng(`
234 allow shell appdomain_tmpfs:file { open execute_no_trans };
235')
236
Inseob Kim0cef0fe2020-11-17 13:54:52 +0900237# Allow shell to write db.log.detailed, db.log.slow_query_threshold*
238set_prop(shell, sqlite_log_prop)
Mitch Phillipseaf14042020-12-03 17:23:06 -0800239
240# Allow shell to write MTE properties even on user builds.
241set_prop(shell, arm64_memtag_prop)
Mitch Phillips98b3e4b2024-03-15 16:26:31 +0100242set_prop(shell, permissive_mte_prop)
Tianjiec3752cf2021-01-19 23:02:51 -0800243
Alice Ryhl6b9aa6d2024-02-21 15:18:14 +0000244# Allow shell to write kcmdline properties even on user builds.
245set_prop(shell, kcmdline_prop)
246
Tianjiec3752cf2021-01-19 23:02:51 -0800247# Allow shell to read the dm-verity props on user builds.
248get_prop(shell, verity_status_prop)
Yifan Honga18cf7e2021-02-17 12:06:12 -0800249
250# Allow shell to read Virtual A/B related properties
251get_prop(shell, virtual_ab_prop)
Michael Rosenfeld3ccbebb2021-02-10 18:45:35 -0800252
Yi-Yo Chiang694ab792021-04-09 13:39:20 +0800253# Allow ReadDefaultFstab() for CTS.
254read_fstab(shell)
Nikita Ioffe681ad262021-06-10 15:37:25 +0100255
256# Allow shell read access to /apex/apex-info-list.xml for CTS.
257allow shell apex_info_file:file r_file_perms;
Jiyong Parkf4083712021-07-10 14:35:06 +0900258
Alan Stokes39f49702021-09-02 11:10:59 +0100259# Let the shell user call virtualizationservice (and
260# virtualizationservice call back to shell) for debugging.
261virtualizationservice_use(shell)
Evan Rosky5cfdf2b2022-03-02 22:13:58 +0000262
263# Allow shell to set persist.wm.debug properties
264userdebug_or_eng(`set_prop(shell, persist_wm_debug_prop)')
Mitch Phillips8cd32cd2022-03-22 15:59:57 -0700265
266# Allow shell to write GWP-ASan properties even on user builds.
267set_prop(shell, gwp_asan_prop)
Alexander Roederer829d9742023-03-23 02:19:22 +0000268
269# Allow shell to set persist.sysui.notification.builder_extras_override property
270userdebug_or_eng(`set_prop(shell, persist_sysui_builder_extras_prop)')
Alexander Roederer584a8622023-05-31 21:25:50 +0000271# Allow shell to set persist.sysui.notification.ranking_update_ashmem property
272userdebug_or_eng(`set_prop(shell, persist_sysui_ranking_update_prop)')
Alexander Roederer829d9742023-03-23 02:19:22 +0000273
Wilson Sung679b7cb2023-09-12 11:24:05 +0800274# Allow shell to read the build properties for attestation feature
275get_prop(shell, build_attestation_prop)
276
Yu-Ting Tseng7dea3a32024-07-10 01:48:59 +0000277# Allow shell to execute oatdump.
Yu-Ting Tseng46e40492024-07-09 19:03:39 -0700278# TODO (b/350628688): Remove this once it's safe to do so.
Yu-Ting Tseng7dea3a32024-07-10 01:48:59 +0000279allow shell oatdump_exec:file rx_file_perms;
280
Inseob Kim75806ef2024-03-27 17:18:41 +0900281# Create and use network sockets.
282net_domain(shell)
283
284# logcat
285read_logd(shell)
286control_logd(shell)
287get_prop(shell, logd_prop)
288# logcat -L (directly, or via dumpstate)
289allow shell pstorefs:dir search;
290allow shell pstorefs:file r_file_perms;
291
292# Root fs.
293allow shell rootfs:dir r_dir_perms;
294
295# read files in /data/anr
296allow shell anr_data_file:dir r_dir_perms;
297allow shell anr_data_file:file r_file_perms;
298
299# Access /data/local/tmp.
300allow shell shell_data_file:dir create_dir_perms;
301allow shell shell_data_file:file create_file_perms;
302allow shell shell_data_file:file rx_file_perms;
303allow shell shell_data_file:lnk_file create_file_perms;
304
305# Access /data/local/tests.
306allow shell shell_test_data_file:dir create_dir_perms;
307allow shell shell_test_data_file:file create_file_perms;
308allow shell shell_test_data_file:file rx_file_perms;
309allow shell shell_test_data_file:lnk_file create_file_perms;
310allow shell shell_test_data_file:sock_file create_file_perms;
311
312# Read and delete from /data/local/traces.
313allow shell trace_data_file:file { r_file_perms unlink };
314allow shell trace_data_file:dir { r_dir_perms remove_name write };
315
316# Access /data/misc/profman.
317allow shell profman_dump_data_file:dir { write remove_name r_dir_perms };
318allow shell profman_dump_data_file:file { unlink r_file_perms };
319
320# Read/execute files in /data/nativetest
321userdebug_or_eng(`
322 allow shell nativetest_data_file:dir r_dir_perms;
323 allow shell nativetest_data_file:file rx_file_perms;
324')
325
326# adb bugreport
327unix_socket_connect(shell, dumpstate, dumpstate)
328
329allow shell devpts:chr_file rw_file_perms;
330allow shell tty_device:chr_file rw_file_perms;
331allow shell console_device:chr_file rw_file_perms;
332
333allow shell input_device:dir r_dir_perms;
334allow shell input_device:chr_file r_file_perms;
335
336r_dir_file(shell, system_file)
337allow shell system_file:file x_file_perms;
338allow shell toolbox_exec:file rx_file_perms;
339allow shell shell_exec:file rx_file_perms;
340allow shell zygote_exec:file rx_file_perms;
341
342userdebug_or_eng(`
343 # "systrace --boot" support - allow boottrace service to run
344 allow shell boottrace_data_file:dir rw_dir_perms;
345 allow shell boottrace_data_file:file create_file_perms;
346')
347
348# allow shell access to services
349allow shell servicemanager:service_manager list;
350# don't allow shell to access GateKeeper service
351# TODO: why is this so broad? Tightening candidate? It needs at list:
352# - dumpstate_service (so it can receive dumpstate progress updates)
353allow shell {
354 service_manager_type
355 -apex_service
356 -dnsresolver_service
357 -gatekeeper_service
358 -hal_keymint_service
359 -hal_secureclock_service
360 -hal_sharedsecret_service
361 -incident_service
362 -installd_service
363 -mdns_service
364 -netd_service
365 -system_suspend_control_internal_service
366 -system_suspend_control_service
367 -virtual_touchpad_service
368 -vold_service
369 -default_android_service
Alice Wang4877bed2024-06-27 14:12:10 +0000370 -virtualization_service
Inseob Kim75806ef2024-03-27 17:18:41 +0900371}:service_manager find;
372allow shell dumpstate:binder call;
373
374# allow shell to get information from hwservicemanager
375# for instance, listing hardware services with lshal
376hwbinder_use(shell)
377allow shell hwservicemanager:hwservice_manager list;
378
379# allow shell to look through /proc/ for lsmod, ps, top, netstat, vmstat.
380r_dir_file(shell, proc_net_type)
381
382allow shell {
383 proc_asound
T.J. Mercier716260a2024-04-26 18:28:28 +0000384 proc_cgroups
Inseob Kim75806ef2024-03-27 17:18:41 +0900385 proc_filesystems
386 proc_interrupts
387 proc_loadavg # b/124024827
388 proc_meminfo
389 proc_modules
390 proc_pid_max
391 proc_slabinfo
392 proc_stat
393 proc_timer
394 proc_uptime
395 proc_version
396 proc_vmstat
397 proc_zoneinfo
398}:file r_file_perms;
399
400# allow listing network interfaces under /sys/class/net.
401allow shell sysfs_net:dir r_dir_perms;
402
403r_dir_file(shell, cgroup)
404allow shell cgroup_desc_file:file r_file_perms;
405allow shell cgroup_desc_api_file:file r_file_perms;
406allow shell vendor_cgroup_desc_file:file r_file_perms;
407r_dir_file(shell, cgroup_v2)
408allow shell domain:dir { search open read getattr };
409allow shell domain:{ file lnk_file } { open read getattr };
410
411# statvfs() of /proc and other labeled filesystems
412# (yaffs2, jffs2, ext2, ext3, ext4, xfs, btrfs, f2fs, squashfs, overlay)
413allow shell { proc labeledfs }:filesystem getattr;
414
415# stat() of /dev
416allow shell device:dir getattr;
417
418# allow shell to read /proc/pid/attr/current for ps -Z
419allow shell domain:process getattr;
420
421# Allow pulling the SELinux policy for CTS purposes
422allow shell selinuxfs:dir r_dir_perms;
423allow shell selinuxfs:file r_file_perms;
424
425# enable shell domain to read/write files/dirs for bootchart data
426# User will creates the start and stop file via adb shell
427# and read other files created by init process under /data/bootchart
428allow shell bootchart_data_file:dir rw_dir_perms;
429allow shell bootchart_data_file:file create_file_perms;
430
431# Make sure strace works for the non-privileged shell user
432allow shell self:process ptrace;
433
434# allow shell to get battery info
435allow shell sysfs:dir r_dir_perms;
436allow shell sysfs_batteryinfo:dir r_dir_perms;
437allow shell sysfs_batteryinfo:file r_file_perms;
438
T.J. Mercier12878e52024-04-26 19:27:06 +0000439# Allow reads (but not writes) of the MGLRU state
440allow shell sysfs_lru_gen_enabled:file r_file_perms;
441
Yi-Yo Chiang15bdfcb2024-05-10 18:01:47 +0800442# Allow communicating with the VM terminal.
443userdebug_or_eng(`
444 allow shell vmlauncher_app_devpts:chr_file rw_file_perms;
445 allowxperm shell vmlauncher_app_devpts:chr_file ioctl unpriv_tty_ioctls;
446')
447
Jaewan Kim168e04d2024-06-17 09:29:05 +0000448# Allow CTS to check whether AVF debug policy is installed
449allow shell { proc_dt_avf sysfs_dt_avf }:dir search;
450
Inseob Kim75806ef2024-03-27 17:18:41 +0900451# Allow access to ion memory allocation device.
452allow shell ion_device:chr_file rw_file_perms;
453
454#
455# filesystem test for insecure chr_file's is done
456# via a host side test
457#
458allow shell dev_type:dir r_dir_perms;
459allow shell dev_type:chr_file getattr;
460
461# /dev/fd is a symlink
462allow shell proc:lnk_file getattr;
463
464#
465# filesystem test for insucre blk_file's is done
466# via hostside test
467#
468allow shell dev_type:blk_file getattr;
469
470# read selinux policy files
471allow shell file_contexts_file:file r_file_perms;
472allow shell property_contexts_file:file r_file_perms;
473allow shell seapp_contexts_file:file r_file_perms;
474allow shell service_contexts_file:file r_file_perms;
475allow shell sepolicy_file:file r_file_perms;
476
477# Allow shell to start up vendor shell
478allow shell vendor_shell_exec:file rx_file_perms;
479
Jeongik Cha3335a042024-06-14 14:28:42 +0900480is_flag_enabled(RELEASE_AVF_SUPPORT_CUSTOM_VM_WITH_PARAVIRTUALIZED_DEVICES, `
Jeongik Cha4c36b702024-10-08 17:08:11 +0900481 allow shell linux_vm_setup_exec:file { entrypoint r_file_perms };
Jeongik Cha3335a042024-06-14 14:28:42 +0900482')
483
Inseob Kim75806ef2024-03-27 17:18:41 +0900484# Everything is labeled as rootfs in recovery mode. Allow shell to
485# execute them.
486recovery_only(`
487 allow shell rootfs:file rx_file_perms;
488')
489
490###
491### Neverallow rules
492###
493
494# Do not allow shell to talk directly to security HAL services other than
495# hal_remotelyprovisionedcomponent_service
496neverallow shell {
497 hal_keymint_service
498 hal_secureclock_service
499 hal_sharedsecret_service
Alice Wang4877bed2024-06-27 14:12:10 +0000500 virtualization_service
Inseob Kim75806ef2024-03-27 17:18:41 +0900501}:service_manager find;
502
503# Do not allow shell to hard link to any files.
504# In particular, if shell hard links to app data
505# files, installd will not be able to guarantee the deletion
506# of the linked to file. Hard links also contribute to security
507# bugs, so we want to ensure the shell user never has this
508# capability.
509neverallow shell file_type:file link;
510
511# Do not allow privileged socket ioctl commands
512neverallowxperm shell domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
513
514# limit shell access to sensitive char drivers to
515# only getattr required for host side test.
516neverallow shell {
517 fuse_device
518 hw_random_device
519 port_device
520}:chr_file ~getattr;
521
522# Limit shell to only getattr on blk devices for host side tests.
523neverallow shell dev_type:blk_file ~getattr;
524
525# b/30861057: Shell access to existing input devices is an abuse
526# vector. The shell user can inject events that look like they
527# originate from the touchscreen etc.
528# Everyone should have already moved to UiAutomation#injectInputEvent
529# if they are running instrumentation tests (i.e. CTS), Monkey for
530# their stress tests, and the input command (adb shell input ...) for
531# injecting swipes and things.
532neverallow shell input_device:chr_file no_w_file_perms;
533
534neverallow shell self:perf_event ~{ open read write kernel };
535
536# Never allow others to set or get the perf.drop_caches property.
537neverallow { domain -shell -init } perf_drop_caches_prop:property_service set;
538neverallow { domain -shell -init -dumpstate } perf_drop_caches_prop:file read;