blob: 6dcecad9f7d14d08ae182400aad82fd77c2bc458 [file] [log] [blame]
Alex Klyubin59322f12017-02-06 15:39:36 -08001#
2# System Server aka system_server spawned by zygote.
3# Most of the framework services run in this process.
4#
5
Alex Klyubinf5446eb2017-03-23 14:27:32 -07006typeattribute system_server coredomain;
Alex Klyubin59322f12017-02-06 15:39:36 -08007typeattribute system_server mlstrustedsubject;
8
dcashmancc39f632016-07-22 13:13:11 -07009# Define a type for tmpfs-backed ashmem regions.
10tmpfs_domain(system_server)
Alex Klyubin59322f12017-02-06 15:39:36 -080011
Josh Gaocb3eb4e2016-10-19 14:39:30 -070012# Create a socket for connections from crash_dump.
dcashmancc39f632016-07-22 13:13:11 -070013type_transition system_server system_data_file:sock_file system_ndebug_socket "ndebugsocket";
dcashman2e00e632016-10-12 14:58:09 -070014
15allow system_server zygote_tmpfs:file read;
Jeff Vander Stoep9f5d0d92019-01-29 14:43:45 -080016allow system_server appdomain_tmpfs:file { getattr map read write };
dcashman2e00e632016-10-12 14:58:09 -070017
Alex Klyubin59322f12017-02-06 15:39:36 -080018# For art.
19allow system_server dalvikcache_data_file:dir r_dir_perms;
Nick Kralevichaa365282017-05-03 14:01:58 -070020allow system_server dalvikcache_data_file:file r_file_perms;
21
Andreas Gampec848d372017-04-03 15:23:16 -070022# When running system server under --invoke-with, we'll try to load the boot image under the
23# system server domain, following links to the system partition.
24with_asan(`allow system_server dalvikcache_data_file:lnk_file r_file_perms;')
Alex Klyubin59322f12017-02-06 15:39:36 -080025
Alex Klyubin59322f12017-02-06 15:39:36 -080026# /data/resource-cache
27allow system_server resourcecache_data_file:file r_file_perms;
28allow system_server resourcecache_data_file:dir r_dir_perms;
29
30# ptrace to processes in the same domain for debugging crashes.
31allow system_server self:process ptrace;
32
33# Child of the zygote.
34allow system_server zygote:fd use;
35allow system_server zygote:process sigchld;
36
37# May kill zygote on crashes.
38allow system_server zygote:process sigkill;
39allow system_server crash_dump:process sigkill;
Robert Sesekbacb19b2018-01-30 10:54:33 -050040allow system_server webview_zygote:process sigkill;
Martijn Coenen1bbda7e2018-11-05 11:39:15 +010041allow system_server app_zygote:process sigkill;
Alex Klyubin59322f12017-02-06 15:39:36 -080042
43# Read /system/bin/app_process.
44allow system_server zygote_exec:file r_file_perms;
45
46# Needed to close the zygote socket, which involves getopt / getattr
47allow system_server zygote:unix_stream_socket { getopt getattr };
48
49# system server gets network and bluetooth permissions.
50net_domain(system_server)
51# in addition to ioctls whitelisted for all domains, also allow system_server
52# to use privileged ioctls commands. Needed to set up VPNs.
53allowxperm system_server self:udp_socket ioctl priv_sock_ioctls;
54bluetooth_domain(system_server)
55
markchienf6b59fe2019-01-16 19:23:58 +080056# Allow setup of tcp keepalive offload. This gives system_server the permission to
57# call ioctl on app domains' tcp sockets. Additional ioctl commands still need to
58# be granted individually, except for a small set of safe values whitelisted in
59# public/domain.te.
60allow system_server appdomain:tcp_socket ioctl;
61
Alex Klyubin59322f12017-02-06 15:39:36 -080062# These are the capabilities assigned by the zygote to the
63# system server.
Benjamin Gordon9b2e0cb2017-11-09 15:51:26 -070064allow system_server self:global_capability_class_set {
Alex Klyubin59322f12017-02-06 15:39:36 -080065 ipc_lock
66 kill
67 net_admin
68 net_bind_service
69 net_broadcast
70 net_raw
71 sys_boot
72 sys_nice
Nick Kralevich44866952017-02-15 15:04:43 -080073 sys_ptrace
Alex Klyubin59322f12017-02-06 15:39:36 -080074 sys_time
75 sys_tty_config
76};
77
Alex Klyubin59322f12017-02-06 15:39:36 -080078# Trigger module auto-load.
79allow system_server kernel:system module_request;
80
81# Allow alarmtimers to be set
Benjamin Gordon9b2e0cb2017-11-09 15:51:26 -070082allow system_server self:global_capability2_class_set wake_alarm;
Alex Klyubin59322f12017-02-06 15:39:36 -080083
Jeff Vander Stoepe58a8de2017-06-26 22:06:20 -070084# Create and share netlink_netfilter_sockets for tetheroffload.
85allow system_server self:netlink_netfilter_socket create_socket_perms_no_ioctl;
86
Jeff Vander Stoepd1b14ab2018-07-23 22:05:38 -070087# Create/use netlink_tcpdiag_socket for looking up connection UIDs for VPN apps.
88allow system_server self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read };
89
Alex Klyubin59322f12017-02-06 15:39:36 -080090# Use netlink uevent sockets.
91allow system_server self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl;
92
93# Use generic netlink sockets.
94allow system_server self:netlink_socket create_socket_perms_no_ioctl;
95allow system_server self:netlink_generic_socket create_socket_perms_no_ioctl;
96
Michael Schwartzbc3150a2017-05-18 09:59:05 -070097# libvintf reads the kernel config to verify vendor interface compatibility.
98allow system_server config_gz:file { read open };
99
Alex Klyubin59322f12017-02-06 15:39:36 -0800100# Use generic "sockets" where the address family is not known
101# to the kernel. The ioctl permission is specifically omitted here, but may
102# be added to device specific policy along with the ioctl commands to be
103# whitelisted.
104allow system_server self:socket create_socket_perms_no_ioctl;
105
106# Set and get routes directly via netlink.
107allow system_server self:netlink_route_socket nlmsg_write;
108
109# Kill apps.
Tom Cherryc59eb4d2017-06-13 14:49:17 -0700110allow system_server appdomain:process { getpgid sigkill signal };
Alex Klyubin59322f12017-02-06 15:39:36 -0800111
112# Set scheduling info for apps.
113allow system_server appdomain:process { getsched setsched };
114allow system_server audioserver:process { getsched setsched };
115allow system_server hal_audio:process { getsched setsched };
Philip Cuadra6eee6eb2017-03-23 10:03:49 -0700116allow system_server hal_bluetooth:process { getsched setsched };
Steven Moreland7baf7252018-05-25 16:23:37 -0700117allow system_server hal_omx_server:process { getsched setsched };
Alex Klyubin59322f12017-02-06 15:39:36 -0800118allow system_server cameraserver:process { getsched setsched };
Eino-Ville Talvala6d53c9e2017-02-15 13:38:25 -0800119allow system_server hal_camera:process { getsched setsched };
Alex Klyubin59322f12017-02-06 15:39:36 -0800120allow system_server mediaserver:process { getsched setsched };
121allow system_server bootanim:process { getsched setsched };
122
Tim Murraya8d538f2019-03-11 11:27:25 -0700123# Allow system_server to write to /proc/<pid>/*
124allow system_server domain:file w_file_perms;
Max Bires655599a2017-07-18 10:18:35 -0700125
Alex Klyubin59322f12017-02-06 15:39:36 -0800126# Read /proc/pid data for all domains. This is used by ProcessCpuTracker
127# within system_server to keep track of memory and CPU usage for
128# all processes on the device. In addition, /proc/pid files access is needed
129# for dumping stack traces of native processes.
130r_dir_file(system_server, domain)
131
Alex Klyubin59322f12017-02-06 15:39:36 -0800132# Write /proc/uid_cputime/remove_uid_range.
133allow system_server proc_uid_cputime_removeuid:file { w_file_perms getattr };
134
135# Write /proc/uid_procstat/set.
136allow system_server proc_uid_procstat_set:file { w_file_perms getattr };
137
138# Write to /proc/sysrq-trigger.
139allow system_server proc_sysrq:file rw_file_perms;
140
yro36dd2a42018-03-29 11:07:13 -0700141# Delete /data/misc/stats-data/ and /data/misc/stats-service/ directories.
142allow system_server stats_data_file:dir { open read remove_name search write };
143allow system_server stats_data_file:file unlink;
144
Alex Klyubin59322f12017-02-06 15:39:36 -0800145# Read /sys/kernel/debug/wakeup_sources.
Yi Jinbc24ba72018-01-22 14:00:46 -0800146allow system_server debugfs_wakeup_sources:file r_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800147
yro7cacc852018-03-30 18:40:30 -0700148# Delete /data/misc/stats-data/ and /data/misc/stats-service/ directories.
149allow system_server stats_data_file:dir { open read remove_name search write };
150allow system_server stats_data_file:file unlink;
151
Alex Klyubin59322f12017-02-06 15:39:36 -0800152# The DhcpClient and WifiWatchdog use packet_sockets
153allow system_server self:packet_socket create_socket_perms_no_ioctl;
154
Alex Klyubin59322f12017-02-06 15:39:36 -0800155# 3rd party VPN clients require a tun_socket to be created
156allow system_server self:tun_socket create_socket_perms_no_ioctl;
157
158# Talk to init and various daemons via sockets.
159unix_socket_connect(system_server, lmkd, lmkd)
160unix_socket_connect(system_server, mtpd, mtp)
161unix_socket_connect(system_server, netd, netd)
Alex Klyubin59322f12017-02-06 15:39:36 -0800162unix_socket_connect(system_server, zygote, zygote)
163unix_socket_connect(system_server, racoon, racoon)
Alex Klyubin59322f12017-02-06 15:39:36 -0800164unix_socket_connect(system_server, uncrypt, uncrypt)
165
Howard Ro98de3222018-10-08 13:15:10 -0700166# Allow system_server to write to statsd.
167unix_socket_send(system_server, statsdw, statsd)
168
Alex Klyubin59322f12017-02-06 15:39:36 -0800169# Communicate over a socket created by surfaceflinger.
170allow system_server surfaceflinger:unix_stream_socket { read write setopt };
171
Peiyong Lin7924dc62018-11-01 13:47:51 -0700172allow system_server gpuservice:unix_stream_socket { read write setopt };
173
Robert Sesekca4c4e52018-01-30 10:54:33 -0500174# Communicate over a socket created by webview_zygote.
175allow system_server webview_zygote:unix_stream_socket { read write connectto setopt };
176
Martijn Coenen1bbda7e2018-11-05 11:39:15 +0100177# Communicate over a socket created by app_zygote.
178allow system_server app_zygote:unix_stream_socket { read write connectto setopt };
179
Alex Klyubin59322f12017-02-06 15:39:36 -0800180# Perform Binder IPC.
181binder_use(system_server)
182binder_call(system_server, appdomain)
183binder_call(system_server, binderservicedomain)
184binder_call(system_server, dumpstate)
185binder_call(system_server, fingerprintd)
Alex Klyubin59322f12017-02-06 15:39:36 -0800186binder_call(system_server, gatekeeperd)
MÃ¥rten Kongstadf62362d2018-06-15 08:08:19 +0200187binder_call(system_server, idmap)
Alex Klyubin59322f12017-02-06 15:39:36 -0800188binder_call(system_server, installd)
Joe Onorato41f93db2016-11-20 23:23:04 -0800189binder_call(system_server, incidentd)
Igor Murashkin68b2f982018-11-29 15:37:22 -0800190binder_call(system_server, iorapd)
Alex Klyubin59322f12017-02-06 15:39:36 -0800191binder_call(system_server, netd)
Carmen Jackson07cb0de2019-02-05 14:21:01 -0800192binder_call(system_server, notify_traceur)
yro29708452017-12-18 15:14:33 -0800193binder_call(system_server, statsd)
Jin Qianfa6c3d72017-10-16 16:39:13 -0700194binder_call(system_server, storaged)
Neda Topoljanacbffe1632018-11-21 18:10:54 +0000195binder_call(system_server, update_engine)
Jeff Sharkey0fa3fb02017-09-06 11:17:32 -0600196binder_call(system_server, vold)
Alex Klyubin59322f12017-02-06 15:39:36 -0800197binder_call(system_server, wificond)
Robert Quattlebaumc8bd93d2017-08-04 14:51:36 -0700198binder_call(system_server, wpantund)
Andreas Gampe986b9af2018-04-30 12:23:20 -0700199userdebug_or_eng(`
200 binder_call(system_server, perfprofd)
201')
Alex Klyubin59322f12017-02-06 15:39:36 -0800202binder_service(system_server)
203
Alex Klyubin632bc492017-04-13 19:05:27 -0700204# Use HALs
Alex Klyubin7cda44f2017-03-21 14:28:53 -0700205hal_client_domain(system_server, hal_allocator)
Andrew Scull1aedf4b2018-01-10 16:11:46 +0000206hal_client_domain(system_server, hal_authsecret)
Tomasz Wasilczyk567b9472017-08-07 17:06:06 -0700207hal_client_domain(system_server, hal_broadcastradio)
Jeff Vander Stoep23e0a7f2017-06-23 08:40:16 -0700208hal_client_domain(system_server, hal_configstore)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700209hal_client_domain(system_server, hal_contexthub)
Zachary Iqbal893272d2018-05-24 00:59:40 -0700210hal_client_domain(system_server, hal_face)
Alex Klyubinf98650e2017-02-21 15:35:16 -0800211hal_client_domain(system_server, hal_fingerprint)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700212hal_client_domain(system_server, hal_gnss)
Alex Klyubin5007c102017-04-17 12:53:40 -0700213hal_client_domain(system_server, hal_graphics_allocator)
Yifan Hong9788e832017-06-02 13:59:39 -0700214hal_client_domain(system_server, hal_health)
Siarhei Vishniakou41a871b2018-01-17 12:27:06 -0800215hal_client_domain(system_server, hal_input_classifier)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700216hal_client_domain(system_server, hal_ir)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700217hal_client_domain(system_server, hal_light)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700218hal_client_domain(system_server, hal_memtrack)
Michael Butlere9d07b92017-06-29 18:33:03 -0700219hal_client_domain(system_server, hal_neuralnetworks)
Andrew Scull46ac9262017-03-27 15:40:21 +0100220hal_client_domain(system_server, hal_oemlock)
Steven Moreland7baf7252018-05-25 16:23:37 -0700221hal_client_domain(system_server, hal_omx)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700222hal_client_domain(system_server, hal_power)
Benjamin Schwartze7040ea2018-12-10 14:59:57 -0800223hal_client_domain(system_server, hal_power_stats)
Alex Klyubin41518be2017-03-13 15:13:52 -0700224hal_client_domain(system_server, hal_sensors)
pkanwar722249b2017-05-21 16:49:37 -0700225hal_client_domain(system_server, hal_tetheroffload)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700226hal_client_domain(system_server, hal_thermal)
Donghyun Chof81dd0c2017-04-05 11:20:48 +0900227hal_client_domain(system_server, hal_tv_cec)
Shubangc76e1582017-03-29 15:03:59 -0700228hal_client_domain(system_server, hal_tv_input)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700229hal_client_domain(system_server, hal_usb)
Badhri Jagan Sridharan9b078892018-01-08 09:29:40 -0800230hal_client_domain(system_server, hal_usb_gadget)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700231hal_client_domain(system_server, hal_vibrator)
Alex Klyubin9e6b24c2017-03-16 18:48:40 -0700232hal_client_domain(system_server, hal_vr)
Andrew Scull9c58c142017-03-27 14:27:20 +0100233hal_client_domain(system_server, hal_weaver)
Alex Klyubin1d2a1472017-02-22 15:12:19 -0800234hal_client_domain(system_server, hal_wifi)
Roshan Pius5bca3e82017-12-22 15:03:15 -0800235hal_client_domain(system_server, hal_wifi_hostapd)
Sohani Rao3dd460b2017-03-01 10:25:44 -0800236hal_client_domain(system_server, hal_wifi_offload)
Roshan Pius2a9595e2017-02-18 21:32:32 -0800237hal_client_domain(system_server, hal_wifi_supplicant)
Alex Klyubin59322f12017-02-06 15:39:36 -0800238
Martijn Coenende2e79c2017-04-14 15:55:20 -0700239# Talk with graphics composer fences
240allow system_server hal_graphics_composer:fd use;
241
Alex Klyubin632bc492017-04-13 19:05:27 -0700242# Use RenderScript always-passthrough HAL
243allow system_server hal_renderscript_hwservice:hwservice_manager find;
Tri Vo90cf5a72018-10-18 12:39:35 -0700244allow system_server same_process_hal_file:file { execute read open getattr map };
Alex Klyubin632bc492017-04-13 19:05:27 -0700245
246# Offer HwBinder services
247add_hwservice(system_server, fwk_scheduler_hwservice)
248add_hwservice(system_server, fwk_sensor_hwservice)
249
Alex Klyubin59322f12017-02-06 15:39:36 -0800250# Talk to tombstoned to get ANR traces.
251unix_socket_connect(system_server, tombstoned_intercept, tombstoned)
252
Chia-I Wue4d21462017-04-20 14:34:00 -0700253# List HAL interfaces to get ANR traces.
254allow system_server hwservicemanager:hwservice_manager list;
255
Alex Klyubin59322f12017-02-06 15:39:36 -0800256# Send signals to trigger ANR traces.
Alex Klyubin59322f12017-02-06 15:39:36 -0800257allow system_server {
Steven Morelandfac31442017-03-24 09:37:17 -0700258 # This is derived from the list that system server defines as interesting native processes
259 # to dump during ANRs or watchdog aborts, defined in NATIVE_STACKS_OF_INTEREST in
260 # frameworks/base/services/core/java/com/android/server/Watchdog.java.
Alex Klyubin59322f12017-02-06 15:39:36 -0800261 audioserver
262 cameraserver
263 drmserver
Peiyong Lin7924dc62018-11-01 13:47:51 -0700264 gpuservice
Alex Klyubin59322f12017-02-06 15:39:36 -0800265 inputflinger
Alex Klyubin59322f12017-02-06 15:39:36 -0800266 mediadrmserver
267 mediaextractor
268 mediaserver
269 mediametrics
270 sdcardd
Andreas Gampe7468db62018-01-24 17:56:25 -0800271 statsd
Alex Klyubin59322f12017-02-06 15:39:36 -0800272 surfaceflinger
Jeff Sharkeyd1018962019-02-05 14:39:02 -0700273 vold
Steven Morelandfac31442017-03-24 09:37:17 -0700274
275 # This list comes from HAL_INTERFACES_OF_INTEREST in
276 # frameworks/base/services/core/java/com/android/server/Watchdog.java.
277 hal_audio_server
278 hal_bluetooth_server
279 hal_camera_server
Chia-I Wuc3aec702018-08-09 15:56:09 -0700280 hal_graphics_allocator_server
Chia-I Wue4d21462017-04-20 14:34:00 -0700281 hal_graphics_composer_server
Yifan Hong0d53ef22018-11-27 17:35:31 -0800282 hal_health_server
Steven Moreland7baf7252018-05-25 16:23:37 -0700283 hal_omx_server
Peng Xue4968f92017-07-11 21:18:53 -0700284 hal_sensors_server
Steven Morelandfac31442017-03-24 09:37:17 -0700285 hal_vr_server
Alex Klyubin59322f12017-02-06 15:39:36 -0800286}:process { signal };
287
288# Use sockets received over binder from various services.
289allow system_server audioserver:tcp_socket rw_socket_perms;
290allow system_server audioserver:udp_socket rw_socket_perms;
291allow system_server mediaserver:tcp_socket rw_socket_perms;
292allow system_server mediaserver:udp_socket rw_socket_perms;
293
294# Use sockets received over binder from various services.
295allow system_server mediadrmserver:tcp_socket rw_socket_perms;
296allow system_server mediadrmserver:udp_socket rw_socket_perms;
297
Sandeep Patilc9cf7362017-03-24 15:02:13 -0700298# Get file context
299allow system_server file_contexts_file:file r_file_perms;
Sandeep Patilbb24f3a2017-03-27 12:06:04 -0700300# access for mac_permissions
301allow system_server mac_perms_file: file r_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800302# Check SELinux permissions.
303selinux_check_access(system_server)
304
Tri Voce8bc8b2017-12-19 13:23:11 -0800305allow system_server sysfs_type:dir search;
306
Tri Vo19602152017-10-09 20:39:34 -0700307r_dir_file(system_server, sysfs_android_usb)
308allow system_server sysfs_android_usb:file w_file_perms;
309
Nick Chalko4ccc8562019-02-15 12:15:21 -0800310allow system_server sysfs_extcon:dir r_dir_perms;
311
Tri Vo19602152017-10-09 20:39:34 -0700312r_dir_file(system_server, sysfs_ipv4)
313allow system_server sysfs_ipv4:file w_file_perms;
314
315r_dir_file(system_server, sysfs_rtc)
316r_dir_file(system_server, sysfs_switch)
317r_dir_file(system_server, sysfs_wakeup_reasons)
318
Alex Klyubin59322f12017-02-06 15:39:36 -0800319allow system_server sysfs_nfc_power_writable:file rw_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800320allow system_server sysfs_mac_address:file r_file_perms;
Max Biresaed69d62017-10-17 12:40:02 -0700321allow system_server sysfs_power:dir search;
Tri Vo19602152017-10-09 20:39:34 -0700322allow system_server sysfs_power:file rw_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800323allow system_server sysfs_thermal:dir search;
324allow system_server sysfs_thermal:file r_file_perms;
325
326# TODO: Remove when HALs are forced into separate processes
327allow system_server sysfs_vibrator:file { write append };
328
329# TODO: added to match above sysfs rule. Remove me?
330allow system_server sysfs_usb:file w_file_perms;
331
332# Access devices.
333allow system_server device:dir r_dir_perms;
334allow system_server mdns_socket:sock_file rw_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800335allow system_server gpu_device:chr_file rw_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800336allow system_server input_device:dir r_dir_perms;
337allow system_server input_device:chr_file rw_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800338allow system_server tty_device:chr_file rw_file_perms;
339allow system_server usbaccessory_device:chr_file rw_file_perms;
340allow system_server video_device:dir r_dir_perms;
341allow system_server video_device:chr_file rw_file_perms;
342allow system_server adbd_socket:sock_file rw_file_perms;
343allow system_server rtc_device:chr_file rw_file_perms;
344allow system_server audio_device:dir r_dir_perms;
345
Tri Vo8a6cc522018-11-28 13:47:44 -0800346# write access to ALSA interfaces (/dev/snd/*) needed for MIDI
Alex Klyubin59322f12017-02-06 15:39:36 -0800347allow system_server audio_device:chr_file rw_file_perms;
348
349# tun device used for 3rd party vpn apps
350allow system_server tun_device:chr_file rw_file_perms;
Nick Kralevich619c1ef2018-10-30 20:12:41 -0700351allowxperm system_server tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF };
Alex Klyubin59322f12017-02-06 15:39:36 -0800352
Neda Topoljanacbffe1632018-11-21 18:10:54 +0000353# Manage data/ota_package
354allow system_server ota_package_file:dir rw_dir_perms;
355allow system_server ota_package_file:file create_file_perms;
356
Alex Klyubin59322f12017-02-06 15:39:36 -0800357# Manage system data files.
358allow system_server system_data_file:dir create_dir_perms;
359allow system_server system_data_file:notdevfile_class_set create_file_perms;
Florian Mayer4ab64c92019-03-19 18:14:38 +0000360allow system_server packages_list_file:file create_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800361allow system_server keychain_data_file:dir create_dir_perms;
362allow system_server keychain_data_file:file create_file_perms;
363allow system_server keychain_data_file:lnk_file create_file_perms;
364
365# Manage /data/app.
366allow system_server apk_data_file:dir create_dir_perms;
367allow system_server apk_data_file:{ file lnk_file } { create_file_perms link };
368allow system_server apk_tmp_file:dir create_dir_perms;
369allow system_server apk_tmp_file:file create_file_perms;
370
Siarhei Vishniakou3639f572018-10-08 12:04:15 -0700371# Access input configuration files in the /vendor directory
372r_dir_file(system_server, vendor_keylayout_file)
373r_dir_file(system_server, vendor_keychars_file)
374r_dir_file(system_server, vendor_idc_file)
375
Jeff Vander Stoep9e335652018-02-28 08:19:48 -0800376# Access /vendor/{app,framework,overlay}
Sandeep Patil277a20e2017-04-01 17:17:12 -0700377r_dir_file(system_server, vendor_app_file)
Jeff Vander Stoep9e335652018-02-28 08:19:48 -0800378r_dir_file(system_server, vendor_framework_file)
Sandeep Patil90756992017-04-05 16:16:13 -0700379r_dir_file(system_server, vendor_overlay_file)
380
Alex Klyubin59322f12017-02-06 15:39:36 -0800381# Manage /data/app-private.
382allow system_server apk_private_data_file:dir create_dir_perms;
383allow system_server apk_private_data_file:file create_file_perms;
384allow system_server apk_private_tmp_file:dir create_dir_perms;
385allow system_server apk_private_tmp_file:file create_file_perms;
386
387# Manage files within asec containers.
388allow system_server asec_apk_file:dir create_dir_perms;
389allow system_server asec_apk_file:file create_file_perms;
390allow system_server asec_public_file:file create_file_perms;
391
392# Manage /data/anr.
Narayan Kamath11bfcc12017-05-15 18:39:16 +0100393#
394# TODO: Some of these permissions can be withdrawn once we've switched to the
395# new stack dumping mechanism, see b/32064548 and the rules below. In particular,
396# the system_server should never need to create a new anr_data_file:file or write
397# to one, but it will still need to read and append to existing files.
Alex Klyubin59322f12017-02-06 15:39:36 -0800398allow system_server anr_data_file:dir create_dir_perms;
399allow system_server anr_data_file:file create_file_perms;
400
Narayan Kamath11bfcc12017-05-15 18:39:16 +0100401# New stack dumping scheme : request an output FD from tombstoned via a unix
402# domain socket.
403#
404# Allow system_server to connect and write to the tombstoned java trace socket in
Narayan Kamatha34781a2017-05-30 17:52:46 +0100405# order to dump its traces. Also allow the system server to write its traces to
Kweku Adams985db6d2018-03-12 16:21:40 -0700406# dumpstate during bugreport capture and incidentd during incident collection.
Narayan Kamath11bfcc12017-05-15 18:39:16 +0100407unix_socket_connect(system_server, tombstoned_java_trace, tombstoned)
408allow system_server tombstoned:fd use;
Narayan Kamatha34781a2017-05-30 17:52:46 +0100409allow system_server dumpstate:fifo_file append;
Kweku Adams985db6d2018-03-12 16:21:40 -0700410allow system_server incidentd:fifo_file append;
Josh Gao5ca755e2018-07-17 12:46:01 -0700411# Write to a pipe created from `adb shell` (for debuggerd -j `pidof system_server`)
412userdebug_or_eng(`
413 allow system_server su:fifo_file append;
414')
Narayan Kamath11bfcc12017-05-15 18:39:16 +0100415
Joe Onorato9cc5c092019-03-16 15:45:45 -0700416# Allow system_server to read pipes from incidentd (used to deliver incident reports
417# to dropbox)
418allow system_server incidentd:fifo_file read;
419
Joe Onorato41f93db2016-11-20 23:23:04 -0800420# Read /data/misc/incidents - only read. The fd will be sent over binder,
421# with no DAC access to it, for dropbox to read.
422allow system_server incident_data_file:file read;
423
Primiano Tucci1a9f4f72018-01-24 16:07:09 +0000424# Allow dropbox to read /data/misc/perfetto-traces. Only the fd is sent over
425# binder.
426allow system_server perfetto_traces_data_file:file read;
427allow system_server perfetto:fd use;
428
Andreas Gampe01936202018-03-19 13:31:38 -0700429# Allow dropbox to read /data/misc/perfprofd. Only the fd is sent over binder.
430userdebug_or_eng(`
Andreas Gampe835881a2018-05-10 15:07:09 -0700431 allow system_server perfprofd_data_file:file { getattr read };
Andreas Gampe01936202018-03-19 13:31:38 -0700432 allow system_server perfprofd:fd use;
433')
434
Alex Klyubin59322f12017-02-06 15:39:36 -0800435# Manage /data/backup.
436allow system_server backup_data_file:dir create_dir_perms;
437allow system_server backup_data_file:file create_file_perms;
438
Jeff Vander Stoep4d3ee1a2018-04-16 07:49:49 -0700439# Write to /data/system/dropbox
440allow system_server dropbox_data_file:dir create_dir_perms;
441allow system_server dropbox_data_file:file create_file_perms;
442
Alex Klyubin59322f12017-02-06 15:39:36 -0800443# Write to /data/system/heapdump
444allow system_server heapdump_data_file:dir rw_dir_perms;
445allow system_server heapdump_data_file:file create_file_perms;
446
447# Manage /data/misc/adb.
448allow system_server adb_keys_file:dir create_dir_perms;
449allow system_server adb_keys_file:file create_file_perms;
450
Ricky Waiff3b9572017-12-14 09:56:32 +0000451# Manage /data/misc/network_watchlist
452allow system_server network_watchlist_data_file:dir create_dir_perms;
453allow system_server network_watchlist_data_file:file create_file_perms;
454
Alex Klyubin59322f12017-02-06 15:39:36 -0800455# Manage /data/misc/sms.
456# TODO: Split into a separate type?
457allow system_server radio_data_file:dir create_dir_perms;
458allow system_server radio_data_file:file create_file_perms;
459
460# Manage /data/misc/systemkeys.
461allow system_server systemkeys_data_file:dir create_dir_perms;
462allow system_server systemkeys_data_file:file create_file_perms;
463
Abodunrinwa Tokiadfc5db2017-04-26 21:20:20 +0100464# Manage /data/misc/textclassifier.
465allow system_server textclassifier_data_file:dir create_dir_perms;
466allow system_server textclassifier_data_file:file create_file_perms;
467
Alex Klyubin59322f12017-02-06 15:39:36 -0800468# Access /data/tombstones.
469allow system_server tombstone_data_file:dir r_dir_perms;
470allow system_server tombstone_data_file:file r_file_perms;
471
472# Manage /data/misc/vpn.
473allow system_server vpn_data_file:dir create_dir_perms;
474allow system_server vpn_data_file:file create_file_perms;
475
476# Manage /data/misc/wifi.
477allow system_server wifi_data_file:dir create_dir_perms;
478allow system_server wifi_data_file:file create_file_perms;
479
480# Manage /data/misc/zoneinfo.
481allow system_server zoneinfo_data_file:dir create_dir_perms;
482allow system_server zoneinfo_data_file:file create_file_perms;
483
Gavin Corkery64b812c2019-02-27 11:21:20 +0000484# Manage /data/app-staging.
Dario Freni274c1de2019-01-02 14:20:52 +0000485allow system_server staging_data_file:dir create_dir_perms;
486allow system_server staging_data_file:file create_file_perms;
487
Alex Klyubin59322f12017-02-06 15:39:36 -0800488# Walk /data/data subdirectories.
489# Types extracted from seapp_contexts type= fields.
Nick Kralevich23c9d912018-08-02 15:54:23 -0700490allow system_server {
491 system_app_data_file
492 bluetooth_data_file
493 nfc_data_file
494 radio_data_file
495 shell_data_file
496 app_data_file
497 privapp_data_file
498}:dir { getattr read search };
499
Alex Klyubin59322f12017-02-06 15:39:36 -0800500# Also permit for unlabeled /data/data subdirectories and
501# for unlabeled asec containers on upgrades from 4.2.
502allow system_server unlabeled:dir r_dir_perms;
503# Read pkg.apk file before it has been relabeled by vold.
504allow system_server unlabeled:file r_file_perms;
505
506# Populate com.android.providers.settings/databases/settings.db.
507allow system_server system_app_data_file:dir create_dir_perms;
508allow system_server system_app_data_file:file create_file_perms;
509
510# Receive and use open app data files passed over binder IPC.
511# Types extracted from seapp_contexts type= fields.
Nick Kralevich23c9d912018-08-02 15:54:23 -0700512allow system_server {
513 system_app_data_file
514 bluetooth_data_file
515 nfc_data_file
516 radio_data_file
517 shell_data_file
518 app_data_file
519 privapp_data_file
David Ng383471c2018-04-11 10:43:57 -0700520}:file { getattr read write append map };
Alex Klyubin59322f12017-02-06 15:39:36 -0800521
522# Access to /data/media for measuring disk usage.
523allow system_server media_rw_data_file:dir { search getattr open read };
524
525# Receive and use open /data/media files passed over binder IPC.
526# Also used for measuring disk usage.
527allow system_server media_rw_data_file:file { getattr read write append };
528
Florian Mayer4ab64c92019-03-19 18:14:38 +0000529# System server needs to setfscreate to packages_list_file when writing
530# /data/system/packages.list
531allow system_server system_server:process setfscreate;
532
Alex Klyubin59322f12017-02-06 15:39:36 -0800533# Relabel apk files.
534allow system_server { apk_tmp_file apk_private_tmp_file }:{ dir file } { relabelfrom relabelto };
535allow system_server { apk_data_file apk_private_data_file }:{ dir file } { relabelfrom relabelto };
536
537# Relabel wallpaper.
538allow system_server system_data_file:file relabelfrom;
539allow system_server wallpaper_file:file relabelto;
540allow system_server wallpaper_file:file { rw_file_perms rename unlink };
541
542# Backup of wallpaper imagery uses temporary hard links to avoid data churn
543allow system_server { system_data_file wallpaper_file }:file link;
544
545# ShortcutManager icons
546allow system_server system_data_file:dir relabelfrom;
547allow system_server shortcut_manager_icons:dir { create_dir_perms relabelto };
548allow system_server shortcut_manager_icons:file create_file_perms;
549
550# Manage ringtones.
551allow system_server ringtone_file:dir { create_dir_perms relabelto };
552allow system_server ringtone_file:file create_file_perms;
553
554# Relabel icon file.
555allow system_server icon_file:file relabelto;
556allow system_server icon_file:file { rw_file_perms unlink };
557
558# FingerprintService.java does a restorecon of the directory /data/system/users/[0-9]+/fpdata(/.*)?
559allow system_server system_data_file:dir relabelfrom;
560
Hongyi Zhangb61ac072018-11-27 13:23:21 -0800561# server_configurable_flags_data_file is used for storing server configurable flags which
562# have been reset during current booting. system_server needs to read the data to perform related
563# disaster recovery actions.
564allow system_server server_configurable_flags_data_file:dir r_dir_perms;
565allow system_server server_configurable_flags_data_file:file r_file_perms;
566
Alex Klyubin59322f12017-02-06 15:39:36 -0800567# Property Service write
568set_prop(system_server, system_prop)
Jaekyun Seoke4971452017-10-19 16:54:49 +0900569set_prop(system_server, exported_system_prop)
570set_prop(system_server, exported2_system_prop)
571set_prop(system_server, exported3_system_prop)
Alex Klyubin59322f12017-02-06 15:39:36 -0800572set_prop(system_server, safemode_prop)
573set_prop(system_server, dhcp_prop)
574set_prop(system_server, net_radio_prop)
Nick Kralevich4e404292017-02-09 16:08:11 -0800575set_prop(system_server, net_dns_prop)
Alex Klyubin59322f12017-02-06 15:39:36 -0800576set_prop(system_server, system_radio_prop)
Jaekyun Seoke4971452017-10-19 16:54:49 +0900577set_prop(system_server, exported_system_radio_prop)
Alex Klyubin59322f12017-02-06 15:39:36 -0800578set_prop(system_server, debug_prop)
579set_prop(system_server, powerctl_prop)
580set_prop(system_server, fingerprint_prop)
Jaekyun Seokf9d27882018-01-12 10:19:48 +0900581set_prop(system_server, exported_fingerprint_prop)
Alex Klyubin59322f12017-02-06 15:39:36 -0800582set_prop(system_server, device_logging_prop)
Alex Klyubin59322f12017-02-06 15:39:36 -0800583set_prop(system_server, dumpstate_options_prop)
584set_prop(system_server, overlay_prop)
Jaekyun Seoke4971452017-10-19 16:54:49 +0900585set_prop(system_server, exported_overlay_prop)
Calin Juravle53165482017-11-16 05:28:14 +0000586set_prop(system_server, pm_prop)
Jaekyun Seoke4971452017-10-19 16:54:49 +0900587set_prop(system_server, exported_pm_prop)
Alex Klyubin59322f12017-02-06 15:39:36 -0800588userdebug_or_eng(`set_prop(system_server, wifi_log_prop)')
589
590# ctl interface
591set_prop(system_server, ctl_default_prop)
592set_prop(system_server, ctl_bugreport_prop)
David Anderson64bbf052019-02-27 18:31:11 -0800593set_prop(system_server, ctl_gsid_prop)
Alex Klyubin59322f12017-02-06 15:39:36 -0800594
595# cppreopt property
596set_prop(system_server, cppreopt_prop)
597
Hongyi Zhangda492f42018-11-15 16:27:18 -0800598# server configurable flags properties
Siarhei Vishniakouc0c91552019-01-14 14:18:38 -0800599set_prop(system_server, device_config_input_native_boot_prop)
chenbrucee3d625b2018-12-27 18:01:25 +0800600set_prop(system_server, device_config_netd_native_prop)
Ng Zhi Anc5bf4a32019-01-17 13:30:05 -0800601set_prop(system_server, device_config_activity_manager_native_boot_prop)
Mathieu Chartier0327d102019-02-01 13:43:11 -0800602set_prop(system_server, device_config_runtime_native_boot_prop)
Mathieu Chartier669cef82019-01-29 09:57:11 -0800603set_prop(system_server, device_config_runtime_native_prop)
Dongwon Kang523c7462019-01-30 15:28:31 -0800604set_prop(system_server, device_config_media_native_prop)
Hongyi Zhangda492f42018-11-15 16:27:18 -0800605
Mark Salyzyn006c2e92017-08-14 14:25:10 -0700606# BootReceiver to read ro.boot.bootreason
607get_prop(system_server, bootloader_boot_reason_prop)
Mark Salyzyna1bce772018-06-05 09:41:59 -0700608# PowerManager to read sys.boot.reason
609get_prop(system_server, system_boot_reason_prop)
Mark Salyzyn006c2e92017-08-14 14:25:10 -0700610
Alex Klyubin59322f12017-02-06 15:39:36 -0800611# Collect metrics on boot time created by init
612get_prop(system_server, boottime_prop)
613
614# Read device's serial number from system properties
615get_prop(system_server, serialno_prop)
616
617# Read/write the property which keeps track of whether this is the first start of system_server
618set_prop(system_server, firstboot_prop)
619
Eino-Ville Talvala3ac71f82018-06-20 14:08:02 -0700620# Audio service in system server can read exported audio properties,
621# such as camera shutter enforcement
622get_prop(system_server, exported_audio_prop)
623
Hongyi Zhangd600c0c2018-11-16 14:59:10 -0800624# system server reads this property to keep track of whether server configurable flags have been
625# reset during current boot.
626get_prop(system_server, device_config_reset_performed_prop)
627
William Hester5f486c72019-01-15 13:39:30 -0800628# Read/write the property that enables Test Harness Mode
629set_prop(system_server, test_harness_prop)
630
David Anderson8fe3c742019-02-07 13:14:20 -0800631# Read gsid.image_running.
632get_prop(system_server, gsid_prop)
633
Alex Klyubin59322f12017-02-06 15:39:36 -0800634# Create a socket for connections from debuggerd.
635allow system_server system_ndebug_socket:sock_file create_file_perms;
636
637# Manage cache files.
Jeff Vander Stoepa4cada72017-07-26 09:54:36 -0700638allow system_server cache_file:lnk_file r_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800639allow system_server { cache_file cache_recovery_file }:dir { relabelfrom create_dir_perms };
640allow system_server { cache_file cache_recovery_file }:file { relabelfrom create_file_perms };
641allow system_server { cache_file cache_recovery_file }:fifo_file create_file_perms;
642
643allow system_server system_file:dir r_dir_perms;
644allow system_server system_file:lnk_file r_file_perms;
645
646# LocationManager(e.g, GPS) needs to read and write
647# to uart driver and ctrl proc entry
648allow system_server gps_control:file rw_file_perms;
649
650# Allow system_server to use app-created sockets and pipes.
651allow system_server appdomain:{ tcp_socket udp_socket } { getattr getopt setopt read write shutdown };
652allow system_server appdomain:{ fifo_file unix_stream_socket } { getattr read write };
653
Alex Klyubin59322f12017-02-06 15:39:36 -0800654# BackupManagerService needs to manipulate backup data files
655allow system_server cache_backup_file:dir rw_dir_perms;
656allow system_server cache_backup_file:file create_file_perms;
657# LocalTransport works inside /cache/backup
658allow system_server cache_private_backup_file:dir create_dir_perms;
659allow system_server cache_private_backup_file:file create_file_perms;
660
661# Allow system to talk to usb device
662allow system_server usb_device:chr_file rw_file_perms;
663allow system_server usb_device:dir r_dir_perms;
664
Alex Klyubin59322f12017-02-06 15:39:36 -0800665# Read from HW RNG (needed by EntropyMixer).
666allow system_server hw_random_device:chr_file r_file_perms;
667
668# Read and delete files under /dev/fscklogs.
669r_dir_file(system_server, fscklogs)
670allow system_server fscklogs:dir { write remove_name };
671allow system_server fscklogs:file unlink;
672
673# logd access, system_server inherit logd write socket
674# (urge is to deprecate this long term)
675allow system_server zygote:unix_dgram_socket write;
676
677# Read from log daemon.
678read_logd(system_server)
679read_runtime_log_tags(system_server)
680
681# Be consistent with DAC permissions. Allow system_server to write to
682# /sys/module/lowmemorykiller/parameters/adj
683# /sys/module/lowmemorykiller/parameters/minfree
684allow system_server sysfs_lowmemorykiller:file { getattr w_file_perms };
685
686# Read /sys/fs/pstore/console-ramoops
687# Don't worry about overly broad permissions for now, as there's
688# only one file in /sys/fs/pstore
689allow system_server pstorefs:dir r_dir_perms;
690allow system_server pstorefs:file r_file_perms;
691
692# /sys access
693allow system_server sysfs_zram:dir search;
694allow system_server sysfs_zram:file r_file_perms;
695
696add_service(system_server, system_server_service);
697allow system_server audioserver_service:service_manager find;
698allow system_server batteryproperties_service:service_manager find;
699allow system_server cameraserver_service:service_manager find;
Luke Huang524f25e2019-02-25 20:12:15 +0800700allow system_server dnsresolver_service:service_manager find;
Alex Klyubin59322f12017-02-06 15:39:36 -0800701allow system_server drmserver_service:service_manager find;
702allow system_server dumpstate_service:service_manager find;
703allow system_server fingerprintd_service:service_manager find;
Alex Klyubin59322f12017-02-06 15:39:36 -0800704allow system_server gatekeeper_service:service_manager find;
Peiyong Lin7924dc62018-11-01 13:47:51 -0700705allow system_server gpu_service:service_manager find;
Hung-ying Tyane4350c12019-01-13 19:13:19 +0800706allow system_server gsi_service:service_manager find;
707allow system_server hal_fingerprint_service:service_manager find;
MÃ¥rten Kongstadf62362d2018-06-15 08:08:19 +0200708allow system_server idmap_service:service_manager find;
Joe Onorato41f93db2016-11-20 23:23:04 -0800709allow system_server incident_service:service_manager find;
Alex Klyubin59322f12017-02-06 15:39:36 -0800710allow system_server installd_service:service_manager find;
Igor Murashkin68b2f982018-11-29 15:37:22 -0800711allow system_server iorapd_service:service_manager find;
Alex Klyubin59322f12017-02-06 15:39:36 -0800712allow system_server keystore_service:service_manager find;
713allow system_server mediaserver_service:service_manager find;
714allow system_server mediametrics_service:service_manager find;
715allow system_server mediaextractor_service:service_manager find;
716allow system_server mediacodec_service:service_manager find;
717allow system_server mediadrmserver_service:service_manager find;
718allow system_server netd_service:service_manager find;
719allow system_server nfc_service:service_manager find;
720allow system_server radio_service:service_manager find;
yro29708452017-12-18 15:14:33 -0800721allow system_server stats_service:service_manager find;
Yangsterf8c2c142018-09-12 14:17:26 -0700722allow system_server thermal_service:service_manager find;
Jin Qianfa6c3d72017-10-16 16:39:13 -0700723allow system_server storaged_service:service_manager find;
Alex Klyubin59322f12017-02-06 15:39:36 -0800724allow system_server surfaceflinger_service:service_manager find;
Neda Topoljanacbffe1632018-11-21 18:10:54 +0000725allow system_server update_engine_service:service_manager find;
Jeff Sharkey0fa3fb02017-09-06 11:17:32 -0600726allow system_server vold_service:service_manager find;
Alex Klyubin59322f12017-02-06 15:39:36 -0800727allow system_server wificond_service:service_manager find;
Andreas Gampe986b9af2018-04-30 12:23:20 -0700728userdebug_or_eng(`
729 allow system_server perfprofd_service:service_manager find;
730')
Alex Klyubin59322f12017-02-06 15:39:36 -0800731
Yifan Hongdc9815e2017-10-17 18:30:06 -0700732add_service(system_server, batteryproperties_service)
733
Alex Klyubin59322f12017-02-06 15:39:36 -0800734allow system_server keystore:keystore_key {
735 get_state
736 get
737 insert
738 delete
739 exist
740 list
741 reset
742 password
743 lock
744 unlock
745 is_empty
746 sign
747 verify
748 grant
749 duplicate
750 clear_uid
751 add_auth
752 user_changed
753};
754
755# Allow system server to search and write to the persistent factory reset
756# protection partition. This block device does not get wiped in a factory reset.
757allow system_server block_device:dir search;
758allow system_server frp_block_device:blk_file rw_file_perms;
Nick Kralevichbacf4482018-11-20 17:57:04 -0800759allowxperm system_server frp_block_device:blk_file ioctl { BLKSECDISCARD BLKDISCARD };
Alex Klyubin59322f12017-02-06 15:39:36 -0800760
761# Clean up old cgroups
762allow system_server cgroup:dir { remove_name rmdir };
763
764# /oem access
765r_dir_file(system_server, oemfs)
766
767# Allow resolving per-user storage symlinks
768allow system_server { mnt_user_file storage_file }:dir { getattr search };
769allow system_server { mnt_user_file storage_file }:lnk_file { getattr read };
770
771# Allow statfs() on storage devices, which happens fast enough that
772# we shouldn't be killed during unsafe removal
773allow system_server sdcard_type:dir { getattr search };
774
775# Traverse into expanded storage
776allow system_server mnt_expand_file:dir r_dir_perms;
777
778# Allow system process to relabel the fingerprint directory after mkdir
779# and delete the directory and files when no longer needed
780allow system_server fingerprintd_data_file:dir { r_dir_perms remove_name rmdir relabelto write };
781allow system_server fingerprintd_data_file:file { getattr unlink };
782
783# Allow system process to read network MAC address
784allow system_server sysfs_mac_address:file r_file_perms;
785
786userdebug_or_eng(`
787 # Allow system server to create and write method traces in /data/misc/trace.
788 allow system_server method_trace_data_file:dir w_dir_perms;
789 allow system_server method_trace_data_file:file { create w_file_perms };
790
791 # Allow system server to read dmesg
792 allow system_server kernel:system syslog_read;
Vishnu Nair2d6942d2017-11-17 08:23:32 -0800793
Vishnu Nairdf8d4b82017-11-20 15:21:56 -0800794 # Allow writing and removing window traces in /data/misc/wmtrace.
Vishnu Nair2d6942d2017-11-17 08:23:32 -0800795 allow system_server wm_trace_data_file:dir rw_dir_perms;
Vishnu Nairdf8d4b82017-11-20 15:21:56 -0800796 allow system_server wm_trace_data_file:file { getattr setattr create unlink w_file_perms };
Alex Klyubin59322f12017-02-06 15:39:36 -0800797')
798
799# For AppFuse.
800allow system_server vold:fd use;
801allow system_server fuse_device:chr_file { read write ioctl getattr };
Risan0c1848b2018-10-30 17:29:22 +0000802allow system_server app_fuse_file:file { read write getattr };
Alex Klyubin59322f12017-02-06 15:39:36 -0800803
804# For configuring sdcardfs
805allow system_server configfs:dir { create_dir_perms };
Niklas Brunlid8e0086a2017-12-01 11:18:31 +0100806allow system_server configfs:file { getattr open create unlink write };
Alex Klyubin59322f12017-02-06 15:39:36 -0800807
808# Connect to adbd and use a socket transferred from it.
809# Used for e.g. jdwp.
810allow system_server adbd:unix_stream_socket connectto;
811allow system_server adbd:fd use;
812allow system_server adbd:unix_stream_socket { getattr getopt ioctl read write shutdown };
813
814# Allow invoking tools like "timeout"
815allow system_server toolbox_exec:file rx_file_perms;
816
Victor Hsieh7397ebd2019-01-04 13:06:20 -0800817# Allow system process to setup and measure fs-verity
818allowxperm system_server apk_data_file:file ioctl {
819 FS_IOC_ENABLE_VERITY FS_IOC_MEASURE_VERITY
820};
Victor Hsieh7397ebd2019-01-04 13:06:20 -0800821
Alex Klyubin59322f12017-02-06 15:39:36 -0800822# Postinstall
823#
824# For OTA dexopt, allow calls coming from postinstall.
825binder_call(system_server, postinstall)
826
827allow system_server postinstall:fifo_file write;
828allow system_server update_engine:fd use;
829allow system_server update_engine:fifo_file write;
830
831# Access to /data/preloads
832allow system_server preloads_data_file:file { r_file_perms unlink };
833allow system_server preloads_data_file:dir { r_dir_perms write remove_name rmdir };
Fyodor Kupolovb238fe62017-03-14 11:42:03 -0700834allow system_server preloads_media_file:file { r_file_perms unlink };
835allow system_server preloads_media_file:dir { r_dir_perms write remove_name rmdir };
Alex Klyubin59322f12017-02-06 15:39:36 -0800836
837r_dir_file(system_server, cgroup)
838allow system_server ion_device:chr_file r_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800839
Tri Vo464f59a2017-10-06 10:20:53 -0700840r_dir_file(system_server, proc_asound)
Jeff Vander Stoep7a4af302018-04-10 12:47:48 -0700841r_dir_file(system_server, proc_net_type)
Jeff Vander Stoep43303c82018-01-02 13:10:46 -0800842r_dir_file(system_server, proc_qtaguid_stat)
Tri Voe7f49342017-11-14 16:32:36 -0800843allow system_server {
844 proc_loadavg
845 proc_meminfo
846 proc_pagetypeinfo
847 proc_pipe_conf
848 proc_stat
849 proc_uid_cputime_showstat
Tej Singh44d47c02018-09-24 10:31:52 -0700850 proc_uid_io_stats
Tri Voe7f49342017-11-14 16:32:36 -0800851 proc_uid_time_in_state
Marissa Wall80ee23f2017-11-10 14:10:19 -0800852 proc_uid_concurrent_active_time
853 proc_uid_concurrent_policy_time
Tri Voe7f49342017-11-14 16:32:36 -0800854 proc_version
855 proc_vmallocinfo
856}:file r_file_perms;
857
Connor O'Brienac3c61e2017-11-17 15:40:51 -0800858allow system_server proc_uid_time_in_state:dir r_dir_perms;
Marissa Walldfe063c2018-01-19 13:48:31 -0800859allow system_server proc_uid_cpupower:file r_file_perms;
Connor O'Brienac3c61e2017-11-17 15:40:51 -0800860
Alex Klyubin59322f12017-02-06 15:39:36 -0800861r_dir_file(system_server, rootfs)
Alex Klyubin59322f12017-02-06 15:39:36 -0800862
mukesh agrawal723364f2017-02-22 18:01:00 -0800863# Allow WifiService to start, stop, and read wifi-specific trace events.
864allow system_server debugfs_tracing_instances:dir search;
Joel Galenson58d69292017-07-06 10:59:11 -0700865allow system_server debugfs_wifi_tracing:dir search;
mukesh agrawal723364f2017-02-22 18:01:00 -0800866allow system_server debugfs_wifi_tracing:file rw_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800867
Andreas Gampe7db95722017-05-04 08:35:03 -0700868# allow system_server to exec shell, asanwrapper & zygote(app_process) on ASAN builds. Needed to run
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700869# asanwrapper.
870with_asan(`
871 allow system_server shell_exec:file rx_file_perms;
Andreas Gampec848d372017-04-03 15:23:16 -0700872 allow system_server asanwrapper_exec:file rx_file_perms;
Andreas Gampe7db95722017-05-04 08:35:03 -0700873 allow system_server zygote_exec:file rx_file_perms;
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700874')
875
Chenbo Feng3c3d52e2018-12-04 17:59:18 -0800876# allow system_server to read the eBPF maps that stores the traffic stats information and update
Chenbo Feng756dd572017-11-21 10:53:01 -0800877# the map after snapshot is recorded
Chenbo Feng88ef20a2018-03-23 16:01:10 -0700878allow system_server fs_bpf:dir search;
Chenbo Feng3c3d52e2018-12-04 17:59:18 -0800879allow system_server fs_bpf:file { read write };
880allow system_server bpfloader:bpf { map_read map_write };
881# in order to invoke side effect of close() on such a socket calling synchronize_rcu()
882# TODO: Remove this permission when 4.9 kernel is deprecated.
883allow system_server self:key_socket create;
884
Chenbo Feng756dd572017-11-21 10:53:01 -0800885
Calin Juravle15da30b2017-11-22 00:09:25 -0800886# ART Profiles.
887# Allow system_server to open profile snapshots for read.
888# System server never reads the actual content. It passes the descriptor to
889# to privileged apps which acquire the permissions to inspect the profiles.
Calin Juravle71d84672018-05-03 20:14:51 -0700890allow system_server user_profile_data_file:dir { getattr search };
Calin Juravleacbda502017-11-29 18:35:04 -0800891allow system_server user_profile_data_file:file { getattr open read };
Calin Juravle15da30b2017-11-22 00:09:25 -0800892
Calin Juravle687d5e42018-05-04 17:44:33 -0700893# System server may dump profile data for debuggable apps in the /data/misc/profman.
894# As such it needs to be able create files but it should never read from them.
895allow system_server profman_dump_data_file:file { create getattr setattr w_file_perms};
896allow system_server profman_dump_data_file:dir w_dir_perms;
897
Calin Juravle71d84672018-05-03 20:14:51 -0700898# On userdebug build we may profile system server. Allow it to write and create its own profile.
899userdebug_or_eng(`
900 allow system_server user_profile_data_file:file create_file_perms;
901')
902
Dongwon Kang1134bd02017-11-06 11:19:07 -0800903userdebug_or_eng(`
904 # Allow system server to notify mediaextractor of the plugin update.
905 allow system_server mediaextractor_update_service:service_manager find;
906')
907
Jerry Zhang1d401542017-12-06 16:13:59 -0800908# UsbDeviceManager uses /dev/usb-ffs
909allow system_server functionfs:dir search;
910allow system_server functionfs:file rw_file_perms;
911
Neil Fullerb794ad02018-06-25 15:36:51 +0100912# system_server contains time / time zone detection logic so reads the associated properties.
913get_prop(system_server, time_prop)
914
Alex Klyubin59322f12017-02-06 15:39:36 -0800915###
916### Neverallow rules
917###
918### system_server should NEVER do any of this
919
920# Do not allow opening files from external storage as unsafe ejection
921# could cause the kernel to kill the system_server.
922neverallow system_server sdcard_type:dir { open read write };
923neverallow system_server sdcard_type:file rw_file_perms;
924
925# system server should never be operating on zygote spawned app data
926# files directly. Rather, they should always be passed via a
927# file descriptor.
928# Types extracted from seapp_contexts type= fields, excluding
929# those types that system_server needs to open directly.
Nick Kralevich23c9d912018-08-02 15:54:23 -0700930neverallow system_server {
931 bluetooth_data_file
932 nfc_data_file
933 shell_data_file
934 app_data_file
935 privapp_data_file
936}:file { open create unlink link };
Alex Klyubin59322f12017-02-06 15:39:36 -0800937
938# Forking and execing is inherently dangerous and racy. See, for
939# example, https://www.linuxprogrammingblog.com/threads-and-fork-think-twice-before-using-them
940# Prevent the addition of new file execs to stop the problem from
941# getting worse. b/28035297
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700942neverallow system_server {
943 file_type
944 -toolbox_exec
945 -logcat_exec
Andreas Gampec848d372017-04-03 15:23:16 -0700946 with_asan(`-shell_exec -asanwrapper_exec -zygote_exec')
Jeff Vander Stoep74434842017-03-13 12:22:15 -0700947}:file execute_no_trans;
Alex Klyubin59322f12017-02-06 15:39:36 -0800948
949# Ensure that system_server doesn't perform any domain transitions other than
950# transitioning to the crash_dump domain when a crash occurs.
951neverallow system_server { domain -crash_dump }:process transition;
952neverallow system_server *:process dyntransition;
953
954# Only allow crash_dump to connect to system_ndebug_socket.
955neverallow { domain -init -system_server -crash_dump } system_ndebug_socket:sock_file { open write };
956
Hongyi Zhangda492f42018-11-15 16:27:18 -0800957# Only allow init, system_server, flags_health_check to set properties for server configurable flags
958neverallow {
959 domain
960 -init
961 -system_server
962 -flags_health_check
963} {
Ng Zhi Anc5bf4a32019-01-17 13:30:05 -0800964 device_config_activity_manager_native_boot_prop
Siarhei Vishniakouc0c91552019-01-14 14:18:38 -0800965 device_config_input_native_boot_prop
chenbrucee3d625b2018-12-27 18:01:25 +0800966 device_config_netd_native_prop
Mathieu Chartier0327d102019-02-01 13:43:11 -0800967 device_config_runtime_native_boot_prop
Mathieu Chartier669cef82019-01-29 09:57:11 -0800968 device_config_runtime_native_prop
Dongwon Kang523c7462019-01-30 15:28:31 -0800969 device_config_media_native_prop
Hongyi Zhangda492f42018-11-15 16:27:18 -0800970}:property_service set;
971
Alex Klyubin59322f12017-02-06 15:39:36 -0800972# system_server should never be executing dex2oat. This is either
973# a bug (for example, bug 16317188), or represents an attempt by
974# system server to dynamically load a dex file, something we do not
975# want to allow.
976neverallow system_server dex2oat_exec:file no_x_file_perms;
977
978# system_server should never execute or load executable shared libraries
Nick Kralevich6cf91602018-09-12 15:41:54 -0700979# in /data. Executable files in /data are a persistence vector.
980# https://bugs.chromium.org/p/project-zero/issues/detail?id=955 for example.
Nick Kralevich2ec15e52017-10-20 13:27:26 -0700981neverallow system_server data_file_type:file no_x_file_perms;
Alex Klyubin59322f12017-02-06 15:39:36 -0800982
983# The only block device system_server should be accessing is
984# the frp_block_device. This helps avoid a system_server to root
985# escalation by writing to raw block devices.
986neverallow system_server { dev_type -frp_block_device }:blk_file no_rw_file_perms;
987
988# system_server should never use JIT functionality
Nick Kralevich6cf91602018-09-12 15:41:54 -0700989# See https://googleprojectzero.blogspot.com/2016/12/bitunmap-attacking-android-ashmem.html
990# in the section titled "A Short ROP Chain" for why.
Alex Klyubin59322f12017-02-06 15:39:36 -0800991neverallow system_server self:process execmem;
992neverallow system_server ashmem_device:chr_file execute;
993
dcashman2e00e632016-10-12 14:58:09 -0700994# TODO: deal with tmpfs_domain pub/priv split properly
Nick Kralevichb56e6ef2016-12-09 20:14:31 -0800995neverallow system_server system_server_tmpfs:file execute;
Calin Juravlee5a1f642017-01-17 20:31:31 -0800996
Nick Kralevichcaf42d62018-10-04 10:57:29 -0700997# Resources handed off by system_server_startup
998allow system_server system_server_startup:fd use;
999allow system_server system_server_startup_tmpfs:file { read write map };
1000allow system_server system_server_startup:unix_dgram_socket write;
1001
Dario Freni7ad743b2018-10-18 12:50:06 +01001002# Allow system server to communicate to apexd
1003allow system_server apex_service:service_manager find;
1004allow system_server apexd:binder call;
1005
Santos Cordonb78a1f52019-01-21 13:45:47 +00001006# Allow system server to communicate to system-suspend's control interface
1007allow system_server system_suspend_control_service:service_manager find;
Tri Voa5320882019-02-26 16:45:40 -08001008binder_call(system_server, system_suspend)
1009binder_call(system_suspend, system_server)
1010
1011# Allow system server to communicate to system-suspend's wakelock interface
1012wakelock_use(system_server)
Santos Cordonb78a1f52019-01-21 13:45:47 +00001013
Narayan Kamath9f343b32019-01-04 16:22:19 +00001014# Allow the system server to read files under /data/apex. The system_server
1015# needs these privileges to compare file signatures while processing installs.
1016#
1017# Only apexd is allowed to create new entries or write to any file under /data/apex.
1018allow system_server apex_data_file:dir search;
1019allow system_server apex_data_file:file r_file_perms;
1020
David Andersond99b7fd2019-02-28 14:11:34 -08001021# Allow PasswordSlotManager rw access to /metadata/password_slots, so GSIs and the host image can
1022# communicate which slots are available for use.
1023allow system_server metadata_file:dir search;
1024allow system_server password_slot_metadata_file:dir rw_dir_perms;
1025allow system_server password_slot_metadata_file:file create_file_perms;
1026
Tim Murray251591f2019-02-14 09:26:46 -08001027# Read/Write /proc/pressure/memory
1028allow system_server proc_pressure_mem:file rw_file_perms;
1029
Calin Juravlee5a1f642017-01-17 20:31:31 -08001030# dexoptanalyzer is currently used only for secondary dex files which
1031# system_server should never access.
1032neverallow system_server dexoptanalyzer_exec:file no_x_file_perms;
Nick Kralevich44866952017-02-15 15:04:43 -08001033
1034# No ptracing others
1035neverallow system_server { domain -system_server }:process ptrace;
1036
1037# CAP_SYS_RESOURCE was traditionally needed for sensitive /proc/PID
1038# file read access. However, that is now unnecessary (b/34951864)
Nick Kralevichdf642be2017-11-22 09:59:08 -08001039neverallow system_server system_server:global_capability_class_set sys_resource;
David Andersond99b7fd2019-02-28 14:11:34 -08001040
1041# Only system_server/init should access /metadata/password_slots.
1042neverallow { domain -init -system_server } password_slot_metadata_file:dir *;
1043neverallow {
1044 domain
1045 -init
1046 -system_server
1047} password_slot_metadata_file:notdevfile_class_set ~{ relabelto getattr };
1048neverallow { domain -init -system_server } password_slot_metadata_file:notdevfile_class_set *;