| Jeff Vander Stoep | d22987b | 2015-11-03 09:54:39 -0800 | [diff] [blame] | 1 | # rules removed from the domain attribute |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 2 | |
| 3 | # Read access to properties mapping. |
| 4 | allow domain_deprecated kernel:fd use; |
| 5 | allow domain_deprecated tmpfs:file { read getattr }; |
| 6 | allow domain_deprecated tmpfs:lnk_file { read getattr }; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 7 | auditallow { domain_deprecated -init } kernel:fd use; |
| 8 | auditallow { domain_deprecated -dex2oat } tmpfs:file { read getattr }; |
| 9 | auditallow domain_deprecated tmpfs:lnk_file { read getattr }; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 10 | |
| 11 | # Search /storage/emulated tmpfs mount. |
| 12 | allow domain_deprecated tmpfs:dir r_dir_perms; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 13 | auditallow { domain_deprecated -appdomain -init -sdcardd -surfaceflinger -system_server -vold -zygote } tmpfs:dir r_dir_perms; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 14 | |
| 15 | # Inherit or receive open files from others. |
| 16 | allow domain_deprecated system_server:fd use; |
| Jeff Vander Stoep | 3a0721a | 2016-10-01 05:26:15 -0700 | [diff] [blame] | 17 | auditallow { domain_deprecated -appdomain -netd -surfaceflinger } system_server:fd use; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 18 | |
| 19 | # Connect to adbd and use a socket transferred from it. |
| 20 | # This is used for e.g. adb backup/restore. |
| 21 | allow domain_deprecated adbd:unix_stream_socket connectto; |
| 22 | allow domain_deprecated adbd:fd use; |
| 23 | allow domain_deprecated adbd:unix_stream_socket { getattr getopt ioctl read write shutdown }; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 24 | auditallow { domain_deprecated -appdomain -system_server } adbd:unix_stream_socket connectto; |
| 25 | auditallow { domain_deprecated -appdomain -system_server } adbd:fd use; |
| 26 | auditallow { domain_deprecated -appdomain -system_server } adbd:unix_stream_socket { getattr getopt ioctl read write shutdown }; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 27 | |
| 28 | # Root fs. |
| 29 | allow domain_deprecated rootfs:dir r_dir_perms; |
| 30 | allow domain_deprecated rootfs:file r_file_perms; |
| 31 | allow domain_deprecated rootfs:lnk_file r_file_perms; |
| Jeff Vander Stoep | 108677c | 2016-09-11 21:18:05 -0700 | [diff] [blame] | 32 | auditallow { domain_deprecated -healthd -init -installd -priv_app -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:dir { open getattr read ioctl lock }; # search granted in domain |
| 33 | auditallow { domain_deprecated -healthd -init -installd -priv_app -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:file r_file_perms; |
| 34 | auditallow { domain_deprecated -appdomain -healthd -init -installd -priv_app -servicemanager -system_server -ueventd -uncrypt -vold -zygote } rootfs:lnk_file { getattr open ioctl lock }; # read granted in domain |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 35 | |
| 36 | # Device accesses. |
| 37 | allow domain_deprecated device:file read; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 38 | auditallow domain_deprecated device:file read; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 39 | |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 40 | # System file accesses. |
| 41 | allow domain_deprecated system_file:dir r_dir_perms; |
| 42 | allow domain_deprecated system_file:file r_file_perms; |
| 43 | allow domain_deprecated system_file:lnk_file r_file_perms; |
| Jeff Vander Stoep | 3a0721a | 2016-10-01 05:26:15 -0700 | [diff] [blame] | 44 | auditallow { domain_deprecated -appdomain -init -rild -surfaceflinger -system_server -zygote } system_file:dir { open read ioctl lock }; # search getattr in domain |
| 45 | auditallow { domain_deprecated -appdomain -init -rild -surfaceflinger -system_server -zygote } system_file:file { ioctl lock }; # read open getattr in domain |
| 46 | auditallow { domain_deprecated -appdomain -init -rild -surfaceflinger -system_server -zygote } system_file:lnk_file { getattr open ioctl lock }; # read in domain |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 47 | |
| 48 | # Read files already opened under /data. |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 49 | allow domain_deprecated system_data_file:file { getattr read }; |
| 50 | allow domain_deprecated system_data_file:lnk_file r_file_perms; |
| Jeff Vander Stoep | 5c4435a | 2016-09-24 14:26:45 -0700 | [diff] [blame] | 51 | auditallow { domain_deprecated -appdomain -init -sdcardd -system_server -tee } system_data_file:file { getattr read }; |
| 52 | auditallow { domain_deprecated -appdomain -init -system_server -tee } system_data_file:lnk_file r_file_perms; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 53 | |
| 54 | # Read apk files under /data/app. |
| 55 | allow domain_deprecated apk_data_file:dir { getattr search }; |
| 56 | allow domain_deprecated apk_data_file:file r_file_perms; |
| 57 | allow domain_deprecated apk_data_file:lnk_file r_file_perms; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 58 | auditallow { domain_deprecated -appdomain -dex2oat -init -installd -system_server } apk_data_file:dir { getattr search }; |
| 59 | auditallow { domain_deprecated -appdomain -dex2oat -installd -system_server } apk_data_file:file r_file_perms; |
| 60 | auditallow { domain_deprecated -appdomain -dex2oat -installd -system_server } apk_data_file:lnk_file r_file_perms; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 61 | |
| 62 | # Read /data/dalvik-cache. |
| 63 | allow domain_deprecated dalvikcache_data_file:dir { search getattr }; |
| 64 | allow domain_deprecated dalvikcache_data_file:file r_file_perms; |
| Nick Kralevich | 79a08e1 | 2016-10-28 11:18:43 -0700 | [diff] [blame] | 65 | auditallow { |
| 66 | domain_deprecated |
| 67 | -appdomain |
| 68 | -debuggerd |
| 69 | -dex2oat |
| 70 | -dumpstate |
| 71 | -init |
| 72 | -installd |
| 73 | -system_server |
| 74 | -zygote |
| 75 | } dalvikcache_data_file:dir { search getattr }; |
| 76 | auditallow { |
| 77 | domain_deprecated |
| 78 | -appdomain |
| 79 | -debuggerd |
| 80 | -dex2oat |
| 81 | -dumpstate |
| 82 | -installd |
| 83 | -system_server |
| 84 | -zygote |
| 85 | } dalvikcache_data_file:file r_file_perms; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 86 | |
| 87 | # Read already opened /cache files. |
| Nick Kralevich | d546473 | 2016-01-16 08:15:52 -0800 | [diff] [blame] | 88 | allow domain_deprecated cache_file:dir r_dir_perms; |
| 89 | allow domain_deprecated cache_file:file { getattr read }; |
| Nick Kralevich | dc37ea7 | 2016-01-07 12:56:54 -0800 | [diff] [blame] | 90 | allow domain_deprecated cache_file:lnk_file r_file_perms; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 91 | auditallow { domain_deprecated -init -priv_app -system_server -vold } cache_file:dir { open read search ioctl lock }; |
| 92 | auditallow { domain_deprecated -appdomain -init -priv_app -system_server -vold } cache_file:dir getattr; |
| 93 | auditallow { domain_deprecated -init -priv_app -system_server -vold } cache_file:file { getattr read }; |
| 94 | auditallow { domain_deprecated -init -system_server -vold } cache_file:lnk_file r_file_perms; |
| Felipe Leme | 549ccf7 | 2015-12-22 12:37:17 -0800 | [diff] [blame] | 95 | |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 96 | #Allow access to ion memory allocation device |
| 97 | allow domain_deprecated ion_device:chr_file rw_file_perms; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 98 | # split this auditallow into read and write perms since most domains seem to |
| 99 | # only require read |
| Jeff Vander Stoep | 24ad514 | 2016-10-01 20:47:01 -0700 | [diff] [blame] | 100 | auditallow { domain_deprecated -appdomain -fingerprintd -keystore -surfaceflinger -system_server -tee -vold -zygote } ion_device:chr_file r_file_perms; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 101 | auditallow domain_deprecated ion_device:chr_file { write append }; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 102 | |
| 103 | # Read access to pseudo filesystems. |
| 104 | r_dir_file(domain_deprecated, proc) |
| Jeff Vander Stoep | a2c4055 | 2016-09-13 11:03:36 -0700 | [diff] [blame] | 105 | r_dir_file(domain_deprecated, sysfs) |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 106 | r_dir_file(domain_deprecated, inotify) |
| 107 | r_dir_file(domain_deprecated, cgroup) |
| Nick Kralevich | 7a35c13 | 2016-03-31 14:11:50 -0700 | [diff] [blame] | 108 | allow domain_deprecated proc_meminfo:file r_file_perms; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 109 | r_dir_file(domain_deprecated, proc_net) |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 110 | #auditallow domain_deprecated proc:dir r_dir_perms; # r_dir_perms granted in domain |
| Jeff Vander Stoep | 5c4435a | 2016-09-24 14:26:45 -0700 | [diff] [blame] | 111 | auditallow { domain_deprecated -fsck -fsck_untrusted -init -priv_app -rild -system_server -vold } proc:file r_file_perms; |
| 112 | auditallow { domain_deprecated -fsck -fsck_untrusted -init -priv_app -rild -system_server -vold } proc:lnk_file { open ioctl lock }; # getattr read granted in domain |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 113 | auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -priv_app -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:dir { open getattr read ioctl lock }; # search granted in domain |
| 114 | auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -priv_app -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:file r_file_perms; |
| 115 | auditallow { domain_deprecated -bluetooth -fingerprintd -healthd -init -netd -priv_app -rild -system_app -surfaceflinger -system_server -tee -ueventd -vold -wpa } sysfs:lnk_file { getattr open ioctl lock }; # read granted in domain |
| 116 | auditallow domain_deprecated inotify:dir r_dir_perms; |
| 117 | auditallow domain_deprecated inotify:{ file lnk_file } r_file_perms; |
| Jeff Vander Stoep | 24ad514 | 2016-10-01 20:47:01 -0700 | [diff] [blame] | 118 | auditallow { domain_deprecated -appdomain -fingerprintd -healthd -init -inputflinger -installd -keystore -netd -rild -surfaceflinger -system_server -zygote } cgroup:dir r_dir_perms; |
| 119 | auditallow { domain_deprecated -appdomain -fingerprintd -healthd -init -inputflinger -installd -keystore -netd -rild -surfaceflinger -system_server -zygote } cgroup:{ file lnk_file } r_file_perms; |
| Jeff Vander Stoep | 5c4435a | 2016-09-24 14:26:45 -0700 | [diff] [blame] | 120 | auditallow { domain_deprecated -appdomain -init -priv_app -surfaceflinger -system_server -vold } proc_meminfo:file r_file_perms; |
| 121 | auditallow { domain_deprecated -appdomain -clatd -init -netd -system_server -vold -wpa -zygote } proc_net:dir { open getattr read ioctl lock }; # search granted in domain |
| Nick Kralevich | 79a08e1 | 2016-10-28 11:18:43 -0700 | [diff] [blame] | 122 | auditallow { |
| 123 | domain_deprecated |
| 124 | -appdomain |
| 125 | -clatd |
| 126 | -dumpstate |
| 127 | -init |
| 128 | -netd |
| 129 | -system_server |
| 130 | -vold |
| 131 | -wpa |
| 132 | -zygote |
| 133 | } proc_net:{ file lnk_file } r_file_perms; |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 134 | |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 135 | # Get SELinux enforcing status. |
| 136 | allow domain_deprecated selinuxfs:dir r_dir_perms; |
| 137 | allow domain_deprecated selinuxfs:file r_file_perms; |
| Jeff Vander Stoep | 3a0721a | 2016-10-01 05:26:15 -0700 | [diff] [blame] | 138 | auditallow { domain_deprecated -appdomain -debuggerd -init -installd -keystore -postinstall_dexopt -runas -servicemanager -system_server -ueventd -zygote } selinuxfs:dir { open getattr read ioctl lock }; # search granted in domain |
| 139 | auditallow { domain_deprecated -appdomain -debuggerd -init -installd -keystore -postinstall_dexopt -runas -servicemanager -system_server -ueventd -zygote } selinuxfs:file { open read ioctl lock }; # getattr granted in domain |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 140 | |
| Jeff Vander Stoep | 6e3506e | 2015-11-05 15:24:22 -0800 | [diff] [blame] | 141 | # World readable asec image contents |
| 142 | allow domain_deprecated asec_public_file:file r_file_perms; |
| 143 | allow domain_deprecated { asec_public_file asec_apk_file }:dir r_dir_perms; |
| Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 144 | auditallow domain_deprecated asec_public_file:file r_file_perms; |
| 145 | auditallow domain_deprecated { asec_public_file asec_apk_file }:dir r_dir_perms; |