Alex Klyubin | f5446eb | 2017-03-23 14:27:32 -0700 | [diff] [blame] | 1 | typeattribute netd coredomain; |
Steven Moreland | 6598175 | 2022-02-10 00:32:44 +0000 | [diff] [blame] | 2 | typeattribute netd bpfdomain; |
Alex Klyubin | f5446eb | 2017-03-23 14:27:32 -0700 | [diff] [blame] | 3 | |
dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 4 | init_daemon_domain(netd) |
| 5 | |
| 6 | # Allow netd to spawn dnsmasq in it's own domain |
| 7 | domain_auto_trans(netd, dnsmasq_exec, dnsmasq) |
| 8 | |
Maciej Żenczykowski | 37ca69e | 2023-11-18 03:36:05 +0000 | [diff] [blame] | 9 | allow netd { fs_bpf fs_bpf_netd_readonly fs_bpf_netd_shared fs_bpf_vendor }:dir search; |
| 10 | allow netd { fs_bpf fs_bpf_netd_readonly fs_bpf_netd_shared fs_bpf_vendor }:file { getattr read }; |
| 11 | allow netd { fs_bpf fs_bpf_netd_shared }:file write; |
Maciej Żenczykowski | b13921c | 2022-05-21 05:03:29 -0700 | [diff] [blame] | 12 | |
Maciej Żenczykowski | 28960d3 | 2023-06-13 20:44:48 -0700 | [diff] [blame] | 13 | # give netd permission to setup iptables rule with xt_bpf, attach program to cgroup, |
| 14 | # create maps, and read/write maps created by bpfloader, itself and NS/SS mainline networking |
| 15 | allow netd bpfloader:bpf prog_run; |
| 16 | allow netd self:bpf map_create; |
| 17 | allow netd { bpfloader netd network_stack system_server }:bpf { map_read map_write }; |
Joel Fernandes | b76a639 | 2019-01-11 08:32:45 -0500 | [diff] [blame] | 18 | |
Chenbo Feng | 8a5539b | 2019-02-27 17:44:26 -0800 | [diff] [blame] | 19 | # in order to invoke side effect of close() on such a socket calling synchronize_rcu() |
Maciej Żenczykowski | 28960d3 | 2023-06-13 20:44:48 -0700 | [diff] [blame] | 20 | # TODO: Still needed as of kernel 6.6-rc1 - see BpfUtils.h synchronizeKernelRCU() |
Ken Chen | 1aed006 | 2022-01-28 15:04:09 +0800 | [diff] [blame] | 21 | # TODO: Remove this after we remove all bpf interactions from netd. |
Chenbo Feng | 8a5539b | 2019-02-27 17:44:26 -0800 | [diff] [blame] | 22 | allow netd self:key_socket create; |
| 23 | |
Inseob Kim | 55e5c9b | 2020-03-04 17:20:35 +0900 | [diff] [blame] | 24 | set_prop(netd, ctl_mdnsd_prop) |
| 25 | set_prop(netd, netd_stable_secret_prop) |
| 26 | |
steven_fann | d3e8f6f | 2021-01-26 13:34:00 +0800 | [diff] [blame] | 27 | get_prop(netd, adbd_config_prop) |
Inseob Kim | 55e5c9b | 2020-03-04 17:20:35 +0900 | [diff] [blame] | 28 | get_prop(netd, hwservicemanager_prop) |
| 29 | get_prop(netd, device_config_netd_native_prop) |
lifr | 980c08c | 2018-11-21 22:53:48 +0800 | [diff] [blame] | 30 | |
| 31 | # Allow netd to write to statsd. |
| 32 | unix_socket_send(netd, statsdw, statsd) |
Remi NGUYEN VAN | 780fbad | 2019-01-28 13:08:42 +0900 | [diff] [blame] | 33 | |
| 34 | # Allow netd to send callbacks to network_stack |
| 35 | binder_call(netd, network_stack) |
| 36 | |
Chalard Jean | a4c9f7b | 2019-04-05 17:33:56 +0900 | [diff] [blame] | 37 | # Allow netd to send dump info to dumpstate |
| 38 | allow netd dumpstate:fd use; |
| 39 | allow netd dumpstate:fifo_file { getattr write }; |
Inseob Kim | 55e5c9b | 2020-03-04 17:20:35 +0900 | [diff] [blame] | 40 | |
Inseob Kim | 75806ef | 2024-03-27 17:18:41 +0900 | [diff] [blame] | 41 | net_domain(netd) |
| 42 | # Connect to mdnsd via mdnsd socket. |
| 43 | unix_socket_connect(netd, mdnsd, mdnsd) |
| 44 | # in addition to ioctls allowlisted for all domains, grant netd priv_sock_ioctls. |
| 45 | allowxperm netd self:udp_socket ioctl priv_sock_ioctls; |
| 46 | |
| 47 | r_dir_file(netd, cgroup) |
| 48 | |
| 49 | allow netd system_server:fd use; |
| 50 | |
| 51 | allow netd self:global_capability_class_set { net_admin net_raw kill }; |
| 52 | # Note: fsetid is deliberately not included above. fsetid checks are |
| 53 | # triggered by chmod on a directory or file owned by a group other |
| 54 | # than one of the groups assigned to the current process to see if |
| 55 | # the setgid bit should be cleared, regardless of whether the setgid |
| 56 | # bit was even set. We do not appear to truly need this capability |
| 57 | # for netd to operate. |
| 58 | dontaudit netd self:global_capability_class_set fsetid; |
| 59 | |
| 60 | # Allow netd to open /dev/tun, set it up and pass it to clatd |
| 61 | allow netd tun_device:chr_file rw_file_perms; |
| 62 | allowxperm netd tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF }; |
| 63 | allow netd self:tun_socket create; |
| 64 | |
| 65 | allow netd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; |
| 66 | allow netd self:netlink_route_socket nlmsg_write; |
| 67 | allow netd self:netlink_nflog_socket create_socket_perms_no_ioctl; |
| 68 | allow netd self:netlink_socket create_socket_perms_no_ioctl; |
| 69 | allow netd self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read nlmsg_write }; |
| 70 | allow netd self:netlink_generic_socket create_socket_perms_no_ioctl; |
| 71 | allow netd self:netlink_netfilter_socket create_socket_perms_no_ioctl; |
| 72 | allow netd shell_exec:file rx_file_perms; |
| 73 | allow netd system_file:file x_file_perms; |
| 74 | not_full_treble(`allow netd vendor_file:file x_file_perms;') |
| 75 | allow netd devpts:chr_file rw_file_perms; |
| 76 | |
| 77 | # Acquire advisory lock on /system/etc/xtables.lock. If this file doesn't |
| 78 | # exist, suppress the denial. |
| 79 | allow netd system_file:file lock; |
| 80 | dontaudit netd system_file:dir write; |
| 81 | |
Inseob Kim | 75806ef | 2024-03-27 17:18:41 +0900 | [diff] [blame] | 82 | r_dir_file(netd, proc_net_type) |
| 83 | # For /proc/sys/net/ipv[46]/route/flush. |
| 84 | allow netd proc_net_type:file rw_file_perms; |
| 85 | |
| 86 | # Enables PppController and interface enumeration (among others) |
| 87 | allow netd sysfs:dir r_dir_perms; |
| 88 | r_dir_file(netd, sysfs_net) |
| 89 | |
| 90 | # Allows setting interface MTU |
| 91 | allow netd sysfs_net:file w_file_perms; |
| 92 | |
| 93 | # TODO: added to match above sysfs rule. Remove me? |
| 94 | allow netd sysfs_usb:file write; |
| 95 | |
| 96 | r_dir_file(netd, cgroup_v2) |
| 97 | |
| 98 | # TODO: netd previously thought it needed these permissions to do WiFi related |
| 99 | # work. However, after all the WiFi stuff is gone, we still need them. |
| 100 | # Why? |
| 101 | allow netd self:global_capability_class_set { dac_override dac_read_search chown }; |
| 102 | |
| 103 | # Needed to update /data/misc/net/rt_tables |
| 104 | allow netd net_data_file:file create_file_perms; |
| 105 | allow netd net_data_file:dir rw_dir_perms; |
| 106 | allow netd self:global_capability_class_set fowner; |
| 107 | |
| 108 | # Needed to lock the iptables lock. |
| 109 | allow netd system_file:file lock; |
| 110 | |
| 111 | # Allow netd to spawn dnsmasq in it's own domain |
| 112 | allow netd dnsmasq:process { sigkill signal }; |
| 113 | |
| 114 | # Allow netd to publish a binder service and make binder calls. |
| 115 | binder_use(netd) |
| 116 | add_service(netd, netd_service) |
| 117 | add_service(netd, dnsresolver_service) |
| 118 | add_service(netd, mdns_service) |
| 119 | allow netd dumpstate:fifo_file { getattr write }; |
| 120 | |
| 121 | # Allow netd to call into the system server so it can check permissions. |
| 122 | allow netd system_server:binder call; |
| 123 | allow netd permission_service:service_manager find; |
| 124 | |
| 125 | # Allow netd to talk to the framework service which collects netd events. |
| 126 | allow netd netd_listener_service:service_manager find; |
| 127 | |
| 128 | # Allow netd to operate on sockets that are passed to it. |
| 129 | allow netd netdomain:{ |
| 130 | icmp_socket |
| 131 | tcp_socket |
| 132 | udp_socket |
| 133 | rawip_socket |
| 134 | tun_socket |
| 135 | } { read write getattr setattr getopt setopt }; |
| 136 | allow netd netdomain:fd use; |
| 137 | |
| 138 | # give netd permission to read and write netlink xfrm |
| 139 | allow netd self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_write nlmsg_read }; |
| 140 | |
| 141 | # Allow netd to register as hal server. |
| 142 | add_hwservice(netd, system_net_netd_hwservice) |
| 143 | hwbinder_use(netd) |
| 144 | |
| 145 | # AIDL hal server |
| 146 | binder_call(system_net_netd_service, servicemanager) |
| 147 | add_service(netd, system_net_netd_service) |
| 148 | |
| 149 | ### |
| 150 | ### Neverallow rules |
| 151 | ### |
| 152 | ### netd should NEVER do any of this |
| 153 | |
| 154 | # Block device access. |
| 155 | neverallow netd dev_type:blk_file { read write }; |
| 156 | |
| 157 | # ptrace any other app |
| 158 | neverallow netd { domain }:process ptrace; |
| 159 | |
| 160 | # Write to /system. |
| 161 | neverallow netd system_file_type:dir_file_class_set write; |
| 162 | |
| 163 | # Write to files in /data/data or system files on /data |
| 164 | neverallow netd { app_data_file_type system_data_file }:dir_file_class_set write; |
| 165 | |
| 166 | # only system_server, dumpstate and network stack app may find netd service |
| 167 | neverallow { |
| 168 | domain |
| 169 | -system_server |
| 170 | -dumpstate |
| 171 | -network_stack |
| 172 | -netd |
| 173 | -netutils_wrapper |
| 174 | } netd_service:service_manager find; |
| 175 | |
| 176 | # only system_server, dumpstate and network stack app may find dnsresolver service |
| 177 | neverallow { |
| 178 | domain |
| 179 | -system_server |
| 180 | -dumpstate |
| 181 | -network_stack |
| 182 | -netd |
| 183 | -netutils_wrapper |
| 184 | } dnsresolver_service:service_manager find; |
| 185 | |
| 186 | # only system_server, dumpstate and network stack app may find mdns service |
| 187 | neverallow { |
| 188 | domain |
| 189 | -system_server |
| 190 | -dumpstate |
| 191 | -network_stack |
| 192 | -netd |
| 193 | -netutils_wrapper |
| 194 | } mdns_service:service_manager find; |
| 195 | |
| 196 | # apps may not interact with netd over binder. |
| 197 | neverallow { appdomain -network_stack } netd:binder call; |
| 198 | neverallow netd { appdomain -network_stack userdebug_or_eng(`-su') }:binder call; |
| 199 | |
| 200 | # If an already existing file is opened with O_CREATE, the kernel might generate |
| 201 | # a false report of a create denial. Silence these denials and make sure that |
| 202 | # inappropriate permissions are not granted. |
| 203 | neverallow netd proc_net:dir no_w_dir_perms; |
| 204 | dontaudit netd proc_net:dir write; |
| 205 | |
| 206 | neverallow netd sysfs_net:dir no_w_dir_perms; |
| 207 | dontaudit netd sysfs_net:dir write; |
| 208 | |
| 209 | # Netd should not have SYS_ADMIN privs. |
| 210 | neverallow netd self:capability sys_admin; |
| 211 | dontaudit netd self:capability sys_admin; |
| 212 | |
| 213 | # Netd should not have SYS_MODULE privs, nor should it be requesting module loads |
| 214 | # (things it requires should be built directly into the kernel) |
| 215 | dontaudit netd self:capability sys_module; |
| 216 | |
| 217 | dontaudit netd appdomain:unix_stream_socket { read write }; |
| 218 | |
Inseob Kim | 55e5c9b | 2020-03-04 17:20:35 +0900 | [diff] [blame] | 219 | # persist.netd.stable_secret contains RFC 7217 secret key which should never be |
| 220 | # leaked to other processes. Make sure it never leaks. |
| 221 | neverallow { domain -netd -init -dumpstate } netd_stable_secret_prop:file r_file_perms; |
| 222 | |
| 223 | # We want to ensure that no other process ever tries tampering with persist.netd.stable_secret, |
| 224 | # the RFC 7217 secret key managed by netd. Doing so could compromise user privacy. |
| 225 | neverallow { domain -netd -init } netd_stable_secret_prop:property_service set; |