Alex Klyubin | f5446eb | 2017-03-23 14:27:32 -0700 | [diff] [blame] | 1 | typeattribute keystore coredomain; |
| 2 | |
dcashman | cc39f63 | 2016-07-22 13:13:11 -0700 | [diff] [blame] | 3 | init_daemon_domain(keystore) |
Alex Klyubin | 53656c1 | 2017-04-13 19:05:27 -0700 | [diff] [blame] | 4 | |
| 5 | # talk to keymaster |
| 6 | hal_client_domain(keystore, hal_keymaster) |
| 7 | |
Janis Danisevskis | 97c56bd | 2018-01-09 17:42:53 -0500 | [diff] [blame] | 8 | # talk to confirmationui |
| 9 | hal_client_domain(keystore, hal_confirmationui) |
| 10 | |
Janis Danisevskis | bd464a9 | 2020-08-24 07:52:32 -0700 | [diff] [blame] | 11 | # talk to keymint |
| 12 | hal_client_domain(keystore, hal_keymint) |
| 13 | |
Janis Danisevskis | 97c56bd | 2018-01-09 17:42:53 -0500 | [diff] [blame] | 14 | # This is used for the ConfirmationUI async callback. |
| 15 | allow keystore platform_app:binder call; |
| 16 | |
Pavel Grafov | c5b3330 | 2018-01-24 19:49:18 +0000 | [diff] [blame] | 17 | # Allow to check whether security logging is enabled. |
| 18 | get_prop(keystore, device_logging_prop) |
Janis Danisevskis | c40681f | 2020-07-25 13:02:29 -0700 | [diff] [blame] | 19 | |
Max Bires | aaacfdb | 2022-02-01 21:15:44 -0800 | [diff] [blame] | 20 | # Allow keystore to check if the system is rkp only. |
| 21 | get_prop(keystore, remote_prov_prop) |
| 22 | |
Vikram Gaur | f6c6f45 | 2024-09-05 23:00:09 +0000 | [diff] [blame] | 23 | # Allow keystore to check whether to post-process RKP certificates |
| 24 | get_prop(keystore, remote_prov_cert_prop) |
| 25 | |
Vikram Gaur | e1c49f5 | 2022-09-29 21:20:22 +0000 | [diff] [blame] | 26 | # Allow keystore to check rkpd feature flags |
| 27 | get_prop(keystore, device_config_remote_key_provisioning_native_prop) |
| 28 | |
Hasini Gunasinghe | 0112daa | 2020-06-10 23:34:41 +0000 | [diff] [blame] | 29 | # Allow keystore to write to statsd. |
| 30 | unix_socket_send(keystore, statsdw, statsd) |
Xin Li | 11da9e6 | 2020-08-29 01:45:24 -0700 | [diff] [blame] | 31 | |
Eric Biggers | cc5cb43 | 2023-10-16 21:44:26 +0000 | [diff] [blame] | 32 | # Keystore need access to the keystore2_key_contexts file to load the keystore key backend. |
Janis Danisevskis | c40681f | 2020-07-25 13:02:29 -0700 | [diff] [blame] | 33 | allow keystore keystore2_key_contexts_file:file r_file_perms; |
Hasini Gunasinghe | 83e1f14 | 2020-06-10 21:10:02 +0000 | [diff] [blame] | 34 | |
Paul Crowley | 283aef2 | 2022-08-22 09:00:25 -0700 | [diff] [blame] | 35 | # Allow keystore to listen to changing boot levels |
Paul Crowley | b0c5571 | 2021-02-23 08:40:05 -0800 | [diff] [blame] | 36 | get_prop(keystore, keystore_listen_prop) |
Satya Tangirala | a999004 | 2021-03-01 02:53:46 -0800 | [diff] [blame] | 37 | |
Paul Crowley | 4a79452 | 2021-06-13 09:56:33 -0700 | [diff] [blame] | 38 | # Keystore needs to transfer binder references to vold so that it |
Satya Tangirala | a999004 | 2021-03-01 02:53:46 -0800 | [diff] [blame] | 39 | # can call keystore methods on those references. |
| 40 | allow keystore vold:binder transfer; |
Hasini Gunasinghe | 4fa6b1a | 2021-07-02 23:14:50 +0000 | [diff] [blame] | 41 | |
Karuna Wadhera | ad0b4ba | 2024-12-28 00:33:30 +0000 | [diff] [blame] | 42 | set_prop(keystore, keystore_diagnostics_prop) |
Rob Seymour | ecbadbb | 2022-07-28 16:23:42 +0000 | [diff] [blame] | 43 | |
David Drysdale | 8b941e5 | 2024-12-05 18:31:00 +0000 | [diff] [blame] | 44 | # Allow keystore to monitor the `apexd.status` property. |
| 45 | get_prop(keystore, apexd_prop) |
| 46 | |
Rob Seymour | ecbadbb | 2022-07-28 16:23:42 +0000 | [diff] [blame] | 47 | # keystore is using apex_info via libvintf |
| 48 | use_apex_info(keystore) |
Inseob Kim | 75806ef | 2024-03-27 17:18:41 +0900 | [diff] [blame] | 49 | |
| 50 | typeattribute keystore mlstrustedsubject; |
| 51 | binder_use(keystore) |
| 52 | binder_service(keystore) |
| 53 | binder_call(keystore, remote_provisioning_service_server) |
Vikram Gaur | f6c6f45 | 2024-09-05 23:00:09 +0000 | [diff] [blame] | 54 | binder_call(keystore, rkp_cert_processor) |
Inseob Kim | 75806ef | 2024-03-27 17:18:41 +0900 | [diff] [blame] | 55 | binder_call(keystore, system_server) |
| 56 | binder_call(keystore, wificond) |
| 57 | |
| 58 | allow keystore keystore_data_file:dir create_dir_perms; |
| 59 | allow keystore keystore_data_file:notdevfile_class_set create_file_perms; |
| 60 | allow keystore keystore_exec:file { getattr }; |
| 61 | |
| 62 | add_service(keystore, keystore_service) |
| 63 | allow keystore sec_key_att_app_id_provider_service:service_manager find; |
Inseob Kim | 75806ef | 2024-03-27 17:18:41 +0900 | [diff] [blame] | 64 | allow keystore remote_provisioning_service:service_manager find; |
Vikram Gaur | f6c6f45 | 2024-09-05 23:00:09 +0000 | [diff] [blame] | 65 | allow keystore rkp_cert_processor_service:service_manager find; |
| 66 | |
David Drysdale | 8b941e5 | 2024-12-05 18:31:00 +0000 | [diff] [blame] | 67 | # Allow keystore to communicate to apexd |
| 68 | allow keystore apex_service:service_manager find; |
| 69 | allow keystore apexd:binder call; |
| 70 | |
Inseob Kim | 75806ef | 2024-03-27 17:18:41 +0900 | [diff] [blame] | 71 | add_service(keystore, apc_service) |
| 72 | add_service(keystore, keystore_compat_hal_service) |
| 73 | add_service(keystore, authorization_service) |
| 74 | add_service(keystore, keystore_maintenance_service) |
| 75 | add_service(keystore, keystore_metrics_service) |
| 76 | add_service(keystore, legacykeystore_service) |
| 77 | |
| 78 | # Check SELinux permissions. |
| 79 | selinux_check_access(keystore) |
| 80 | |
| 81 | r_dir_file(keystore, cgroup) |
| 82 | r_dir_file(keystore, cgroup_v2) |
| 83 | |
| 84 | # The software KeyMint implementation used in km_compat needs |
| 85 | # to read the vendor security patch level. |
| 86 | get_prop(keystore, vendor_security_patch_level_prop); |
| 87 | |
| 88 | # Allow keystore to read its vendor configuration |
| 89 | get_prop(keystore, keystore_config_prop) |
| 90 | |
| 91 | ### |
| 92 | ### Neverallow rules |
| 93 | ### |
| 94 | ### Protect ourself from others |
| 95 | ### |
| 96 | |
| 97 | neverallow { domain -keystore } keystore_data_file:dir ~{ open create read getattr setattr search relabelto ioctl }; |
| 98 | neverallow { domain -keystore } keystore_data_file:notdevfile_class_set ~{ relabelto getattr }; |
| 99 | |
| 100 | neverallow { domain -keystore -init } keystore_data_file:dir *; |
| 101 | neverallow { domain -keystore -init } keystore_data_file:notdevfile_class_set *; |
| 102 | |
Max Bires | ef43855 | 2024-10-16 12:57:48 +0000 | [diff] [blame] | 103 | neverallow * keystore:process ptrace; |
Inseob Kim | 75806ef | 2024-03-27 17:18:41 +0900 | [diff] [blame] | 104 | |
Karuna Wadhera | ad0b4ba | 2024-12-28 00:33:30 +0000 | [diff] [blame] | 105 | # Only keystore can set keystore_diagnostics_prop system properties. Since init is allowed to set |
| 106 | # any system property, an exception is added for init as well. |
| 107 | neverallow { domain -keystore -init } keystore_diagnostics_prop:property_service set; |