|
| 1 | +### |
| 2 | +### Services with isolatedProcess=true in their manifest. |
| 3 | +### |
| 4 | +### This file defines the rules for isolated apps. An "isolated |
| 5 | +### app" is an APP with UID between AID_ISOLATED_START (99000) |
| 6 | +### and AID_ISOLATED_END (99999). |
| 7 | +### |
| 8 | + |
| 9 | +typeattribute isolated_base_app coredomain; |
| 10 | + |
| 11 | +app_domain(isolated_base_app) |
| 12 | + |
| 13 | +# Access already open app data files received over Binder or local socket IPC. |
| 14 | +allow isolated_base_app { app_data_file privapp_data_file }:file { append read write getattr lock map }; |
| 15 | + |
| 16 | +# Allow access to network sockets received over IPC. New socket creation is not |
| 17 | +# permitted. |
| 18 | +allow isolated_base_app { ephemeral_app priv_app untrusted_app_all }:{ tcp_socket udp_socket } { rw_socket_perms_no_ioctl }; |
| 19 | + |
| 20 | +allow isolated_base_app activity_service:service_manager find; |
| 21 | +allow isolated_base_app display_service:service_manager find; |
| 22 | +allow isolated_base_app webviewupdate_service:service_manager find; |
| 23 | + |
| 24 | +# Google Breakpad (crash reporter for Chrome) relies on ptrace |
| 25 | +# functionality. Without the ability to ptrace, the crash reporter |
| 26 | +# tool is broken. |
| 27 | +# b/20150694 |
| 28 | +# https://code.google.com/p/chromium/issues/detail?id=475270 |
| 29 | +allow isolated_base_app self:process ptrace; |
| 30 | + |
| 31 | +# b/32896414: Allow accessing sdcard file descriptors passed to isolated_base_apps |
| 32 | +# by other processes. Open should never be allowed, and is blocked by |
| 33 | +# neverallow rules below. |
| 34 | +# media_rw_data_file is included for sdcardfs, and can be removed if sdcardfs |
| 35 | +# is modified to change the secontext when accessing the lower filesystem. |
| 36 | +allow isolated_base_app { sdcard_type media_rw_data_file }:file { read write append getattr lock map }; |
| 37 | + |
| 38 | +# For webviews, isolated_base_app processes can be forked from the webview_zygote |
| 39 | +# in addition to the zygote. Allow access to resources inherited from the |
| 40 | +# webview_zygote process. These rules are specialized copies of the ones in app.te. |
| 41 | +# Inherit FDs from the webview_zygote. |
| 42 | +allow isolated_base_app webview_zygote:fd use; |
| 43 | +# Notify webview_zygote of child death. |
| 44 | +allow isolated_base_app webview_zygote:process sigchld; |
| 45 | +# Inherit logd write socket. |
| 46 | +allow isolated_base_app webview_zygote:unix_dgram_socket write; |
| 47 | +# Read system properties managed by webview_zygote. |
| 48 | +allow isolated_base_app webview_zygote_tmpfs:file read; |
| 49 | + |
| 50 | +# Inherit FDs from the app_zygote. |
| 51 | +allow isolated_base_app app_zygote:fd use; |
| 52 | +# Notify app_zygote of child death. |
| 53 | +allow isolated_base_app app_zygote:process sigchld; |
| 54 | +# Inherit logd write socket. |
| 55 | +allow isolated_base_app app_zygote:unix_dgram_socket write; |
| 56 | + |
| 57 | +# TODO (b/63631799) fix this access |
| 58 | +# suppress denials to /data/local/tmp |
| 59 | +dontaudit isolated_base_app shell_data_file:dir search; |
| 60 | + |
| 61 | +# Write app-specific trace data to the Perfetto traced damon. This requires |
| 62 | +# connecting to its producer socket and obtaining a (per-process) tmpfs fd. |
| 63 | +perfetto_producer(isolated_base_app) |
| 64 | + |
| 65 | +# Allow profiling if the main app has been marked as profileable or |
| 66 | +# debuggable. |
| 67 | +can_profile_heap(isolated_base_app) |
| 68 | +can_profile_perf(isolated_base_app) |
| 69 | + |
| 70 | +##### |
| 71 | +##### Neverallow |
| 72 | +##### |
| 73 | + |
| 74 | +# Isolated apps should not directly open app data files themselves. |
| 75 | +neverallow isolated_base_app { app_data_file privapp_data_file }:file open; |
| 76 | + |
| 77 | +# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553) |
| 78 | +# TODO: are there situations where isolated_base_apps write to this file? |
| 79 | +# TODO: should we tighten these restrictions further? |
| 80 | +neverallow isolated_base_app anr_data_file:file ~{ open append }; |
| 81 | +neverallow isolated_base_app anr_data_file:dir ~search; |
| 82 | + |
| 83 | +# Isolated apps must not be permitted to use HwBinder |
| 84 | +neverallow isolated_base_app hwbinder_device:chr_file *; |
| 85 | +neverallow isolated_base_app *:hwservice_manager *; |
| 86 | + |
| 87 | +# Isolated apps must not be permitted to use VndBinder |
| 88 | +neverallow isolated_base_app vndbinder_device:chr_file *; |
| 89 | + |
| 90 | +# Isolated apps must not be permitted to perform actions on Binder and VndBinder service_manager |
| 91 | +# except the find actions for services whitelisted below. |
| 92 | +neverallow isolated_base_app *:service_manager ~find; |
| 93 | + |
| 94 | +# b/17487348 |
| 95 | +# Isolated apps can only access three services, |
| 96 | +# activity_service, display_service, webviewupdate_service. |
| 97 | +neverallow isolated_base_app { |
| 98 | + service_manager_type |
| 99 | + -activity_service |
| 100 | + -display_service |
| 101 | + -webviewupdate_service |
| 102 | +}:service_manager find; |
| 103 | + |
| 104 | +# Isolated apps shouldn't be able to access the driver directly. |
| 105 | +neverallow isolated_base_app gpu_device:chr_file { rw_file_perms execute }; |
| 106 | + |
| 107 | +# Do not allow isolated_base_app access to /cache |
| 108 | +neverallow isolated_base_app cache_file:dir ~{ r_dir_perms }; |
| 109 | +neverallow isolated_base_app cache_file:file ~{ read getattr }; |
| 110 | + |
| 111 | +# Do not allow isolated_base_app to access external storage, except for files passed |
| 112 | +# via file descriptors (b/32896414). |
| 113 | +neverallow isolated_base_app { storage_file mnt_user_file sdcard_type }:dir ~getattr; |
| 114 | +neverallow isolated_base_app { storage_file mnt_user_file }:file_class_set *; |
| 115 | +neverallow isolated_base_app sdcard_type:{ devfile_class_set lnk_file sock_file fifo_file } *; |
| 116 | +neverallow isolated_base_app sdcard_type:file ~{ read write append getattr lock map }; |
| 117 | + |
| 118 | +# Do not allow USB access |
| 119 | +neverallow isolated_base_app { usb_device usbaccessory_device }:chr_file *; |
| 120 | + |
| 121 | +# Restrict the webview_zygote control socket. |
| 122 | +neverallow isolated_base_app webview_zygote:sock_file write; |
| 123 | + |
| 124 | +# Limit the /sys files which isolated_base_app can access. This is important |
| 125 | +# for controlling isolated_base_app attack surface. |
| 126 | +neverallow isolated_base_app { |
| 127 | + sysfs_type |
| 128 | + -sysfs_devices_system_cpu |
| 129 | + -sysfs_transparent_hugepage |
| 130 | + -sysfs_usb # TODO: check with audio team if needed for isolated_base_app (b/28417852) |
| 131 | +}:file no_rw_file_perms; |
| 132 | + |
| 133 | +# No creation of sockets families other than AF_UNIX sockets. |
| 134 | +# List taken from system/sepolicy/public/global_macros - socket_class_set |
| 135 | +# excluding unix_stream_socket and unix_dgram_socket. |
| 136 | +# Many of these are socket families which have never and will never |
| 137 | +# be compiled into the Android kernel. |
| 138 | +neverallow isolated_base_app { self ephemeral_app priv_app untrusted_app_all }:{ |
| 139 | + socket tcp_socket udp_socket rawip_socket netlink_socket packet_socket |
| 140 | + key_socket appletalk_socket netlink_route_socket |
| 141 | + netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket |
| 142 | + netlink_selinux_socket netlink_audit_socket netlink_dnrt_socket |
| 143 | + netlink_kobject_uevent_socket tun_socket netlink_iscsi_socket |
| 144 | + netlink_fib_lookup_socket netlink_connector_socket netlink_netfilter_socket |
| 145 | + netlink_generic_socket netlink_scsitransport_socket netlink_rdma_socket |
| 146 | + netlink_crypto_socket sctp_socket icmp_socket ax25_socket ipx_socket |
| 147 | + netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket atmsvc_socket |
| 148 | + rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket |
| 149 | + bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket |
| 150 | + ieee802154_socket caif_socket alg_socket nfc_socket vsock_socket kcm_socket |
| 151 | + qipcrtr_socket smc_socket xdp_socket |
| 152 | +} create; |
0 commit comments