From 62d3b4f103e30b4d0795a8d6438d5a3060b536b1 Mon Sep 17 00:00:00 2001
From: Nick Kralevich <nnk@google.com>
Date: Mon, 9 Oct 2017 15:10:30 -0700
Subject: [PATCH] Ensure /sys restrictions for isolated_apps
isolated_apps are intended to be strictly limited in the /sys files
which can be read. Add a neverallow assertion to guarantee this on all
Android compatible devices.
Test: policy compiles.
Change-Id: I2980291dcf4e74bb12c81199d61c5eb8a182036c
---
private/isolated_app.te | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/private/isolated_app.te b/private/isolated_app.te
index 951a0df25..30253af60 100644
--- a/private/isolated_app.te
+++ b/private/isolated_app.te
@@ -103,3 +103,11 @@ neverallow isolated_app { usb_device usbaccessory_device }:chr_file *;
# Restrict the webview_zygote control socket.
neverallow isolated_app webview_zygote_socket:sock_file write;
+
+# Limit the /sys files which isolated_app can access. This is important
+# for controlling isolated_app attack surface.
+neverallow isolated_app {
+ sysfs_type
+ -sysfs_devices_system_cpu
+ -sysfs_usb # TODO: check with audio team if needed for isolated_app (b/28417852)
+}:file no_rw_file_perms;
--
GitLab