Merge "add links to docs explaining motivations behind neverallow assertions."

private/system_server.te

@@ -880,7 +880,8 @@ neverallow { domain -init -system_server -crash_dump } system_ndebug_socket:sock
 neverallow system_server dex2oat_exec:file no_x_file_perms;
 
 # system_server should never execute or load executable shared libraries
-# in /data
+# in /data. Executable files in /data are a persistence vector.
+# https://bugs.chromium.org/p/project-zero/issues/detail?id=955 for example.
 neverallow system_server data_file_type:file no_x_file_perms;
 
 # The only block device system_server should be accessing is
@@ -889,6 +890,8 @@ neverallow system_server data_file_type:file no_x_file_perms;
 neverallow system_server { dev_type -frp_block_device }:blk_file no_rw_file_perms;
 
 # system_server should never use JIT functionality
+# See https://googleprojectzero.blogspot.com/2016/12/bitunmap-attacking-android-ashmem.html
+# in the section titled "A Short ROP Chain" for why.
 neverallow system_server self:process execmem;
 neverallow system_server ashmem_device:chr_file execute;
 

private/zygote.te

@@ -43,7 +43,9 @@ allow zygote resourcecache_data_file:dir rw_dir_perms;
 allow zygote resourcecache_data_file:file create_file_perms;
 
 # When WITH_DEXPREOPT is true, the zygote does not load executable content from
-# /data/dalvik-cache.
+# /data/dalvik-cache. Executable files loaded from /data is a persistence vector
+# we want to avoid. See
+# https://bugs.chromium.org/p/project-zero/issues/detail?id=955 for example.
 allow { zygote with_dexpreopt(`-zygote') } dalvikcache_data_file:file execute;
 
 # Execute idmap and dex2oat within zygote's own domain.

public/domain.te

@@ -425,6 +425,9 @@ neverallow { domain -kernel -init -recovery -vold -zygote -update_engine -otapre
 #
 # Assert that, to the extent possible, we're not loading executable content from
 # outside the rootfs or /system partition except for a few whitelisted domains.
+# Executable files loaded from /data is a persistence vector
+# we want to avoid. See
+# https://bugs.chromium.org/p/project-zero/issues/detail?id=955 for example.
 #
 neverallow {
     domain