diff --git a/private/zygote.te b/private/zygote.te index bab15c7a80caa649312ecbbfe53e97c8df55f574..5d55b1e44e99471d7669a92ca2be6ec9f1428763 100644 --- a/private/zygote.te +++ b/private/zygote.te @@ -1,3 +1,128 @@ -# type_transition must be private policy the domain_trans rules could stay -# public, but conceptually should go with this +# zygote +typeattribute zygote domain_deprecated; +typeattribute zygote mlstrustedsubject; + init_daemon_domain(zygote) + +# Override DAC on files and switch uid/gid. +allow zygote self:capability { dac_override setgid setuid fowner chown }; + +# Drop capabilities from bounding set. +allow zygote self:capability setpcap; + +# Switch SELinux context to app domains. +allow zygote self:process setcurrent; +allow zygote system_server:process dyntransition; +allow zygote appdomain:process dyntransition; + +# Allow zygote to read app /proc/pid dirs (b/10455872). +allow zygote appdomain:dir { getattr search }; +allow zygote appdomain:file { r_file_perms }; + +# Move children into the peer process group. +allow zygote system_server:process { getpgid setpgid }; +allow zygote appdomain:process { getpgid setpgid }; + +# Read system data. +allow zygote system_data_file:dir r_dir_perms; +allow zygote system_data_file:file r_file_perms; + +# Write to /data/dalvik-cache. +allow zygote dalvikcache_data_file:dir create_dir_perms; +allow zygote dalvikcache_data_file:file create_file_perms; + +# Create symlinks in /data/dalvik-cache. +allow zygote dalvikcache_data_file:lnk_file create_file_perms; + +# Write to /data/resource-cache. +allow zygote resourcecache_data_file:dir rw_dir_perms; +allow zygote resourcecache_data_file:file create_file_perms; + +# For art. +allow zygote libart_file:file { execute read open getattr }; +# When WITH_DEXPREOPT is true, the zygote does not load executable content from +# /data/dalvik-cache. +allow { zygote with_dexpreopt(`-zygote') } dalvikcache_data_file:file execute; + +# Execute idmap and dex2oat within zygote's own domain. +# TODO: Should either of these be transitioned to the same domain +# used by installd or stay in-domain for zygote? +allow zygote idmap_exec:file rx_file_perms; +allow zygote dex2oat_exec:file rx_file_perms; + +# Control cgroups. +allow zygote cgroup:dir create_dir_perms; +allow zygote cgroup:{ file lnk_file } r_file_perms; +allow zygote self:capability sys_admin; + +# Allow zygote to stat the files that it opens. The zygote must +# be able to inspect them so that it can reopen them on fork +# if necessary: b/30963384. +allow zygote pmsg_device:chr_file getattr; +allow zygote debugfs_trace_marker:file getattr; + +# Check validity of SELinux context before use. +selinux_check_context(zygote) +# Check SELinux permissions. +selinux_check_access(zygote) + +# Native bridge functionality requires that zygote replaces +# /proc/cpuinfo with /system/lib/<ISA>/cpuinfo using a bind mount +allow zygote proc_cpuinfo:file mounton; + +# Allow remounting rootfs as MS_SLAVE. +allow zygote rootfs:dir mounton; +allow zygote tmpfs:filesystem { mount unmount }; +allow zygote fuse:filesystem { unmount }; +allow zygote sdcardfs:filesystem { unmount }; + +# Allow creating user-specific storage source if started before vold. +allow zygote mnt_user_file:dir create_dir_perms; +allow zygote mnt_user_file:lnk_file create_file_perms; +# Allowed to mount user-specific storage into place +allow zygote storage_file:dir { search mounton }; + +# Handle --invoke-with command when launching Zygote with a wrapper command. +allow zygote zygote_exec:file rx_file_perms; + +# Read access to pseudo filesystems. +r_dir_file(zygote, proc_net) + +# Root fs. +r_dir_file(zygote, rootfs) + +# System file accesses. +r_dir_file(zygote, system_file) + +userdebug_or_eng(` + # Allow zygote to create and write method traces in /data/misc/trace. + allow zygote method_trace_data_file:dir w_dir_perms; + allow zygote method_trace_data_file:file { create w_file_perms }; +') + +allow zygote ion_device:chr_file r_file_perms; +allow zygote tmpfs:dir r_dir_perms; + +# Let the zygote access overlays so it can initialize the AssetManager. +get_prop(zygote, overlay_prop) + +### +### neverallow rules +### + +# Ensure that all types assigned to app processes are included +# in the appdomain attribute, so that all allow and neverallow rules +# written on appdomain are applied to all app processes. +# This is achieved by ensuring that it is impossible for zygote to +# setcon (dyntransition) to any types other than those associated +# with appdomain plus system_server. +neverallow zygote ~{ appdomain system_server }:process dyntransition; + +# Zygote should never execute anything from /data except for /data/dalvik-cache files. +neverallow zygote { + data_file_type + -dalvikcache_data_file # map PROT_EXEC +}:file no_x_file_perms; + +# Do not allow access to Bluetooth-related system properties and files +neverallow zygote bluetooth_prop:file create_file_perms; diff --git a/public/zygote.te b/public/zygote.te index 594ac5795c055b992a6893b513c53b7ce2baae3a..83c42efb0ea9b0d1b7c4f5302433bfc639dde204 100644 --- a/public/zygote.te +++ b/public/zygote.te @@ -1,128 +1,3 @@ # zygote -type zygote, domain, domain_deprecated; +type zygote, domain; type zygote_exec, exec_type, file_type; - -typeattribute zygote mlstrustedsubject; - -# Override DAC on files and switch uid/gid. -allow zygote self:capability { dac_override setgid setuid fowner chown }; - -# Drop capabilities from bounding set. -allow zygote self:capability setpcap; - -# Switch SELinux context to app domains. -allow zygote self:process setcurrent; -allow zygote system_server:process dyntransition; -allow zygote appdomain:process dyntransition; - -# Allow zygote to read app /proc/pid dirs (b/10455872). -allow zygote appdomain:dir { getattr search }; -allow zygote appdomain:file { r_file_perms }; - -# Move children into the peer process group. -allow zygote system_server:process { getpgid setpgid }; -allow zygote appdomain:process { getpgid setpgid }; - -# Read system data. -allow zygote system_data_file:dir r_dir_perms; -allow zygote system_data_file:file r_file_perms; - -# Write to /data/dalvik-cache. -allow zygote dalvikcache_data_file:dir create_dir_perms; -allow zygote dalvikcache_data_file:file create_file_perms; - -# Create symlinks in /data/dalvik-cache. -allow zygote dalvikcache_data_file:lnk_file create_file_perms; - -# Write to /data/resource-cache. -allow zygote resourcecache_data_file:dir rw_dir_perms; -allow zygote resourcecache_data_file:file create_file_perms; - -# For art. -allow zygote libart_file:file { execute read open getattr }; -# When WITH_DEXPREOPT is true, the zygote does not load executable content from -# /data/dalvik-cache. -allow { zygote with_dexpreopt(`-zygote') } dalvikcache_data_file:file execute; - -# Execute idmap and dex2oat within zygote's own domain. -# TODO: Should either of these be transitioned to the same domain -# used by installd or stay in-domain for zygote? -allow zygote idmap_exec:file rx_file_perms; -allow zygote dex2oat_exec:file rx_file_perms; - -# Control cgroups. -allow zygote cgroup:dir create_dir_perms; -allow zygote cgroup:{ file lnk_file } r_file_perms; -allow zygote self:capability sys_admin; - -# Allow zygote to stat the files that it opens. The zygote must -# be able to inspect them so that it can reopen them on fork -# if necessary: b/30963384. -allow zygote pmsg_device:chr_file getattr; -allow zygote debugfs_trace_marker:file getattr; - -# Check validity of SELinux context before use. -selinux_check_context(zygote) -# Check SELinux permissions. -selinux_check_access(zygote) - -# Native bridge functionality requires that zygote replaces -# /proc/cpuinfo with /system/lib/<ISA>/cpuinfo using a bind mount -allow zygote proc_cpuinfo:file mounton; - -# Allow remounting rootfs as MS_SLAVE. -allow zygote rootfs:dir mounton; -allow zygote tmpfs:filesystem { mount unmount }; -allow zygote fuse:filesystem { unmount }; -allow zygote sdcardfs:filesystem { unmount }; - -# Allow creating user-specific storage source if started before vold. -allow zygote mnt_user_file:dir create_dir_perms; -allow zygote mnt_user_file:lnk_file create_file_perms; -# Allowed to mount user-specific storage into place -allow zygote storage_file:dir { search mounton }; - -# Handle --invoke-with command when launching Zygote with a wrapper command. -allow zygote zygote_exec:file rx_file_perms; - -# Read access to pseudo filesystems. -r_dir_file(zygote, proc_net) - -# Root fs. -r_dir_file(zygote, rootfs) - -# System file accesses. -r_dir_file(zygote, system_file) - -userdebug_or_eng(` - # Allow zygote to create and write method traces in /data/misc/trace. - allow zygote method_trace_data_file:dir w_dir_perms; - allow zygote method_trace_data_file:file { create w_file_perms }; -') - -allow zygote ion_device:chr_file r_file_perms; -allow zygote tmpfs:dir r_dir_perms; - -# Let the zygote access overlays so it can initialize the AssetManager. -get_prop(zygote, overlay_prop) - -### -### neverallow rules -### - -# Ensure that all types assigned to app processes are included -# in the appdomain attribute, so that all allow and neverallow rules -# written on appdomain are applied to all app processes. -# This is achieved by ensuring that it is impossible for zygote to -# setcon (dyntransition) to any types other than those associated -# with appdomain plus system_server. -neverallow zygote ~{ appdomain system_server }:process dyntransition; - -# Zygote should never execute anything from /data except for /data/dalvik-cache files. -neverallow zygote { - data_file_type - -dalvikcache_data_file # map PROT_EXEC -}:file no_x_file_perms; - -# Do not allow access to Bluetooth-related system properties and files -neverallow zygote bluetooth_prop:file create_file_perms;