| ### |
| ### SDK Sandbox process. |
| ### |
| ### This file defines the security policy for the sdk sandbox processes. |
| |
| type sdk_sandbox, domain; |
| |
| typeattribute sdk_sandbox coredomain; |
| |
| net_domain(sdk_sandbox) |
| app_domain(sdk_sandbox) |
| |
| # TODO(b/252967582): remove this rule if it generates too much logs traffic. |
| auditallow sdk_sandbox { |
| property_type |
| # remove expected properties to reduce noise. |
| -servicemanager_prop |
| -hwservicemanager_prop |
| -use_memfd_prop |
| -binder_cache_system_server_prop |
| -graphics_config_prop |
| -persist_wm_debug_prop |
| -aaudio_config_prop |
| -adbd_config_prop |
| -apex_ready_prop |
| -apexd_select_prop |
| -arm64_memtag_prop |
| -audio_prop |
| -binder_cache_bluetooth_server_prop |
| -binder_cache_telephony_server_prop |
| -bluetooth_config_prop |
| -boot_status_prop |
| -bootloader_prop |
| -bq_config_prop |
| -build_odm_prop |
| -build_prop |
| -build_vendor_prop |
| -camera2_extensions_prop |
| -camera_calibration_prop |
| -camera_config_prop |
| -camerax_extensions_prop |
| -codec2_config_prop |
| -config_prop |
| -cppreopt_prop |
| -dalvik_config_prop |
| -dalvik_prop |
| -dalvik_runtime_prop |
| -dck_prop |
| -debug_prop |
| -debuggerd_prop |
| -default_prop |
| -device_config_memory_safety_native_prop |
| -device_config_nnapi_native_prop |
| -device_config_runtime_native_boot_prop |
| -device_config_runtime_native_prop |
| -dhcp_prop |
| -dumpstate_prop |
| -exported3_system_prop |
| -exported_config_prop |
| -exported_default_prop |
| -exported_dumpstate_prop |
| -exported_pm_prop |
| -exported_system_prop |
| -ffs_config_prop |
| -fingerprint_prop |
| -framework_status_prop |
| -gwp_asan_prop |
| -hal_instrumentation_prop |
| -hdmi_config_prop |
| -heapprofd_prop |
| -hw_timeout_multiplier_prop |
| -init_service_status_private_prop |
| -init_service_status_prop |
| -libc_debug_prop |
| -lmkd_config_prop |
| -locale_prop |
| -localization_prop |
| -log_file_logger_prop |
| -log_prop |
| -log_tag_prop |
| -logd_prop |
| -media_config_prop |
| -media_variant_prop |
| -mediadrm_config_prop |
| -module_sdkextensions_prop |
| -net_radio_prop |
| -nfc_prop |
| -nnapi_ext_deny_product_prop |
| -ota_prop |
| -packagemanager_config_prop |
| -pan_result_prop |
| -permissive_mte_prop |
| -persist_debug_prop |
| -pm_prop |
| -powerctl_prop |
| -property_service_version_prop |
| -radio_control_prop |
| -radio_prop |
| -restorecon_prop |
| -rollback_test_prop |
| -sendbug_config_prop |
| -setupwizard_prop |
| -shell_prop |
| -soc_prop |
| -socket_hook_prop |
| -sqlite_log_prop |
| -storagemanager_config_prop |
| -surfaceflinger_color_prop |
| -surfaceflinger_prop |
| -system_prop |
| -system_user_mode_emulation_prop |
| -systemsound_config_prop |
| -telephony_config_prop |
| -telephony_status_prop |
| -test_harness_prop |
| -timezone_prop |
| -usb_config_prop |
| -usb_control_prop |
| -usb_prop |
| -userdebug_or_eng_prop |
| -userspace_reboot_config_prop |
| -userspace_reboot_exported_prop |
| -userspace_reboot_log_prop |
| -userspace_reboot_test_prop |
| -vendor_socket_hook_prop |
| -vndk_prop |
| -vold_config_prop |
| -vold_prop |
| -vold_status_prop |
| -vts_config_prop |
| -vts_status_prop |
| -wifi_log_prop |
| -zygote_config_prop |
| -zygote_wrap_prop |
| -init_service_status_prop |
| }:file { getattr open read map }; |
| |
| # Allow finding services. This is different from ephemeral_app policy. |
| # Adding services manually to the allowlist is preferred hence app_api_service is not used. |
| |
| allow sdk_sandbox activity_service:service_manager find; |
| allow sdk_sandbox activity_task_service:service_manager find; |
| allow sdk_sandbox appops_service:service_manager find; |
| allow sdk_sandbox audio_service:service_manager find; |
| allow sdk_sandbox audioserver_service:service_manager find; |
| allow sdk_sandbox batteryproperties_service:service_manager find; |
| allow sdk_sandbox batterystats_service:service_manager find; |
| allow sdk_sandbox connectivity_service:service_manager find; |
| allow sdk_sandbox connmetrics_service:service_manager find; |
| allow sdk_sandbox deviceidle_service:service_manager find; |
| allow sdk_sandbox display_service:service_manager find; |
| allow sdk_sandbox dropbox_service:service_manager find; |
| allow sdk_sandbox font_service:service_manager find; |
| allow sdk_sandbox game_service:service_manager find; |
| allow sdk_sandbox gpu_service:service_manager find; |
| allow sdk_sandbox graphicsstats_service:service_manager find; |
| allow sdk_sandbox hardware_properties_service:service_manager find; |
| allow sdk_sandbox hint_service:service_manager find; |
| allow sdk_sandbox imms_service:service_manager find; |
| allow sdk_sandbox input_method_service:service_manager find; |
| allow sdk_sandbox input_service:service_manager find; |
| allow sdk_sandbox IProxyService_service:service_manager find; |
| allow sdk_sandbox ipsec_service:service_manager find; |
| allow sdk_sandbox launcherapps_service:service_manager find; |
| allow sdk_sandbox legacy_permission_service:service_manager find; |
| allow sdk_sandbox light_service:service_manager find; |
| allow sdk_sandbox locale_service:service_manager find; |
| allow sdk_sandbox media_communication_service:service_manager find; |
| allow sdk_sandbox mediaextractor_service:service_manager find; |
| allow sdk_sandbox mediametrics_service:service_manager find; |
| allow sdk_sandbox media_projection_service:service_manager find; |
| allow sdk_sandbox media_router_service:service_manager find; |
| allow sdk_sandbox mediaserver_service:service_manager find; |
| allow sdk_sandbox media_session_service:service_manager find; |
| allow sdk_sandbox memtrackproxy_service:service_manager find; |
| allow sdk_sandbox midi_service:service_manager find; |
| allow sdk_sandbox netpolicy_service:service_manager find; |
| allow sdk_sandbox netstats_service:service_manager find; |
| allow sdk_sandbox network_management_service:service_manager find; |
| allow sdk_sandbox notification_service:service_manager find; |
| allow sdk_sandbox package_service:service_manager find; |
| allow sdk_sandbox permission_checker_service:service_manager find; |
| allow sdk_sandbox permission_service:service_manager find; |
| allow sdk_sandbox permissionmgr_service:service_manager find; |
| allow sdk_sandbox platform_compat_service:service_manager find; |
| allow sdk_sandbox power_service:service_manager find; |
| allow sdk_sandbox procstats_service:service_manager find; |
| allow sdk_sandbox registry_service:service_manager find; |
| allow sdk_sandbox restrictions_service:service_manager find; |
| allow sdk_sandbox rttmanager_service:service_manager find; |
| allow sdk_sandbox search_service:service_manager find; |
| allow sdk_sandbox selection_toolbar_service:service_manager find; |
| allow sdk_sandbox sensor_privacy_service:service_manager find; |
| allow sdk_sandbox sensorservice_service:service_manager find; |
| allow sdk_sandbox servicediscovery_service:service_manager find; |
| allow sdk_sandbox settings_service:service_manager find; |
| allow sdk_sandbox speech_recognition_service:service_manager find; |
| allow sdk_sandbox statusbar_service:service_manager find; |
| allow sdk_sandbox storagestats_service:service_manager find; |
| allow sdk_sandbox surfaceflinger_service:service_manager find; |
| allow sdk_sandbox telecom_service:service_manager find; |
| allow sdk_sandbox tethering_service:service_manager find; |
| allow sdk_sandbox textclassification_service:service_manager find; |
| allow sdk_sandbox textservices_service:service_manager find; |
| allow sdk_sandbox texttospeech_service:service_manager find; |
| allow sdk_sandbox thermal_service:service_manager find; |
| allow sdk_sandbox translation_service:service_manager find; |
| allow sdk_sandbox tv_iapp_service:service_manager find; |
| allow sdk_sandbox tv_input_service:service_manager find; |
| allow sdk_sandbox uimode_service:service_manager find; |
| allow sdk_sandbox vcn_management_service:service_manager find; |
| allow sdk_sandbox webviewupdate_service:service_manager find; |
| |
| allow sdk_sandbox system_linker_exec:file execute_no_trans; |
| |
| # Required to read CTS tests data from the shell_data_file location. |
| allow sdk_sandbox shell_data_file:file r_file_perms; |
| allow sdk_sandbox shell_data_file:dir r_dir_perms; |
| |
| # Write app-specific trace data to the Perfetto traced damon. This requires |
| # connecting to its producer socket and obtaining a (per-process) tmpfs fd. |
| perfetto_producer(sdk_sandbox) |
| |
| # Allow profiling if the app opts in by being marked profileable/debuggable. |
| can_profile_heap(sdk_sandbox) |
| can_profile_perf(sdk_sandbox) |
| |
| # allow sdk sandbox to use UDP sockets provided by the system server but not |
| # modify them other than to connect |
| allow sdk_sandbox system_server:udp_socket { |
| connect getattr read recvfrom sendto write getopt setopt }; |
| |
| # allow sandbox to search in sdk system server directory |
| # additionally, for webview to work, getattr has been permitted |
| allow sdk_sandbox sdk_sandbox_system_data_file:dir { getattr search }; |
| # allow sandbox to create files and dirs in sdk data directory |
| allow sdk_sandbox sdk_sandbox_data_file:dir create_dir_perms; |
| allow sdk_sandbox sdk_sandbox_data_file:file create_file_perms; |
| |
| ### |
| ### neverallow rules |
| ### |
| |
| neverallow sdk_sandbox { app_data_file privapp_data_file sdk_sandbox_data_file }:file { execute execute_no_trans }; |
| |
| # Receive or send uevent messages. |
| neverallow sdk_sandbox domain:netlink_kobject_uevent_socket *; |
| |
| # Receive or send generic netlink messages |
| neverallow sdk_sandbox domain:netlink_socket *; |
| |
| # Too much leaky information in debugfs. It's a security |
| # best practice to ensure these files aren't readable. |
| neverallow sdk_sandbox debugfs:file read; |
| |
| # execute gpu_device |
| neverallow sdk_sandbox gpu_device:chr_file execute; |
| |
| # access files in /sys with the default sysfs label |
| neverallow sdk_sandbox sysfs:file *; |
| |
| # Avoid reads from generically labeled /proc files |
| # Create a more specific label if needed |
| neverallow sdk_sandbox proc:file { no_rw_file_perms no_x_file_perms }; |
| |
| # Directly access external storage |
| neverallow sdk_sandbox { sdcard_type media_rw_data_file }:file {open create}; |
| neverallow sdk_sandbox { sdcard_type media_rw_data_file }:dir search; |
| |
| # Avoid reads to proc_net, it contains too much device wide information about |
| # ongoing connections. |
| neverallow sdk_sandbox proc_net:file no_rw_file_perms; |
| |
| # SDK sandbox processes have their own storage not related to app_data_file or privapp_data_file |
| neverallow sdk_sandbox { app_data_file privapp_data_file }:dir no_rw_file_perms; |
| neverallow sdk_sandbox { app_data_file privapp_data_file }:file no_rw_file_perms; |
| |
| # SDK sandbox processes don't have any access to external storage |
| neverallow sdk_sandbox { media_rw_data_file }:dir no_rw_file_perms; |
| neverallow sdk_sandbox { media_rw_data_file }:file no_rw_file_perms; |
| |
| neverallow { sdk_sandbox } tmpfs:dir no_rw_file_perms; |
| |
| neverallow sdk_sandbox hal_drm_service:service_manager find; |
| |
| # Only certain system components should have access to sdk_sandbox_system_data_file |
| # sdk_sandbox only needs search. Restricted in follow up neverallow rule. |
| neverallow { |
| domain |
| -init |
| -installd |
| -system_server |
| -vold_prepare_subdirs |
| } sdk_sandbox_system_data_file:dir { relabelfrom }; |
| |
| neverallow { |
| domain |
| -init |
| -installd |
| -sdk_sandbox |
| -system_server |
| -vold_prepare_subdirs |
| -zygote |
| } sdk_sandbox_system_data_file:dir { create_dir_perms relabelto }; |
| |
| # sdk_sandbox only needs to traverse through the sdk_sandbox_system_data_file |
| neverallow sdk_sandbox sdk_sandbox_system_data_file:dir ~{ getattr search }; |
| |
| # Only dirs should be created at sdk_sandbox_system_data_file level |
| neverallow { domain -init } sdk_sandbox_system_data_file:file *; |
