| # Properties used only in /system |
| system_internal_prop(apexd_prop) |
| system_internal_prop(bootloader_boot_reason_prop) |
| system_internal_prop(device_config_activity_manager_native_boot_prop) |
| system_internal_prop(device_config_boot_count_prop) |
| system_internal_prop(device_config_input_native_boot_prop) |
| system_internal_prop(device_config_media_native_prop) |
| system_internal_prop(device_config_netd_native_prop) |
| system_internal_prop(device_config_reset_performed_prop) |
| system_internal_prop(device_config_runtime_native_boot_prop) |
| system_internal_prop(device_config_runtime_native_prop) |
| system_internal_prop(device_config_storage_native_boot_prop) |
| system_internal_prop(device_config_sys_traced_prop) |
| system_internal_prop(device_config_window_manager_native_boot_prop) |
| system_internal_prop(device_config_configuration_prop) |
| system_internal_prop(firstboot_prop) |
| system_internal_prop(fastbootd_protocol_prop) |
| system_internal_prop(gsid_prop) |
| system_internal_prop(init_perf_lsm_hooks_prop) |
| system_internal_prop(init_svc_debug_prop) |
| system_internal_prop(last_boot_reason_prop) |
| system_internal_prop(netd_stable_secret_prop) |
| system_internal_prop(pm_prop) |
| system_internal_prop(userspace_reboot_log_prop) |
| system_internal_prop(userspace_reboot_test_prop) |
| system_internal_prop(system_adbd_prop) |
| system_internal_prop(adbd_prop) |
| system_internal_prop(traced_perf_enabled_prop) |
| |
| compatible_property_only(` |
| # DO NOT ADD ANY PROPERTIES HERE |
| system_internal_prop(boottime_prop) |
| system_internal_prop(bpf_progs_loaded_prop) |
| system_internal_prop(charger_prop) |
| system_internal_prop(cold_boot_done_prop) |
| system_internal_prop(ctl_adbd_prop) |
| system_internal_prop(ctl_apexd_prop) |
| system_internal_prop(ctl_bootanim_prop) |
| system_internal_prop(ctl_bugreport_prop) |
| system_internal_prop(ctl_console_prop) |
| system_internal_prop(ctl_dumpstate_prop) |
| system_internal_prop(ctl_fuse_prop) |
| system_internal_prop(ctl_gsid_prop) |
| system_internal_prop(ctl_interface_restart_prop) |
| system_internal_prop(ctl_interface_stop_prop) |
| system_internal_prop(ctl_mdnsd_prop) |
| system_internal_prop(ctl_restart_prop) |
| system_internal_prop(ctl_rildaemon_prop) |
| system_internal_prop(ctl_sigstop_prop) |
| system_internal_prop(dynamic_system_prop) |
| system_internal_prop(heapprofd_enabled_prop) |
| system_internal_prop(llkd_prop) |
| system_internal_prop(lpdumpd_prop) |
| system_internal_prop(mmc_prop) |
| system_internal_prop(mock_ota_prop) |
| system_internal_prop(net_dns_prop) |
| system_internal_prop(overlay_prop) |
| system_internal_prop(persistent_properties_ready_prop) |
| system_internal_prop(safemode_prop) |
| system_internal_prop(system_lmk_prop) |
| system_internal_prop(system_trace_prop) |
| system_internal_prop(test_boot_reason_prop) |
| system_internal_prop(time_prop) |
| system_internal_prop(traced_enabled_prop) |
| system_internal_prop(traced_lazy_prop) |
| ') |
| |
| # Properties which can't be written outside system |
| |
| # Properties used by binder caches |
| system_restricted_prop(binder_cache_bluetooth_server_prop) |
| system_restricted_prop(binder_cache_system_server_prop) |
| system_restricted_prop(binder_cache_telephony_server_prop) |
| system_restricted_prop(boottime_public_prop) |
| system_restricted_prop(bq_config_prop) |
| system_restricted_prop(module_sdkextensions_prop) |
| system_restricted_prop(nnapi_ext_deny_product_prop) |
| system_restricted_prop(restorecon_prop) |
| system_restricted_prop(socket_hook_prop) |
| system_restricted_prop(surfaceflinger_display_prop) |
| system_restricted_prop(system_boot_reason_prop) |
| system_restricted_prop(system_jvmti_agent_prop) |
| system_restricted_prop(userspace_reboot_exported_prop) |
| |
| compatible_property_only(` |
| # DO NOT ADD ANY PROPERTIES HERE |
| system_restricted_prop(config_prop) |
| system_restricted_prop(cppreopt_prop) |
| system_restricted_prop(dalvik_prop) |
| system_restricted_prop(debuggerd_prop) |
| system_restricted_prop(default_prop) |
| system_restricted_prop(device_logging_prop) |
| system_restricted_prop(dhcp_prop) |
| system_restricted_prop(dumpstate_prop) |
| system_restricted_prop(exported2_default_prop) |
| system_restricted_prop(exported3_system_prop) |
| system_restricted_prop(exported_dumpstate_prop) |
| system_restricted_prop(exported_fingerprint_prop) |
| system_restricted_prop(exported_secure_prop) |
| system_restricted_prop(exported_vold_prop) |
| system_restricted_prop(ffs_prop) |
| system_restricted_prop(fingerprint_prop) |
| system_restricted_prop(heapprofd_prop) |
| system_restricted_prop(net_radio_prop) |
| system_restricted_prop(pan_result_prop) |
| system_restricted_prop(persist_debug_prop) |
| system_restricted_prop(shell_prop) |
| system_restricted_prop(system_radio_prop) |
| system_restricted_prop(test_harness_prop) |
| system_restricted_prop(theme_prop) |
| system_restricted_prop(use_memfd_prop) |
| system_restricted_prop(vold_prop) |
| ') |
| |
| # Properties which can be written only by vendor_init |
| system_vendor_config_prop(apk_verity_prop) |
| system_vendor_config_prop(cpu_variant_prop) |
| system_vendor_config_prop(exported_audio_prop) |
| system_vendor_config_prop(exported_camera_prop) |
| system_vendor_config_prop(exported_config_prop) |
| system_vendor_config_prop(exported_default_prop) |
| system_vendor_config_prop(exported3_default_prop) |
| system_vendor_config_prop(graphics_config_prop) |
| system_vendor_config_prop(incremental_prop) |
| system_vendor_config_prop(media_variant_prop) |
| system_vendor_config_prop(storage_config_prop) |
| system_vendor_config_prop(userspace_reboot_config_prop) |
| system_vendor_config_prop(vehicle_hal_prop) |
| system_vendor_config_prop(vendor_security_patch_level_prop) |
| system_vendor_config_prop(vendor_socket_hook_prop) |
| system_vendor_config_prop(vndk_prop) |
| system_vendor_config_prop(virtual_ab_prop) |
| |
| # Properties with no restrictions |
| system_public_prop(adbd_config_prop) |
| system_public_prop(audio_prop) |
| system_public_prop(bluetooth_a2dp_offload_prop) |
| system_public_prop(bluetooth_audio_hal_prop) |
| system_public_prop(bluetooth_prop) |
| system_public_prop(ctl_default_prop) |
| system_public_prop(ctl_interface_start_prop) |
| system_public_prop(ctl_start_prop) |
| system_public_prop(ctl_stop_prop) |
| system_public_prop(debug_prop) |
| system_public_prop(dumpstate_options_prop) |
| system_public_prop(exported_system_prop) |
| system_public_prop(exported2_config_prop) |
| system_public_prop(exported2_radio_prop) |
| system_public_prop(exported2_system_prop) |
| system_public_prop(exported2_vold_prop) |
| system_public_prop(exported3_radio_prop) |
| system_public_prop(exported_bluetooth_prop) |
| system_public_prop(exported_dalvik_prop) |
| system_public_prop(exported_ffs_prop) |
| system_public_prop(exported_overlay_prop) |
| system_public_prop(exported_pm_prop) |
| system_public_prop(exported_radio_prop) |
| system_public_prop(exported_system_radio_prop) |
| system_public_prop(exported_wifi_prop) |
| system_public_prop(sota_prop) |
| system_public_prop(hwservicemanager_prop) |
| system_public_prop(lmkd_prop) |
| system_public_prop(logd_prop) |
| system_public_prop(logpersistd_logging_prop) |
| system_public_prop(log_prop) |
| system_public_prop(log_tag_prop) |
| system_public_prop(lowpan_prop) |
| system_public_prop(nfc_prop) |
| system_public_prop(ota_prop) |
| system_public_prop(powerctl_prop) |
| system_public_prop(radio_prop) |
| system_public_prop(serialno_prop) |
| system_public_prop(system_prop) |
| system_public_prop(wifi_log_prop) |
| system_public_prop(wifi_prop) |
| |
| # Properties used in default HAL implementations |
| vendor_internal_prop(rebootescrow_hal_prop) |
| |
| # Properties which are public for devices launching with Android O or earlier |
| # This should not be used for any new properties. |
| not_compatible_property(` |
| # DO NOT ADD ANY PROPERTIES HERE |
| system_public_prop(boottime_prop) |
| system_public_prop(bpf_progs_loaded_prop) |
| system_public_prop(charger_prop) |
| system_public_prop(cold_boot_done_prop) |
| system_public_prop(ctl_adbd_prop) |
| system_public_prop(ctl_apexd_prop) |
| system_public_prop(ctl_bootanim_prop) |
| system_public_prop(ctl_bugreport_prop) |
| system_public_prop(ctl_console_prop) |
| system_public_prop(ctl_dumpstate_prop) |
| system_public_prop(ctl_fuse_prop) |
| system_public_prop(ctl_gsid_prop) |
| system_public_prop(ctl_interface_restart_prop) |
| system_public_prop(ctl_interface_stop_prop) |
| system_public_prop(ctl_mdnsd_prop) |
| system_public_prop(ctl_restart_prop) |
| system_public_prop(ctl_rildaemon_prop) |
| system_public_prop(ctl_sigstop_prop) |
| system_public_prop(dynamic_system_prop) |
| system_public_prop(heapprofd_enabled_prop) |
| system_public_prop(llkd_prop) |
| system_public_prop(lpdumpd_prop) |
| system_public_prop(mmc_prop) |
| system_public_prop(mock_ota_prop) |
| system_public_prop(net_dns_prop) |
| system_public_prop(overlay_prop) |
| system_public_prop(persistent_properties_ready_prop) |
| system_public_prop(safemode_prop) |
| system_public_prop(system_lmk_prop) |
| system_public_prop(system_trace_prop) |
| system_public_prop(test_boot_reason_prop) |
| system_public_prop(time_prop) |
| system_public_prop(traced_enabled_prop) |
| system_public_prop(traced_lazy_prop) |
| |
| system_public_prop(config_prop) |
| system_public_prop(cppreopt_prop) |
| system_public_prop(dalvik_prop) |
| system_public_prop(debuggerd_prop) |
| system_public_prop(default_prop) |
| system_public_prop(device_logging_prop) |
| system_public_prop(dhcp_prop) |
| system_public_prop(dumpstate_prop) |
| system_public_prop(exported2_default_prop) |
| system_public_prop(exported3_system_prop) |
| system_public_prop(exported_dumpstate_prop) |
| system_public_prop(exported_fingerprint_prop) |
| system_public_prop(exported_secure_prop) |
| system_public_prop(exported_vold_prop) |
| system_public_prop(ffs_prop) |
| system_public_prop(fingerprint_prop) |
| system_public_prop(heapprofd_prop) |
| system_public_prop(net_radio_prop) |
| system_public_prop(pan_result_prop) |
| system_public_prop(persist_debug_prop) |
| system_public_prop(shell_prop) |
| system_public_prop(system_radio_prop) |
| system_public_prop(test_harness_prop) |
| system_public_prop(theme_prop) |
| system_public_prop(use_memfd_prop) |
| system_public_prop(vold_prop) |
| ') |
| |
| type vendor_default_prop, property_type; |
| |
| typeattribute log_prop log_property_type; |
| typeattribute log_tag_prop log_property_type; |
| typeattribute wifi_log_prop log_property_type; |
| |
| allow property_type tmpfs:filesystem associate; |
| |
| ### |
| ### Neverallow rules |
| ### |
| |
| treble_sysprop_neverallow(` |
| |
| # TODO(b/131162102): uncomment these after assigning ownership attributes to all properties |
| # neverallow domain { |
| # property_type |
| # -system_property_type |
| # -product_property_type |
| # -vendor_property_type |
| # }:file no_rw_file_perms; |
| |
| neverallow { domain -coredomain } { |
| system_property_type |
| system_internal_property_type |
| -system_restricted_property_type |
| -system_public_property_type |
| }:file no_rw_file_perms; |
| |
| neverallow { domain -coredomain } { |
| system_property_type |
| -system_public_property_type |
| }:property_service set; |
| |
| # init is in coredomain, but should be able to read/write all props. |
| # dumpstate is also in coredomain, but should be able to read all props. |
| neverallow { coredomain -init -dumpstate } { |
| vendor_property_type |
| vendor_internal_property_type |
| -vendor_restricted_property_type |
| -vendor_public_property_type |
| }:file no_rw_file_perms; |
| |
| neverallow { coredomain -init } { |
| vendor_property_type |
| -vendor_public_property_type |
| }:property_service set; |
| |
| ') |
| |
| # There is no need to perform ioctl or advisory locking operations on |
| # property files. If this neverallow is being triggered, it is |
| # likely that the policy is using r_file_perms directly instead of |
| # the get_prop() macro. |
| neverallow domain property_type:file { ioctl lock }; |
| |
| # core_property_type should not be used for new properties or |
| # device specific properties. Properties with this attribute |
| # are readable to everyone, which is overly broad and should |
| # be avoided. |
| # New properties should have appropriate read / write access |
| # control rules written. |
| |
| typeattribute audio_prop core_property_type; |
| typeattribute config_prop core_property_type; |
| typeattribute cppreopt_prop core_property_type; |
| typeattribute dalvik_prop core_property_type; |
| typeattribute debuggerd_prop core_property_type; |
| typeattribute debug_prop core_property_type; |
| typeattribute default_prop core_property_type; |
| typeattribute dhcp_prop core_property_type; |
| typeattribute dumpstate_prop core_property_type; |
| typeattribute ffs_prop core_property_type; |
| typeattribute fingerprint_prop core_property_type; |
| typeattribute logd_prop core_property_type; |
| typeattribute net_radio_prop core_property_type; |
| typeattribute nfc_prop core_property_type; |
| typeattribute ota_prop core_property_type; |
| typeattribute pan_result_prop core_property_type; |
| typeattribute persist_debug_prop core_property_type; |
| typeattribute powerctl_prop core_property_type; |
| typeattribute radio_prop core_property_type; |
| typeattribute restorecon_prop core_property_type; |
| typeattribute shell_prop core_property_type; |
| typeattribute system_prop core_property_type; |
| typeattribute system_radio_prop core_property_type; |
| typeattribute vold_prop core_property_type; |
| |
| neverallow * { |
| core_property_type |
| -audio_prop |
| -config_prop |
| -cppreopt_prop |
| -dalvik_prop |
| -debuggerd_prop |
| -debug_prop |
| -default_prop |
| -dhcp_prop |
| -dumpstate_prop |
| -ffs_prop |
| -fingerprint_prop |
| -logd_prop |
| -net_radio_prop |
| -nfc_prop |
| -ota_prop |
| -pan_result_prop |
| -persist_debug_prop |
| -powerctl_prop |
| -radio_prop |
| -restorecon_prop |
| -shell_prop |
| -system_prop |
| -system_radio_prop |
| -vold_prop |
| }:file no_rw_file_perms; |
| |
| # sigstop property is only used for debugging; should only be set by su which is permissive |
| # for userdebug/eng |
| neverallow { |
| domain |
| -init |
| -vendor_init |
| } ctl_sigstop_prop:property_service set; |
| |
| # Don't audit legacy ctl. property handling. We only want the newer permission check to appear |
| # in the audit log |
| dontaudit domain { |
| ctl_bootanim_prop |
| ctl_bugreport_prop |
| ctl_console_prop |
| ctl_default_prop |
| ctl_dumpstate_prop |
| ctl_fuse_prop |
| ctl_mdnsd_prop |
| ctl_rildaemon_prop |
| }:property_service set; |
| |
| neverallow { |
| domain |
| -init |
| } init_svc_debug_prop:property_service set; |
| |
| neverallow { |
| domain |
| -init |
| -dumpstate |
| userdebug_or_eng(`-su') |
| } init_svc_debug_prop:file no_rw_file_perms; |
| |
| compatible_property_only(` |
| # Prevent properties from being set |
| neverallow { |
| domain |
| -coredomain |
| -appdomain |
| -vendor_init |
| } { |
| core_property_type |
| extended_core_property_type |
| exported_config_prop |
| exported_dalvik_prop |
| exported_default_prop |
| exported_dumpstate_prop |
| exported_ffs_prop |
| exported_fingerprint_prop |
| exported_system_prop |
| exported_system_radio_prop |
| exported_vold_prop |
| exported2_config_prop |
| exported2_default_prop |
| exported2_system_prop |
| exported2_vold_prop |
| exported3_default_prop |
| exported3_system_prop |
| -nfc_prop |
| -powerctl_prop |
| -radio_prop |
| }:property_service set; |
| |
| neverallow { |
| domain |
| -coredomain |
| -appdomain |
| -hal_nfc_server |
| } { |
| nfc_prop |
| }:property_service set; |
| |
| neverallow { |
| domain |
| -coredomain |
| -appdomain |
| -hal_telephony_server |
| -vendor_init |
| } { |
| exported_radio_prop |
| exported3_radio_prop |
| }:property_service set; |
| |
| neverallow { |
| domain |
| -coredomain |
| -appdomain |
| -hal_telephony_server |
| } { |
| exported2_radio_prop |
| radio_prop |
| }:property_service set; |
| |
| neverallow { |
| domain |
| -coredomain |
| -bluetooth |
| -hal_bluetooth_server |
| } { |
| bluetooth_prop |
| }:property_service set; |
| |
| neverallow { |
| domain |
| -coredomain |
| -bluetooth |
| -hal_bluetooth_server |
| -vendor_init |
| } { |
| exported_bluetooth_prop |
| }:property_service set; |
| |
| neverallow { |
| domain |
| -coredomain |
| -hal_camera_server |
| -cameraserver |
| -vendor_init |
| } { |
| exported_camera_prop |
| }:property_service set; |
| |
| neverallow { |
| domain |
| -coredomain |
| -hal_wifi_server |
| -wificond |
| } { |
| wifi_prop |
| }:property_service set; |
| |
| neverallow { |
| domain |
| -coredomain |
| -hal_wifi_server |
| -wificond |
| -vendor_init |
| } { |
| exported_wifi_prop |
| }:property_service set; |
| |
| # Prevent properties from being read |
| neverallow { |
| domain |
| -coredomain |
| -appdomain |
| -vendor_init |
| } { |
| core_property_type |
| extended_core_property_type |
| exported_dalvik_prop |
| exported_ffs_prop |
| exported_system_radio_prop |
| exported2_config_prop |
| exported2_system_prop |
| exported2_vold_prop |
| exported3_default_prop |
| exported3_system_prop |
| -debug_prop |
| -logd_prop |
| -nfc_prop |
| -powerctl_prop |
| -radio_prop |
| }:file no_rw_file_perms; |
| |
| neverallow { |
| domain |
| -coredomain |
| -appdomain |
| -hal_nfc_server |
| } { |
| nfc_prop |
| }:file no_rw_file_perms; |
| |
| neverallow { |
| domain |
| -coredomain |
| -appdomain |
| -hal_telephony_server |
| } { |
| radio_prop |
| }:file no_rw_file_perms; |
| |
| neverallow { |
| domain |
| -coredomain |
| -bluetooth |
| -hal_bluetooth_server |
| } { |
| bluetooth_prop |
| }:file no_rw_file_perms; |
| |
| neverallow { |
| domain |
| -coredomain |
| -hal_wifi_server |
| -wificond |
| } { |
| wifi_prop |
| }:file no_rw_file_perms; |
| ') |
| |
| compatible_property_only(` |
| # Neverallow coredomain to set vendor properties |
| neverallow { |
| coredomain |
| -init |
| -system_writes_vendor_properties_violators |
| } { |
| property_type |
| -system_property_type |
| -extended_core_property_type |
| }:property_service set; |
| ') |
| |
| neverallow { |
| -init |
| -system_server |
| } { |
| userspace_reboot_log_prop |
| }:property_service set; |
| |
| neverallow { |
| # Only allow init and system_server to set system_adbd_prop |
| -init |
| -system_server |
| } { |
| system_adbd_prop |
| }:property_service set; |
| |
| neverallow { |
| # Only allow init and adbd to set adbd_prop |
| -init |
| -adbd |
| } { |
| adbd_prop |
| }:property_service set; |
| |
| neverallow { |
| # Only allow init and shell to set userspace_reboot_test_prop |
| -init |
| -shell |
| } { |
| userspace_reboot_test_prop |
| }:property_service set; |
| |
| neverallow { |
| -init |
| -vendor_init |
| } { |
| graphics_config_prop |
| }:property_service set; |
| |
| neverallow { |
| -init |
| -surfaceflinger |
| } { |
| surfaceflinger_display_prop |
| }:property_service set; |
