1# only HALs responsible for network hardware should have privileged
2# network capabilities
3neverallow {
4  halserverdomain
5  -hal_bluetooth_server
6  -hal_wifi_server
7  -hal_wifi_supplicant_server
8  -rild
9} self:capability { net_admin net_raw };
10
11# Unless a HAL's job is to communicate over the network, or control network
12# hardware, it should not be using network sockets.
13neverallow {
14  halserverdomain
15  -hal_tetheroffload_server
16  -hal_wifi_server
17  -hal_wifi_supplicant_server
18  -rild
19} domain:{ tcp_socket udp_socket rawip_socket } *;
20neverallow hal_tetheroffload_server unlabeled:service_manager list; #TODO: b/62658302
21
22###
23# HALs are defined as an attribute and so a given domain could hypothetically
24# have multiple HALs in it (or even all of them) with the subsequent policy of
25# the domain comprised of the union of all the HALs.
26#
27# This is a problem because
28# 1) Security sensitive components should only be accessed by specific HALs.
29# 2) hwbinder_call and the restrictions it provides cannot be reasoned about in
30#    the platform.
31# 3) The platform cannot reason about defense in depth if there are
32#    monolithic domains etc.
33#
34# As an example, hal_keymaster and hal_gatekeeper can access the TEE and while
35# its OK for them to share a process its not OK with them to share processes
36# with other hals.
37#
38# The following neverallow rules, in conjuntion with CTS tests, assert that
39# these security principles are adhered to.
40#
41# Do not allow a hal to exec another process without a domain transition.
42# TODO remove exemptions.
43neverallow {
44  halserverdomain
45  -hal_dumpstate_server
46  -rild
47} { file_type fs_type }:file execute_no_trans;
48# Do not allow a process other than init to transition into a HAL domain.
49neverallow { domain -init } halserverdomain:process transition;
50# Only allow transitioning to a domain by running its executable. Do not
51# allow transitioning into a HAL domain by use of seclabel in an
52# init.*.rc script.
53neverallow * halserverdomain:process dyntransition;
54