1### ADB daemon
2
3typeattribute adbd coredomain;
4typeattribute adbd mlstrustedsubject;
5
6init_daemon_domain(adbd)
7
8domain_auto_trans(adbd, shell_exec, shell)
9
10userdebug_or_eng(`
11  allow adbd self:process setcurrent;
12  allow adbd su:process dyntransition;
13')
14
15# When 'adb shell' is executed in recovery mode, adbd explicitly
16# switches into shell domain using setcon() because the shell executable
17# is not labeled as shell but as rootfs.
18recovery_only(`
19  domain_trans(adbd, rootfs, shell)
20  allow adbd shell:process dyntransition;
21
22  # Allows reboot fastboot to enter fastboot directly
23  unix_socket_connect(adbd, recovery, recovery)
24')
25
26# Control Perfetto traced and obtain traces from it.
27# Needed to allow port forwarding directly to traced.
28unix_socket_connect(adbd, traced_consumer, traced)
29
30# Do not sanitize the environment or open fds of the shell. Allow signaling
31# created processes.
32allow adbd shell:process { noatsecure signal };
33
34# Set UID and GID to shell.  Set supplementary groups.
35allow adbd self:global_capability_class_set { setuid setgid };
36
37# Drop capabilities from bounding set on user builds.
38allow adbd self:global_capability_class_set setpcap;
39
40# ignore spurious denials for adbd when disk space is low.
41dontaudit adbd self:global_capability_class_set sys_resource;
42
43# adbd probes for vsock support. Do not generate denials when
44# this occurs. (b/123569840)
45dontaudit adbd self:{ socket vsock_socket } create;
46
47# Create and use network sockets.
48net_domain(adbd)
49
50# Access /dev/usb-ffs/adb/ep0
51allow adbd functionfs:dir search;
52allow adbd functionfs:file rw_file_perms;
53allowxperm adbd functionfs:file ioctl {
54  FUNCTIONFS_ENDPOINT_DESC
55  FUNCTIONFS_CLEAR_HALT
56};
57
58# Use a pseudo tty.
59allow adbd devpts:chr_file rw_file_perms;
60
61# adb push/pull /data/local/tmp.
62allow adbd shell_data_file:dir create_dir_perms;
63allow adbd shell_data_file:file create_file_perms;
64
65# adb pull /data/local/traces/*
66allow adbd trace_data_file:dir r_dir_perms;
67allow adbd trace_data_file:file r_file_perms;
68
69# adb pull /data/misc/profman.
70allow adbd profman_dump_data_file:dir r_dir_perms;
71allow adbd profman_dump_data_file:file r_file_perms;
72
73# adb push/pull sdcard.
74allow adbd tmpfs:dir search;
75allow adbd rootfs:lnk_file r_file_perms;  # /sdcard symlink
76allow adbd tmpfs:lnk_file r_file_perms;   # /mnt/sdcard symlink
77allow adbd sdcard_type:dir create_dir_perms;
78allow adbd sdcard_type:file create_file_perms;
79
80# adb pull /data/anr/traces.txt
81allow adbd anr_data_file:dir r_dir_perms;
82allow adbd anr_data_file:file r_file_perms;
83
84# Set service.adb.*, sys.powerctl, and sys.usb.ffs.ready properties.
85set_prop(adbd, shell_prop)
86set_prop(adbd, powerctl_prop)
87set_prop(adbd, ffs_prop)
88set_prop(adbd, exported_ffs_prop)
89
90# Set service.adb.tls.port, persist.adb.wifi. properties
91set_prop(adbd, adbd_prop)
92
93# Access device logging gating property
94get_prop(adbd, device_logging_prop)
95
96# Read device's serial number from system properties
97get_prop(adbd, serialno_prop)
98
99# Read whether or not Test Harness Mode is enabled
100get_prop(adbd, test_harness_prop)
101
102# Read persist.adb.tls_server.enable property
103get_prop(adbd, system_adbd_prop)
104
105# Read device's overlayfs related properties and files
106userdebug_or_eng(`
107  get_prop(adbd, persistent_properties_ready_prop)
108  r_dir_file(adbd, sysfs_dt_firmware_android)
109')
110
111# Run /system/bin/bu
112allow adbd system_file:file rx_file_perms;
113
114# Perform binder IPC to surfaceflinger (screencap)
115# XXX Run screencap in a separate domain?
116binder_use(adbd)
117binder_call(adbd, surfaceflinger)
118binder_call(adbd, gpuservice)
119# b/13188914
120allow adbd gpu_device:chr_file rw_file_perms;
121allow adbd ion_device:chr_file rw_file_perms;
122r_dir_file(adbd, system_file)
123
124# Needed for various screenshots
125hal_client_domain(adbd, hal_graphics_allocator)
126
127# Read /data/misc/adb/adb_keys.
128allow adbd adb_keys_file:dir search;
129allow adbd adb_keys_file:file r_file_perms;
130
131userdebug_or_eng(`
132  # Write debugging information to /data/adb
133  # when persist.adb.trace_mask is set
134  # https://code.google.com/p/android/issues/detail?id=72895
135  allow adbd adb_data_file:dir rw_dir_perms;
136  allow adbd adb_data_file:file create_file_perms;
137')
138
139# ndk-gdb invokes adb forward to forward the gdbserver socket.
140allow adbd app_data_file:dir search;
141allow adbd app_data_file:sock_file write;
142allow adbd appdomain:unix_stream_socket connectto;
143
144# ndk-gdb invokes adb pull of app_process, linker, and libc.so.
145allow adbd zygote_exec:file r_file_perms;
146allow adbd system_file:file r_file_perms;
147
148# Allow pulling the SELinux policy for CTS purposes
149allow adbd selinuxfs:dir r_dir_perms;
150allow adbd selinuxfs:file r_file_perms;
151allow adbd kernel:security read_policy;
152allow adbd service_contexts_file:file r_file_perms;
153allow adbd file_contexts_file:file r_file_perms;
154allow adbd seapp_contexts_file:file r_file_perms;
155allow adbd property_contexts_file:file r_file_perms;
156allow adbd sepolicy_file:file r_file_perms;
157
158# Allow pulling config.gz for CTS purposes
159allow adbd config_gz:file r_file_perms;
160
161allow adbd gpu_service:service_manager find;
162allow adbd surfaceflinger_service:service_manager find;
163allow adbd bootchart_data_file:dir search;
164allow adbd bootchart_data_file:file r_file_perms;
165
166# Allow access to external storage; we have several visible mount points under /storage
167# and symlinks to primary storage at places like /storage/sdcard0 and /mnt/user/0/primary
168allow adbd storage_file:dir r_dir_perms;
169allow adbd storage_file:lnk_file r_file_perms;
170allow adbd mnt_user_file:dir r_dir_perms;
171allow adbd mnt_user_file:lnk_file r_file_perms;
172
173# Access to /data/media.
174# This should be removed if sdcardfs is modified to alter the secontext for its
175# accesses to the underlying FS.
176allow adbd media_rw_data_file:dir create_dir_perms;
177allow adbd media_rw_data_file:file create_file_perms;
178
179r_dir_file(adbd, apk_data_file)
180
181allow adbd rootfs:dir r_dir_perms;
182
183# Allow killing child "perfetto" binary processes, which auto-transition to
184# their own domain. Allows propagating termination of "adb shell perfetto ..."
185# invocations.
186allow adbd perfetto:process signal;
187
188# Allow to pull Perfetto traces.
189allow adbd perfetto_traces_data_file:file r_file_perms;
190allow adbd perfetto_traces_data_file:dir r_dir_perms;
191
192# Connect to shell and use a socket transferred from it.
193# Used for e.g. abb.
194allow adbd shell:unix_stream_socket { read write shutdown };
195allow adbd shell:fd use;
196
197###
198### Neverallow rules
199###
200
201# No transitions from adbd to non-shell, non-crash_dump domains. adbd only ever
202# transitions to the shell domain (except when it crashes). In particular, we
203# never want to see a transition from adbd to su (aka "adb root")
204neverallow adbd { domain -crash_dump -shell }:process transition;
205neverallow adbd { domain userdebug_or_eng(`-su') recovery_only(`-shell') }:process dyntransition;
206