1###
2### neverallow rules for untrusted app domains
3###
4
5# Only allow domains in AOSP to use the untrusted_app_all attribute.
6neverallow { untrusted_app_all -untrusted_app -untrusted_app_25 } domain:process fork;
7
8define(`all_untrusted_apps',`{ untrusted_app_all untrusted_app_25 untrusted_app ephemeral_app isolated_app }')
9# Receive or send uevent messages.
10neverallow all_untrusted_apps domain:netlink_kobject_uevent_socket *;
11
12# Receive or send generic netlink messages
13neverallow all_untrusted_apps domain:netlink_socket *;
14
15# Too much leaky information in debugfs. It's a security
16# best practice to ensure these files aren't readable.
17neverallow all_untrusted_apps debugfs_type:file read;
18
19# Do not allow untrusted apps to register services.
20# Only trusted components of Android should be registering
21# services.
22neverallow all_untrusted_apps service_manager_type:service_manager add;
23
24# Do not allow untrusted apps to use VendorBinder
25neverallow all_untrusted_apps vndbinder_device:chr_file *;
26neverallow all_untrusted_apps vndservice_manager_type:service_manager *;
27
28# Do not allow untrusted apps to connect to the property service
29# or set properties. b/10243159
30neverallow all_untrusted_apps property_socket:sock_file write;
31neverallow all_untrusted_apps init:unix_stream_socket connectto;
32neverallow all_untrusted_apps property_type:property_service set;
33
34# Do not allow untrusted apps to be assigned mlstrustedsubject.
35# This would undermine the per-user isolation model being
36# enforced via levelFrom=user in seapp_contexts and the mls
37# constraints.  As there is no direct way to specify a neverallow
38# on attribute assignment, this relies on the fact that fork
39# permission only makes sense within a domain (hence should
40# never be granted to any other domain within mlstrustedsubject)
41# and an untrusted app is allowed fork permission to itself.
42neverallow all_untrusted_apps mlstrustedsubject:process fork;
43
44# Do not allow untrusted apps to hard link to any files.
45# In particular, if an untrusted app links to other app data
46# files, installd will not be able to guarantee the deletion
47# of the linked to file. Hard links also contribute to security
48# bugs, so we want to ensure untrusted apps never have this
49# capability.
50neverallow all_untrusted_apps file_type:file link;
51
52# Do not allow untrusted apps to access network MAC address file
53neverallow all_untrusted_apps sysfs_mac_address:file no_rw_file_perms;
54
55# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the
56# ioctl permission, or 3. disallow the socket class.
57neverallowxperm all_untrusted_apps domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
58neverallow all_untrusted_apps *:{ netlink_route_socket netlink_selinux_socket } ioctl;
59neverallow all_untrusted_apps *:{
60  socket netlink_socket packet_socket key_socket appletalk_socket
61  netlink_tcpdiag_socket netlink_nflog_socket
62  netlink_xfrm_socket netlink_audit_socket
63  netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
64  netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
65  netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
66  netlink_rdma_socket netlink_crypto_socket
67} *;
68
69# Do not allow untrusted apps access to /cache
70neverallow all_untrusted_apps { cache_file cache_recovery_file }:dir ~{ r_dir_perms };
71neverallow all_untrusted_apps { cache_file cache_recovery_file }:file ~{ read getattr };
72
73# Do not allow untrusted apps to create/unlink files outside of its sandbox,
74# internal storage or sdcard.
75# World accessible data locations allow application to fill the device
76# with unaccounted for data. This data will not get removed during
77# application un-installation.
78neverallow all_untrusted_apps {
79  fs_type
80  -fuse                     # sdcard
81  -sdcardfs                 # sdcard
82  -vfat
83  file_type
84  -app_data_file            # The apps sandbox itself
85  -media_rw_data_file       # Internal storage. Known that apps can
86                            # leave artfacts here after uninstall.
87  -user_profile_data_file   # Access to profile files
88  userdebug_or_eng(`
89    -method_trace_data_file # only on ro.debuggable=1
90    -coredump_file          # userdebug/eng only
91  ')
92}:dir_file_class_set { create unlink };
93
94# No untrusted component should be touching /dev/fuse
95neverallow all_untrusted_apps fuse_device:chr_file *;
96
97# Do not allow untrusted apps to directly open tun_device
98neverallow all_untrusted_apps tun_device:chr_file open;
99
100# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553)
101neverallow all_untrusted_apps anr_data_file:file ~{ open append };
102neverallow all_untrusted_apps anr_data_file:dir ~search;
103
104# Avoid reads from generically labeled /proc files
105# Create a more specific label if needed
106neverallow all_untrusted_apps proc:file { no_rw_file_perms no_x_file_perms };
107
108# Avoid all access to kernel configuration
109neverallow all_untrusted_apps config_gz:file { no_rw_file_perms no_x_file_perms };
110
111# Do not allow untrusted apps access to preloads data files
112neverallow all_untrusted_apps preloads_data_file:file no_rw_file_perms;
113
114# Locking of files on /system could lead to denial of service attacks
115# against privileged system components
116neverallow all_untrusted_apps system_file:file lock;
117
118# Do not permit untrusted apps to perform actions on HwBinder service_manager
119# other than find actions for services listed below
120neverallow all_untrusted_apps *:hwservice_manager ~find;
121
122# Do not permit access from apps which host arbitrary code to HwBinder services,
123# except those considered sufficiently safe for access from such apps.
124# The two main reasons for this are:
125# 1. HwBinder servers do not perform client authentication because HIDL
126#    currently does not expose caller UID information and, even if it did, many
127#    HwBinder services either operate at a level below that of apps (e.g., HALs)
128#    or must not rely on app identity for authorization. Thus, to be safe, the
129#    default assumption is that every HwBinder service treats all its clients as
130#    equally authorized to perform operations offered by the service.
131# 2. HAL servers (a subset of HwBinder services) contain code with higher
132#    incidence rate of security issues than system/core components and have
133#    access to lower layes of the stack (all the way down to hardware) thus
134#    increasing opportunities for bypassing the Android security model.
135#
136# Safe services include:
137# - same process services: because they by definition run in the process
138#   of the client and thus have the same access as the client domain in which
139#   the process runs
140# - coredomain_hwservice: are considered safe because they do not pose risks
141#   associated with reason #2 above.
142# - hal_configstore_ISurfaceFlingerConfigs:  becuase it has specifically been
143#   designed for use by any domain.
144# - hal_graphics_allocator_hwservice: because these operations are also offered
145#   by surfaceflinger Binder service, which apps are permitted to access
146# - hal_omx_hwservice: because this is a HwBinder version of the mediacodec
147#   Binder service which apps were permitted to access.
148neverallow all_untrusted_apps {
149  hwservice_manager_type
150  -same_process_hwservice
151  -coredomain_hwservice
152  -hal_configstore_ISurfaceFlingerConfigs
153  -hal_graphics_allocator_hwservice
154  -hal_omx_hwservice
155  -untrusted_app_visible_hwservice
156}:hwservice_manager find;
157neverallow untrusted_app_visible_hwservice unlabeled:service_manager list; #TODO: b/62658302
158# Make sure that the following services are never accessible by untrusted_apps
159neverallow all_untrusted_apps {
160  default_android_hwservice
161  hal_audio_hwservice
162  hal_bluetooth_hwservice
163  hal_bootctl_hwservice
164  hal_camera_hwservice
165  hal_contexthub_hwservice
166  hal_drm_hwservice
167  hal_dumpstate_hwservice
168  hal_fingerprint_hwservice
169  hal_gatekeeper_hwservice
170  hal_gnss_hwservice
171  hal_graphics_composer_hwservice
172  hal_health_hwservice
173  hal_ir_hwservice
174  hal_keymaster_hwservice
175  hal_light_hwservice
176  hal_memtrack_hwservice
177  hal_nfc_hwservice
178  hal_oemlock_hwservice
179  hal_power_hwservice
180  hal_sensors_hwservice
181  hal_telephony_hwservice
182  hal_thermal_hwservice
183  hal_tv_cec_hwservice
184  hal_tv_input_hwservice
185  hal_usb_hwservice
186  hal_vibrator_hwservice
187  hal_vr_hwservice
188  hal_weaver_hwservice
189  hal_wifi_hwservice
190  hal_wifi_supplicant_hwservice
191  hidl_base_hwservice
192}:hwservice_manager find;
193# HwBinder services offered by core components (as opposed to vendor components)
194# are considered somewhat safer due to point #2 above.
195neverallow all_untrusted_apps {
196  coredomain_hwservice
197  -same_process_hwservice
198  -hidl_allocator_hwservice # Designed for use by any domain
199  -hidl_manager_hwservice # Designed for use by any domain
200  -hidl_memory_hwservice # Designed for use by any domain
201  -hidl_token_hwservice # Designed for use by any domain
202}:hwservice_manager find;
203
204# Restrict *Binder access from apps to HAL domains. We can only do this on full
205# Treble devices where *Binder communications between apps and HALs are tightly
206# restricted.
207full_treble_only(`
208  neverallow all_untrusted_apps {
209    halserverdomain
210    -coredomain
211    -hal_configstore_server
212    -hal_graphics_allocator_server
213    -binder_in_vendor_violators # TODO(b/35870313): Remove once all violations are gone
214  }:binder { call transfer };
215')
216