1# zygote
2typeattribute zygote coredomain;
3typeattribute zygote domain_deprecated;
4typeattribute zygote mlstrustedsubject;
5
6init_daemon_domain(zygote)
7
8read_runtime_log_tags(zygote)
9
10# Override DAC on files and switch uid/gid.
11allow zygote self:capability { dac_override setgid setuid fowner chown };
12
13# Drop capabilities from bounding set.
14allow zygote self:capability setpcap;
15
16# Switch SELinux context to app domains.
17allow zygote self:process setcurrent;
18allow zygote system_server:process dyntransition;
19allow zygote appdomain:process dyntransition;
20
21# Allow zygote to read app /proc/pid dirs (b/10455872).
22allow zygote appdomain:dir { getattr search };
23allow zygote appdomain:file { r_file_perms };
24
25# Move children into the peer process group.
26allow zygote system_server:process { getpgid setpgid };
27allow zygote appdomain:process { getpgid setpgid };
28
29# Read system data.
30allow zygote system_data_file:dir r_dir_perms;
31allow zygote system_data_file:file r_file_perms;
32
33# Write to /data/dalvik-cache.
34allow zygote dalvikcache_data_file:dir create_dir_perms;
35allow zygote dalvikcache_data_file:file create_file_perms;
36
37# Create symlinks in /data/dalvik-cache.
38allow zygote dalvikcache_data_file:lnk_file create_file_perms;
39
40# Write to /data/resource-cache.
41allow zygote resourcecache_data_file:dir rw_dir_perms;
42allow zygote resourcecache_data_file:file create_file_perms;
43
44# When WITH_DEXPREOPT is true, the zygote does not load executable content from
45# /data/dalvik-cache.
46allow { zygote with_dexpreopt(`-zygote') } dalvikcache_data_file:file execute;
47
48# Execute idmap and dex2oat within zygote's own domain.
49# TODO:  Should either of these be transitioned to the same domain
50# used by installd or stay in-domain for zygote?
51allow zygote idmap_exec:file rx_file_perms;
52allow zygote dex2oat_exec:file rx_file_perms;
53
54# Allow apps access to /vendor/overlay
55r_dir_file(zygote, vendor_overlay_file)
56
57# Control cgroups.
58allow zygote cgroup:dir create_dir_perms;
59allow zygote cgroup:{ file lnk_file } r_file_perms;
60allow zygote self:capability sys_admin;
61
62# Allow zygote to stat the files that it opens. The zygote must
63# be able to inspect them so that it can reopen them on fork
64# if necessary: b/30963384.
65allow zygote pmsg_device:chr_file getattr;
66allow zygote debugfs_trace_marker:file getattr;
67
68# Get seapp_contexts
69allow zygote seapp_contexts_file:file r_file_perms;
70# Check validity of SELinux context before use.
71selinux_check_context(zygote)
72# Check SELinux permissions.
73selinux_check_access(zygote)
74
75# Native bridge functionality requires that zygote replaces
76# /proc/cpuinfo with /system/lib/<ISA>/cpuinfo using a bind mount
77allow zygote proc_cpuinfo:file mounton;
78
79# Allow remounting rootfs as MS_SLAVE.
80allow zygote rootfs:dir mounton;
81allow zygote tmpfs:filesystem { mount unmount };
82allow zygote fuse:filesystem { unmount };
83allow zygote sdcardfs:filesystem { unmount };
84
85# Allow creating user-specific storage source if started before vold.
86allow zygote mnt_user_file:dir create_dir_perms;
87allow zygote mnt_user_file:lnk_file create_file_perms;
88# Allowed to mount user-specific storage into place
89allow zygote storage_file:dir { search mounton };
90
91# Handle --invoke-with command when launching Zygote with a wrapper command.
92allow zygote zygote_exec:file rx_file_perms;
93
94# Read access to pseudo filesystems.
95r_dir_file(zygote, proc_net)
96
97# Root fs.
98r_dir_file(zygote, rootfs)
99
100# System file accesses.
101r_dir_file(zygote, system_file)
102
103userdebug_or_eng(`
104  # Allow zygote to create and write method traces in /data/misc/trace.
105  allow zygote method_trace_data_file:dir w_dir_perms;
106  allow zygote method_trace_data_file:file { create w_file_perms };
107')
108
109allow zygote ion_device:chr_file r_file_perms;
110allow zygote tmpfs:dir r_dir_perms;
111
112# Let the zygote access overlays so it can initialize the AssetManager.
113get_prop(zygote, overlay_prop)
114
115###
116### neverallow rules
117###
118
119# Ensure that all types assigned to app processes are included
120# in the appdomain attribute, so that all allow and neverallow rules
121# written on appdomain are applied to all app processes.
122# This is achieved by ensuring that it is impossible for zygote to
123# setcon (dyntransition) to any types other than those associated
124# with appdomain plus system_server.
125neverallow zygote ~{ appdomain system_server }:process dyntransition;
126
127# Zygote should never execute anything from /data except for /data/dalvik-cache files.
128neverallow zygote {
129  data_file_type
130  -dalvikcache_data_file # map PROT_EXEC
131}:file no_x_file_perms;
132
133# Do not allow access to Bluetooth-related system properties and files
134neverallow zygote bluetooth_prop:file create_file_perms;
135