1### ADB daemon
2
3typeattribute adbd coredomain;
4typeattribute adbd mlstrustedsubject;
5
6init_daemon_domain(adbd)
7
8domain_auto_trans(adbd, shell_exec, shell)
9
10userdebug_or_eng(`
11  allow adbd self:process setcurrent;
12  allow adbd su:process dyntransition;
13')
14
15# Do not sanitize the environment or open fds of the shell. Allow signaling
16# created processes.
17allow adbd shell:process { noatsecure signal };
18
19# Set UID and GID to shell.  Set supplementary groups.
20allow adbd self:global_capability_class_set { setuid setgid };
21
22# Drop capabilities from bounding set on user builds.
23allow adbd self:global_capability_class_set setpcap;
24
25# Create and use network sockets.
26net_domain(adbd)
27
28# Access /dev/usb-ffs/adb/ep0
29allow adbd functionfs:dir search;
30allow adbd functionfs:file rw_file_perms;
31
32# Use a pseudo tty.
33allow adbd devpts:chr_file rw_file_perms;
34
35# adb push/pull /data/local/tmp.
36allow adbd shell_data_file:dir create_dir_perms;
37allow adbd shell_data_file:file create_file_perms;
38
39# adb pull /data/local/traces/*
40allow adbd trace_data_file:dir r_dir_perms;
41allow adbd trace_data_file:file r_file_perms;
42
43# adb pull /data/misc/profman.
44allow adbd profman_dump_data_file:dir r_dir_perms;
45allow adbd profman_dump_data_file:file r_file_perms;
46
47# adb push/pull sdcard.
48allow adbd tmpfs:dir search;
49allow adbd rootfs:lnk_file r_file_perms;  # /sdcard symlink
50allow adbd tmpfs:lnk_file r_file_perms;   # /mnt/sdcard symlink
51allow adbd sdcard_type:dir create_dir_perms;
52allow adbd sdcard_type:file create_file_perms;
53
54# adb pull /data/anr/traces.txt
55allow adbd anr_data_file:dir r_dir_perms;
56allow adbd anr_data_file:file r_file_perms;
57
58# Set service.adb.*, sys.powerctl, and sys.usb.ffs.ready properties.
59set_prop(adbd, shell_prop)
60set_prop(adbd, powerctl_prop)
61set_prop(adbd, ffs_prop)
62set_prop(adbd, exported_ffs_prop)
63
64# Access device logging gating property
65get_prop(adbd, device_logging_prop)
66
67# Read device's serial number from system properties
68get_prop(adbd, serialno_prop)
69
70# Run /system/bin/bu
71allow adbd system_file:file rx_file_perms;
72
73# Perform binder IPC to surfaceflinger (screencap)
74# XXX Run screencap in a separate domain?
75binder_use(adbd)
76binder_call(adbd, surfaceflinger)
77# b/13188914
78allow adbd gpu_device:chr_file rw_file_perms;
79allow adbd ion_device:chr_file rw_file_perms;
80r_dir_file(adbd, system_file)
81
82# Needed for various screenshots
83hal_client_domain(adbd, hal_graphics_allocator)
84
85# Read /data/misc/adb/adb_keys.
86allow adbd adb_keys_file:dir search;
87allow adbd adb_keys_file:file r_file_perms;
88
89userdebug_or_eng(`
90  # Write debugging information to /data/adb
91  # when persist.adb.trace_mask is set
92  # https://code.google.com/p/android/issues/detail?id=72895
93  allow adbd adb_data_file:dir rw_dir_perms;
94  allow adbd adb_data_file:file create_file_perms;
95')
96
97# ndk-gdb invokes adb forward to forward the gdbserver socket.
98allow adbd app_data_file:dir search;
99allow adbd app_data_file:sock_file write;
100allow adbd appdomain:unix_stream_socket connectto;
101
102# ndk-gdb invokes adb pull of app_process, linker, and libc.so.
103allow adbd zygote_exec:file r_file_perms;
104allow adbd system_file:file r_file_perms;
105
106# Allow pulling the SELinux policy for CTS purposes
107allow adbd selinuxfs:dir r_dir_perms;
108allow adbd selinuxfs:file r_file_perms;
109allow adbd kernel:security read_policy;
110allow adbd service_contexts_file:file r_file_perms;
111allow adbd file_contexts_file:file r_file_perms;
112allow adbd seapp_contexts_file:file r_file_perms;
113allow adbd property_contexts_file:file r_file_perms;
114allow adbd sepolicy_file:file r_file_perms;
115
116# Allow pulling config.gz for CTS purposes
117allow adbd config_gz:file r_file_perms;
118
119allow adbd surfaceflinger_service:service_manager find;
120allow adbd bootchart_data_file:dir search;
121allow adbd bootchart_data_file:file r_file_perms;
122
123# Allow access to external storage; we have several visible mount points under /storage
124# and symlinks to primary storage at places like /storage/sdcard0 and /mnt/user/0/primary
125allow adbd storage_file:dir r_dir_perms;
126allow adbd storage_file:lnk_file r_file_perms;
127allow adbd mnt_user_file:dir r_dir_perms;
128allow adbd mnt_user_file:lnk_file r_file_perms;
129
130# Access to /data/media.
131# This should be removed if sdcardfs is modified to alter the secontext for its
132# accesses to the underlying FS.
133allow adbd media_rw_data_file:dir create_dir_perms;
134allow adbd media_rw_data_file:file create_file_perms;
135
136r_dir_file(adbd, apk_data_file)
137
138allow adbd rootfs:dir r_dir_perms;
139
140###
141### Neverallow rules
142###
143
144# No transitions from adbd to non-shell, non-crash_dump domains. adbd only ever
145# transitions to the shell domain (except when it crashes). In particular, we
146# never want to see a transition from adbd to su (aka "adb root")
147neverallow adbd { domain -crash_dump -shell }:process transition;
148neverallow adbd { domain userdebug_or_eng(`-su') }:process dyntransition;
149