1# vendor_init is its own domain.
2type vendor_init, domain, mlstrustedsubject;
3
4# Communication to the main init process
5allow vendor_init init:unix_stream_socket { read write };
6
7# Logging to kmsg
8allow vendor_init kmsg_device:chr_file { open getattr write };
9
10# Mount on /dev/usb-ffs/adb.
11allow vendor_init device:dir mounton;
12
13# Create and remove symlinks in /.
14allow vendor_init rootfs:lnk_file { create unlink };
15
16# Create cgroups mount points in tmpfs and mount cgroups on them.
17allow vendor_init cgroup:dir create_dir_perms;
18allow vendor_init cgroup:file w_file_perms;
19
20# /config
21allow vendor_init configfs:dir mounton;
22allow vendor_init configfs:dir create_dir_perms;
23allow vendor_init configfs:{ file lnk_file } create_file_perms;
24
25# Create directories under /dev/cpuctl after chowning it to system.
26allow vendor_init self:global_capability_class_set { dac_override dac_read_search };
27
28# mkdir, symlink, write, rm/rmdir, chown/chmod, restorecon/restorecon_recursive from init.rc files.
29# chown/chmod require open+read+setattr required for open()+fchown/fchmod().
30# system/core/init.rc requires at least cache_file and data_file_type.
31# init.<board>.rc files often include device-specific types, so
32# we just allow all file types except /system files here.
33allow vendor_init self:global_capability_class_set { chown fowner fsetid };
34
35# mkdir with FBE requires reading /data/unencrypted/{ref,mode}.
36allow vendor_init unencrypted_data_file:dir search;
37allow vendor_init unencrypted_data_file:file r_file_perms;
38
39# Set encryption policy on dirs in /data
40allowxperm vendor_init data_file_type:dir ioctl {
41  FS_IOC_GET_ENCRYPTION_POLICY
42  FS_IOC_SET_ENCRYPTION_POLICY
43};
44
45allow vendor_init system_data_file:dir getattr;
46
47allow vendor_init {
48  file_type
49  -core_data_file_type
50  -exec_type
51  -system_file_type
52  -mnt_product_file
53  -password_slot_metadata_file
54  -ota_metadata_file
55  -unlabeled
56  -vendor_file_type
57  -vold_metadata_file
58  -gsi_metadata_file
59  -apex_metadata_file
60}:dir { create search getattr open read setattr ioctl write add_name remove_name rmdir relabelfrom };
61
62allow vendor_init unlabeled:{ dir notdevfile_class_set } { getattr relabelfrom };
63
64allow vendor_init {
65  file_type
66  -core_data_file_type
67  -exec_type
68  -password_slot_metadata_file
69  -ota_metadata_file
70  -runtime_event_log_tags_file
71  -system_file_type
72  -unlabeled
73  -vendor_file_type
74  -vold_metadata_file
75  -gsi_metadata_file
76  -apex_metadata_file
77}:file { create getattr open read write setattr relabelfrom unlink map };
78
79allow vendor_init {
80  file_type
81  -core_data_file_type
82  -exec_type
83  -password_slot_metadata_file
84  -ota_metadata_file
85  -system_file_type
86  -unlabeled
87  -vendor_file_type
88  -vold_metadata_file
89  -gsi_metadata_file
90  -apex_metadata_file
91}:{ sock_file fifo_file } { create getattr open read setattr relabelfrom unlink };
92
93allow vendor_init {
94  file_type
95  -apex_mnt_dir
96  -core_data_file_type
97  -exec_type
98  -password_slot_metadata_file
99  -ota_metadata_file
100  -system_file_type
101  -unlabeled
102  -vendor_file_type
103  -vold_metadata_file
104  -gsi_metadata_file
105  -apex_metadata_file
106}:lnk_file { create getattr setattr relabelfrom unlink };
107
108allow vendor_init {
109  file_type
110  -core_data_file_type
111  -exec_type
112  -mnt_product_file
113  -password_slot_metadata_file
114  -ota_metadata_file
115  -system_file_type
116  -vendor_file_type
117  -vold_metadata_file
118  -gsi_metadata_file
119  -apex_metadata_file
120}:dir_file_class_set relabelto;
121
122allow vendor_init dev_type:dir create_dir_perms;
123allow vendor_init dev_type:lnk_file create;
124
125# Disable tracing by writing to /sys/kernel/debug/tracing/tracing_on
126allow vendor_init debugfs_tracing:file w_file_perms;
127
128# chown/chmod on pseudo files.
129allow vendor_init {
130  fs_type
131  -contextmount_type
132  -keychord_device
133  -sdcard_type
134  -rootfs
135  -proc_uid_time_in_state
136  -proc_uid_concurrent_active_time
137  -proc_uid_concurrent_policy_time
138}:file { open read setattr map };
139
140allow vendor_init {
141  fs_type
142  -contextmount_type
143  -sdcard_type
144  -rootfs
145  -proc_uid_time_in_state
146  -proc_uid_concurrent_active_time
147  -proc_uid_concurrent_policy_time
148}:dir  { open read setattr search };
149
150# chown/chmod on devices, e.g. /dev/ttyHS0
151allow vendor_init {
152  dev_type
153  -keychord_device
154  -port_device
155  -lowpan_device
156  -hw_random_device
157}:chr_file setattr;
158
159allow vendor_init dev_type:blk_file getattr;
160
161# Write to /proc/sys/net/ping_group_range and other /proc/sys/net files.
162r_dir_file(vendor_init, proc_net_type)
163allow vendor_init proc_net_type:file w_file_perms;
164allow vendor_init self:global_capability_class_set net_admin;
165
166# Write to /proc/sys/vm/page-cluster
167allow vendor_init proc_page_cluster:file w_file_perms;
168
169# Write to sysfs nodes.
170allow vendor_init sysfs_type:dir r_dir_perms;
171allow vendor_init sysfs_type:lnk_file read;
172allow vendor_init { sysfs_type -sysfs_usermodehelper }:file rw_file_perms;
173
174# setfscreatecon() for labeling directories and socket files.
175allow vendor_init self:process { setfscreate };
176
177r_dir_file(vendor_init, vendor_file_type)
178
179# Vendor init can read properties
180allow vendor_init serialno_prop:file { getattr open read map };
181
182# Vendor init can perform operations on trusted and security Extended Attributes
183allow vendor_init self:global_capability_class_set sys_admin;
184
185# Raw writes to misc block device
186allow vendor_init misc_block_device:blk_file w_file_perms;
187
188# vendor_init is using bootstrap bionic
189allow vendor_init system_bootstrap_lib_file:dir r_dir_perms;
190allow vendor_init system_bootstrap_lib_file:file { execute read open getattr map };
191
192# Everything is labeled as rootfs in recovery mode. Vendor init has to execute
193# the dynamic linker and shared libraries.
194recovery_only(`
195  allow vendor_init rootfs:file { r_file_perms execute };
196')
197
198not_compatible_property(`
199    set_prop(vendor_init, {
200      property_type
201      -system_internal_property_type
202      -system_restricted_property_type
203    })
204')
205
206# Get file context
207allow vendor_init file_contexts_file:file r_file_perms;
208
209set_prop(vendor_init, apk_verity_prop)
210set_prop(vendor_init, bluetooth_a2dp_offload_prop)
211set_prop(vendor_init, bluetooth_audio_hal_prop)
212set_prop(vendor_init, cpu_variant_prop)
213set_prop(vendor_init, debug_prop)
214set_prop(vendor_init, exported_audio_prop)
215set_prop(vendor_init, exported_bluetooth_prop)
216set_prop(vendor_init, exported_camera_prop)
217set_prop(vendor_init, exported_config_prop)
218set_prop(vendor_init, exported_dalvik_prop)
219set_prop(vendor_init, exported_default_prop)
220set_prop(vendor_init, exported_ffs_prop)
221set_prop(vendor_init, exported_overlay_prop)
222set_prop(vendor_init, exported_pm_prop)
223set_prop(vendor_init, exported_radio_prop)
224set_prop(vendor_init, exported_system_radio_prop)
225set_prop(vendor_init, exported_wifi_prop)
226set_prop(vendor_init, exported2_config_prop)
227set_prop(vendor_init, exported2_system_prop)
228set_prop(vendor_init, exported2_vold_prop)
229set_prop(vendor_init, exported3_default_prop)
230set_prop(vendor_init, exported3_radio_prop)
231set_prop(vendor_init, incremental_prop)
232set_prop(vendor_init, lmkd_prop)
233set_prop(vendor_init, logd_prop)
234set_prop(vendor_init, log_tag_prop)
235set_prop(vendor_init, log_prop)
236set_prop(vendor_init, rebootescrow_hal_prop)
237set_prop(vendor_init, serialno_prop)
238set_prop(vendor_init, storage_config_prop)
239set_prop(vendor_init, userspace_reboot_config_prop)
240set_prop(vendor_init, vehicle_hal_prop)
241set_prop(vendor_init, vendor_default_prop)
242set_prop(vendor_init, vendor_security_patch_level_prop)
243set_prop(vendor_init, vndk_prop)
244set_prop(vendor_init, virtual_ab_prop)
245set_prop(vendor_init, wifi_log_prop)
246
247get_prop(vendor_init, exported2_radio_prop)
248get_prop(vendor_init, exported3_system_prop)
249get_prop(vendor_init, surfaceflinger_display_prop)
250get_prop(vendor_init, theme_prop)
251
252get_prop(vendor_init, ota_prop)
253
254###
255### neverallow rules
256###
257
258# Vendor init shouldn't communicate with any vendor process, nor most system processes.
259neverallow_establish_socket_comms(vendor_init, { domain -init -logd -su -vendor_init });
260
261# The vendor_init domain is only entered via an exec based transition from the
262# init domain, never via setcon().
263neverallow domain vendor_init:process dyntransition;
264neverallow { domain -init } vendor_init:process transition;
265neverallow vendor_init { file_type fs_type -init_exec }:file entrypoint;
266
267# Never read/follow symlinks created by shell or untrusted apps.
268neverallow vendor_init { app_data_file privapp_data_file }:lnk_file read;
269neverallow vendor_init shell_data_file:lnk_file read;
270# Init should not be creating subdirectories in /data/local/tmp
271neverallow vendor_init shell_data_file:dir { write add_name remove_name };
272
273# init should never execute a program without changing to another domain.
274neverallow vendor_init { file_type fs_type }:file execute_no_trans;
275
276# Init never adds or uses services via service_manager.
277neverallow vendor_init service_manager_type:service_manager { add find };
278neverallow vendor_init servicemanager:service_manager list;
279
280# vendor_init should never be ptraced
281neverallow * vendor_init:process ptrace;
282