1### 2### neverallow rules for untrusted app domains 3### 4 5define(`all_untrusted_apps',`{ 6 ephemeral_app 7 isolated_app 8 mediaprovider 9 mediaprovider_app 10 untrusted_app 11 untrusted_app_25 12 untrusted_app_27 13 untrusted_app_29 14 untrusted_app_all 15}') 16# Receive or send uevent messages. 17neverallow all_untrusted_apps domain:netlink_kobject_uevent_socket *; 18 19# Receive or send generic netlink messages 20neverallow all_untrusted_apps domain:netlink_socket *; 21 22# Read or write kernel printk buffer 23neverallow all_untrusted_apps kmsg_device:chr_file no_rw_file_perms; 24 25# Too much leaky information in debugfs. It's a security 26# best practice to ensure these files aren't readable. 27neverallow all_untrusted_apps { debugfs_type -debugfs_kcov }:file read; 28neverallow {all_untrusted_apps userdebug_or_eng(`-domain')} debugfs_type:{ file lnk_file } read; 29 30# Do not allow untrusted apps to register services. 31# Only trusted components of Android should be registering 32# services. 33neverallow all_untrusted_apps service_manager_type:service_manager add; 34 35# Do not allow untrusted apps to use VendorBinder 36neverallow all_untrusted_apps vndbinder_device:chr_file *; 37neverallow all_untrusted_apps vndservice_manager_type:service_manager *; 38 39# Do not allow untrusted apps to connect to the property service 40# or set properties. b/10243159 41neverallow { all_untrusted_apps -mediaprovider } property_socket:sock_file write; 42neverallow { all_untrusted_apps -mediaprovider } init:unix_stream_socket connectto; 43neverallow { all_untrusted_apps -mediaprovider } property_type:property_service set; 44 45# net.dns properties are not a public API. Disallow untrusted apps from reading this property. 46neverallow { all_untrusted_apps } net_dns_prop:file read; 47 48# radio_cdma_ecm_prop properties are not a public API. Disallow untrusted apps from reading this property. 49neverallow { all_untrusted_apps } radio_cdma_ecm_prop:file read; 50 51# Shared libraries created by trusted components within an app home 52# directory can be dlopen()ed. To maintain the W^X property, these files 53# must never be writable to the app. 54neverallow all_untrusted_apps app_exec_data_file:file 55 { append create link relabelfrom relabelto rename setattr write }; 56 57# Block calling execve() on files in an apps home directory. 58# This is a W^X violation (loading executable code from a writable 59# home directory). For compatibility, allow for targetApi <= 28. 60# b/112357170 61neverallow { 62 all_untrusted_apps 63 -untrusted_app_25 64 -untrusted_app_27 65 -runas_app 66} { app_data_file privapp_data_file }:file execute_no_trans; 67 68# Do not allow untrusted apps to invoke dex2oat. This was historically required 69# by ART for compiling secondary dex files but has been removed in Q. 70# Exempt legacy apps (targetApi<=28) for compatibility. 71neverallow { 72 all_untrusted_apps 73 -untrusted_app_25 74 -untrusted_app_27 75} dex2oat_exec:file no_x_file_perms; 76 77# Do not allow untrusted apps to be assigned mlstrustedsubject. 78# This would undermine the per-user isolation model being 79# enforced via levelFrom=user in seapp_contexts and the mls 80# constraints. As there is no direct way to specify a neverallow 81# on attribute assignment, this relies on the fact that fork 82# permission only makes sense within a domain (hence should 83# never be granted to any other domain within mlstrustedsubject) 84# and an untrusted app is allowed fork permission to itself. 85neverallow all_untrusted_apps mlstrustedsubject:process fork; 86 87# Do not allow untrusted apps to hard link to any files. 88# In particular, if an untrusted app links to other app data 89# files, installd will not be able to guarantee the deletion 90# of the linked to file. Hard links also contribute to security 91# bugs, so we want to ensure untrusted apps never have this 92# capability. 93neverallow all_untrusted_apps file_type:file link; 94 95# Do not allow untrusted apps to access network MAC address file 96neverallow all_untrusted_apps sysfs_net:file no_rw_file_perms; 97 98# Do not allow any write access to files in /sys 99neverallow all_untrusted_apps sysfs_type:file { no_w_file_perms no_x_file_perms }; 100 101# Apps may never access the default sysfs label. 102neverallow all_untrusted_apps sysfs:file no_rw_file_perms; 103 104# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the 105# ioctl permission, or 3. disallow the socket class. 106neverallowxperm all_untrusted_apps domain:{ icmp_socket rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls; 107neverallow all_untrusted_apps *:{ netlink_route_socket netlink_selinux_socket } ioctl; 108neverallow all_untrusted_apps *:{ 109 socket netlink_socket packet_socket key_socket appletalk_socket 110 netlink_tcpdiag_socket netlink_nflog_socket 111 netlink_xfrm_socket netlink_audit_socket 112 netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket 113 netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket 114 netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket 115 netlink_rdma_socket netlink_crypto_socket sctp_socket 116 ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket 117 atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket 118 bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket 119 alg_socket nfc_socket vsock_socket kcm_socket qipcrtr_socket smc_socket xdp_socket 120} *; 121 122# Disallow sending RTM_GETLINK messages on netlink sockets. 123neverallow { 124 all_untrusted_apps 125 -untrusted_app_25 126 -untrusted_app_27 127 -untrusted_app_29 128} domain:netlink_route_socket { bind nlmsg_readpriv }; 129 130# Do not allow untrusted apps access to /cache 131neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:dir ~{ r_dir_perms }; 132neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:file ~{ read getattr }; 133 134# Do not allow untrusted apps to create/unlink files outside of its sandbox, 135# internal storage or sdcard. 136# World accessible data locations allow application to fill the device 137# with unaccounted for data. This data will not get removed during 138# application un-installation. 139neverallow { all_untrusted_apps -mediaprovider } { 140 fs_type 141 -sdcard_type 142 file_type 143 -app_data_file # The apps sandbox itself 144 -privapp_data_file 145 -app_exec_data_file # stored within the app sandbox directory 146 -media_rw_data_file # Internal storage. Known that apps can 147 # leave artfacts here after uninstall. 148 -user_profile_data_file # Access to profile files 149 userdebug_or_eng(` 150 -method_trace_data_file # only on ro.debuggable=1 151 -coredump_file # userdebug/eng only 152 ') 153}:dir_file_class_set { create unlink }; 154 155# No untrusted component except mediaprovider_app should be touching /dev/fuse 156neverallow { all_untrusted_apps -mediaprovider_app } fuse_device:chr_file *; 157 158# Do not allow untrusted apps to directly open the tun_device 159neverallow all_untrusted_apps tun_device:chr_file open; 160# The tun_device ioctls below are not allowed, to prove equivalence 161# to the kernel patch at 162# https://android.googlesource.com/kernel/common/+/11cee2be0c2062ba88f04eb51196506f870a3b5d%5E%21 163neverallowxperm all_untrusted_apps tun_device:chr_file ioctl ~{ FIOCLEX FIONCLEX TUNGETIFF }; 164 165# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553) 166neverallow all_untrusted_apps anr_data_file:file ~{ open append }; 167neverallow all_untrusted_apps anr_data_file:dir ~search; 168 169# Avoid reads from generically labeled /proc files 170# Create a more specific label if needed 171neverallow all_untrusted_apps { 172 proc 173 proc_asound 174 proc_kmsg 175 proc_loadavg 176 proc_mounts 177 proc_pagetypeinfo 178 proc_slabinfo 179 proc_stat 180 proc_swaps 181 proc_uptime 182 proc_version 183 proc_vmallocinfo 184 proc_vmstat 185}:file { no_rw_file_perms no_x_file_perms }; 186 187# /proc/filesystems is accessible to mediaprovider_app only since it handles 188# external storage 189neverallow { all_untrusted_apps - mediaprovider_app } proc_filesystems:file { no_rw_file_perms no_x_file_perms }; 190 191# Avoid all access to kernel configuration 192neverallow all_untrusted_apps config_gz:file { no_rw_file_perms no_x_file_perms }; 193 194# Do not allow untrusted apps access to preloads data files 195neverallow all_untrusted_apps preloads_data_file:file no_rw_file_perms; 196 197# Locking of files on /system could lead to denial of service attacks 198# against privileged system components 199neverallow all_untrusted_apps system_file:file lock; 200 201# Do not permit untrusted apps to perform actions on HwBinder service_manager 202# other than find actions for services listed below 203neverallow all_untrusted_apps *:hwservice_manager ~find; 204 205# Do not permit access from apps which host arbitrary code to the protected services 206# The two main reasons for this are: 207# 1. Protected HwBinder servers do not perform client authentication because 208# vendor code does not have a way to understand apps or their relation to 209# caller UID information and, even if it did, those services either operate 210# at a level below that of apps (e.g., HALs) or must not rely on app identity 211# for authorization. Thus, to be safe, the default assumption for all added 212# vendor services is that they treat all their clients as equally authorized 213# to perform operations offered by the service. 214# 2. HAL servers contain code with higher incidence rate of security issues 215# than system/core components and have access to lower layes of the stack 216# (all the way down to hardware) thus increasing opportunities for bypassing 217# the Android security model. 218neverallow all_untrusted_apps protected_hwservice:hwservice_manager find; 219neverallow all_untrusted_apps protected_service:service_manager find; 220 221# SELinux is not an API for untrusted apps to use 222neverallow all_untrusted_apps selinuxfs:file no_rw_file_perms; 223 224# Access to /proc/tty/drivers, to allow apps to determine if they 225# are running in an emulated environment. 226# b/33214085 b/33814662 b/33791054 b/33211769 227# https://github.com/strazzere/anti-emulator/blob/master/AntiEmulator/src/diff/strazzere/anti/emulator/FindEmulator.java 228# This will go away in a future Android release 229neverallow { all_untrusted_apps -untrusted_app_25 } proc_tty_drivers:file r_file_perms; 230neverallow all_untrusted_apps proc_tty_drivers:file ~r_file_perms; 231 232# Untrusted apps are not allowed to use cgroups. 233neverallow all_untrusted_apps cgroup:file *; 234neverallow all_untrusted_apps cgroup_v2:file *; 235 236# /mnt/sdcard symlink was supposed to have been removed in Gingerbread. Apps 237# must not use it. 238neverallow { 239 all_untrusted_apps 240 -untrusted_app_25 241 -untrusted_app_27 242} mnt_sdcard_file:lnk_file *; 243 244# Only privileged apps may find the incident service 245neverallow all_untrusted_apps incident_service:service_manager find; 246