1# gsid - Manager for GSI Installation
2
3type gsid, domain;
4type gsid_exec, exec_type, file_type, system_file_type;
5typeattribute gsid coredomain;
6
7init_daemon_domain(gsid)
8
9binder_use(gsid)
10binder_service(gsid)
11add_service(gsid, gsi_service)
12
13# Manage DSU metadata encryption key through vold.
14allow gsid vold_service:service_manager find;
15binder_call(gsid, vold)
16
17set_prop(gsid, gsid_prop)
18
19# Needed to create/delete device-mapper nodes, and read/write to them.
20allow gsid dm_device:chr_file rw_file_perms;
21allow gsid dm_device:blk_file rw_file_perms;
22allow gsid self:global_capability_class_set sys_admin;
23dontaudit gsid self:global_capability_class_set dac_override;
24
25# On FBE devices (not using dm-default-key), gsid will use loop devices to map
26# images rather than device-mapper.
27allow gsid loop_control_device:chr_file rw_file_perms;
28allow gsid loop_device:blk_file rw_file_perms;
29allowxperm gsid loop_device:blk_file ioctl {
30  LOOP_GET_STATUS64
31  LOOP_SET_STATUS64
32  LOOP_SET_FD
33  LOOP_SET_BLOCK_SIZE
34  LOOP_SET_DIRECT_IO
35  LOOP_CLR_FD
36  BLKFLSBUF
37};
38
39# libfiemap_writer uses sysfs to derive the bottom of a device-mapper stacking.
40# This requires traversing /sys/block/dm-N/slaves/* and reading the list of
41# file names.
42r_dir_file(gsid, sysfs_dm)
43
44# libfiemap_writer needs to read /sys/fs/f2fs/<dev>/features to determine
45# whether pin_file support is enabled.
46r_dir_file(gsid, sysfs_fs_f2fs)
47
48# Needed to read fstab, which is used to validate that system verity does not
49# use check_once_at_most for sdcard installs. (Note: proc_cmdline is needed
50# to get the A/B slot suffix).
51allow gsid proc_cmdline:file r_file_perms;
52allow gsid sysfs_dt_firmware_android:dir r_dir_perms;
53allow gsid sysfs_dt_firmware_android:file r_file_perms;
54
55# Needed to stat /data/gsi/* and realpath on /dev/block/by-name/*
56allow gsid block_device:dir r_dir_perms;
57
58# liblp queries these block alignment properties.
59allowxperm gsid { userdata_block_device sdcard_block_device }:blk_file ioctl {
60  BLKIOMIN
61  BLKALIGNOFF
62};
63
64# When installing images to an sdcard, gsid needs to be able to stat() the
65# block device. gsid also calls realpath() to remove symlinks.
66allow gsid mnt_media_rw_file:dir r_dir_perms;
67allow gsid mnt_media_rw_stub_file:dir r_dir_perms;
68
69# When installing images to an sdcard, gsid must bypass sdcardfs and install
70# directly to vfat, which supports the FIBMAP ioctl.
71allow gsid vfat:dir create_dir_perms;
72allow gsid vfat:file create_file_perms;
73allow gsid sdcard_block_device:blk_file r_file_perms;
74# This is needed for FIBMAP unfortunately. Oddly FIEMAP does not carry this
75# requirement, but the kernel does not implement FIEMAP support for VFAT.
76allow gsid self:global_capability_class_set sys_rawio;
77
78# Allow rules for gsi_tool.
79userdebug_or_eng(`
80  # gsi_tool passes the system image over the adb connection, via stdin.
81  allow gsid adbd:fd use;
82  # Needed when running gsi_tool through "su root" rather than adb root.
83  allow gsid adbd:unix_stream_socket rw_socket_perms;
84  # gsi_tool passes a FIFO to gsid if invoked with pipe redirection.
85  allow gsid { shell su }:fifo_file r_file_perms;
86  # Allow installing images from /storage/emulated/...
87  allow gsid sdcard_type:file r_file_perms;
88')
89
90neverallow {
91  domain
92  -gsid
93  -init
94  -update_engine_common
95  -recovery
96  -fastbootd
97} gsid_prop:property_service set;
98
99# gsid needs to store images on /data, but cannot use file I/O. If it did, the
100# underlying blocks would be encrypted, and we couldn't mount the GSI image in
101# first-stage init. So instead of directly writing to /data, we:
102#
103#   1. fallocate a file large enough to hold the signed GSI
104#   2. extract its block layout with FIEMAP
105#   3. create a dm-linear device using the FIEMAP, targeting /dev/block/by-name/userdata
106#   4. write system_gsi into that dm device
107#
108# To make this process work, we need to unwrap the device-mapper stacking for
109# userdata to reach the underlying block device. To verify the result we use
110# stat(), which requires read access.
111allow gsid userdata_block_device:blk_file r_file_perms;
112
113# gsid uses /metadata/gsi to communicate GSI boot information to first-stage
114# init. It cannot use userdata since data cannot be decrypted during this
115# stage.
116#
117# gsid uses /metadata/gsi to store three files:
118#   install_status - A short string indicating whether a GSI image is bootable.
119#   lp_metadata    - LpMetadata blob describing the block ranges on userdata
120#                    where system_gsi resides.
121#   booted         - An empty file that, if exists, indicates that a GSI is
122#                    currently running.
123#
124allow gsid metadata_file:dir { search getattr };
125allow gsid {
126    gsi_metadata_file_type
127}:dir create_dir_perms;
128
129allow gsid {
130    ota_metadata_file
131}:dir rw_dir_perms;
132
133allow gsid {
134    gsi_metadata_file_type
135    ota_metadata_file
136}:file create_file_perms;
137
138# Allow restorecon to fix context of gsi_public_metadata_file.
139allow gsid file_contexts_file:file r_file_perms;
140allow gsid gsi_metadata_file:file relabelfrom;
141allow gsid gsi_public_metadata_file:file relabelto;
142
143allow gsid {
144      gsi_data_file
145      ota_image_data_file
146}:dir rw_dir_perms;
147allow gsid {
148      gsi_data_file
149      ota_image_data_file
150}:file create_file_perms;
151allowxperm gsid {
152      gsi_data_file
153      ota_image_data_file
154}:file ioctl {
155      FS_IOC_FIEMAP
156      FS_IOC_GETFLAGS
157};
158
159allow gsid system_server:binder call;
160
161# Prevent most processes from writing to gsi_metadata_file_type, but allow
162# adding rules for path resolution of gsi_public_metadata_file and reading
163# gsi_public_metadata_file.
164neverallow {
165    domain
166    -init
167    -gsid
168    -fastbootd
169} gsi_metadata_file_type:dir no_w_dir_perms;
170
171neverallow {
172    domain
173    -init
174    -gsid
175    -fastbootd
176} { gsi_metadata_file_type -gsi_public_metadata_file }:file_class_set *;
177
178neverallow {
179    domain
180    -init
181    -gsid
182    -fastbootd
183} gsi_public_metadata_file:file_class_set ~{ r_file_perms };
184
185# Prevent apps from accessing gsi_metadata_file_type.
186neverallow {
187    appdomain
188    -shell
189} gsi_metadata_file_type:dir_file_class_set *;
190
191neverallow {
192    domain
193    -init
194    -gsid
195} gsi_data_file:dir_file_class_set *;
196
197neverallow {
198    domain
199    -gsid
200} gsi_data_file:file_class_set ~{ relabelto getattr };
201