1#####################################
2# domain_trans(olddomain, type, newdomain)
3# Allow a transition from olddomain to newdomain
4# upon executing a file labeled with type.
5# This only allows the transition; it does not
6# cause it to occur automatically - use domain_auto_trans
7# if that is what you want.
8#
9define(`domain_trans', `
10# Old domain may exec the file and transition to the new domain.
11allow $1 $2:file { getattr open read execute };
12allow $1 $3:process transition;
13# New domain is entered by executing the file.
14allow $3 $2:file { entrypoint open read execute getattr };
15# New domain can send SIGCHLD to its caller.
16allow $3 $1:process sigchld;
17# Enable AT_SECURE, i.e. libc secure mode.
18dontaudit $1 $3:process noatsecure;
19# XXX dontaudit candidate but requires further study.
20allow $1 $3:process { siginh rlimitinh };
21')
22
23#####################################
24# domain_auto_trans(olddomain, type, newdomain)
25# Automatically transition from olddomain to newdomain
26# upon executing a file labeled with type.
27#
28define(`domain_auto_trans', `
29# Allow the necessary permissions.
30domain_trans($1,$2,$3)
31# Make the transition occur by default.
32type_transition $1 $2:process $3;
33')
34
35#####################################
36# file_type_trans(domain, dir_type, file_type)
37# Allow domain to create a file labeled file_type in a
38# directory labeled dir_type.
39# This only allows the transition; it does not
40# cause it to occur automatically - use file_type_auto_trans
41# if that is what you want.
42#
43define(`file_type_trans', `
44# Allow the domain to add entries to the directory.
45allow $1 $2:dir ra_dir_perms;
46# Allow the domain to create the file.
47allow $1 $3:notdevfile_class_set create_file_perms;
48allow $1 $3:dir create_dir_perms;
49')
50
51#####################################
52# file_type_auto_trans(domain, dir_type, file_type)
53# Automatically label new files with file_type when
54# they are created by domain in directories labeled dir_type.
55#
56define(`file_type_auto_trans', `
57# Allow the necessary permissions.
58file_type_trans($1, $2, $3)
59# Make the transition occur by default.
60type_transition $1 $2:dir $3;
61type_transition $1 $2:notdevfile_class_set $3;
62')
63
64#####################################
65# r_dir_file(domain, type)
66# Allow the specified domain to read directories, files
67# and symbolic links of the specified type.
68define(`r_dir_file', `
69allow $1 $2:dir r_dir_perms;
70allow $1 $2:{ file lnk_file } r_file_perms;
71')
72
73#####################################
74# tmpfs_domain(domain)
75# Define and allow access to a unique type for
76# this domain when creating tmpfs / shmem / ashmem files.
77define(`tmpfs_domain', `
78type $1_tmpfs, file_type;
79type_transition $1 tmpfs:file $1_tmpfs;
80allow $1 $1_tmpfs:file { read write };
81')
82
83#####################################
84# init_daemon_domain(domain)
85# Set up a transition from init to the daemon domain
86# upon executing its binary.
87define(`init_daemon_domain', `
88domain_auto_trans(init, $1_exec, $1)
89tmpfs_domain($1)
90')
91
92#####################################
93# app_domain(domain)
94# Allow a base set of permissions required for all apps.
95define(`app_domain', `
96typeattribute $1 appdomain;
97# Label ashmem objects with our own unique type.
98tmpfs_domain($1)
99# Map with PROT_EXEC.
100allow $1 $1_tmpfs:file execute;
101')
102
103#####################################
104# net_domain(domain)
105# Allow a base set of permissions required for network access.
106define(`net_domain', `
107typeattribute $1 netdomain;
108')
109
110#####################################
111# bluetooth_domain(domain)
112# Allow a base set of permissions required for bluetooth access.
113define(`bluetooth_domain', `
114typeattribute $1 bluetoothdomain;
115')
116
117#####################################
118# unix_socket_connect(clientdomain, socket, serverdomain)
119# Allow a local socket connection from clientdomain via
120# socket to serverdomain.
121#
122# Note: If you see denial records that distill to the
123# following allow rules:
124# allow clientdomain property_socket:sock_file write;
125# allow clientdomain init:unix_stream_socket connectto;
126# allow clientdomain something_prop:property_service set;
127#
128# This sequence is indicative of attempting to set a property.
129# use set_prop(sourcedomain, targetproperty)
130#
131define(`unix_socket_connect', `
132ifelse($2, `property', `
133    ifelse($3,`init', `
134       print(`deprecated: unix_socket_connect($1, $2, $3) Please use set_prop($1, <property name>) instead.')
135   ')
136')
137__unix_socket_connect__($1, $2, $3)
138')
139
140define(`__unix_socket_connect__', `
141allow $1 $2_socket:sock_file write;
142allow $1 $3:unix_stream_socket connectto;
143')
144
145#####################################
146# set_prop(sourcedomain, targetproperty)
147# Allows source domain to set the
148# targetproperty.
149#
150define(`set_prop', `
151__unix_socket_connect__($1, property, init)
152allow $1 $2:property_service set;
153get_prop($1, $2)
154')
155
156#####################################
157# get_prop(sourcedomain, targetproperty)
158# Allows source domain to read the
159# targetproperty.
160#
161define(`get_prop', `
162allow $1 $2:file r_file_perms;
163')
164
165#####################################
166# unix_socket_send(clientdomain, socket, serverdomain)
167# Allow a local socket send from clientdomain via
168# socket to serverdomain.
169define(`unix_socket_send', `
170allow $1 $2_socket:sock_file write;
171allow $1 $3:unix_dgram_socket sendto;
172')
173
174#####################################
175# binder_use(domain)
176# Allow domain to use Binder IPC.
177define(`binder_use', `
178# Call the servicemanager and transfer references to it.
179allow $1 servicemanager:binder { call transfer };
180# servicemanager performs getpidcon on clients.
181allow servicemanager $1:dir search;
182allow servicemanager $1:file { read open };
183allow servicemanager $1:process getattr;
184# rw access to /dev/binder and /dev/ashmem is presently granted to
185# all domains in domain.te.
186')
187
188#####################################
189# binder_call(clientdomain, serverdomain)
190# Allow clientdomain to perform binder IPC to serverdomain.
191define(`binder_call', `
192# Call the server domain and optionally transfer references to it.
193allow $1 $2:binder { call transfer };
194# Allow the serverdomain to transfer references to the client on the reply.
195allow $2 $1:binder transfer;
196# Receive and use open files from the server.
197allow $1 $2:fd use;
198')
199
200#####################################
201# binder_service(domain)
202# Mark a domain as being a Binder service domain.
203# Used to allow binder IPC to the various system services.
204define(`binder_service', `
205typeattribute $1 binderservicedomain;
206')
207
208#####################################
209# wakelock_use(domain)
210# Allow domain to manage wake locks
211define(`wakelock_use', `
212# Access /sys/power/wake_lock and /sys/power/wake_unlock
213allow $1 sysfs_wake_lock:file rw_file_perms;
214# Accessing these files requires CAP_BLOCK_SUSPEND
215allow $1 self:capability2 block_suspend;
216')
217
218#####################################
219# selinux_check_access(domain)
220# Allow domain to check SELinux permissions via selinuxfs.
221define(`selinux_check_access', `
222allow $1 selinuxfs:file rw_file_perms;
223allow $1 kernel:security compute_av;
224allow $1 self:netlink_selinux_socket { read write create getattr setattr lock relabelfrom relabelto append bind connect listen accept getopt setopt shutdown recvfrom sendto recv_msg send_msg name_bind };
225')
226
227#####################################
228# selinux_check_context(domain)
229# Allow domain to check SELinux contexts via selinuxfs.
230define(`selinux_check_context', `
231allow $1 selinuxfs:file rw_file_perms;
232allow $1 kernel:security check_context;
233')
234
235#####################################
236# selinux_setenforce(domain)
237# Allow domain to set SELinux to enforcing.
238define(`selinux_setenforce', `
239allow $1 selinuxfs:file rw_file_perms;
240allow $1 kernel:security setenforce;
241')
242
243#####################################
244# selinux_setbool(domain)
245# Allow domain to set SELinux booleans.
246define(`selinux_setbool', `
247allow $1 selinuxfs:file rw_file_perms;
248allow $1 kernel:security setbool;
249')
250
251#####################################
252# security_access_policy(domain)
253# Read only access to all policy files and
254# selinuxfs
255define(`security_access_policy', `
256allow $1 security_file:dir r_dir_perms;
257allow $1 security_file:file r_file_perms;
258')
259
260#####################################
261# mmac_manage_policy(domain)
262# Ability to manage mmac policy files,
263# trigger runtime reload, change
264# mmac enforcing mode and access logcat.
265define(`mmac_manage_policy', `
266allow $1 security_file:dir create_dir_perms;
267allow $1 security_file:file create_file_perms;
268allow $1 security_file:lnk_file { create rename unlink };
269set_prop($1, security_prop)
270')
271
272#####################################
273# create_pty(domain)
274# Allow domain to create and use a pty, isolated from any other domain ptys.
275define(`create_pty', `
276# Each domain gets a unique devpts type.
277type $1_devpts, fs_type;
278# Label the pty with the unique type when created.
279type_transition $1 devpts:chr_file $1_devpts;
280# Allow use of the pty after creation.
281allow $1 $1_devpts:chr_file { open getattr read write ioctl };
282# Note: devpts:dir search and ptmx_device:chr_file rw_file_perms
283# allowed to everyone via domain.te.
284')
285
286#####################################
287# Non system_app application set
288#
289define(`non_system_app_set', `{ appdomain -system_app }')
290
291#####################################
292# Recovery only
293# SELinux rules which apply only to recovery mode
294#
295define(`recovery_only', ifelse(target_recovery, `true', $1, ))
296
297#####################################
298# Userdebug or eng builds
299# SELinux rules which apply only to userdebug or eng builds
300#
301define(`userdebug_or_eng', ifelse(target_build_variant, `eng', $1, ifelse(target_build_variant, `userdebug', $1)))
302define(`eng', ifelse(target_build_variant, `eng', $1))
303
304#####################################
305# write_logd(domain)
306# Ability to write to android log
307# daemon via sockets
308define(`write_logd', `
309unix_socket_send($1, logdw, logd)
310allow $1 pmsg_device:chr_file w_file_perms;
311')
312
313#####################################
314# read_logd(domain)
315# Ability to run logcat and read from android
316# log daemon via sockets
317define(`read_logd', `
318allow $1 logcat_exec:file rx_file_perms;
319unix_socket_connect($1, logdr, logd)
320')
321
322#####################################
323# control_logd(domain)
324# Ability to control
325# android log daemon via sockets
326define(`control_logd', `
327# Group AID_LOG checked by filesystem & logd
328# to permit control commands
329unix_socket_connect($1, logd, logd)
330')
331
332#####################################
333# use_keystore(domain)
334# Ability to use keystore.
335# Keystore is requires the following permissions
336# to call getpidcon.
337define(`use_keystore', `
338  allow keystore $1:dir search;
339  allow keystore $1:file { read open };
340  allow keystore $1:process getattr;
341  allow $1 keystore_service:service_manager find;
342  binder_call($1, keystore)
343')
344
345###########################################
346# use_drmservice(domain)
347# Ability to use DrmService which requires
348# DrmService to call getpidcon.
349define(`use_drmservice', `
350  allow drmserver $1:dir search;
351  allow drmserver $1:file { read open };
352  allow drmserver $1:process getattr;
353')
354
355##########################################
356# print a message with a trailing newline
357# print(`args')
358define(`print', `errprint(`m4: '__file__: __line__`: $*
359')')
360