1# zygote
2type zygote, domain, domain_deprecated;
3type zygote_exec, exec_type, file_type;
4
5init_daemon_domain(zygote)
6typeattribute zygote mlstrustedsubject;
7# Override DAC on files and switch uid/gid.
8allow zygote self:capability { dac_override setgid setuid fowner chown };
9# Drop capabilities from bounding set.
10allow zygote self:capability setpcap;
11# Switch SELinux context to app domains.
12allow zygote self:process setcurrent;
13allow zygote system_server:process dyntransition;
14allow zygote { appdomain autoplay_app }:process dyntransition;
15# Allow zygote to read app /proc/pid dirs (b/10455872)
16allow zygote { appdomain autoplay_app }:dir { getattr search };
17allow zygote { appdomain autoplay_app }:file { r_file_perms };
18# Move children into the peer process group.
19allow zygote system_server:process { getpgid setpgid };
20allow zygote { appdomain autoplay_app }:process { getpgid setpgid };
21# Read system data.
22allow zygote system_data_file:dir r_dir_perms;
23allow zygote system_data_file:file r_file_perms;
24# Write to /data/dalvik-cache.
25allow zygote dalvikcache_data_file:dir create_dir_perms;
26allow zygote dalvikcache_data_file:file create_file_perms;
27# Create symlinks in /data/dalvik-cache
28allow zygote dalvikcache_data_file:lnk_file create_file_perms;
29# Write to /data/resource-cache
30allow zygote resourcecache_data_file:dir rw_dir_perms;
31allow zygote resourcecache_data_file:file create_file_perms;
32# For art.
33allow zygote dalvikcache_data_file:file execute;
34# Execute idmap and dex2oat within zygote's own domain.
35# TODO:  Should either of these be transitioned to the same domain
36# used by installd or stay in-domain for zygote?
37allow zygote idmap_exec:file rx_file_perms;
38allow zygote dex2oat_exec:file rx_file_perms;
39# Control cgroups.
40allow zygote cgroup:dir create_dir_perms;
41allow zygote self:capability sys_admin;
42# Check validity of SELinux context before use.
43selinux_check_context(zygote)
44# Check SELinux permissions.
45selinux_check_access(zygote)
46# Read /seapp_contexts and /data/security/seapp_contexts
47security_access_policy(zygote)
48
49# Native bridge functionality requires that zygote replaces
50# /proc/cpuinfo with /system/lib/<ISA>/cpuinfo using a bind mount
51allow zygote proc_cpuinfo:file mounton;
52
53# Allow remounting rootfs as MS_SLAVE
54allow zygote rootfs:dir mounton;
55allow zygote tmpfs:filesystem { mount unmount };
56allow zygote fuse:filesystem { unmount };
57allow zygote sdcardfs:filesystem { unmount };
58
59# Allowed to create user-specific storage source if started before vold
60allow zygote mnt_user_file:dir create_dir_perms;
61allow zygote mnt_user_file:lnk_file create_file_perms;
62# Allowed to mount user-specific storage into place
63allow zygote storage_file:dir { search mounton };
64
65# Handle --invoke-with command when launching Zygote with a wrapper command.
66allow zygote zygote_exec:file rx_file_perms;
67
68# Read access to pseudo filesystems.
69r_dir_file(zygote, proc_net)
70
71# Root fs.
72allow zygote rootfs:file r_file_perms;
73
74# System file accesses.
75allow zygote system_file:dir r_dir_perms;
76allow zygote system_file:file r_file_perms;
77
78userdebug_or_eng(`
79  # Allow zygote to create and write method traces in /data/misc/trace.
80  allow zygote method_trace_data_file:dir w_dir_perms;
81  allow zygote method_trace_data_file:file { create w_file_perms };
82')
83
84###
85### A/B OTA
86###
87
88# The zygote is responsible for detecting A/B OTA artifacts and moving them into
89# the actual dalvik-cache.
90
91# Allow zygote access to files in /data/ota.
92# This includes reading symlinks in /data/ota/dalvik-cache. This is required for PIC mode boot
93# images, where the oat file is symlinked to the original file in /system.
94r_dir_file(zygote, ota_data_file)
95
96# The zygote renames the OTA dalvik-cache to the regular dalvik-cache.
97allow zygote ota_data_file:dir { rw_dir_perms rename reparent };
98
99# And needs to relabel the entries, so as to have the dalvikcache_data_file label.
100allow zygote ota_data_file:{ dir file lnk_file } relabelfrom;
101allow zygote dalvikcache_data_file:{ dir file lnk_file } relabelto;
102
103# The zygote also cleans up the now-empty dalvik-cache directory after an OTA.
104# In case something goes wrong in relabelling, we also need to be able to delete the files that
105# have already been moved.
106allow zygote ota_data_file:dir rmdir;
107allow zygote ota_data_file:{ file lnk_file } unlink;
108
109###
110### neverallow rules
111###
112
113# Ensure that all types assigned to app processes are included
114# in the appdomain attribute, so that all allow and neverallow rules
115# written on appdomain are applied to all app processes.
116# This is achieved by ensuring that it is impossible for zygote to
117# setcon (dyntransition) to any types other than those associated
118# with appdomain plus system_server.
119neverallow zygote ~{ appdomain autoplay_app system_server }:process dyntransition;
120
121# Zygote should never execute anything from /data except for /data/dalvik-cache files.
122neverallow zygote {
123  data_file_type
124  -dalvikcache_data_file # map PROT_EXEC
125}:file no_x_file_perms;
126