diff --git a/public/attributes b/public/attributes index c25f1ebc899ebfedbef86c0cb14ebed4624e4c9e..2a8a40ada20732b34e48382c4e6efa427e14486d 100644 --- a/public/attributes +++ b/public/attributes @@ -154,6 +154,12 @@ expandattribute vendor_executes_system_violators false; attribute data_between_core_and_vendor_violators; expandattribute data_between_core_and_vendor_violators false; +# All system domains which violate the requirement of not executing vendor +# binaries/libraries. +# TODO(b/62041836) +attribute system_executes_vendor_violators; +expandattribute system_executes_vendor_violators false; + # hwservices that are accessible from untrusted applications # WARNING: Use of this attribute should be avoided unless # absolutely necessary. It is a temporary allowance to aid the diff --git a/public/domain.te b/public/domain.te index 70d8ae20fd3c551c54026ef63de7e5a7120108fa..fb468e0db803e5b761f8272d540cfe8ae02bca91 100644 --- a/public/domain.te +++ b/public/domain.te @@ -829,6 +829,20 @@ full_treble_only(` -crash_dump_exec -netutils_wrapper_exec }:file { entrypoint execute execute_no_trans }; + + # Do not allow system components to execute files from vendor + # except for the ones whitelist here. + neverallow { + coredomain + -init + -system_executes_vendor_violators + -vendor_init + } { + vendor_file_type + -same_process_hal_file + -vndk_sp_file + -vendor_app_file + }:file { execute execute_no_trans }; ') # Only authorized processes should be writing to files in /data/dalvik-cache