diff --git a/private/app.te b/private/app.te index b009d986944a0e3ea1f127921174937a6cd86eaa..98fcce0f14571112c91fede409bf641f6a5e2102 100644 --- a/private/app.te +++ b/private/app.te @@ -86,9 +86,9 @@ allow appdomain oemfs:dir r_dir_perms; allow appdomain oemfs:file rx_file_perms; # Execute the shell or other system executables. -allow appdomain shell_exec:file rx_file_perms; -allow appdomain system_file:file rx_file_perms; -allow appdomain toolbox_exec:file rx_file_perms; +allow { appdomain -ephemeral_app -untrusted_v2_app } shell_exec:file rx_file_perms; +allow { appdomain -ephemeral_app -untrusted_v2_app } system_file:file rx_file_perms; +allow { appdomain -ephemeral_app -untrusted_v2_app } toolbox_exec:file rx_file_perms; # Renderscript needs the ability to read directories on /system r_dir_file(appdomain, system_file) @@ -232,7 +232,7 @@ allow appdomain resourcecache_data_file:dir r_dir_perms; # logd access read_logd(appdomain) -control_logd(appdomain) +control_logd({ appdomain -ephemeral_app untrusted_v2_app }) # application inherit logd write socket (urge is to deprecate this long term) allow appdomain zygote:unix_dgram_socket write; diff --git a/private/app_neverallows.te b/private/app_neverallows.te index a881d52df5e283300eb64502909ea434816beda5..565936aa7c7c3b57504c90c448caf1c83ee9a3f6 100644 --- a/private/app_neverallows.te +++ b/private/app_neverallows.te @@ -5,30 +5,27 @@ # Only allow domains in AOSP to use the untrusted_app_all attribute. neverallow { untrusted_app_all -untrusted_app -untrusted_app_25 } domain:process fork; +define(`all_untrusted_apps',`{ untrusted_app_all untrusted_app_25 untrusted_app ephemeral_app isolated_app }') # Receive or send uevent messages. -neverallow { untrusted_app_all ephemeral_app isolated_app } domain:netlink_kobject_uevent_socket *; +neverallow all_untrusted_apps domain:netlink_kobject_uevent_socket *; # Receive or send generic netlink messages -neverallow { untrusted_app_all ephemeral_app isolated_app } domain:netlink_socket *; +neverallow all_untrusted_apps domain:netlink_socket *; # Too much leaky information in debugfs. It's a security # best practice to ensure these files aren't readable. -neverallow { untrusted_app_all ephemeral_app isolated_app } debugfs_type:file read; +neverallow all_untrusted_apps debugfs_type:file read; # Do not allow untrusted apps to register services. # Only trusted components of Android should be registering # services. -neverallow { untrusted_app_all ephemeral_app isolated_app } service_manager_type:service_manager add; +neverallow all_untrusted_apps service_manager_type:service_manager add; # Do not allow untrusted apps to connect to the property service # or set properties. b/10243159 -neverallow { untrusted_app_all ephemeral_app isolated_app } property_socket:sock_file write; -neverallow { untrusted_app_all ephemeral_app isolated_app } init:unix_stream_socket connectto; -neverallow { untrusted_app_all ephemeral_app isolated_app } property_type:property_service set; - -# b/34115651 - net.dns* properties read -# This will go away in a future Android release -neverallow { appdomain -untrusted_app_25 } net_dns_prop:file r_file_perms; +neverallow all_untrusted_apps property_socket:sock_file write; +neverallow all_untrusted_apps init:unix_stream_socket connectto; +neverallow all_untrusted_apps property_type:property_service set; # Do not allow untrusted apps to be assigned mlstrustedsubject. # This would undermine the per-user isolation model being @@ -38,7 +35,7 @@ neverallow { appdomain -untrusted_app_25 } net_dns_prop:file r_file_perms; # permission only makes sense within a domain (hence should # never be granted to any other domain within mlstrustedsubject) # and an untrusted app is allowed fork permission to itself. -neverallow { untrusted_app_all ephemeral_app isolated_app } mlstrustedsubject:process fork; +neverallow all_untrusted_apps mlstrustedsubject:process fork; # Do not allow untrusted apps to hard link to any files. # In particular, if an untrusted app links to other app data @@ -46,16 +43,16 @@ neverallow { untrusted_app_all ephemeral_app isolated_app } mlstrustedsubject:pr # of the linked to file. Hard links also contribute to security # bugs, so we want to ensure untrusted apps never have this # capability. -neverallow { untrusted_app_all ephemeral_app isolated_app } file_type:file link; +neverallow all_untrusted_apps file_type:file link; # Do not allow untrusted apps to access network MAC address file -neverallow { untrusted_app_all ephemeral_app isolated_app } sysfs_mac_address:file no_rw_file_perms; +neverallow all_untrusted_apps sysfs_mac_address:file no_rw_file_perms; # Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the # ioctl permission, or 3. disallow the socket class. -neverallowxperm { untrusted_app_all ephemeral_app isolated_app } domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls; -neverallow { untrusted_app_all ephemeral_app isolated_app } *:{ netlink_route_socket netlink_selinux_socket } ioctl; -neverallow { untrusted_app_all ephemeral_app isolated_app } *:{ +neverallowxperm all_untrusted_apps domain:{ rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls; +neverallow all_untrusted_apps *:{ netlink_route_socket netlink_selinux_socket } ioctl; +neverallow all_untrusted_apps *:{ socket netlink_socket packet_socket key_socket appletalk_socket netlink_tcpdiag_socket netlink_nflog_socket netlink_xfrm_socket netlink_audit_socket @@ -66,15 +63,15 @@ neverallow { untrusted_app_all ephemeral_app isolated_app } *:{ } *; # Do not allow untrusted apps access to /cache -neverallow { untrusted_app_all ephemeral_app isolated_app } { cache_file cache_recovery_file }:dir ~{ r_dir_perms }; -neverallow { untrusted_app_all ephemeral_app isolated_app } { cache_file cache_recovery_file }:file ~{ read getattr }; +neverallow all_untrusted_apps { cache_file cache_recovery_file }:dir ~{ r_dir_perms }; +neverallow all_untrusted_apps { cache_file cache_recovery_file }:file ~{ read getattr }; # Do not allow untrusted apps to create/unlink files outside of its sandbox, # internal storage or sdcard. # World accessible data locations allow application to fill the device # with unaccounted for data. This data will not get removed during # application un-installation. -neverallow { untrusted_app_all ephemeral_app isolated_app } { +neverallow all_untrusted_apps { fs_type -fuse # sdcard -sdcardfs # sdcard @@ -92,12 +89,12 @@ neverallow { untrusted_app_all ephemeral_app isolated_app } { }:dir_file_class_set { create unlink }; # Do not allow untrusted apps to directly open tun_device -neverallow { untrusted_app_all ephemeral_app isolated_app } tun_device:chr_file open; +neverallow all_untrusted_apps tun_device:chr_file open; # Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553) -neverallow { untrusted_app_all ephemeral_app isolated_app } anr_data_file:file ~{ open append }; -neverallow { untrusted_app_all ephemeral_app isolated_app } anr_data_file:dir ~search; +neverallow all_untrusted_apps anr_data_file:file ~{ open append }; +neverallow all_untrusted_apps anr_data_file:dir ~search; # Avoid reads from generically labeled /proc files # Create a more specific label if needed -neverallow { untrusted_app_all ephemeral_app isolated_app } proc:file { no_rw_file_perms no_x_file_perms }; +neverallow all_untrusted_apps proc:file { no_rw_file_perms no_x_file_perms }; diff --git a/private/seapp_contexts b/private/seapp_contexts index ee2740a4c42cd663a1a2b143572743a039ef7bbd..15a019ccca5c1dda5d53e5e17255b94d8f9c69ad 100644 --- a/private/seapp_contexts +++ b/private/seapp_contexts @@ -1,6 +1,7 @@ # Input selectors: # isSystemServer (boolean) # isEphemeralApp (boolean) +# isV2App (boolean) # isOwner (boolean) # user (string) # seinfo (string) @@ -11,6 +12,7 @@ # isSystemServer=true can only be used once. # An unspecified isSystemServer defaults to false. # isEphemeralApp=true will match apps marked by PackageManager as Ephemeral +# isV2App=true will match apps in the v2 app sandbox. # isOwner=true will only match for the owner/primary user. # isOwner=false will only match for secondary users. # If unspecified, the entry can match either case. @@ -29,16 +31,17 @@ # Precedence rules (see external/selinux/libselinux/src/android/android.c seapp_context_cmp()): # (1) isSystemServer=true before isSystemServer=false. # (2) Specified isEphemeralApp= before unspecified isEphemeralApp= boolean. -# (3) Specified isOwner= before unspecified isOwner= boolean. -# (4) Specified user= string before unspecified user= string. -# (5) Fixed user= string before user= prefix (i.e. ending in *). -# (6) Longer user= prefix before shorter user= prefix. -# (7) Specified seinfo= string before unspecified seinfo= string. +# (3) Specified isV2App= before unspecified isV2App= boolean. +# (4) Specified isOwner= before unspecified isOwner= boolean. +# (5) Specified user= string before unspecified user= string. +# (6) Fixed user= string before user= prefix (i.e. ending in *). +# (7) Longer user= prefix before shorter user= prefix. +# (8) Specified seinfo= string before unspecified seinfo= string. # ':' character is reserved and may not be used. -# (8) Specified name= string before unspecified name= string. -# (9) Specified path= string before unspecified path= string. -# (10) Specified isPrivApp= before unspecified isPrivApp= boolean. -# (11) Higher value of minTargetSdkVersion= before lower value of minTargetSdkVersion= +# (9) Specified name= string before unspecified name= string. +# (10) Specified path= string before unspecified path= string. +# (11) Specified isPrivApp= before unspecified isPrivApp= boolean. +# (12) Higher value of minTargetSdkVersion= before lower value of minTargetSdkVersion= # integer. Note that minTargetSdkVersion= defaults to 0 if unspecified. # # Outputs: @@ -100,7 +103,8 @@ user=shared_relro domain=shared_relro user=shell seinfo=platform domain=shell type=shell_data_file user=_isolated domain=isolated_app levelFrom=user user=_app seinfo=platform domain=platform_app type=app_data_file levelFrom=user -user=_app isEphemeralApp=true domain=ephemeral_app type=app_data_file levelFrom=all +user=_app isV2App=true isEphemeralApp=true domain=ephemeral_app type=app_data_file levelFrom=all +user=_app isV2App=true domain=untrusted_v2_app type=app_data_file levelFrom=all user=_app isPrivApp=true domain=priv_app type=app_data_file levelFrom=user user=_app minTargetSdkVersion=26 domain=untrusted_app type=app_data_file levelFrom=user user=_app domain=untrusted_app_25 type=app_data_file levelFrom=user diff --git a/private/untrusted_v2_app.te b/private/untrusted_v2_app.te new file mode 100644 index 0000000000000000000000000000000000000000..df37fdda3bc30d2a8dcd55dc0a4c15e261322564 --- /dev/null +++ b/private/untrusted_v2_app.te @@ -0,0 +1,39 @@ +### +### Untrusted v2 sandbox apps. +### +app_domain(untrusted_v2_app) +net_domain(untrusted_v2_app) +bluetooth_domain(untrusted_v2_app) + +# Read and write system app data files passed over Binder. +# Motivating case was /data/data/com.android.settings/cache/*.jpg for +# cropping or taking user photos. +allow untrusted_v2_app system_app_data_file:file { read write getattr }; + +# Access to /data/media. +allow untrusted_v2_app media_rw_data_file:dir create_dir_perms; +allow untrusted_v2_app media_rw_data_file:file create_file_perms; + +# Traverse into /mnt/media_rw for bypassing FUSE daemon +# TODO: narrow this to just MediaProvider +allow untrusted_v2_app mnt_media_rw_file:dir search; + +# allow cts to query all services +allow untrusted_v2_app servicemanager:service_manager list; + +allow untrusted_v2_app audioserver_service:service_manager find; +allow untrusted_v2_app cameraserver_service:service_manager find; +allow untrusted_v2_app drmserver_service:service_manager find; +allow untrusted_v2_app mediaserver_service:service_manager find; +allow untrusted_v2_app mediaextractor_service:service_manager find; +allow untrusted_v2_app mediacodec_service:service_manager find; +allow untrusted_v2_app mediametrics_service:service_manager find; +allow untrusted_v2_app mediadrmserver_service:service_manager find; +allow untrusted_v2_app nfc_service:service_manager find; +allow untrusted_v2_app radio_service:service_manager find; +allow untrusted_v2_app surfaceflinger_service:service_manager find; +# TODO: potentially provide a tighter list of services here +allow untrusted_v2_app app_api_service:service_manager find; + +# gdbserver for ndk-gdb ptrace attaches to app process. +allow untrusted_v2_app self:process ptrace; diff --git a/public/untrusted_v2_app.te b/public/untrusted_v2_app.te new file mode 100644 index 0000000000000000000000000000000000000000..ac82f15310e4a832a332ac98129937301184469b --- /dev/null +++ b/public/untrusted_v2_app.te @@ -0,0 +1,5 @@ +### +### Untrusted v2 sandbox apps. +### + +type untrusted_v2_app, domain; diff --git a/tools/check_seapp.c b/tools/check_seapp.c index 96b9ebf89ced554f0726a3dbe5005dd510a7c378..c23c1f6c6a58ad3a82fe296a7d25b7320a73102d 100644 --- a/tools/check_seapp.c +++ b/tools/check_seapp.c @@ -204,6 +204,7 @@ key_map rules[] = { /*Inputs*/ { .name = "isSystemServer", .dir = dir_in, .fn_validate = validate_bool }, { .name = "isEphemeralApp", .dir = dir_in, .fn_validate = validate_bool }, + { .name = "isV2App", .dir = dir_in, .fn_validate = validate_bool }, { .name = "isOwner", .dir = dir_in, .fn_validate = validate_bool }, { .name = "user", .dir = dir_in, }, { .name = "seinfo", .dir = dir_in, },