1### 2### A domain for further sandboxing the PrebuiltGMSCore app. 3### 4typeattribute gmscore_app coredomain; 5 6app_domain(gmscore_app) 7 8allow gmscore_app sysfs_type:dir search; 9# Read access to /sys/block/zram*/mm_stat 10r_dir_file(gmscore_app, sysfs_zram) 11 12r_dir_file(gmscore_app, rootfs) 13 14# Allow GMS core to open kernel config for OTA matching through libvintf 15allow gmscore_app config_gz:file { open read getattr }; 16 17# Allow GMS core to communicate with update_engine for A/B update. 18binder_call(gmscore_app, update_engine) 19allow gmscore_app update_engine_service:service_manager find; 20 21# Allow GMS core to communicate with dumpsys storaged. 22binder_call(gmscore_app, storaged) 23allow gmscore_app storaged_service:service_manager find; 24 25# Allow GMS core to access system_update_service (e.g. to publish pending 26# system update info). 27allow gmscore_app system_update_service:service_manager find; 28 29# Allow GMS core to communicate with statsd. 30binder_call(gmscore_app, statsd) 31 32# Allow GMS core to receive Perfetto traces through the framework 33# (i.e. TracingServiceProxy) and sendfile them into its private directory 34# for reporting when network and battery conditions are appropriate. 35allow gmscore_app perfetto:fd use; 36allow gmscore_app perfetto_traces_data_file:file { read getattr }; 37 38# Allow GMS core to generate unique hardware IDs 39allow gmscore_app keystore:keystore2_key gen_unique_id; 40 41# Allow GMS core to access /sys/fs/selinux/policyvers for compatibility check 42allow gmscore_app selinuxfs:file r_file_perms; 43 44# suppress denials for non-API accesses. 45dontaudit gmscore_app exec_type:file r_file_perms; 46dontaudit gmscore_app device:dir r_dir_perms; 47dontaudit gmscore_app fs_bpf:dir r_dir_perms; 48dontaudit gmscore_app kernel:security *; 49dontaudit gmscore_app net_dns_prop:file r_file_perms; 50dontaudit gmscore_app proc:file r_file_perms; 51dontaudit gmscore_app proc_interrupts:file r_file_perms; 52dontaudit gmscore_app proc_modules:file r_file_perms; 53dontaudit gmscore_app proc_net:file r_file_perms; 54dontaudit gmscore_app proc_stat:file r_file_perms; 55dontaudit gmscore_app proc_version:file r_file_perms; 56dontaudit gmscore_app sysfs:dir r_dir_perms; 57dontaudit gmscore_app sysfs:file r_file_perms; 58dontaudit gmscore_app sysfs_android_usb:file r_file_perms; 59dontaudit gmscore_app sysfs_dm:file r_file_perms; 60dontaudit gmscore_app sysfs_loop:file r_file_perms; 61dontaudit gmscore_app sysfs_net:file r_file_perms; 62dontaudit gmscore_app sysfs_net:dir r_dir_perms; 63dontaudit gmscore_app { wifi_prop wifi_hal_prop }:file r_file_perms; 64dontaudit gmscore_app mirror_data_file:dir search; 65dontaudit gmscore_app mnt_vendor_file:dir search; 66 67# Access the network 68net_domain(gmscore_app) 69 70# webview crash handling depends on self ptrace (b/27697529, b/20150694, b/19277529#comment7) 71allow gmscore_app self:process ptrace; 72 73# Allow loading executable code from writable priv-app home 74# directories. This is a W^X violation, however, it needs 75# to be supported for now for the following reasons. 76# * /data/user_*/0/*/code_cache/* POSSIBLE uses (b/117841367) 77# 1) com.android.opengl.shaders_cache 78# 2) com.android.skia.shaders_cache 79# 3) com.android.renderscript.cache 80# * /data/user_de/0/com.google.android.gms/app_chimera 81# TODO: Tighten (b/112357170) 82allow gmscore_app privapp_data_file:file execute; 83 84# Chrome Crashpad uses the the dynamic linker to load native executables 85# from an APK (b/112050209, crbug.com/928422) 86allow gmscore_app system_linker_exec:file execute_no_trans; 87 88allow gmscore_app privapp_data_file:lnk_file create_file_perms; 89 90# /proc access 91allow gmscore_app proc_vmstat:file r_file_perms; 92 93# Allow interaction with gpuservice 94binder_call(gmscore_app, gpuservice) 95allow gmscore_app gpu_service:service_manager find; 96 97# find services that expose both @SystemAPI and normal APIs. 98allow gmscore_app app_api_service:service_manager find; 99allow gmscore_app system_api_service:service_manager find; 100allow gmscore_app audioserver_service:service_manager find; 101allow gmscore_app cameraserver_service:service_manager find; 102allow gmscore_app drmserver_service:service_manager find; 103allow gmscore_app mediadrmserver_service:service_manager find; 104allow gmscore_app mediaextractor_service:service_manager find; 105allow gmscore_app mediametrics_service:service_manager find; 106allow gmscore_app mediaserver_service:service_manager find; 107allow gmscore_app network_watchlist_service:service_manager find; 108allow gmscore_app nfc_service:service_manager find; 109allow gmscore_app oem_lock_service:service_manager find; 110allow gmscore_app persistent_data_block_service:service_manager find; 111allow gmscore_app radio_service:service_manager find; 112allow gmscore_app recovery_service:service_manager find; 113allow gmscore_app stats_service:service_manager find; 114 115# Used by Finsky / Android "Verify Apps" functionality when 116# running "adb install foo.apk". 117allow gmscore_app shell_data_file:file r_file_perms; 118allow gmscore_app shell_data_file:dir r_dir_perms; 119 120# Write to /cache. 121allow gmscore_app { cache_file cache_recovery_file }:dir create_dir_perms; 122allow gmscore_app { cache_file cache_recovery_file }:file create_file_perms; 123# /cache is a symlink to /data/cache on some devices. Allow reading the link. 124allow gmscore_app cache_file:lnk_file r_file_perms; 125 126# Write to /data/ota_package for OTA packages. 127allow gmscore_app ota_package_file:dir create_dir_perms; 128allow gmscore_app ota_package_file:file create_file_perms; 129 130# Write the checkin metadata to /data/misc_ce/<userid>/checkin 131allow gmscore_app checkin_data_file:dir rw_dir_perms; 132allow gmscore_app checkin_data_file:file create_file_perms; 133 134# Used by Finsky / Android "Verify Apps" functionality when 135# running "adb install foo.apk". 136allow gmscore_app shell_data_file:file r_file_perms; 137allow gmscore_app shell_data_file:dir r_dir_perms; 138 139# allow gms core app write to aconfigd socket 140allow gmscore_app aconfigd_socket:sock_file {read write}; 141allow gmscore_app aconfigd:unix_stream_socket connectto; 142 143# b/18504118: Allow reads from /data/anr/traces.txt 144allow gmscore_app anr_data_file:file r_file_perms; 145 146# b/148974132: com.android.vending needs this 147allow gmscore_app priv_app:tcp_socket { read write }; 148 149# b/168059475 Allow GMSCore to read Virtual AB properties to determine 150# if device supports VAB. 151get_prop(gmscore_app, virtual_ab_prop) 152 153# b/186488185: Allow GMSCore to read dck properties 154get_prop(gmscore_app, dck_prop) 155 156# Allow GMSCore to read RKP properties for the purpose of GTS testing. 157get_prop(gmscore_app, remote_prov_prop) 158 159# Allow GmsCore to read Quick Start properties and prevent access from other 160# policies. 161get_prop(gmscore_app, quick_start_prop) 162neverallow { domain -init -dumpstate -vendor_init -gmscore_app } quick_start_prop:file no_rw_file_perms; 163 164# Do not allow getting permission-protected network information from sysfs. 165neverallow gmscore_app sysfs_net:file *; 166 167# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the 168# ioctl permission, or 3. disallow the socket class. 169neverallowxperm gmscore_app domain:{ icmp_socket rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls; 170neverallow gmscore_app *:{ netlink_route_socket netlink_selinux_socket } ioctl; 171neverallow gmscore_app *:{ 172 socket netlink_socket packet_socket key_socket appletalk_socket 173 netlink_tcpdiag_socket netlink_nflog_socket 174 netlink_xfrm_socket netlink_audit_socket 175 netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket 176 netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket 177 netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket 178 netlink_rdma_socket netlink_crypto_socket sctp_socket 179 ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket 180 atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket 181 bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket 182 alg_socket nfc_socket kcm_socket qipcrtr_socket smc_socket xdp_socket 183} *; 184