1###
2### Ephemeral apps.
3###
4### This file defines the security policy for apps with the ephemeral
5### feature.
6###
7### The ephemeral_app domain is a reduced permissions sandbox allowing
8### ephemeral applications to be safely installed and run. Non ephemeral
9### applications may also opt-in to ephemeral to take advantage of the
10### additional security features.
11###
12### PackageManager flags an app as ephemeral at install time.
13
14typeattribute ephemeral_app coredomain;
15
16net_domain(ephemeral_app)
17app_domain(ephemeral_app)
18
19# Allow ephemeral apps to read/write files in visible storage if provided fds
20allow ephemeral_app { sdcard_type media_rw_data_file }:file {read write getattr ioctl lock append};
21
22# Some apps ship with shared libraries and binaries that they write out
23# to their sandbox directory and then execute.
24allow ephemeral_app app_data_file:file {r_file_perms execute};
25
26# services
27allow ephemeral_app audioserver_service:service_manager find;
28allow ephemeral_app cameraserver_service:service_manager find;
29allow ephemeral_app mediaserver_service:service_manager find;
30allow ephemeral_app mediaextractor_service:service_manager find;
31allow ephemeral_app mediacodec_service:service_manager find;
32allow ephemeral_app mediametrics_service:service_manager find;
33allow ephemeral_app mediadrmserver_service:service_manager find;
34allow ephemeral_app drmserver_service:service_manager find;
35allow ephemeral_app radio_service:service_manager find;
36allow ephemeral_app ephemeral_app_api_service:service_manager find;
37
38# Write app-specific trace data to the Perfetto traced damon. This requires
39# connecting to its producer socket and obtaining a (per-process) tmpfs fd.
40allow ephemeral_app traced:fd use;
41allow ephemeral_app traced_tmpfs:file { read write getattr map };
42unix_socket_connect(ephemeral_app, traced_producer, traced)
43
44# allow ephemeral apps to use UDP sockets provided by the system server but not
45# modify them other than to connect
46allow ephemeral_app system_server:udp_socket {
47        connect getattr read recvfrom sendto write getopt setopt };
48
49###
50### neverallow rules
51###
52
53neverallow ephemeral_app app_data_file:file execute_no_trans;
54
55# Receive or send uevent messages.
56neverallow ephemeral_app domain:netlink_kobject_uevent_socket *;
57
58# Receive or send generic netlink messages
59neverallow ephemeral_app domain:netlink_socket *;
60
61# Too much leaky information in debugfs. It's a security
62# best practice to ensure these files aren't readable.
63neverallow ephemeral_app debugfs:file read;
64
65# execute gpu_device
66neverallow ephemeral_app gpu_device:chr_file execute;
67
68# access files in /sys with the default sysfs label
69neverallow ephemeral_app sysfs:file *;
70
71# Avoid reads from generically labeled /proc files
72# Create a more specific label if needed
73neverallow ephemeral_app proc:file { no_rw_file_perms no_x_file_perms };
74
75# Directly access external storage
76neverallow ephemeral_app { sdcard_type media_rw_data_file }:file {open create};
77neverallow ephemeral_app { sdcard_type media_rw_data_file }:dir search;
78
79# Avoid reads to proc_net, it contains too much device wide information about
80# ongoing connections.
81neverallow ephemeral_app proc_net:file no_rw_file_perms;
82