1###
2### Ephemeral apps.
3###
4### This file defines the security policy for apps with the ephemeral
5### feature.
6###
7### The ephemeral_app domain is a reduced permissions sandbox allowing
8### ephemeral applications to be safely installed and run. Non ephemeral
9### applications may also opt-in to ephemeral to take advantage of the
10### additional security features.
11###
12### PackageManager flags an app as ephemeral at install time.
13
14typeattribute ephemeral_app coredomain;
15
16net_domain(ephemeral_app)
17app_domain(ephemeral_app)
18
19# Allow ephemeral apps to read/write files in visible storage if provided fds
20allow ephemeral_app { sdcard_type media_rw_data_file }:file {read write getattr ioctl lock append};
21
22# Some apps ship with shared libraries and binaries that they write out
23# to their sandbox directory and then execute.
24allow ephemeral_app privapp_data_file:file { r_file_perms execute };
25allow ephemeral_app app_data_file:file     { r_file_perms execute };
26
27# Follow priv-app symlinks. This is used for dynamite functionality.
28allow ephemeral_app privapp_data_file:lnk_file r_file_perms;
29
30# Allow the renderscript compiler to be run.
31domain_auto_trans(ephemeral_app, rs_exec, rs)
32
33# Allow loading and deleting shared libraries created by trusted system
34# components within an application home directory.
35allow ephemeral_app app_exec_data_file:file { r_file_perms execute unlink };
36
37# services
38allow ephemeral_app audioserver_service:service_manager find;
39allow ephemeral_app cameraserver_service:service_manager find;
40allow ephemeral_app mediaserver_service:service_manager find;
41allow ephemeral_app mediaextractor_service:service_manager find;
42allow ephemeral_app mediacodec_service:service_manager find;
43allow ephemeral_app mediametrics_service:service_manager find;
44allow ephemeral_app mediadrmserver_service:service_manager find;
45allow ephemeral_app drmserver_service:service_manager find;
46allow ephemeral_app radio_service:service_manager find;
47allow ephemeral_app ephemeral_app_api_service:service_manager find;
48allow ephemeral_app gpu_service:service_manager find;
49
50# Allow ephemeral apps to interact with gpuservice
51binder_call(ephemeral_app, gpuservice)
52
53# Write app-specific trace data to the Perfetto traced damon. This requires
54# connecting to its producer socket and obtaining a (per-process) tmpfs fd.
55allow ephemeral_app traced:fd use;
56allow ephemeral_app traced_tmpfs:file { read write getattr map };
57unix_socket_connect(ephemeral_app, traced_producer, traced)
58
59# Allow heap profiling if the app opts in by being marked
60# profileable/debuggable.
61can_profile_heap(ephemeral_app)
62
63# allow ephemeral apps to use UDP sockets provided by the system server but not
64# modify them other than to connect
65allow ephemeral_app system_server:udp_socket {
66        connect getattr read recvfrom sendto write getopt setopt };
67
68allow ephemeral_app ashmem_device:chr_file rw_file_perms;
69
70###
71### neverallow rules
72###
73
74neverallow ephemeral_app { app_data_file privapp_data_file }:file execute_no_trans;
75
76# Receive or send uevent messages.
77neverallow ephemeral_app domain:netlink_kobject_uevent_socket *;
78
79# Receive or send generic netlink messages
80neverallow ephemeral_app domain:netlink_socket *;
81
82# Too much leaky information in debugfs. It's a security
83# best practice to ensure these files aren't readable.
84neverallow ephemeral_app debugfs:file read;
85
86# execute gpu_device
87neverallow ephemeral_app gpu_device:chr_file execute;
88
89# access files in /sys with the default sysfs label
90neverallow ephemeral_app sysfs:file *;
91
92# Avoid reads from generically labeled /proc files
93# Create a more specific label if needed
94neverallow ephemeral_app proc:file { no_rw_file_perms no_x_file_perms };
95
96# Directly access external storage
97neverallow ephemeral_app { sdcard_type media_rw_data_file }:file {open create};
98neverallow ephemeral_app { sdcard_type media_rw_data_file }:dir search;
99
100# Avoid reads to proc_net, it contains too much device wide information about
101# ongoing connections.
102neverallow ephemeral_app proc_net:file no_rw_file_perms;
103