1# vendor_init is its own domain.
2type vendor_init, domain, mlstrustedsubject;
3
4# Communication to the main init process
5allow vendor_init init:unix_stream_socket { read write };
6
7# Logging to kmsg
8allow vendor_init kmsg_device:chr_file { open getattr write };
9
10# Mount on /dev/usb-ffs/adb.
11allow vendor_init device:dir mounton;
12
13# Create and remove symlinks in /.
14allow vendor_init rootfs:lnk_file { create unlink };
15
16# Create cgroups mount points in tmpfs and mount cgroups on them.
17allow vendor_init cgroup:dir create_dir_perms;
18allow vendor_init cgroup:file w_file_perms;
19
20# /config
21allow vendor_init configfs:dir mounton;
22allow vendor_init configfs:dir create_dir_perms;
23allow vendor_init configfs:{ file lnk_file } create_file_perms;
24
25# Create directories under /dev/cpuctl after chowning it to system.
26allow vendor_init self:global_capability_class_set { dac_override dac_read_search };
27
28# mkdir, symlink, write, rm/rmdir, chown/chmod, restorecon/restorecon_recursive from init.rc files.
29# chown/chmod require open+read+setattr required for open()+fchown/fchmod().
30# system/core/init.rc requires at least cache_file and data_file_type.
31# init.<board>.rc files often include device-specific types, so
32# we just allow all file types except /system files here.
33allow vendor_init self:global_capability_class_set { chown fowner fsetid };
34
35# mkdir with FBE requires reading /data/unencrypted/{ref,mode}.
36allow vendor_init unencrypted_data_file:dir search;
37allow vendor_init unencrypted_data_file:file r_file_perms;
38
39# Set encryption policy on dirs in /data
40allowxperm vendor_init data_file_type:dir ioctl {
41  FS_IOC_GET_ENCRYPTION_POLICY
42  FS_IOC_SET_ENCRYPTION_POLICY
43};
44
45allow vendor_init system_data_file:dir getattr;
46
47allow vendor_init {
48  file_type
49  -core_data_file_type
50  -exec_type
51  -system_file_type
52  -mnt_product_file
53  -password_slot_metadata_file
54  -unlabeled
55  -vendor_file_type
56  -vold_metadata_file
57  -gsi_metadata_file
58  -apex_metadata_file
59}:dir { create search getattr open read setattr ioctl write add_name remove_name rmdir relabelfrom };
60
61allow vendor_init unlabeled:{ dir notdevfile_class_set } { getattr relabelfrom };
62
63allow vendor_init {
64  file_type
65  -core_data_file_type
66  -exec_type
67  -password_slot_metadata_file
68  -runtime_event_log_tags_file
69  -system_file_type
70  -unlabeled
71  -vendor_file_type
72  -vold_metadata_file
73  -gsi_metadata_file
74  -apex_metadata_file
75}:file { create getattr open read write setattr relabelfrom unlink map };
76
77allow vendor_init {
78  file_type
79  -core_data_file_type
80  -exec_type
81  -password_slot_metadata_file
82  -system_file_type
83  -unlabeled
84  -vendor_file_type
85  -vold_metadata_file
86  -gsi_metadata_file
87  -apex_metadata_file
88}:{ sock_file fifo_file } { create getattr open read setattr relabelfrom unlink };
89
90allow vendor_init {
91  file_type
92  -apex_mnt_dir
93  -core_data_file_type
94  -exec_type
95  -password_slot_metadata_file
96  -system_file_type
97  -unlabeled
98  -vendor_file_type
99  -vold_metadata_file
100  -gsi_metadata_file
101  -apex_metadata_file
102}:lnk_file { create getattr setattr relabelfrom unlink };
103
104allow vendor_init {
105  file_type
106  -core_data_file_type
107  -exec_type
108  -mnt_product_file
109  -password_slot_metadata_file
110  -system_file_type
111  -vendor_file_type
112  -vold_metadata_file
113  -gsi_metadata_file
114  -apex_metadata_file
115}:dir_file_class_set relabelto;
116
117allow vendor_init dev_type:dir create_dir_perms;
118allow vendor_init dev_type:lnk_file create;
119
120# Disable tracing by writing to /sys/kernel/debug/tracing/tracing_on
121allow vendor_init debugfs_tracing:file w_file_perms;
122
123# chown/chmod on pseudo files.
124allow vendor_init {
125  fs_type
126  -contextmount_type
127  -keychord_device
128  -sdcard_type
129  -rootfs
130  -proc_uid_time_in_state
131  -proc_uid_concurrent_active_time
132  -proc_uid_concurrent_policy_time
133}:file { open read setattr map };
134
135allow vendor_init {
136  fs_type
137  -contextmount_type
138  -sdcard_type
139  -rootfs
140  -proc_uid_time_in_state
141  -proc_uid_concurrent_active_time
142  -proc_uid_concurrent_policy_time
143}:dir  { open read setattr search };
144
145# chown/chmod on devices, e.g. /dev/ttyHS0
146allow vendor_init {
147  dev_type
148  -keychord_device
149  -port_device
150  -lowpan_device
151  -hw_random_device
152}:chr_file setattr;
153
154allow vendor_init dev_type:blk_file getattr;
155
156# Write to /proc/sys/net/ping_group_range and other /proc/sys/net files.
157r_dir_file(vendor_init, proc_net_type)
158allow vendor_init proc_net_type:file w_file_perms;
159allow vendor_init self:global_capability_class_set net_admin;
160
161# Write to /proc/sys/vm/page-cluster
162allow vendor_init proc_page_cluster:file w_file_perms;
163
164# Write to sysfs nodes.
165allow vendor_init sysfs_type:dir r_dir_perms;
166allow vendor_init sysfs_type:lnk_file read;
167allow vendor_init { sysfs_type -sysfs_usermodehelper }:file rw_file_perms;
168
169# setfscreatecon() for labeling directories and socket files.
170allow vendor_init self:process { setfscreate };
171
172r_dir_file(vendor_init, vendor_file_type)
173
174# Vendor init can read properties
175allow vendor_init serialno_prop:file { getattr open read map };
176
177# Vendor init can perform operations on trusted and security Extended Attributes
178allow vendor_init self:global_capability_class_set sys_admin;
179
180# Raw writes to misc block device
181allow vendor_init misc_block_device:blk_file w_file_perms;
182
183# vendor_init is using bootstrap bionic
184allow vendor_init system_bootstrap_lib_file:dir r_dir_perms;
185allow vendor_init system_bootstrap_lib_file:file { execute read open getattr map };
186
187# Everything is labeled as rootfs in recovery mode. Vendor init has to execute
188# the dynamic linker and shared libraries.
189recovery_only(`
190  allow vendor_init rootfs:file { r_file_perms execute };
191')
192
193not_compatible_property(`
194    set_prop(vendor_init, {
195      property_type
196      -device_config_activity_manager_native_boot_prop
197      -device_config_boot_count_prop
198      -device_config_reset_performed_prop
199      -device_config_input_native_boot_prop
200      -device_config_netd_native_prop
201      -device_config_runtime_native_boot_prop
202      -device_config_runtime_native_prop
203      -device_config_media_native_prop
204      -restorecon_prop
205      -netd_stable_secret_prop
206      -firstboot_prop
207      -pm_prop
208      -system_boot_reason_prop
209      -bootloader_boot_reason_prop
210      -last_boot_reason_prop
211      -apexd_prop
212      -gsid_prop
213      -nnapi_ext_deny_product_prop
214    })
215')
216
217# Get file context
218allow vendor_init file_contexts_file:file r_file_perms;
219
220set_prop(vendor_init, bluetooth_a2dp_offload_prop)
221set_prop(vendor_init, bluetooth_audio_hal_prop)
222set_prop(vendor_init, cpu_variant_prop)
223set_prop(vendor_init, debug_prop)
224set_prop(vendor_init, exported_audio_prop)
225set_prop(vendor_init, exported_bluetooth_prop)
226set_prop(vendor_init, exported_config_prop)
227set_prop(vendor_init, exported_dalvik_prop)
228set_prop(vendor_init, exported_default_prop)
229set_prop(vendor_init, exported_ffs_prop)
230set_prop(vendor_init, exported_overlay_prop)
231set_prop(vendor_init, exported_pm_prop)
232set_prop(vendor_init, exported_radio_prop)
233set_prop(vendor_init, exported_system_radio_prop)
234set_prop(vendor_init, exported_wifi_prop)
235set_prop(vendor_init, exported2_config_prop)
236set_prop(vendor_init, exported2_system_prop)
237set_prop(vendor_init, exported2_vold_prop)
238set_prop(vendor_init, exported3_default_prop)
239set_prop(vendor_init, exported3_radio_prop)
240set_prop(vendor_init, logd_prop)
241set_prop(vendor_init, log_tag_prop)
242set_prop(vendor_init, log_prop)
243set_prop(vendor_init, serialno_prop)
244set_prop(vendor_init, vendor_default_prop)
245set_prop(vendor_init, vendor_security_patch_level_prop)
246set_prop(vendor_init, wifi_log_prop)
247
248get_prop(vendor_init, exported2_radio_prop)
249get_prop(vendor_init, exported3_system_prop)
250get_prop(vendor_init, theme_prop)
251
252###
253### neverallow rules
254###
255
256# Vendor init shouldn't communicate with any vendor process, nor most system processes.
257neverallow_establish_socket_comms(vendor_init, { domain -init -logd -su -vendor_init });
258
259# The vendor_init domain is only entered via an exec based transition from the
260# init domain, never via setcon().
261neverallow domain vendor_init:process dyntransition;
262neverallow { domain -init } vendor_init:process transition;
263neverallow vendor_init { file_type fs_type -init_exec }:file entrypoint;
264
265# Never read/follow symlinks created by shell or untrusted apps.
266neverallow vendor_init { app_data_file privapp_data_file }:lnk_file read;
267neverallow vendor_init shell_data_file:lnk_file read;
268# Init should not be creating subdirectories in /data/local/tmp
269neverallow vendor_init shell_data_file:dir { write add_name remove_name };
270
271# init should never execute a program without changing to another domain.
272neverallow vendor_init { file_type fs_type }:file execute_no_trans;
273
274# Init never adds or uses services via service_manager.
275neverallow vendor_init service_manager_type:service_manager { add find };
276neverallow vendor_init servicemanager:service_manager list;
277
278# vendor_init should never be ptraced
279neverallow * vendor_init:process ptrace;
280