1typeattribute apexd coredomain;
2
3init_daemon_domain(apexd)
4
5# Allow creating, reading and writing of APEX files/dirs in the APEX data dir
6allow apexd apex_data_file:dir create_dir_perms;
7allow apexd apex_data_file:file create_file_perms;
8
9# Allow creating, reading and writing of APEX files/dirs in the APEX metadata dir
10allow apexd metadata_file:dir search;
11allow apexd apex_metadata_file:dir create_dir_perms;
12allow apexd apex_metadata_file:file create_file_perms;
13
14# Allow apexd to create files and directories for snapshots of apex data
15allow apexd apex_permission_data_file:dir { create_dir_perms relabelto };
16allow apexd apex_permission_data_file:file { create_file_perms relabelto };
17allow apexd apex_module_data_file:dir { create_dir_perms relabelfrom };
18allow apexd apex_module_data_file:file { create_file_perms relabelfrom };
19allow apexd apex_rollback_data_file:dir create_dir_perms;
20allow apexd apex_rollback_data_file:file create_file_perms;
21allow apexd apex_wifi_data_file:dir { create_dir_perms relabelto };
22allow apexd apex_wifi_data_file:file { create_file_perms relabelto };
23
24# Allow apexd to read directories under /data/misc_de in order to snapshot and
25# restore apex data for all users.
26allow apexd system_data_file:dir r_dir_perms;
27
28# allow apexd to create loop devices with /dev/loop-control
29allow apexd loop_control_device:chr_file rw_file_perms;
30# allow apexd to access loop devices
31allow apexd loop_device:blk_file rw_file_perms;
32allowxperm apexd loop_device:blk_file ioctl {
33  LOOP_GET_STATUS64
34  LOOP_SET_STATUS64
35  LOOP_SET_FD
36  LOOP_SET_BLOCK_SIZE
37  LOOP_SET_DIRECT_IO
38  LOOP_CLR_FD
39  BLKFLSBUF
40};
41# allow apexd to access /dev/block
42allow apexd block_device:dir r_dir_perms;
43
44# allow apexd to access /dev/block/dm-* (device-mapper entries)
45allow apexd dm_device:chr_file rw_file_perms;
46allow apexd dm_device:blk_file rw_file_perms;
47
48# sys_admin is required to access the device-mapper and mount
49# dac_override, chown, and fowner are needed for snapshot and restore
50allow apexd self:global_capability_class_set { sys_admin chown dac_override dac_read_search fowner };
51
52# Note: fsetid is deliberately not included above. fsetid checks are
53# triggered by chmod on a directory or file owned by a group other
54# than one of the groups assigned to the current process to see if
55# the setgid bit should be cleared, regardless of whether the setgid
56# bit was even set.  We do not appear to truly need this capability
57# for apexd to operate.
58dontaudit apexd self:global_capability_class_set fsetid;
59
60# allow apexd to create a mount point in /apex
61allow apexd apex_mnt_dir:dir create_dir_perms;
62# allow apexd to mount in /apex
63allow apexd apex_mnt_dir:filesystem { mount unmount };
64allow apexd apex_mnt_dir:dir mounton;
65# allow apexd to create symlinks in /apex
66allow apexd apex_mnt_dir:lnk_file create_file_perms;
67# allow apexd to create /apex/apex-info-list.xml and relabel to apex_info_file
68allow apexd apex_mnt_dir:file { create_file_perms relabelfrom mounton };
69allow apexd apex_info_file:file relabelto;
70# allow apexd to unlink apex files in /data/apex/active
71# note that apexd won't be able to unlink files in /data/app-staging/session_XXXX,
72# because it doesn't have write permission for staging_data_file object.
73allow apexd staging_data_file:file unlink;
74
75# allow apexd to read files from /data/app-staging and hardlink them to /data/apex.
76allow apexd staging_data_file:dir r_dir_perms;
77allow apexd staging_data_file:file { r_file_perms link };
78
79# allow apexd to read files from /vendor/apex
80allow apexd vendor_apex_file:dir r_dir_perms;
81allow apexd vendor_apex_file:file r_file_perms;
82
83# Unmount and mount filesystems
84allow apexd labeledfs:filesystem { mount unmount };
85
86# /sys directory tree traversal
87allow apexd sysfs_type:dir search;
88# Configure read-ahead of dm-verity and loop devices
89# for dm-X
90allow apexd sysfs_dm:dir r_dir_perms;
91allow apexd sysfs_dm:file rw_file_perms;
92# for loopX
93allow apexd sysfs_loop:dir r_dir_perms;
94allow apexd sysfs_loop:file rw_file_perms;
95
96# Allow apexd to log to the kernel.
97allow apexd kmsg_device:chr_file w_file_perms;
98
99# Allow apexd to reboot device. Required for rollbacks of apexes that are
100# not covered by rollback manager.
101set_prop(apexd, powerctl_prop)
102
103# Allow apexd to stop itself
104set_prop(apexd, ctl_apexd_prop)
105
106# Find the vold service, and call into vold to manage FS checkpoints
107allow apexd vold_service:service_manager find;
108binder_call(apexd, vold)
109
110# Apex pre- & post-install permission.
111
112# Allow self-execute for the fork mount helper.
113allow apexd apexd_exec:file execute_no_trans;
114
115# Unshare and make / private so that hooks cannot influence the
116# running system.
117allow apexd rootfs:dir mounton;
118
119# Allow to execute shell for pre- and postinstall scripts. A transition
120# rule is required, thus restricted to execute and not execute_no_trans.
121allow apexd shell_exec:file { r_file_perms execute };
122
123# apexd is using bootstrap bionic
124allow apexd system_bootstrap_lib_file:dir r_dir_perms;
125allow apexd system_bootstrap_lib_file:file { execute read open getattr map };
126
127# Allow transition to ART APEX preinstall domain.
128domain_auto_trans(apexd, art_apex_preinstall_exec, art_apex_preinstall)
129# Allow transition to ART APEX postinstall domain.
130domain_auto_trans(apexd, art_apex_postinstall_exec, art_apex_postinstall)
131
132# Allow transition to test APEX preinstall domain.
133userdebug_or_eng(`
134  domain_auto_trans(apexd, apex_test_prepostinstall_exec, apex_test_prepostinstall)
135')
136
137# Allow apexd to be invoked with logwrapper from init during userspace reboot.
138allow apexd devpts:chr_file { read write };
139
140# Allow apexd to create pts files via logwrap_fork_exec for its own use, to pass to
141# other processes
142create_pty(apexd)
143
144# Allow apexd to read file contexts when performing restorecon of snapshots.
145allow apexd file_contexts_file:file r_file_perms;
146
147# Allow apexd to execute toybox for snapshot & restore
148allow apexd toolbox_exec:file rx_file_perms;
149
150neverallow { domain -apexd -init } apex_data_file:dir no_w_dir_perms;
151neverallow { domain -apexd -init } apex_metadata_file:dir no_w_dir_perms;
152neverallow { domain -apexd -init -kernel } apex_data_file:file no_w_file_perms;
153neverallow { domain -apexd -init -kernel } apex_metadata_file:file no_w_file_perms;
154neverallow { domain -apexd } apex_mnt_dir:lnk_file no_w_file_perms;
155
156neverallow { domain -apexd -init -vold_prepare_subdirs } apex_module_data_file:dir no_w_dir_perms;
157neverallow { domain -apexd -init -vold_prepare_subdirs } apex_module_data_file:file no_w_file_perms;
158
159neverallow { domain -apexd -init -vold_prepare_subdirs } apex_rollback_data_file:dir no_w_dir_perms;
160neverallow { domain -apexd -init -vold_prepare_subdirs } apex_rollback_data_file:file no_w_file_perms;
161
162# only apexd can set apexd sysprop
163set_prop(apexd, apexd_prop)
164neverallow { domain -apexd -init } apexd_prop:property_service set;
165
166# only apexd can write apex-info-list.xml
167neverallow { domain -apexd } apex_info_file:file no_w_file_perms;
168