| # zygote |
| type zygote, domain; |
| type zygote_exec, exec_type, file_type; |
| |
| init_daemon_domain(zygote) |
| typeattribute zygote mlstrustedsubject; |
| # Override DAC on files and switch uid/gid. |
| allow zygote self:capability { dac_override setgid setuid fowner chown }; |
| # Drop capabilities from bounding set. |
| allow zygote self:capability setpcap; |
| # Switch SELinux context to app domains. |
| allow zygote self:process setcurrent; |
| allow zygote system_server:process dyntransition; |
| allow zygote appdomain:process dyntransition; |
| # Allow zygote to read app /proc/pid dirs (b/10455872) |
| allow zygote appdomain:dir { getattr search }; |
| allow zygote appdomain:file { r_file_perms }; |
| # Move children into the peer process group. |
| allow zygote system_server:process { getpgid setpgid }; |
| allow zygote appdomain:process { getpgid setpgid }; |
| # Read system data. |
| allow zygote system_data_file:dir r_dir_perms; |
| allow zygote system_data_file:file r_file_perms; |
| # Write to /data/dalvik-cache. |
| allow zygote dalvikcache_data_file:dir create_dir_perms; |
| allow zygote dalvikcache_data_file:file create_file_perms; |
| # Create symlinks in /data/dalvik-cache |
| allow zygote dalvikcache_data_file:lnk_file create_file_perms; |
| # Write to /data/resource-cache |
| allow zygote resourcecache_data_file:dir rw_dir_perms; |
| allow zygote resourcecache_data_file:file create_file_perms; |
| # For art. |
| allow zygote dalvikcache_data_file:file execute; |
| # Execute idmap and dex2oat within zygote's own domain. |
| # TODO: Should either of these be transitioned to the same domain |
| # used by installd or stay in-domain for zygote? |
| allow zygote idmap_exec:file rx_file_perms; |
| allow zygote dex2oat_exec:file rx_file_perms; |
| # Control cgroups. |
| allow zygote cgroup:dir create_dir_perms; |
| allow zygote self:capability sys_admin; |
| # Check validity of SELinux context before use. |
| selinux_check_context(zygote) |
| # Check SELinux permissions. |
| selinux_check_access(zygote) |
| # Read /seapp_contexts and /data/security/seapp_contexts |
| security_access_policy(zygote) |
| |
| # Native bridge functionality requires that zygote replaces |
| # /proc/cpuinfo with /system/lib/<ISA>/cpuinfo using a bind mount |
| allow zygote proc_cpuinfo:file mounton; |
| |
| # Allow remounting rootfs as MS_SLAVE |
| allow zygote rootfs:dir mounton; |
| allow zygote sdcard_type:dir { write search setattr create add_name mounton }; # TODO: deprecated in M |
| dontaudit zygote self:capability fsetid; # TODO: deprecated in M |
| allow zygote tmpfs:dir { write create add_name setattr mounton search }; # TODO: deprecated in M |
| allow zygote tmpfs:filesystem mount; # TODO: deprecated in M |
| allow zygote labeledfs:filesystem remount; # TODO: deprecated in M |
| |
| # Allowed to create user-specific storage source if started before vold |
| allow zygote mnt_user_file:dir create_dir_perms; |
| allow zygote mnt_user_file:lnk_file create_file_perms; |
| # Allowed to mount user-specific storage into place |
| allow zygote storage_file:dir { search mounton }; |
| |
| # Handle --invoke-with command when launching Zygote with a wrapper command. |
| allow zygote zygote_exec:file rx_file_perms; |
| |
| ### |
| ### neverallow rules |
| ### |
| |
| # Ensure that all types assigned to app processes are included |
| # in the appdomain attribute, so that all allow and neverallow rules |
| # written on appdomain are applied to all app processes. |
| # This is achieved by ensuring that it is impossible for zygote to |
| # setcon (dyntransition) to any types other than those associated |
| # with appdomain plus system_server. |
| neverallow zygote ~{ appdomain system_server }:process dyntransition; |
| |
| # Zygote should never execute anything from /data except for /data/dalvik-cache files. |
| neverallow zygote { |
| data_file_type |
| -dalvikcache_data_file # map PROT_EXEC |
| }:file no_x_file_perms; |