private/app_neverallows.te

###
### neverallow rules for untrusted app domains
###

define(`all_untrusted_apps',`{
  ephemeral_app
  isolated_app
  isolated_app_all
  isolated_compute_app
  mediaprovider
  mediaprovider_app
  untrusted_app
  untrusted_app_25
  untrusted_app_27
  untrusted_app_29
  untrusted_app_30
  untrusted_app_all
}')
# Receive or send uevent messages.
neverallow all_untrusted_apps domain:netlink_kobject_uevent_socket *;

# Receive or send generic netlink messages
neverallow all_untrusted_apps domain:netlink_socket *;

# Read or write kernel printk buffer
neverallow all_untrusted_apps kmsg_device:chr_file no_rw_file_perms;

# Too much leaky information in debugfs. It's a security
# best practice to ensure these files aren't readable.
neverallow all_untrusted_apps { debugfs_type -debugfs_kcov }:file read;
neverallow {all_untrusted_apps userdebug_or_eng(`-domain')} debugfs_type:{ file lnk_file } read;

# Do not allow untrusted apps to register services.
# Only trusted components of Android should be registering
# services.
neverallow all_untrusted_apps service_manager_type:service_manager add;

# Do not allow untrusted apps to use VendorBinder
neverallow all_untrusted_apps vndbinder_device:chr_file *;
neverallow all_untrusted_apps vndservice_manager_type:service_manager *;

# Do not allow untrusted apps to connect to the property service
# or set properties. b/10243159
neverallow { all_untrusted_apps -mediaprovider } property_socket:sock_file write;
neverallow { all_untrusted_apps -mediaprovider } init:unix_stream_socket connectto;
neverallow { all_untrusted_apps -mediaprovider } property_type:property_service set;

# net.dns properties are not a public API. Disallow untrusted apps from reading this property.
neverallow { all_untrusted_apps } net_dns_prop:file read;

# radio_cdma_ecm_prop properties are not a public API. Disallow untrusted apps from reading this property.
neverallow { all_untrusted_apps } radio_cdma_ecm_prop:file read;

# Shared libraries created by trusted components within an app home
# directory can be dlopen()ed. To maintain the W^X property, these files
# must never be writable to the app.
neverallow all_untrusted_apps app_exec_data_file:file
  { append create link relabelfrom relabelto rename setattr write };

# Block calling execve() on files in an apps home directory.
# This is a W^X violation (loading executable code from a writable
# home directory). For compatibility, allow for targetApi <= 28.
# b/112357170
neverallow {
  all_untrusted_apps
  -untrusted_app_25
  -untrusted_app_27
  -runas_app
} { app_data_file privapp_data_file }:file execute_no_trans;

# Do not allow untrusted apps to invoke dex2oat. This was historically required
# by ART for compiling secondary dex files but has been removed in Q.
# Exempt legacy apps (targetApi<=28) for compatibility.
neverallow {
  all_untrusted_apps
  -untrusted_app_25
  -untrusted_app_27
} dex2oat_exec:file no_x_file_perms;

# Do not allow untrusted apps to be assigned mlstrustedsubject.
# This would undermine the per-user isolation model being
# enforced via levelFrom=user in seapp_contexts and the mls
# constraints.  As there is no direct way to specify a neverallow
# on attribute assignment, this relies on the fact that fork
# permission only makes sense within a domain (hence should
# never be granted to any other domain within mlstrustedsubject)
# and an untrusted app is allowed fork permission to itself.
neverallow all_untrusted_apps mlstrustedsubject:process fork;

# Do not allow untrusted apps to hard link to any files.
# In particular, if an untrusted app links to other app data
# files, installd will not be able to guarantee the deletion
# of the linked to file. Hard links also contribute to security
# bugs, so we want to ensure untrusted apps never have this
# capability.
neverallow all_untrusted_apps file_type:file link;

# Do not allow untrusted apps to access network MAC address file
neverallow all_untrusted_apps sysfs_net:file no_rw_file_perms;

# Do not allow any write access to files in /sys
neverallow all_untrusted_apps sysfs_type:file { no_w_file_perms no_x_file_perms };

# Apps may never access the default sysfs label.
neverallow all_untrusted_apps sysfs:file no_rw_file_perms;

# Restrict socket ioctls. Either 1. disallow privileged ioctls, 2. disallow the
# ioctl permission, or 3. disallow the socket class.
neverallowxperm all_untrusted_apps domain:{ icmp_socket rawip_socket tcp_socket udp_socket } ioctl priv_sock_ioctls;
neverallow all_untrusted_apps *:{ netlink_route_socket netlink_selinux_socket } ioctl;
neverallow all_untrusted_apps *:{
  socket netlink_socket packet_socket key_socket appletalk_socket
  netlink_tcpdiag_socket netlink_nflog_socket
  netlink_xfrm_socket netlink_audit_socket
  netlink_dnrt_socket netlink_kobject_uevent_socket tun_socket
  netlink_iscsi_socket netlink_fib_lookup_socket netlink_connector_socket
  netlink_netfilter_socket netlink_generic_socket netlink_scsitransport_socket
  netlink_rdma_socket netlink_crypto_socket sctp_socket
  ax25_socket ipx_socket netrom_socket atmpvc_socket x25_socket rose_socket decnet_socket
  atmsvc_socket rds_socket irda_socket pppox_socket llc_socket can_socket tipc_socket
  bluetooth_socket iucv_socket rxrpc_socket isdn_socket phonet_socket ieee802154_socket caif_socket
  alg_socket nfc_socket kcm_socket qipcrtr_socket smc_socket xdp_socket
} *;

# Apps can read/write an already open vsock (e.g. created by
# virtualizationservice) but nothing more than that (e.g. creating a
# new vsock, etc.)
neverallow all_untrusted_apps *:vsock_socket ~{ getattr getopt read write };

# Disallow sending RTM_GETLINK messages on netlink sockets.
neverallow all_untrusted_apps domain:netlink_route_socket { bind nlmsg_readpriv };
neverallow priv_app domain:netlink_route_socket { bind nlmsg_readpriv };

# Disallow sending RTM_GETNEIGH{TBL} messages on netlink sockets.
neverallow {
  all_untrusted_apps
  -untrusted_app_25
  -untrusted_app_27
  -untrusted_app_29
  -untrusted_app_30
} domain:netlink_route_socket nlmsg_getneigh;

# Do not allow untrusted apps access to /cache
neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:dir ~{ r_dir_perms };
neverallow { all_untrusted_apps -mediaprovider } { cache_file cache_recovery_file }:file ~{ read getattr };

# Do not allow untrusted apps to create/unlink files outside of its sandbox,
# internal storage or sdcard.
# World accessible data locations allow application to fill the device
# with unaccounted for data. This data will not get removed during
# application un-installation.
neverallow { all_untrusted_apps -mediaprovider } {
  fs_type
  -sdcard_type
  -fuse
  file_type
  -app_data_file            # The apps sandbox itself
  -privapp_data_file
  -app_exec_data_file       # stored within the app sandbox directory
  -media_rw_data_file       # Internal storage. Known that apps can
                            # leave artfacts here after uninstall.
  -user_profile_data_file   # Access to profile files
  userdebug_or_eng(`
    -method_trace_data_file # only on ro.debuggable=1
    -coredump_file          # userdebug/eng only
  ')
}:dir_file_class_set { create unlink };

# No untrusted component except mediaprovider_app should be touching /dev/fuse
neverallow { all_untrusted_apps -mediaprovider_app } fuse_device:chr_file *;

# Do not allow untrusted apps to directly open the tun_device
neverallow all_untrusted_apps tun_device:chr_file open;
# The tun_device ioctls below are not allowed, to prove equivalence
# to the kernel patch at
# https://android.googlesource.com/kernel/common/+/11cee2be0c2062ba88f04eb51196506f870a3b5d%5E%21
neverallowxperm all_untrusted_apps tun_device:chr_file ioctl ~{ FIOCLEX FIONCLEX TUNGETIFF };

# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553)
neverallow all_untrusted_apps anr_data_file:file ~{ open append };
neverallow all_untrusted_apps anr_data_file:dir ~search;

# Avoid reads from generically labeled /proc files
# Create a more specific label if needed
neverallow all_untrusted_apps {
  proc
  proc_asound
  proc_kmsg
  proc_loadavg
  proc_mounts
  proc_pagetypeinfo
  proc_slabinfo
  proc_stat
  proc_swaps
  proc_uptime
  proc_version
  proc_vmallocinfo
  proc_vmstat
}:file { no_rw_file_perms no_x_file_perms };

# /proc/filesystems is accessible to mediaprovider_app only since it handles
# external storage
neverallow { all_untrusted_apps - mediaprovider_app } proc_filesystems:file { no_rw_file_perms no_x_file_perms };

# Avoid all access to kernel configuration
neverallow all_untrusted_apps config_gz:file { no_rw_file_perms no_x_file_perms };

# Do not allow untrusted apps access to preloads data files
neverallow all_untrusted_apps preloads_data_file:file no_rw_file_perms;

# Locking of files on /system could lead to denial of service attacks
# against privileged system components
neverallow all_untrusted_apps system_file:file lock;

# Do not permit untrusted apps to perform actions on HwBinder service_manager
# other than find actions for services listed below
neverallow all_untrusted_apps *:hwservice_manager ~find;

# Do not permit access from apps which host arbitrary code to the protected services
# The two main reasons for this are:
# 1. Protected HwBinder servers do not perform client authentication because
#    vendor code does not have a way to understand apps or their relation to
#    caller UID information and, even if it did, those services either operate
#    at a level below that of apps (e.g., HALs) or must not rely on app identity
#    for authorization. Thus, to be safe, the default assumption for all added
#    vendor services is that they treat all their clients as equally authorized
#    to perform operations offered by the service.
# 2. HAL servers contain code with higher incidence rate of security issues
#    than system/core components and have access to lower layes of the stack
#    (all the way down to hardware) thus increasing opportunities for bypassing
#    the Android security model.
neverallow all_untrusted_apps protected_hwservice:hwservice_manager find;
neverallow all_untrusted_apps protected_service:service_manager find;

# SELinux is not an API for untrusted apps to use
neverallow all_untrusted_apps selinuxfs:file no_rw_file_perms;

# Access to /proc/tty/drivers, to allow apps to determine if they
# are running in an emulated environment.
# b/33214085 b/33814662 b/33791054 b/33211769
# https://github.com/strazzere/anti-emulator/blob/master/AntiEmulator/src/diff/strazzere/anti/emulator/FindEmulator.java
# This will go away in a future Android release
neverallow { all_untrusted_apps -untrusted_app_25 } proc_tty_drivers:file r_file_perms;
neverallow all_untrusted_apps proc_tty_drivers:file ~r_file_perms;

# Untrusted apps are not allowed to use cgroups.
neverallow all_untrusted_apps cgroup:file *;
neverallow all_untrusted_apps cgroup_v2:file *;

# /mnt/sdcard symlink was supposed to have been removed in Gingerbread. Apps
# must not use it.
neverallow {
  all_untrusted_apps
  -untrusted_app_25
  -untrusted_app_27
} mnt_sdcard_file:lnk_file *;

# Only privileged apps may find the incident service
neverallow all_untrusted_apps incident_service:service_manager find;

# Do not allow untrusted app to read hidden system proprerties.
# We do not include in the exclusions other normally untrusted applications such as mediaprovider
#  due to the specific logging use cases.
# Context: b/193912100
neverallow {
  all_untrusted_apps
  -mediaprovider
  -mediaprovider_app
} { userdebug_or_eng_prop }:file read;

# Do not allow untrusted app to access /dev/socket/mdnsd since U. The socket is
# used to communicate to the mdnsd responder. The mdnsd responder will be
# replaced by a java implementation which is integrated into the system server.
# For untrusted apps running with API level 33-, they still have access to
# /dev/socket/mdnsd for backward compatibility.
neverallow {
  all_untrusted_apps
  -untrusted_app_25
  -untrusted_app_27
  -untrusted_app_29
  -untrusted_app_30
  -untrusted_app_32
} mdnsd_socket:sock_file write;
neverallow {
  all_untrusted_apps
  -untrusted_app_25
  -untrusted_app_27
  -untrusted_app_29
  -untrusted_app_30
  -untrusted_app_32
} mdnsd:unix_stream_socket connectto;

# Do not allow untrusted apps to use anonymous inodes. At the moment,
# type transitions are the only way to distinguish between different
# anon_inode usages like userfaultfd and io_uring. This prevents us from
# creating a more fine-grained neverallow policy for each anon_inode usage.
neverallow all_untrusted_apps domain:anon_inode *;

# Do not allow untrusted app access to hidraw devices.
neverallow all_untrusted_apps hidraw_device:chr_file *;