| # zygote |
| typeattribute zygote coredomain; |
| typeattribute zygote mlstrustedsubject; |
| |
| init_daemon_domain(zygote) |
| |
| read_runtime_log_tags(zygote) |
| |
| # Override DAC on files and switch uid/gid. |
| allow zygote self:global_capability_class_set { dac_override dac_read_search setgid setuid fowner chown }; |
| |
| # Drop capabilities from bounding set. |
| allow zygote self:global_capability_class_set setpcap; |
| |
| # Switch SELinux context to app domains. |
| allow zygote self:process setcurrent; |
| allow zygote system_server:process dyntransition; |
| allow zygote appdomain:process dyntransition; |
| allow zygote webview_zygote:process dyntransition; |
| |
| # Allow zygote to read app /proc/pid dirs (b/10455872). |
| allow zygote appdomain:dir { getattr search }; |
| allow zygote appdomain:file { r_file_perms }; |
| |
| # Move children into the peer process group. |
| allow zygote system_server:process { getpgid setpgid }; |
| allow zygote appdomain:process { getpgid setpgid }; |
| allow zygote webview_zygote:process { getpgid setpgid }; |
| |
| # Read system data. |
| allow zygote system_data_file:dir r_dir_perms; |
| allow zygote system_data_file:file r_file_perms; |
| |
| # Write to /data/dalvik-cache. |
| allow zygote dalvikcache_data_file:dir create_dir_perms; |
| allow zygote dalvikcache_data_file:file create_file_perms; |
| |
| # Create symlinks in /data/dalvik-cache. |
| allow zygote dalvikcache_data_file:lnk_file create_file_perms; |
| |
| # Write to /data/resource-cache. |
| allow zygote resourcecache_data_file:dir rw_dir_perms; |
| allow zygote resourcecache_data_file:file create_file_perms; |
| |
| # When WITH_DEXPREOPT is true, the zygote does not load executable content from |
| # /data/dalvik-cache. Executable files loaded from /data is a persistence vector |
| # we want to avoid. See |
| # https://bugs.chromium.org/p/project-zero/issues/detail?id=955 for example. |
| allow { zygote with_dexpreopt(`-zygote') } dalvikcache_data_file:file execute; |
| |
| # Execute idmap and dex2oat within zygote's own domain. |
| # TODO: Should either of these be transitioned to the same domain |
| # used by installd or stay in-domain for zygote? |
| allow zygote idmap_exec:file rx_file_perms; |
| allow zygote dex2oat_exec:file rx_file_perms; |
| |
| # Allow apps access to /vendor/overlay |
| r_dir_file(zygote, vendor_overlay_file) |
| |
| # Control cgroups. |
| allow zygote cgroup:dir create_dir_perms; |
| allow zygote cgroup:{ file lnk_file } r_file_perms; |
| allow zygote self:global_capability_class_set sys_admin; |
| |
| # Allow zygote to stat the files that it opens. The zygote must |
| # be able to inspect them so that it can reopen them on fork |
| # if necessary: b/30963384. |
| allow zygote pmsg_device:chr_file getattr; |
| allow zygote debugfs_trace_marker:file getattr; |
| |
| # Get seapp_contexts |
| allow zygote seapp_contexts_file:file r_file_perms; |
| # Check validity of SELinux context before use. |
| selinux_check_context(zygote) |
| # Check SELinux permissions. |
| selinux_check_access(zygote) |
| |
| # Native bridge functionality requires that zygote replaces |
| # /proc/cpuinfo with /system/lib/<ISA>/cpuinfo using a bind mount |
| allow zygote proc_cpuinfo:file mounton; |
| |
| # Allow remounting rootfs as MS_SLAVE. |
| allow zygote rootfs:dir mounton; |
| allow zygote tmpfs:filesystem { mount unmount }; |
| allow zygote fuse:filesystem { unmount }; |
| allow zygote sdcardfs:filesystem { unmount }; |
| |
| # Allow creating user-specific storage source if started before vold. |
| allow zygote mnt_user_file:dir create_dir_perms; |
| allow zygote mnt_user_file:lnk_file create_file_perms; |
| # Allowed to mount user-specific storage into place |
| allow zygote storage_file:dir { search mounton }; |
| |
| # Handle --invoke-with command when launching Zygote with a wrapper command. |
| allow zygote zygote_exec:file rx_file_perms; |
| |
| # Root fs. |
| r_dir_file(zygote, rootfs) |
| |
| # System file accesses. |
| r_dir_file(zygote, system_file) |
| |
| userdebug_or_eng(` |
| # Allow zygote to create and write method traces in /data/misc/trace. |
| allow zygote method_trace_data_file:dir w_dir_perms; |
| allow zygote method_trace_data_file:file { create w_file_perms }; |
| ') |
| |
| allow zygote ion_device:chr_file r_file_perms; |
| allow zygote tmpfs:dir r_dir_perms; |
| |
| # Let the zygote access overlays so it can initialize the AssetManager. |
| get_prop(zygote, overlay_prop) |
| get_prop(zygote, exported_overlay_prop) |
| |
| # ingore spurious denials |
| dontaudit zygote self:global_capability_class_set sys_resource; |
| |
| ### |
| ### neverallow rules |
| ### |
| |
| # Ensure that all types assigned to app processes are included |
| # in the appdomain attribute, so that all allow and neverallow rules |
| # written on appdomain are applied to all app processes. |
| # This is achieved by ensuring that it is impossible for zygote to |
| # setcon (dyntransition) to any types other than those associated |
| # with appdomain plus system_server and webview_zygote. |
| neverallow zygote ~{ appdomain system_server webview_zygote }:process dyntransition; |
| |
| # Zygote should never execute anything from /data except for /data/dalvik-cache files. |
| neverallow zygote { |
| data_file_type |
| -dalvikcache_data_file # map PROT_EXEC |
| }:file no_x_file_perms; |
| |
| # Do not allow access to Bluetooth-related system properties and files |
| neverallow zygote { |
| bluetooth_a2dp_offload_prop |
| bluetooth_prop |
| exported_bluetooth_prop |
| }:file create_file_perms; |