Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 1 | # network manager |
Jeff Vander Stoep | 76aab82 | 2017-05-15 13:19:03 -0700 | [diff] [blame] | 2 | type netd, domain, mlstrustedsubject; |
Nick Kralevich | 5e37271 | 2018-09-27 10:21:37 -0700 | [diff] [blame] | 3 | type netd_exec, system_file_type, exec_type, file_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 4 | |
Nick Kralevich | bc19050 | 2013-12-15 19:04:09 -0800 | [diff] [blame] | 5 | net_domain(netd) |
Yuyang Huang | cfdea5f | 2023-01-18 16:52:43 +0900 | [diff] [blame] | 6 | # Connect to mdnsd via mdnsd socket. |
| 7 | unix_socket_connect(netd, mdnsd, mdnsd) |
Jeff Sharkey | a0e7a6d | 2020-07-31 12:28:11 -0600 | [diff] [blame] | 8 | # in addition to ioctls allowlisted for all domains, grant netd priv_sock_ioctls. |
Jeff Vander Stoep | bff9801 | 2016-05-16 21:12:17 -0700 | [diff] [blame] | 9 | allowxperm netd self:udp_socket ioctl priv_sock_ioctls; |
Nick Kralevich | bc19050 | 2013-12-15 19:04:09 -0800 | [diff] [blame] | 10 | |
Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 11 | r_dir_file(netd, cgroup) |
Chenbo Feng | 566411e | 2018-01-02 15:31:18 -0800 | [diff] [blame] | 12 | |
Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 13 | allow netd system_server:fd use; |
| 14 | |
Benjamin Gordon | 9b2e0cb | 2017-11-09 15:51:26 -0700 | [diff] [blame] | 15 | allow netd self:global_capability_class_set { net_admin net_raw kill }; |
Stephen Smalley | d581b81 | 2014-02-24 13:00:59 -0500 | [diff] [blame] | 16 | # Note: fsetid is deliberately not included above. fsetid checks are |
| 17 | # triggered by chmod on a directory or file owned by a group other |
| 18 | # than one of the groups assigned to the current process to see if |
| 19 | # the setgid bit should be cleared, regardless of whether the setgid |
| 20 | # bit was even set. We do not appear to truly need this capability |
Nick Kralevich | 8d20081 | 2015-04-02 15:36:51 -0700 | [diff] [blame] | 21 | # for netd to operate. |
Benjamin Gordon | 9b2e0cb | 2017-11-09 15:51:26 -0700 | [diff] [blame] | 22 | dontaudit netd self:global_capability_class_set fsetid; |
Stephen Smalley | d581b81 | 2014-02-24 13:00:59 -0500 | [diff] [blame] | 23 | |
Maciej Żenczykowski | 6450e00 | 2019-04-08 21:18:50 -0700 | [diff] [blame] | 24 | # Allow netd to open /dev/tun, set it up and pass it to clatd |
| 25 | allow netd tun_device:chr_file rw_file_perms; |
| 26 | allowxperm netd tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF }; |
| 27 | allow netd self:tun_socket create; |
| 28 | |
Jeff Vander Stoep | bff9801 | 2016-05-16 21:12:17 -0700 | [diff] [blame] | 29 | allow netd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; |
Stephen Smalley | 1601132 | 2014-02-24 15:06:11 -0500 | [diff] [blame] | 30 | allow netd self:netlink_route_socket nlmsg_write; |
Jeff Vander Stoep | bff9801 | 2016-05-16 21:12:17 -0700 | [diff] [blame] | 31 | allow netd self:netlink_nflog_socket create_socket_perms_no_ioctl; |
| 32 | allow netd self:netlink_socket create_socket_perms_no_ioctl; |
| 33 | allow netd self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read nlmsg_write }; |
| 34 | allow netd self:netlink_generic_socket create_socket_perms_no_ioctl; |
| 35 | allow netd self:netlink_netfilter_socket create_socket_perms_no_ioctl; |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 36 | allow netd shell_exec:file rx_file_perms; |
| 37 | allow netd system_file:file x_file_perms; |
Jeff Vander Stoep | f627e55 | 2017-04-13 21:58:12 -0700 | [diff] [blame] | 38 | not_full_treble(`allow netd vendor_file:file x_file_perms;') |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 39 | allow netd devpts:chr_file rw_file_perms; |
| 40 | |
Jeff Vander Stoep | f8155a0 | 2020-07-10 09:10:31 +0200 | [diff] [blame] | 41 | # Acquire advisory lock on /system/etc/xtables.lock. If this file doesn't |
| 42 | # exist, suppress the denial. |
Nick Kralevich | 4a580cc | 2017-04-04 18:34:52 -0700 | [diff] [blame] | 43 | allow netd system_file:file lock; |
Jeff Vander Stoep | f8155a0 | 2020-07-10 09:10:31 +0200 | [diff] [blame] | 44 | dontaudit netd system_file:dir write; |
Nick Kralevich | 4a580cc | 2017-04-04 18:34:52 -0700 | [diff] [blame] | 45 | |
Jeff Vander Stoep | bdf2a9c | 2018-04-03 09:53:23 -0700 | [diff] [blame] | 46 | # Allow netd to write to qtaguid ctrl file. |
| 47 | # TODO: Add proper rules to prevent other process to access qtaguid_proc file |
| 48 | # after migration complete |
| 49 | allow netd proc_qtaguid_ctrl:file rw_file_perms; |
Chenbo Feng | cc781f7 | 2017-11-15 11:18:44 -0800 | [diff] [blame] | 50 | # Allow netd to read /dev/qtaguid. This is the same privilege level that normal apps have. |
| 51 | allow netd qtaguid_device:chr_file r_file_perms; |
Chenbo Feng | 185941a | 2017-10-24 14:40:53 -0700 | [diff] [blame] | 52 | |
Jeff Vander Stoep | 7a4af30 | 2018-04-10 12:47:48 -0700 | [diff] [blame] | 53 | r_dir_file(netd, proc_net_type) |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 54 | # For /proc/sys/net/ipv[46]/route/flush. |
Jeff Vander Stoep | 7a4af30 | 2018-04-10 12:47:48 -0700 | [diff] [blame] | 55 | allow netd proc_net_type:file rw_file_perms; |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 56 | |
Christopher Wiley | 97db27d | 2016-06-30 14:23:12 -0700 | [diff] [blame] | 57 | # Enables PppController and interface enumeration (among others) |
Tri Vo | 8dabc2c | 2017-10-01 15:53:01 -0700 | [diff] [blame] | 58 | allow netd sysfs:dir r_dir_perms; |
| 59 | r_dir_file(netd, sysfs_net) |
| 60 | |
Christopher Wiley | 97db27d | 2016-06-30 14:23:12 -0700 | [diff] [blame] | 61 | # Allows setting interface MTU |
Tri Vo | 8dabc2c | 2017-10-01 15:53:01 -0700 | [diff] [blame] | 62 | allow netd sysfs_net:file w_file_perms; |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 63 | |
dcashman | 17cfd3f | 2016-06-14 13:41:47 -0700 | [diff] [blame] | 64 | # TODO: added to match above sysfs rule. Remove me? |
| 65 | allow netd sysfs_usb:file write; |
| 66 | |
Marco Ballesio | 8f280b0 | 2020-05-27 14:10:39 -0700 | [diff] [blame] | 67 | r_dir_file(netd, cgroup_v2) |
Chenbo Feng | 7b57104 | 2018-12-04 17:57:27 -0800 | [diff] [blame] | 68 | |
Christopher Wiley | 8211568 | 2016-07-22 16:34:08 -0700 | [diff] [blame] | 69 | # TODO: netd previously thought it needed these permissions to do WiFi related |
| 70 | # work. However, after all the WiFi stuff is gone, we still need them. |
| 71 | # Why? |
Benjamin Gordon | 342362a | 2018-09-06 16:19:40 -0600 | [diff] [blame] | 72 | allow netd self:global_capability_class_set { dac_override dac_read_search chown }; |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 73 | |
Sreeram Ramachandran | 65edb75 | 2014-07-07 22:04:57 -0700 | [diff] [blame] | 74 | # Needed to update /data/misc/net/rt_tables |
| 75 | allow netd net_data_file:file create_file_perms; |
| 76 | allow netd net_data_file:dir rw_dir_perms; |
Benjamin Gordon | 9b2e0cb | 2017-11-09 15:51:26 -0700 | [diff] [blame] | 77 | allow netd self:global_capability_class_set fowner; |
Sreeram Ramachandran | 65edb75 | 2014-07-07 22:04:57 -0700 | [diff] [blame] | 78 | |
Lorenzo Colitti | 9273c1b | 2017-07-16 17:48:39 +0900 | [diff] [blame] | 79 | # Needed to lock the iptables lock. |
| 80 | allow netd system_file:file lock; |
| 81 | |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 82 | # Allow netd to spawn dnsmasq in it's own domain |
Ken Chen | 099da6d | 2023-05-16 15:54:31 +0800 | [diff] [blame] | 83 | allow netd dnsmasq:process { sigkill signal }; |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 84 | |
Lorenzo Colitti | 24dcc8b | 2016-02-18 23:55:51 +0900 | [diff] [blame] | 85 | # Allow netd to publish a binder service and make binder calls. |
| 86 | binder_use(netd) |
William Roberts | 606d2fd | 2017-01-19 13:23:52 -0800 | [diff] [blame] | 87 | add_service(netd, netd_service) |
Luke Huang | 524f25e | 2019-02-25 20:12:15 +0800 | [diff] [blame] | 88 | add_service(netd, dnsresolver_service) |
paulhu | 70b0a77 | 2021-12-09 11:49:23 +0800 | [diff] [blame] | 89 | add_service(netd, mdns_service) |
Lorenzo Colitti | f7bfd48 | 2016-04-19 08:05:44 +0900 | [diff] [blame] | 90 | allow netd dumpstate:fifo_file { getattr write }; |
Lorenzo Colitti | 24dcc8b | 2016-02-18 23:55:51 +0900 | [diff] [blame] | 91 | |
| 92 | # Allow netd to call into the system server so it can check permissions. |
| 93 | allow netd system_server:binder call; |
Lorenzo Colitti | 5f376c1 | 2016-03-02 22:55:17 +0900 | [diff] [blame] | 94 | allow netd permission_service:service_manager find; |
Lorenzo Colitti | 24dcc8b | 2016-02-18 23:55:51 +0900 | [diff] [blame] | 95 | |
Michal Karpinski | 59afa24 | 2016-09-01 10:08:57 +0100 | [diff] [blame] | 96 | # Allow netd to talk to the framework service which collects netd events. |
| 97 | allow netd netd_listener_service:service_manager find; |
Lorenzo Colitti | 71d6ddc | 2016-04-14 00:14:58 +0900 | [diff] [blame] | 98 | |
Sreeram Ramachandran | 56ecf4b | 2014-05-01 11:12:10 -0700 | [diff] [blame] | 99 | # Allow netd to operate on sockets that are passed to it. |
Nick Kralevich | 5251ad1 | 2017-02-27 09:21:11 -0800 | [diff] [blame] | 100 | allow netd netdomain:{ |
Yongqin Liu | 8a8d4ef | 2018-07-02 18:34:18 +0800 | [diff] [blame] | 101 | icmp_socket |
Nick Kralevich | 5251ad1 | 2017-02-27 09:21:11 -0800 | [diff] [blame] | 102 | tcp_socket |
| 103 | udp_socket |
| 104 | rawip_socket |
| 105 | tun_socket |
| 106 | } { read write getattr setattr getopt setopt }; |
Sreeram Ramachandran | 56ecf4b | 2014-05-01 11:12:10 -0700 | [diff] [blame] | 107 | allow netd netdomain:fd use; |
| 108 | |
Nathan Harold | 63a9315 | 2017-03-01 20:29:21 -0800 | [diff] [blame] | 109 | # give netd permission to read and write netlink xfrm |
| 110 | allow netd self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_write nlmsg_read }; |
| 111 | |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 112 | # Allow netd to register as hal server. |
| 113 | add_hwservice(netd, system_net_netd_hwservice) |
| 114 | hwbinder_use(netd) |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 115 | |
Devin Moore | 309a355 | 2022-05-10 21:56:20 +0000 | [diff] [blame] | 116 | # AIDL hal server |
| 117 | binder_call(system_net_netd_service, servicemanager) |
| 118 | add_service(netd, system_net_netd_service) |
| 119 | |
Nick Kralevich | 9a19885 | 2013-07-12 21:28:41 -0700 | [diff] [blame] | 120 | ### |
| 121 | ### Neverallow rules |
| 122 | ### |
| 123 | ### netd should NEVER do any of this |
| 124 | |
| 125 | # Block device access. |
| 126 | neverallow netd dev_type:blk_file { read write }; |
| 127 | |
Nick Kralevich | 9a19885 | 2013-07-12 21:28:41 -0700 | [diff] [blame] | 128 | # ptrace any other app |
| 129 | neverallow netd { domain }:process ptrace; |
| 130 | |
| 131 | # Write to /system. |
Steven Moreland | 9c2a5cf | 2023-05-17 23:44:30 +0000 | [diff] [blame] | 132 | neverallow netd system_file_type:dir_file_class_set write; |
Nick Kralevich | 9a19885 | 2013-07-12 21:28:41 -0700 | [diff] [blame] | 133 | |
| 134 | # Write to files in /data/data or system files on /data |
Alan Stokes | f8ad339 | 2020-10-27 17:35:33 +0000 | [diff] [blame] | 135 | neverallow netd { app_data_file_type system_data_file }:dir_file_class_set write; |
Lorenzo Colitti | 9119f12 | 2016-03-02 22:57:34 +0900 | [diff] [blame] | 136 | |
Remi NGUYEN VAN | 5f3ba92 | 2018-11-14 17:07:41 +0900 | [diff] [blame] | 137 | # only system_server, dumpstate and network stack app may find netd service |
| 138 | neverallow { |
| 139 | domain |
| 140 | -system_server |
| 141 | -dumpstate |
| 142 | -network_stack |
| 143 | -netd |
Luke Huang | 554b334 | 2019-03-19 15:07:00 +0800 | [diff] [blame] | 144 | -netutils_wrapper |
Remi NGUYEN VAN | 5f3ba92 | 2018-11-14 17:07:41 +0900 | [diff] [blame] | 145 | } netd_service:service_manager find; |
Jeff Vander Stoep | 07c650e | 2017-07-26 12:53:21 -0700 | [diff] [blame] | 146 | |
Luke Huang | 524f25e | 2019-02-25 20:12:15 +0800 | [diff] [blame] | 147 | # only system_server, dumpstate and network stack app may find dnsresolver service |
| 148 | neverallow { |
| 149 | domain |
| 150 | -system_server |
| 151 | -dumpstate |
| 152 | -network_stack |
| 153 | -netd |
Luke Huang | 554b334 | 2019-03-19 15:07:00 +0800 | [diff] [blame] | 154 | -netutils_wrapper |
Luke Huang | 524f25e | 2019-02-25 20:12:15 +0800 | [diff] [blame] | 155 | } dnsresolver_service:service_manager find; |
| 156 | |
paulhu | 70b0a77 | 2021-12-09 11:49:23 +0800 | [diff] [blame] | 157 | # only system_server, dumpstate and network stack app may find mdns service |
| 158 | neverallow { |
| 159 | domain |
| 160 | -system_server |
| 161 | -dumpstate |
| 162 | -network_stack |
| 163 | -netd |
| 164 | -netutils_wrapper |
| 165 | } mdns_service:service_manager find; |
| 166 | |
Jeff Vander Stoep | 07c650e | 2017-07-26 12:53:21 -0700 | [diff] [blame] | 167 | # apps may not interact with netd over binder. |
Roshan Pius | 1086c7d | 2019-10-01 13:49:21 -0700 | [diff] [blame] | 168 | neverallow { appdomain -network_stack } netd:binder call; |
| 169 | neverallow netd { appdomain -network_stack userdebug_or_eng(`-su') }:binder call; |
Lorenzo Colitti | 5b3efd3 | 2017-07-11 09:43:19 +0900 | [diff] [blame] | 170 | |
Tri Vo | 569e22e | 2018-03-16 16:08:31 -0700 | [diff] [blame] | 171 | # If an already existing file is opened with O_CREATE, the kernel might generate |
| 172 | # a false report of a create denial. Silence these denials and make sure that |
| 173 | # inappropriate permissions are not granted. |
| 174 | neverallow netd proc_net:dir no_w_dir_perms; |
| 175 | dontaudit netd proc_net:dir write; |
| 176 | |
| 177 | neverallow netd sysfs_net:dir no_w_dir_perms; |
| 178 | dontaudit netd sysfs_net:dir write; |
Maciej Żenczykowski | d4a692f | 2020-01-24 04:50:04 -0800 | [diff] [blame] | 179 | |
| 180 | # Netd should not have SYS_ADMIN privs. |
| 181 | neverallow netd self:capability sys_admin; |
| 182 | dontaudit netd self:capability sys_admin; |
| 183 | |
| 184 | # Netd should not have SYS_MODULE privs, nor should it be requesting module loads |
| 185 | # (things it requires should be built directly into the kernel) |
Maciej Żenczykowski | d4a692f | 2020-01-24 04:50:04 -0800 | [diff] [blame] | 186 | dontaudit netd self:capability sys_module; |
| 187 | |
Ken Chen | e49acfa | 2020-07-13 20:20:49 +0800 | [diff] [blame] | 188 | dontaudit netd appdomain:unix_stream_socket { read write }; |