Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 1 | # network manager |
Jeff Vander Stoep | 76aab82 | 2017-05-15 13:19:03 -0700 | [diff] [blame] | 2 | type netd, domain, mlstrustedsubject; |
Nick Kralevich | 5e37271 | 2018-09-27 10:21:37 -0700 | [diff] [blame] | 3 | type netd_exec, system_file_type, exec_type, file_type; |
Stephen Smalley | 2dd4e51 | 2012-01-04 12:33:27 -0500 | [diff] [blame] | 4 | |
Nick Kralevich | bc19050 | 2013-12-15 19:04:09 -0800 | [diff] [blame] | 5 | net_domain(netd) |
Jeff Vander Stoep | bff9801 | 2016-05-16 21:12:17 -0700 | [diff] [blame] | 6 | # in addition to ioctls whitelisted for all domains, grant netd priv_sock_ioctls. |
| 7 | allowxperm netd self:udp_socket ioctl priv_sock_ioctls; |
Nick Kralevich | bc19050 | 2013-12-15 19:04:09 -0800 | [diff] [blame] | 8 | |
Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 9 | r_dir_file(netd, cgroup) |
Chenbo Feng | 566411e | 2018-01-02 15:31:18 -0800 | [diff] [blame] | 10 | |
Jeff Vander Stoep | 7ef8073 | 2016-09-09 16:27:17 -0700 | [diff] [blame] | 11 | allow netd system_server:fd use; |
| 12 | |
Benjamin Gordon | 9b2e0cb | 2017-11-09 15:51:26 -0700 | [diff] [blame] | 13 | allow netd self:global_capability_class_set { net_admin net_raw kill }; |
Stephen Smalley | d581b81 | 2014-02-24 13:00:59 -0500 | [diff] [blame] | 14 | # Note: fsetid is deliberately not included above. fsetid checks are |
| 15 | # triggered by chmod on a directory or file owned by a group other |
| 16 | # than one of the groups assigned to the current process to see if |
| 17 | # the setgid bit should be cleared, regardless of whether the setgid |
| 18 | # bit was even set. We do not appear to truly need this capability |
Nick Kralevich | 8d20081 | 2015-04-02 15:36:51 -0700 | [diff] [blame] | 19 | # for netd to operate. |
Benjamin Gordon | 9b2e0cb | 2017-11-09 15:51:26 -0700 | [diff] [blame] | 20 | dontaudit netd self:global_capability_class_set fsetid; |
Stephen Smalley | d581b81 | 2014-02-24 13:00:59 -0500 | [diff] [blame] | 21 | |
Maciej Żenczykowski | 6450e00 | 2019-04-08 21:18:50 -0700 | [diff] [blame] | 22 | # Allow netd to open /dev/tun, set it up and pass it to clatd |
| 23 | allow netd tun_device:chr_file rw_file_perms; |
| 24 | allowxperm netd tun_device:chr_file ioctl { TUNGETIFF TUNSETIFF }; |
| 25 | allow netd self:tun_socket create; |
| 26 | |
Jeff Vander Stoep | bff9801 | 2016-05-16 21:12:17 -0700 | [diff] [blame] | 27 | allow netd self:netlink_kobject_uevent_socket create_socket_perms_no_ioctl; |
Stephen Smalley | 1601132 | 2014-02-24 15:06:11 -0500 | [diff] [blame] | 28 | allow netd self:netlink_route_socket nlmsg_write; |
Jeff Vander Stoep | bff9801 | 2016-05-16 21:12:17 -0700 | [diff] [blame] | 29 | allow netd self:netlink_nflog_socket create_socket_perms_no_ioctl; |
| 30 | allow netd self:netlink_socket create_socket_perms_no_ioctl; |
| 31 | allow netd self:netlink_tcpdiag_socket { create_socket_perms_no_ioctl nlmsg_read nlmsg_write }; |
| 32 | allow netd self:netlink_generic_socket create_socket_perms_no_ioctl; |
| 33 | allow netd self:netlink_netfilter_socket create_socket_perms_no_ioctl; |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 34 | allow netd shell_exec:file rx_file_perms; |
| 35 | allow netd system_file:file x_file_perms; |
Jeff Vander Stoep | f627e55 | 2017-04-13 21:58:12 -0700 | [diff] [blame] | 36 | not_full_treble(`allow netd vendor_file:file x_file_perms;') |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 37 | allow netd devpts:chr_file rw_file_perms; |
| 38 | |
Jeff Vander Stoep | f8155a0 | 2020-07-10 09:10:31 +0200 | [diff] [blame] | 39 | # Acquire advisory lock on /system/etc/xtables.lock. If this file doesn't |
| 40 | # exist, suppress the denial. |
Nick Kralevich | 4a580cc | 2017-04-04 18:34:52 -0700 | [diff] [blame] | 41 | allow netd system_file:file lock; |
Jeff Vander Stoep | f8155a0 | 2020-07-10 09:10:31 +0200 | [diff] [blame] | 42 | dontaudit netd system_file:dir write; |
Nick Kralevich | 4a580cc | 2017-04-04 18:34:52 -0700 | [diff] [blame] | 43 | |
Jeff Vander Stoep | bdf2a9c | 2018-04-03 09:53:23 -0700 | [diff] [blame] | 44 | # Allow netd to write to qtaguid ctrl file. |
| 45 | # TODO: Add proper rules to prevent other process to access qtaguid_proc file |
| 46 | # after migration complete |
| 47 | allow netd proc_qtaguid_ctrl:file rw_file_perms; |
Chenbo Feng | cc781f7 | 2017-11-15 11:18:44 -0800 | [diff] [blame] | 48 | # Allow netd to read /dev/qtaguid. This is the same privilege level that normal apps have. |
| 49 | allow netd qtaguid_device:chr_file r_file_perms; |
Chenbo Feng | 185941a | 2017-10-24 14:40:53 -0700 | [diff] [blame] | 50 | |
Jeff Vander Stoep | 7a4af30 | 2018-04-10 12:47:48 -0700 | [diff] [blame] | 51 | r_dir_file(netd, proc_net_type) |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 52 | # For /proc/sys/net/ipv[46]/route/flush. |
Jeff Vander Stoep | 7a4af30 | 2018-04-10 12:47:48 -0700 | [diff] [blame] | 53 | allow netd proc_net_type:file rw_file_perms; |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 54 | |
Christopher Wiley | 97db27d | 2016-06-30 14:23:12 -0700 | [diff] [blame] | 55 | # Enables PppController and interface enumeration (among others) |
Tri Vo | 8dabc2c | 2017-10-01 15:53:01 -0700 | [diff] [blame] | 56 | allow netd sysfs:dir r_dir_perms; |
| 57 | r_dir_file(netd, sysfs_net) |
| 58 | |
Christopher Wiley | 97db27d | 2016-06-30 14:23:12 -0700 | [diff] [blame] | 59 | # Allows setting interface MTU |
Tri Vo | 8dabc2c | 2017-10-01 15:53:01 -0700 | [diff] [blame] | 60 | allow netd sysfs_net:file w_file_perms; |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 61 | |
dcashman | 17cfd3f | 2016-06-14 13:41:47 -0700 | [diff] [blame] | 62 | # TODO: added to match above sysfs rule. Remove me? |
| 63 | allow netd sysfs_usb:file write; |
| 64 | |
Chenbo Feng | 7b57104 | 2018-12-04 17:57:27 -0800 | [diff] [blame] | 65 | r_dir_file(netd, cgroup_bpf) |
| 66 | |
Maciej Żenczykowski | 487fcb8 | 2019-04-08 21:34:53 -0700 | [diff] [blame] | 67 | allow netd fs_bpf:dir search; |
Maciej Żenczykowski | 49c73b0 | 2020-01-30 22:08:43 -0800 | [diff] [blame] | 68 | allow netd fs_bpf:file { read write }; |
Chenbo Feng | 254ad0d | 2017-08-01 18:06:18 -0700 | [diff] [blame] | 69 | |
Christopher Wiley | 8211568 | 2016-07-22 16:34:08 -0700 | [diff] [blame] | 70 | # TODO: netd previously thought it needed these permissions to do WiFi related |
| 71 | # work. However, after all the WiFi stuff is gone, we still need them. |
| 72 | # Why? |
Benjamin Gordon | 342362a | 2018-09-06 16:19:40 -0600 | [diff] [blame] | 73 | allow netd self:global_capability_class_set { dac_override dac_read_search chown }; |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 74 | |
Sreeram Ramachandran | 65edb75 | 2014-07-07 22:04:57 -0700 | [diff] [blame] | 75 | # Needed to update /data/misc/net/rt_tables |
| 76 | allow netd net_data_file:file create_file_perms; |
| 77 | allow netd net_data_file:dir rw_dir_perms; |
Benjamin Gordon | 9b2e0cb | 2017-11-09 15:51:26 -0700 | [diff] [blame] | 78 | allow netd self:global_capability_class_set fowner; |
Sreeram Ramachandran | 65edb75 | 2014-07-07 22:04:57 -0700 | [diff] [blame] | 79 | |
Lorenzo Colitti | 9273c1b | 2017-07-16 17:48:39 +0900 | [diff] [blame] | 80 | # Needed to lock the iptables lock. |
| 81 | allow netd system_file:file lock; |
| 82 | |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 83 | # Allow netd to spawn dnsmasq in it's own domain |
Nick Kralevich | dbd28d9 | 2013-06-27 15:11:02 -0700 | [diff] [blame] | 84 | allow netd dnsmasq:process signal; |
| 85 | |
Lorenzo Colitti | 24dcc8b | 2016-02-18 23:55:51 +0900 | [diff] [blame] | 86 | # Allow netd to publish a binder service and make binder calls. |
| 87 | binder_use(netd) |
William Roberts | 606d2fd | 2017-01-19 13:23:52 -0800 | [diff] [blame] | 88 | add_service(netd, netd_service) |
Luke Huang | 524f25e | 2019-02-25 20:12:15 +0800 | [diff] [blame] | 89 | add_service(netd, dnsresolver_service) |
Lorenzo Colitti | f7bfd48 | 2016-04-19 08:05:44 +0900 | [diff] [blame] | 90 | allow netd dumpstate:fifo_file { getattr write }; |
Lorenzo Colitti | 24dcc8b | 2016-02-18 23:55:51 +0900 | [diff] [blame] | 91 | |
| 92 | # Allow netd to call into the system server so it can check permissions. |
| 93 | allow netd system_server:binder call; |
Lorenzo Colitti | 5f376c1 | 2016-03-02 22:55:17 +0900 | [diff] [blame] | 94 | allow netd permission_service:service_manager find; |
Lorenzo Colitti | 24dcc8b | 2016-02-18 23:55:51 +0900 | [diff] [blame] | 95 | |
Michal Karpinski | 59afa24 | 2016-09-01 10:08:57 +0100 | [diff] [blame] | 96 | # Allow netd to talk to the framework service which collects netd events. |
| 97 | allow netd netd_listener_service:service_manager find; |
Lorenzo Colitti | 71d6ddc | 2016-04-14 00:14:58 +0900 | [diff] [blame] | 98 | |
Sreeram Ramachandran | 56ecf4b | 2014-05-01 11:12:10 -0700 | [diff] [blame] | 99 | # Allow netd to operate on sockets that are passed to it. |
Nick Kralevich | 5251ad1 | 2017-02-27 09:21:11 -0800 | [diff] [blame] | 100 | allow netd netdomain:{ |
Yongqin Liu | 8a8d4ef | 2018-07-02 18:34:18 +0800 | [diff] [blame] | 101 | icmp_socket |
Nick Kralevich | 5251ad1 | 2017-02-27 09:21:11 -0800 | [diff] [blame] | 102 | tcp_socket |
| 103 | udp_socket |
| 104 | rawip_socket |
| 105 | tun_socket |
| 106 | } { read write getattr setattr getopt setopt }; |
Sreeram Ramachandran | 56ecf4b | 2014-05-01 11:12:10 -0700 | [diff] [blame] | 107 | allow netd netdomain:fd use; |
| 108 | |
Nathan Harold | 63a9315 | 2017-03-01 20:29:21 -0800 | [diff] [blame] | 109 | # give netd permission to read and write netlink xfrm |
| 110 | allow netd self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_write nlmsg_read }; |
| 111 | |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 112 | # Allow netd to register as hal server. |
| 113 | add_hwservice(netd, system_net_netd_hwservice) |
| 114 | hwbinder_use(netd) |
Dan Cashman | 91d398d | 2017-09-26 12:58:29 -0700 | [diff] [blame] | 115 | |
Nick Kralevich | 9a19885 | 2013-07-12 21:28:41 -0700 | [diff] [blame] | 116 | ### |
| 117 | ### Neverallow rules |
| 118 | ### |
| 119 | ### netd should NEVER do any of this |
| 120 | |
| 121 | # Block device access. |
| 122 | neverallow netd dev_type:blk_file { read write }; |
| 123 | |
Nick Kralevich | 9a19885 | 2013-07-12 21:28:41 -0700 | [diff] [blame] | 124 | # ptrace any other app |
| 125 | neverallow netd { domain }:process ptrace; |
| 126 | |
| 127 | # Write to /system. |
| 128 | neverallow netd system_file:dir_file_class_set write; |
| 129 | |
| 130 | # Write to files in /data/data or system files on /data |
Nick Kralevich | 23c9d91 | 2018-08-02 15:54:23 -0700 | [diff] [blame] | 131 | neverallow netd { app_data_file privapp_data_file system_data_file }:dir_file_class_set write; |
Lorenzo Colitti | 9119f12 | 2016-03-02 22:57:34 +0900 | [diff] [blame] | 132 | |
Remi NGUYEN VAN | 5f3ba92 | 2018-11-14 17:07:41 +0900 | [diff] [blame] | 133 | # only system_server, dumpstate and network stack app may find netd service |
| 134 | neverallow { |
| 135 | domain |
| 136 | -system_server |
| 137 | -dumpstate |
| 138 | -network_stack |
| 139 | -netd |
Luke Huang | 554b334 | 2019-03-19 15:07:00 +0800 | [diff] [blame] | 140 | -netutils_wrapper |
Remi NGUYEN VAN | 5f3ba92 | 2018-11-14 17:07:41 +0900 | [diff] [blame] | 141 | } netd_service:service_manager find; |
Jeff Vander Stoep | 07c650e | 2017-07-26 12:53:21 -0700 | [diff] [blame] | 142 | |
Luke Huang | 524f25e | 2019-02-25 20:12:15 +0800 | [diff] [blame] | 143 | # only system_server, dumpstate and network stack app may find dnsresolver service |
| 144 | neverallow { |
| 145 | domain |
| 146 | -system_server |
| 147 | -dumpstate |
| 148 | -network_stack |
| 149 | -netd |
Luke Huang | 554b334 | 2019-03-19 15:07:00 +0800 | [diff] [blame] | 150 | -netutils_wrapper |
Luke Huang | 524f25e | 2019-02-25 20:12:15 +0800 | [diff] [blame] | 151 | } dnsresolver_service:service_manager find; |
| 152 | |
Jeff Vander Stoep | 07c650e | 2017-07-26 12:53:21 -0700 | [diff] [blame] | 153 | # apps may not interact with netd over binder. |
Roshan Pius | 1086c7d | 2019-10-01 13:49:21 -0700 | [diff] [blame] | 154 | neverallow { appdomain -network_stack } netd:binder call; |
| 155 | neverallow netd { appdomain -network_stack userdebug_or_eng(`-su') }:binder call; |
Lorenzo Colitti | 5b3efd3 | 2017-07-11 09:43:19 +0900 | [diff] [blame] | 156 | |
Tri Vo | 569e22e | 2018-03-16 16:08:31 -0700 | [diff] [blame] | 157 | # If an already existing file is opened with O_CREATE, the kernel might generate |
| 158 | # a false report of a create denial. Silence these denials and make sure that |
| 159 | # inappropriate permissions are not granted. |
| 160 | neverallow netd proc_net:dir no_w_dir_perms; |
| 161 | dontaudit netd proc_net:dir write; |
| 162 | |
| 163 | neverallow netd sysfs_net:dir no_w_dir_perms; |
| 164 | dontaudit netd sysfs_net:dir write; |
Maciej Żenczykowski | d4a692f | 2020-01-24 04:50:04 -0800 | [diff] [blame] | 165 | |
| 166 | # Netd should not have SYS_ADMIN privs. |
| 167 | neverallow netd self:capability sys_admin; |
| 168 | dontaudit netd self:capability sys_admin; |
| 169 | |
| 170 | # Netd should not have SYS_MODULE privs, nor should it be requesting module loads |
| 171 | # (things it requires should be built directly into the kernel) |
Maciej Żenczykowski | d4a692f | 2020-01-24 04:50:04 -0800 | [diff] [blame] | 172 | dontaudit netd self:capability sys_module; |
| 173 | |
Maciej Żenczykowski | d4a692f | 2020-01-24 04:50:04 -0800 | [diff] [blame] | 174 | dontaudit netd kernel:system module_request; |
Ken Chen | e49acfa | 2020-07-13 20:20:49 +0800 | [diff] [blame^] | 175 | |
| 176 | dontaudit netd appdomain:unix_stream_socket { read write }; |