You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
143 lines
4.5 KiB
143 lines
4.5 KiB
### ADB daemon |
|
|
|
typeattribute adbd coredomain; |
|
typeattribute adbd mlstrustedsubject; |
|
|
|
init_daemon_domain(adbd) |
|
|
|
domain_auto_trans(adbd, shell_exec, shell) |
|
|
|
userdebug_or_eng(` |
|
allow adbd self:process setcurrent; |
|
allow adbd su:process dyntransition; |
|
') |
|
|
|
# Do not sanitize the environment or open fds of the shell. Allow signaling |
|
# created processes. |
|
allow adbd shell:process { noatsecure signal }; |
|
|
|
# Set UID and GID to shell. Set supplementary groups. |
|
allow adbd self:capability { setuid setgid }; |
|
|
|
# Drop capabilities from bounding set on user builds. |
|
allow adbd self:capability setpcap; |
|
|
|
# Create and use network sockets. |
|
net_domain(adbd) |
|
|
|
# Access /dev/usb-ffs/adb/ep0 |
|
allow adbd functionfs:dir search; |
|
allow adbd functionfs:file rw_file_perms; |
|
|
|
# Use a pseudo tty. |
|
allow adbd devpts:chr_file rw_file_perms; |
|
|
|
# adb push/pull /data/local/tmp. |
|
allow adbd shell_data_file:dir create_dir_perms; |
|
allow adbd shell_data_file:file create_file_perms; |
|
|
|
# adb pull /data/misc/profman. |
|
allow adbd profman_dump_data_file:dir r_dir_perms; |
|
allow adbd profman_dump_data_file:file r_file_perms; |
|
|
|
# adb push/pull sdcard. |
|
allow adbd tmpfs:dir search; |
|
allow adbd rootfs:lnk_file r_file_perms; # /sdcard symlink |
|
allow adbd tmpfs:lnk_file r_file_perms; # /mnt/sdcard symlink |
|
allow adbd sdcard_type:dir create_dir_perms; |
|
allow adbd sdcard_type:file create_file_perms; |
|
|
|
# adb pull /data/anr/traces.txt |
|
allow adbd anr_data_file:dir r_dir_perms; |
|
allow adbd anr_data_file:file r_file_perms; |
|
|
|
# Set service.adb.*, sys.powerctl, and sys.usb.ffs.ready properties. |
|
set_prop(adbd, shell_prop) |
|
set_prop(adbd, powerctl_prop) |
|
set_prop(adbd, ffs_prop) |
|
|
|
# Access device logging gating property |
|
get_prop(adbd, device_logging_prop) |
|
|
|
# Read device's serial number from system properties |
|
get_prop(adbd, serialno_prop) |
|
|
|
# Run /system/bin/bu |
|
allow adbd system_file:file rx_file_perms; |
|
|
|
# Perform binder IPC to surfaceflinger (screencap) |
|
# XXX Run screencap in a separate domain? |
|
binder_use(adbd) |
|
binder_call(adbd, surfaceflinger) |
|
# b/13188914 |
|
allow adbd gpu_device:chr_file rw_file_perms; |
|
allow adbd ion_device:chr_file rw_file_perms; |
|
r_dir_file(adbd, system_file) |
|
|
|
# Needed for various screenshots |
|
hal_client_domain(adbd, hal_graphics_allocator) |
|
|
|
# Read /data/misc/adb/adb_keys. |
|
allow adbd adb_keys_file:dir search; |
|
allow adbd adb_keys_file:file r_file_perms; |
|
|
|
userdebug_or_eng(` |
|
# Write debugging information to /data/adb |
|
# when persist.adb.trace_mask is set |
|
# https://code.google.com/p/android/issues/detail?id=72895 |
|
allow adbd adb_data_file:dir rw_dir_perms; |
|
allow adbd adb_data_file:file create_file_perms; |
|
') |
|
|
|
# ndk-gdb invokes adb forward to forward the gdbserver socket. |
|
allow adbd app_data_file:dir search; |
|
allow adbd app_data_file:sock_file write; |
|
allow adbd appdomain:unix_stream_socket connectto; |
|
|
|
# ndk-gdb invokes adb pull of app_process, linker, and libc.so. |
|
allow adbd zygote_exec:file r_file_perms; |
|
allow adbd system_file:file r_file_perms; |
|
|
|
# Allow pulling the SELinux policy for CTS purposes |
|
allow adbd selinuxfs:dir r_dir_perms; |
|
allow adbd selinuxfs:file r_file_perms; |
|
allow adbd kernel:security read_policy; |
|
allow adbd service_contexts_file:file r_file_perms; |
|
allow adbd file_contexts_file:file r_file_perms; |
|
allow adbd seapp_contexts_file:file r_file_perms; |
|
allow adbd property_contexts_file:file r_file_perms; |
|
allow adbd sepolicy_file:file r_file_perms; |
|
|
|
# Allow pulling config.gz for CTS purposes |
|
allow adbd config_gz:file r_file_perms; |
|
|
|
allow adbd surfaceflinger_service:service_manager find; |
|
allow adbd bootchart_data_file:dir search; |
|
allow adbd bootchart_data_file:file r_file_perms; |
|
|
|
# Allow access to external storage; we have several visible mount points under /storage |
|
# and symlinks to primary storage at places like /storage/sdcard0 and /mnt/user/0/primary |
|
allow adbd storage_file:dir r_dir_perms; |
|
allow adbd storage_file:lnk_file r_file_perms; |
|
allow adbd mnt_user_file:dir r_dir_perms; |
|
allow adbd mnt_user_file:lnk_file r_file_perms; |
|
|
|
# Access to /data/media. |
|
# This should be removed if sdcardfs is modified to alter the secontext for its |
|
# accesses to the underlying FS. |
|
allow adbd media_rw_data_file:dir create_dir_perms; |
|
allow adbd media_rw_data_file:file create_file_perms; |
|
|
|
r_dir_file(adbd, apk_data_file) |
|
|
|
allow adbd rootfs:dir r_dir_perms; |
|
|
|
### |
|
### Neverallow rules |
|
### |
|
|
|
# No transitions from adbd to non-shell, non-crash_dump domains. adbd only ever |
|
# transitions to the shell domain (except when it crashes). In particular, we |
|
# never want to see a transition from adbd to su (aka "adb root") |
|
neverallow adbd { domain -crash_dump -shell }:process transition; |
|
neverallow adbd { domain userdebug_or_eng(`-su') }:process dyntransition;
|
|
|