aboutsummaryrefslogtreecommitdiffstats
blob: 135dfa859580cd29c16d8e0edb949d622c331d11 (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
# vendor_init is its own domain.
type vendor_init, domain, mlstrustedsubject;

# Communication to the main init process
allow vendor_init init:unix_stream_socket { read write };

# Vendor init shouldn't communicate with any vendor process, nor most system processes.
neverallow_establish_socket_comms(vendor_init, { domain -init -logd -su -vendor_init });

# Logging to kmsg
allow vendor_init kmsg_device:chr_file { open write };

# Mount on /dev/usb-ffs/adb.
allow vendor_init device:dir mounton;

# Create and remove symlinks in /.
allow vendor_init rootfs:lnk_file { create unlink };

# Create cgroups mount points in tmpfs and mount cgroups on them.
allow vendor_init cgroup:dir create_dir_perms;

# /config
allow vendor_init configfs:dir mounton;
allow vendor_init configfs:dir create_dir_perms;
allow vendor_init configfs:{ file lnk_file } create_file_perms;

# Create directories under /dev/cpuctl after chowning it to system.
allow vendor_init self:global_capability_class_set dac_override;

# mkdir, symlink, write, rm/rmdir, chown/chmod, restorecon/restorecon_recursive from init.rc files.
# chown/chmod require open+read+setattr required for open()+fchown/fchmod().
# system/core/init.rc requires at least cache_file and data_file_type.
# init.<board>.rc files often include device-specific types, so
# we just allow all file types except /system files here.
allow vendor_init self:global_capability_class_set { chown fowner fsetid };

# mkdir with FBE requires reading /data/unencrypted/{ref,mode}.
allow vendor_init unencrypted_data_file:dir search;
allow vendor_init unencrypted_data_file:file r_file_perms;

allow vendor_init {
  file_type
  -core_data_file_type
  -exec_type
  -system_file
  -unlabeled
  -vendor_file_type
  -vold_metadata_file
}:dir { create search getattr open read setattr ioctl write add_name remove_name rmdir relabelfrom };

allow vendor_init {
  file_type
  -core_data_file_type
  -exec_type
  -runtime_event_log_tags_file
  -system_file
  -unlabeled
  -vendor_file_type
  -vold_metadata_file
}:file { create getattr open read write setattr relabelfrom unlink };

allow vendor_init {
  file_type
  -core_data_file_type
  -exec_type
  -system_file
  -unlabeled
  -vendor_file_type
  -vold_metadata_file
}:{ sock_file fifo_file } { create getattr open read setattr relabelfrom unlink };

allow vendor_init {
  file_type
  -core_data_file_type
  -exec_type
  -system_file
  -unlabeled
  -vendor_file_type
  -vold_metadata_file
}:lnk_file { create getattr setattr relabelfrom unlink };

allow vendor_init {
  file_type
  -core_data_file_type
  -exec_type
  -system_file
  -vendor_file_type
  -vold_metadata_file
}:dir_file_class_set relabelto;

allow vendor_init dev_type:dir create_dir_perms;
allow vendor_init dev_type:lnk_file create;

# Disable tracing by writing to /sys/kernel/debug/tracing/tracing_on
allow vendor_init debugfs_tracing:file w_file_perms;

# chown/chmod on pseudo files.
allow vendor_init {
  fs_type
  -contextmount_type
  -sdcard_type
  -rootfs
  -proc_uid_time_in_state
  -proc_uid_concurrent_active_time
  -proc_uid_concurrent_policy_time
}:file { open read setattr };

allow vendor_init {
  fs_type
  -contextmount_type
  -sdcard_type
  -rootfs
  -proc_uid_time_in_state
  -proc_uid_concurrent_active_time
  -proc_uid_concurrent_policy_time
}:dir  { open read setattr search };

# chown/chmod on devices, e.g. /dev/ttyHS0
allow vendor_init {
  dev_type
  -kmem_device
  -port_device
  -lowpan_device
  -hw_random_device
}:chr_file setattr;

allow vendor_init dev_type:blk_file getattr;

# Write to /proc/sys/net/ping_group_range and other /proc/sys/net files.
r_dir_file(vendor_init, proc_net)
allow vendor_init proc_net:file w_file_perms;
allow vendor_init self:global_capability_class_set net_admin;

# Write to /proc/sys/vm/page-cluster
allow vendor_init proc_page_cluster:file w_file_perms;

# Write to sysfs nodes.
allow vendor_init sysfs_type:dir r_dir_perms;
allow vendor_init sysfs_type:lnk_file read;
allow vendor_init { sysfs_type -sysfs_usermodehelper }:file rw_file_perms;

# setfscreatecon() for labeling directories and socket files.
allow vendor_init self:process { setfscreate };

r_dir_file(vendor_init, vendor_file_type)

# Vendor init can read properties
allow vendor_init serialno_prop:file { getattr open read };

# Vendor init can perform operations on trusted and security Extended Attributes
allow vendor_init self:global_capability_class_set sys_admin;

# Raw writes to misc block device
allow vendor_init misc_block_device:blk_file w_file_perms;

not_compatible_property(`
    set_prop(vendor_init, {
      property_type
      -restorecon_prop
      -netd_stable_secret_prop
      -firstboot_prop
      -pm_prop
      -system_boot_reason_prop
      -bootloader_boot_reason_prop
      -last_boot_reason_prop
    })
')

set_prop(vendor_init, bluetooth_a2dp_offload_prop)
set_prop(vendor_init, debug_prop)
set_prop(vendor_init, exported_bluetooth_prop)
set_prop(vendor_init, exported_config_prop)
set_prop(vendor_init, exported_dalvik_prop)
set_prop(vendor_init, exported_default_prop)
set_prop(vendor_init, exported_ffs_prop)
set_prop(vendor_init, exported_overlay_prop)
set_prop(vendor_init, exported_pm_prop)
set_prop(vendor_init, exported_radio_prop)
set_prop(vendor_init, exported_system_radio_prop)
set_prop(vendor_init, exported_wifi_prop)
set_prop(vendor_init, exported2_config_prop)
set_prop(vendor_init, exported2_system_prop)
set_prop(vendor_init, exported2_vold_prop)
set_prop(vendor_init, exported3_default_prop)
set_prop(vendor_init, exported3_radio_prop)
set_prop(vendor_init, logd_prop)
set_prop(vendor_init, log_tag_prop)
set_prop(vendor_init, log_prop)
set_prop(vendor_init, serialno_prop)
set_prop(vendor_init, vendor_default_prop)
set_prop(vendor_init, vendor_security_patch_level_prop)
set_prop(vendor_init, wifi_log_prop)

get_prop(vendor_init, exported2_radio_prop)
get_prop(vendor_init, exported3_system_prop)