diff options
| author | Nick Kralevich <nnk@google.com> | 2016-03-25 12:22:32 -0700 |
|---|---|---|
| committer | Nick Kralevich <nnk@google.com> | 2016-03-25 12:22:32 -0700 |
| commit | 369cf8cde5f69e6d6b752e250edfba80289b9c83 (patch) | |
| tree | 0f91bd625cbaa65531eeb88869dbb7e1d144c416 | |
| parent | f2d07904f7754a066c7e15a072cf57126ff348d3 (diff) | |
| download | sepolicy-369cf8cde5f69e6d6b752e250edfba80289b9c83.tar.gz | |
neverallow /data/anr access for isolated/untrusted apps
Add a neverallow rule (compile time assertion + CTS test) that
isolated_apps and untrusted_apps can't do anything else but append
to /data/anr/traces.txt. In particular, assert that they can't
read from the file, or overwrite other data which may already be
in the file.
Bug: 18340553
Bug: 27853304
Change-Id: I249fe2a46401b660efaa3f1102924a448ed750d5
| -rw-r--r-- | isolated_app.te | 6 | ||||
| -rw-r--r-- | untrusted_app.te | 4 |
2 files changed, 10 insertions, 0 deletions
diff --git a/isolated_app.te b/isolated_app.te index 862592e..34fe41c 100644 --- a/isolated_app.te +++ b/isolated_app.te @@ -39,6 +39,12 @@ neverallow isolated_app property_type:property_service set; # Isolated apps should not directly open app data files themselves. neverallow isolated_app app_data_file:file open; +# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553) +# TODO: are there situations where isolated_apps write to this file? +# TODO: should we tighten these restrictions further? +neverallow isolated_app anr_data_file:file ~{ open append }; +neverallow isolated_app anr_data_file:dir ~search; + # b/17487348 # Isolated apps can only access two services, # activity_service and display_service diff --git a/untrusted_app.te b/untrusted_app.te index b05627a..47ccb55 100644 --- a/untrusted_app.te +++ b/untrusted_app.te @@ -172,3 +172,7 @@ neverallow untrusted_app { # Do not allow untrusted_app to directly open tun_device neverallow untrusted_app tun_device:chr_file open; + +# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553) +neverallow untrusted_app anr_data_file:file ~{ open append }; +neverallow untrusted_app anr_data_file:dir ~search; |