From 369cf8cde5f69e6d6b752e250edfba80289b9c83 Mon Sep 17 00:00:00 2001 From: Nick Kralevich Date: Fri, 25 Mar 2016 12:22:32 -0700 Subject: neverallow /data/anr access for isolated/untrusted apps Add a neverallow rule (compile time assertion + CTS test) that isolated_apps and untrusted_apps can't do anything else but append to /data/anr/traces.txt. In particular, assert that they can't read from the file, or overwrite other data which may already be in the file. Bug: 18340553 Bug: 27853304 Change-Id: I249fe2a46401b660efaa3f1102924a448ed750d5 --- isolated_app.te | 6 ++++++ untrusted_app.te | 4 ++++ 2 files changed, 10 insertions(+) diff --git a/isolated_app.te b/isolated_app.te index 862592e..34fe41c 100644 --- a/isolated_app.te +++ b/isolated_app.te @@ -39,6 +39,12 @@ neverallow isolated_app property_type:property_service set; # Isolated apps should not directly open app data files themselves. neverallow isolated_app app_data_file:file open; +# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553) +# TODO: are there situations where isolated_apps write to this file? +# TODO: should we tighten these restrictions further? +neverallow isolated_app anr_data_file:file ~{ open append }; +neverallow isolated_app anr_data_file:dir ~search; + # b/17487348 # Isolated apps can only access two services, # activity_service and display_service diff --git a/untrusted_app.te b/untrusted_app.te index b05627a..47ccb55 100644 --- a/untrusted_app.te +++ b/untrusted_app.te @@ -172,3 +172,7 @@ neverallow untrusted_app { # Do not allow untrusted_app to directly open tun_device neverallow untrusted_app tun_device:chr_file open; + +# Only allow appending to /data/anr/traces.txt (b/27853304, b/18340553) +neverallow untrusted_app anr_data_file:file ~{ open append }; +neverallow untrusted_app anr_data_file:dir ~search; -- cgit v1.2.3