File waydroid.te of Package waydroid

policy_module(waydroid, 1.1)

require {
    type unconfined_t;
    type unconfined_service_t;
    type binder_device_t;
    type binderfs_t;
    type abrt_t;
    type bin_t;
    type var_lib_t;
    type proc_t;
    type mount_exec_t;
    type mount_t;
    type uhid_device_t;
    type tun_tap_device_t;
    type tmp_t;
    type http_cache_port_t;
    type rpm_script_t;
    role rpm_script_roles;
    type iptables_t;
    type systemd_systemctl_exec_t;
    type wayland_t;
    type xdg_runtime_t;
    type pulseaudio_home_t;
    type dri_device_t;
    type sysfs_t;
    type udev_t;
    type dnsmasq_t;
}

# Define domain
type waydroid_t;
type waydroid_exec_t;
init_daemon_domain(waydroid_t, waydroid_exec_t)

# Execute python
allow waydroid_t bin_t:file { execute getattr map open read };
allow waydroid_t proc_t:file read_file_perms;
gnome_search_gconf_data_dir(waydroid_t)
auth_read_passwd(waydroid_t)
miscfiles_read_generic_certs(waydroid_t)

# Manage waydroid fifos
type waydroid_var_run_t;
files_pid_file(waydroid_var_run_t)
files_pid_filetrans(waydroid_t, waydroid_var_run_t, fifo_file, "waydroid-remote_init_output")
manage_files_pattern(waydroid_t, waydroid_var_run_t, waydroid_var_run_t)
manage_fifo_files_pattern(waydroid_t, waydroid_var_run_t, waydroid_var_run_t)
manage_dirs_pattern(waydroid_t, waydroid_var_run_t, waydroid_var_run_t)

# Manage /var/lib/waydroid
type waydroid_data_t;
files_type(waydroid_data_t)
filetrans_pattern(waydroid_t, var_lib_t, waydroid_data_t, dir, "waydroid")
filetrans_pattern(unconfined_t, var_lib_t, waydroid_data_t, dir, "waydroid")
manage_dirs_pattern(waydroid_t, waydroid_data_t, waydroid_data_t)
manage_files_pattern(waydroid_t, waydroid_data_t, waydroid_data_t)
manage_lnk_files_pattern(waydroid_t, waydroid_data_t, waydroid_data_t)

# Execute lxc commands, domain transition
container_runtime_domtrans(waydroid_t)

# Execute misc utils
exec_files_pattern(waydroid_t, bin_t, bin_t)
domtrans_pattern(waydroid_t, mount_exec_t, mount_t)
corecmd_exec_shell(waydroid_t)
modutils_domtrans_kmod(waydroid_t)

# Waydroid init from the container daemon
dev_read_sysfs(waydroid_t)
storage_getattr_fuse_dev(waydroid_t)
getattr_chr_files_pattern(waydroid_t, device_t, { uhid_device_t tun_tap_device_t })
fs_search_cgroup_dirs(waydroid_t)
allow waydroid_t tmp_t:dir { getattr search open read lock ioctl };
allow waydroid_t self:process setfscreate;
allow waydroid_t self:tcp_socket create_socket_perms;
allow waydroid_t http_cache_port_t:tcp_socket name_connect;
sysnet_dns_name_resolve(waydroid_t)
corenet_sendrecv_http_client_packets(waydroid_t)
corenet_tcp_connect_http_port(waydroid_t)
# No need to run systemctl. It is only used to determine apparmor status
dontaudit waydroid_t systemd_systemctl_exec_t:file getattr;

# waydroid-net.sh
type waydroid_net_exec_t;
files_type(waydroid_net_exec_t)
domtrans_pattern(waydroid_t, waydroid_net_exec_t, container_runtime_t)
domain_entry_file(container_runtime_t, waydroid_net_exec_t)
manage_fifo_files_pattern(iptables_t, waydroid_t, waydroid_t)

# Read android rootfs
type waydroid_rootfs_t;
files_type(waydroid_rootfs_t)
read_files_pattern(waydroid_t, waydroid_rootfs_t, waydroid_rootfs_t)

# Read android data
allow waydroid_t self:capability { dac_read_search };

# Upgrade from app
allow waydroid_t self:capability dac_override;
read_files_pattern(waydroid_t, data_home_t, data_home_t)
delete_files_pattern(waydroid_t, data_home_t, data_home_t)
list_dirs_pattern(waydroid_t, waydroid_data_t, waydroid_rootfs_t)
delete_files_pattern(waydroid_t, { waydroid_data_t waydroid_rootfs_t }, { waydroid_data_t waydroid_rootfs_t })
delete_dirs_pattern(waydroid_t, { waydroid_data_t waydroid_rootfs_t }, { waydroid_data_t waydroid_rootfs_t })
allow waydroid_t self:unix_dgram_socket { create setopt getopt };

# Use binder devices
allow waydroid_t binderfs_t:dir search_dir_perms;
allow waydroid_t binder_device_t:chr_file { getattr setattr ioctl map open read write };
allow waydroid_t container_runtime_t:binder { call transfer };
allow container_runtime_t waydroid_t:binder call;
allow container_runtime_t self:binder { call set_context_mgr transfer };
allow container_runtime_t self:capability2 mac_admin;
allow container_runtime_t unconfined_service_t:binder call;
allow container_runtime_t unconfined_t:binder { call transfer };
allow unconfined_service_t container_runtime_t:binder { call transfer };
allow unconfined_t container_runtime_t:binder { call transfer };

# Graphics
dev_search_dri(waydroid_t)
dev_setattr_dri(waydroid_t)
dev_getattr_dri(waydroid_t)
allow waydroid_t dri_device_t:chr_file { ioctl map open read write };
dev_setattr_generic_dirs(waydroid_t)
dev_getattr_dri_dev(waydroid_t)
dev_setattr_dri_dev(waydroid_t)
dev_getattr_framebuffer_dev(waydroid_t)
dev_setattr_framebuffer_dev(waydroid_t)
allow waydroid_t self:capability fsetid;

# Video
dev_getattr_video_dev(waydroid_t)
dev_setattr_video_dev(waydroid_t)

# Search shared sockets
userdom_search_user_tmp_dirs(waydroid_t)
allow waydroid_t user_tmp_t:sock_file getattr;

# RPM upgrade scriptlets
container_runtime_run(rpm_script_t, rpm_script_roles)
filetrans_pattern(rpm_script_t, var_lib_t, waydroid_data_t, dir, "waydroid")

# For when we crash
allow abrt_t binder_device_t:chr_file { open read };

# Attach to the container
allow container_runtime_t self:process2 { nnp_transition };
exec_files_pattern(container_runtime_t, waydroid_rootfs_t, waydroid_rootfs_t)
domain_entry_file(container_runtime_t, waydroid_rootfs_t)

# DBus
type waydroid_tmpfs_t;
files_tmp_file(waydroid_tmpfs_t)
manage_files_pattern(waydroid_t, waydroid_tmpfs_t, waydroid_tmpfs_t)
can_exec(waydroid_t, waydroid_tmpfs_t)
fs_tmpfs_filetrans(waydroid_t, waydroid_tmpfs_t, file)
dbus_system_bus_client(waydroid_t)
dbus_connect_system_bus(waydroid_t)
policykit_dbus_chat(waydroid_t)
unconfined_dbus_chat(waydroid_t)
unconfined_signal(waydroid_t)
allow waydroid_t self:capability kill;

# Wayland and XDG integration
allow waydroid_t wayland_t:unix_stream_socket { connectto read write };
allow waydroid_t xdg_runtime_t:dir search;
allow waydroid_t xdg_runtime_t:file read;

# PulseAudio support
allow waydroid_t pulseaudio_home_t:dir search;
allow waydroid_t pulseaudio_home_t:file { getattr open read };
allow waydroid_t pulseaudio_home_t:unix_stream_socket { connectto read write };

# USB access
allow waydroid_t self:capability sys_rawio;
allow waydroid_t udev_t:dir search;
allow waydroid_t sysfs_t:file read;

# DNSMasq integration
allow dnsmasq_t waydroid_t:unix_dgram_socket sendto;
allow waydroid_t dnsmasq_t:unix_dgram_socket { connect create getattr setopt };

# SELinux sandboxing
domain_use_interactive_fds(waydroid_t)
term_use_all_terms(waydroid_t)

 # Snap
 optional_policy(`
     require {
         type snappy_var_lib_t;
     }
     dontaudit waydroid_t snappy_var_lib_t:dir search_dir_perms;
 ')

# OpenSUSE specific policies
optional_policy(`
    require {
        type systemd_logind_t;
    }
    allow waydroid_t systemd_logind_t:unix_stream_socket connectto;
    allow waydroid_t systemd_logind_t:dbus send_msg;
')