bazzite/spec_files/waydroid/waydroid.te

policy_module(waydroid, 1.0)

require {
	type unconfined_t;
	type unconfined_service_t;
	type binder_device_t;
	type binderfs_t;
	type abrt_t;
	type bin_t;
	type var_lib_t;
	type proc_t;
	type mount_exec_t;
	type mount_t;
	type uhid_device_t;
	type tun_tap_device_t;
	type tmp_t;
	type http_cache_port_t;
	type rpm_script_t;
	role rpm_script_roles;
	type iptables_t;
	type systemd_systemctl_exec_t;
}

# Define domain
type waydroid_t;
type waydroid_exec_t;
init_daemon_domain(waydroid_t, waydroid_exec_t)

# Execute python
allow waydroid_t bin_t:file { map execute };
allow waydroid_t proc_t:file read_file_perms;
gnome_search_gconf_data_dir(waydroid_t)
auth_read_passwd(waydroid_t)
miscfiles_read_generic_certs(waydroid_t)

# Manage waydroid fifos
type waydroid_var_run_t;
files_pid_file(waydroid_var_run_t)
files_pid_filetrans(waydroid_t, waydroid_var_run_t, fifo_file, "waydroid-remote_init_output")
manage_files_pattern(waydroid_t, waydroid_var_run_t, waydroid_var_run_t)
manage_fifo_files_pattern(waydroid_t, waydroid_var_run_t, waydroid_var_run_t)
manage_dirs_pattern(waydroid_t, waydroid_var_run_t, waydroid_var_run_t)

# Manage /var/lib/waydroid
type waydroid_data_t;
files_type(waydroid_data_t)
filetrans_pattern(waydroid_t, var_lib_t, waydroid_data_t, dir, "waydroid")
filetrans_pattern(unconfined_t, var_lib_t, waydroid_data_t, dir, "waydroid")
manage_dirs_pattern(waydroid_t, waydroid_data_t, waydroid_data_t)
manage_files_pattern(waydroid_t, waydroid_data_t, waydroid_data_t)
manage_lnk_files_pattern(waydroid_t, waydroid_data_t, waydroid_data_t)

# Execute lxc commands, domain transition
container_runtime_domtrans(waydroid_t)

# Execute misc utils
exec_files_pattern(waydroid_t, bin_t, bin_t)
domtrans_pattern(waydroid_t, mount_exec_t, mount_t)
corecmd_exec_shell(waydroid_t)
modutils_domtrans_kmod(waydroid_t)

# Waydroid init from the container daemon
dev_read_sysfs(waydroid_t)
storage_getattr_fuse_dev(waydroid_t)
getattr_chr_files_pattern(waydroid_t, device_t, { uhid_device_t tun_tap_device_t })
fs_search_cgroup_dirs(waydroid_t)
allow waydroid_t tmp_t:dir read;
allow waydroid_t self:process setfscreate;
allow waydroid_t self:tcp_socket create_socket_perms;
allow waydroid_t http_cache_port_t:tcp_socket name_connect;
sysnet_dns_name_resolve(waydroid_t)
corenet_sendrecv_http_client_packets(waydroid_t)
corenet_tcp_connect_http_port(waydroid_t)
# No need to run systemctl. It is only used to determine apparmor status
dontaudit waydroid_t systemd_systemctl_exec_t:file getattr;

# waydroid-net.sh
type waydroid_net_exec_t;
files_type(waydroid_net_exec_t)
domtrans_pattern(waydroid_t, waydroid_net_exec_t, container_runtime_t)
domain_entry_file(container_runtime_t, waydroid_net_exec_t)
manage_fifo_files_pattern(iptables_t, waydroid_t, waydroid_t)

# Read android rootfs
type waydroid_rootfs_t;
files_type(waydroid_rootfs_t)
read_files_pattern(waydroid_t, waydroid_rootfs_t, waydroid_rootfs_t)

# Read android data
allow waydroid_t self:capability { dac_read_search };

# Upgrade from app
allow waydroid_t self:capability dac_override;
read_files_pattern(waydroid_t, data_home_t, data_home_t)
delete_files_pattern(waydroid_t, data_home_t, data_home_t)
list_dirs_pattern(waydroid_t, waydroid_data_t, waydroid_rootfs_t)
delete_files_pattern(waydroid_t, { waydroid_data_t waydroid_rootfs_t }, { waydroid_data_t waydroid_rootfs_t })
delete_dirs_pattern(waydroid_t, { waydroid_data_t waydroid_rootfs_t }, { waydroid_data_t waydroid_rootfs_t })
allow waydroid_t self:unix_dgram_socket { create setopt getopt };

# Use binder devices
allow waydroid_t binderfs_t:dir search_dir_perms;
allow waydroid_t binder_device_t:chr_file { getattr setattr ioctl map open read write };
allow waydroid_t container_runtime_t:binder { call transfer };
allow container_runtime_t waydroid_t:binder call;
allow container_runtime_t self:binder { call set_context_mgr transfer };
allow container_runtime_t self:capability2 mac_admin;
allow container_runtime_t unconfined_service_t:binder call;
allow container_runtime_t unconfined_t:binder { call transfer };
allow unconfined_service_t container_runtime_t:binder { call transfer };
allow unconfined_t container_runtime_t:binder { call transfer };

# Graphics
dev_setattr_generic_dirs(waydroid_t)
dev_getattr_dri_dev(waydroid_t)
dev_setattr_dri_dev(waydroid_t)
dev_getattr_framebuffer_dev(waydroid_t)
dev_setattr_framebuffer_dev(waydroid_t)
allow waydroid_t self:capability fsetid;

# Video
dev_getattr_video_dev(waydroid_t)
dev_setattr_video_dev(waydroid_t)

# Search shared sockets
userdom_search_user_tmp_dirs(waydroid_t)
allow waydroid_t user_tmp_t:sock_file getattr;

# RPM upgrade scriptlets
container_runtime_run(rpm_script_t, rpm_script_roles)
filetrans_pattern(rpm_script_t, var_lib_t, waydroid_data_t, dir, "waydroid")

# For when we crash
allow abrt_t binder_device_t:chr_file { open read };

# Attach to the container
allow container_runtime_t self:process2 { nnp_transition };
exec_files_pattern(container_runtime_t, waydroid_rootfs_t, waydroid_rootfs_t)
domain_entry_file(container_runtime_t, waydroid_rootfs_t)

# DBus
type waydroid_tmpfs_t;
files_tmp_file(waydroid_tmpfs_t)
manage_files_pattern(waydroid_t, waydroid_tmpfs_t, waydroid_tmpfs_t)
can_exec(waydroid_t, waydroid_tmpfs_t)
fs_tmpfs_filetrans(waydroid_t, waydroid_tmpfs_t, file)
dbus_system_bus_client(waydroid_t)
dbus_connect_system_bus(waydroid_t)
policykit_dbus_chat(waydroid_t)
unconfined_dbus_chat(waydroid_t)
unconfined_signal(waydroid_t)
allow waydroid_t self:capability kill;

# Snap
optional_policy(`
	require {
		type snappy_var_lib_t;
	}
	dontaudit waydroid_t snappy_var_lib_t:dir search_dir_perms;
')