platform_system_sepolicy/private/shared_relro.te

typeattribute shared_relro coredomain;

# The shared relro process is a Java program forked from the zygote, so it
# inherits from app to get basic permissions it needs to run.
app_domain(shared_relro)

allow shared_relro shared_relro_file:dir rw_dir_perms;
allow shared_relro shared_relro_file:file create_file_perms;

allow shared_relro activity_service:service_manager find;
allow shared_relro webviewupdate_service:service_manager find;
allow shared_relro package_service:service_manager find;

# StrictMode may attempt to find this service, failure is harmless.
dontaudit shared_relro network_management_service:service_manager find;
Vendor domains must not use Binder On PRODUCT_FULL_TREBLE devices, non-vendor domains (except vendor apps) are not permitted to use Binder. This commit thus: * groups non-vendor domains using the new "coredomain" attribute, * adds neverallow rules restricting Binder use to coredomain and appdomain only, and * temporarily exempts the domains which are currently violating this rule from this restriction. These domains are grouped using the new "binder_in_vendor_violators" attribute. The attribute is needed because the types corresponding to violators are not exposed to the public policy where the neverallow rules are. Test: mmm system/sepolicy Test: Device boots, no new denials Test: In Chrome, navigate to ip6.me, play a YouTube video Test: YouTube: play a video Test: Netflix: play a movie Test: Google Camera: take a photo, take an HDR+ photo, record video with sound, record slow motion video with sound. Confirm videos play back fine and with sound. Bug: 35870313 Change-Id: I0cd1a80b60bcbde358ce0f7a47b90f4435a45c95 2017-03-23 22:27:32 +01:00			`typeattribute shared_relro coredomain;`

Restore app_domain macro and move to private use. app_domain was split up in commit: 2e00e6373faa6271d7839d33c5b9e69d998ff020 to enable compilation by hiding type_transition rules from public policy. These rules need to be hidden from public policy because they describe how objects are labeled, of which non-platform should be unaware. Instead of cutting apart the app_domain macro, which non-platform policy may rely on for implementing new app types, move all app_domain calls to private policy. (cherry-pick of commit: 76035ea01971156895cf0d8efc1876bfa2025bd6) Bug: 33428593 Test: bullhead and sailfish both boot. sediff shows no policy change. Change-Id: I4beead8ccc9b6e13c6348da98bb575756f539665 2016-12-08 20:23:34 +01:00			`# The shared relro process is a Java program forked from the zygote, so it`
			`# inherits from app to get basic permissions it needs to run.`
			`app_domain(shared_relro)`
Make shared_relro policy private. Nothing should be depending on the details. I haven't removed public/shared_relro.te entirely - there's a reference to shared_relro in public/app.te, and at least one reference to the domain outside of system policy. Fix: 175867372 Test: Presubmits Change-Id: I5fd4090f4b445520c4fa767c1835a5bb4e9cb146 2020-12-22 16:43:23 +01:00
			`allow shared_relro shared_relro_file:dir rw_dir_perms;`
			`allow shared_relro shared_relro_file:file create_file_perms;`

			`allow shared_relro activity_service:service_manager find;`
			`allow shared_relro webviewupdate_service:service_manager find;`
			`allow shared_relro package_service:service_manager find;`

			`# StrictMode may attempt to find this service, failure is harmless.`
			`dontaudit shared_relro network_management_service:service_manager find;`