2013-07-13 01:33:29 +02:00
|
|
|
###
|
|
|
|
|
### Services with isolatedProcess=true in their manifest.
|
|
|
|
|
###
|
|
|
|
|
### This file defines the rules for isolated apps. An "isolated
|
|
|
|
|
### app" is an APP with UID between AID_ISOLATED_START (99000)
|
|
|
|
|
### and AID_ISOLATED_END (99999).
|
|
|
|
|
###
|
|
|
|
|
### isolated_app includes all the appdomain rules, plus the
|
|
|
|
|
### additional following rules:
|
|
|
|
|
###
|
|
|
|
|
|
|
|
|
|
type isolated_app, domain;
|
|
|
|
|
app_domain(isolated_app)
|
untrusted_app.te / isolated_app.te / app.te first pass
This is my first attempt at creating an enforcing SELinux domain for
apps, untrusted_apps, and isolated_apps. Much of these rules are based on the
contents of app.te as of commit 11153ef34928ab9d13658606695cba192aa03e21
with extensive modifications, some of which are included below.
* Allow communication with netd/dnsproxyd, to allow netd to handle
dns requests
* Allow binder communications with the DNS server
* Allow binder communications with surfaceflinger
* Allow an app to bind to tcp/udp ports
* Allow all domains to read files from the root partition, assuming
the DAC allows access.
In addition, I added a bunch of "neverallow" rules, to assert that
certain capabilities are never added.
This change has a high probability of breaking someone, somewhere.
If it does, then I'm happy to fix the breakage, rollback this change,
or put untrusted_app into permissive mode.
Change-Id: I83f220135d20ab4f70fbd7be9401b5b1def1fe35
2013-07-13 03:45:56 +02:00
|
|
|
|
|
|
|
|
# Appdomain interaction with isolated apps
|
|
|
|
|
r_dir_file(appdomain, isolated_app)
|
|
|
|
|
|
|
|
|
|
# Already connected, unnamed sockets being passed over some other IPC
|
|
|
|
|
# hence no sock_file or connectto permission. This appears to be how
|
|
|
|
|
# Chrome works, may need to be updated as more apps using isolated services
|
|
|
|
|
# are examined.
|
|
|
|
|
allow isolated_app appdomain:unix_stream_socket { read write };
|
