platform_system_sepolicy/isolated_app.te

###
### Services with isolatedProcess=true in their manifest.
###
### This file defines the rules for isolated apps. An "isolated
### app" is an APP with UID between AID_ISOLATED_START (99000)
### and AID_ISOLATED_END (99999).
###
### isolated_app includes all the appdomain rules, plus the
### additional following rules:
###

type isolated_app, domain;
app_domain(isolated_app)

# Access already open app data files received over Binder or local socket IPC.
allow isolated_app app_data_file:file { read write getattr };

allow isolated_app activity_service:service_manager find;
allow isolated_app display_service:service_manager find;

#####
##### Neverallow
#####

# Isolated apps should not directly open app data files themselves.
neverallow isolated_app app_data_file:file open;

# b/17487348
# Isolated apps can only access two services,
# activity_service and display_service
neverallow isolated_app {
    service_manager_type
    -activity_service
    -display_service
}:service_manager find;
Move *_app into their own file app.te covers a lot of different apps types (platform_app, media_app, shared_app, release_app, isolated_app, and untrusted_app), all of which are going to have slightly different security policies. Separate the different domains from app.te. Over time, these files are likely to grow substantially, and mixing different domain types is a recipe for confusion and mistakes. No functional change. Change-Id: Ida4e77fadb510f5993eb2d32f2f7649227edff4f 2013-07-13 01:33:29 +02:00			`###`
			`### Services with isolatedProcess=true in their manifest.`
			`###`
			`### This file defines the rules for isolated apps. An "isolated`
			`### app" is an APP with UID between AID_ISOLATED_START (99000)`
			`### and AID_ISOLATED_END (99999).`
			`###`
			`### isolated_app includes all the appdomain rules, plus the`
			`### additional following rules:`
			`###`

			`type isolated_app, domain;`
			`app_domain(isolated_app)`
isolated_app: allow app_data_file execute Chrome renderer processes dlopen() a shared library from gmscore. Open and read on app data file is already allowed, but execute isn't, so the dlopen() fails. This is a regression from K, where the dlopen succeeded. Longer term, there's questions about whether this is appropriate behavior for an isolated app. For now, allow the behavior. See the discussion in b/15902433 for details. Addresses the following denial: I/auditd ( 5087): type=1400 audit(0.0:76): avc: denied { execute } for comm="CrRendererMain" path="/data/data/com.google.android.gms/files/libAppDataSearchExt_armeabi_v7a.so" dev="mmcblk0p28" ino=83196 scontext=u:r:isolated_app:s0 tcontext=u:object_r:app_data_file:s0 tclass=file Bug: 15902433 Change-Id: Ie98605d43753be8c31a6fe510ef2dde0bdb52678 2014-06-28 00:19:04 +02:00
Do not allow isolated_app to directly open app data files. Only allow it to read/write/stat already open app data files received via Binder or local socket IPC. Change-Id: Ie66f240e109410a17aa93d9d5dea4c2b87d47009 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> 2014-11-21 18:28:42 +01:00			`# Access already open app data files received over Binder or local socket IPC.`
			`allow isolated_app app_data_file:file { read write getattr };`

Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef 2014-12-17 00:45:26 +01:00			`allow isolated_app activity_service:service_manager find;`
			`allow isolated_app display_service:service_manager find;`

update isolated_app service_manager rules isolated apps should only be able to access 2 services. Remove access permissions for services inappropriately added, and add a neverallow rule to prevent regressions. Change-Id: I2783465c4a22507849b2a64894fb76690a27bc01 2015-03-05 21:10:30 +01:00			`#####`
			`##### Neverallow`
			`#####`

			`# Isolated apps should not directly open app data files themselves.`
			`neverallow isolated_app app_data_file:file open;`

			`# b/17487348`
			`# Isolated apps can only access two services,`
			`# activity_service and display_service`
			`neverallow isolated_app {`
			`service_manager_type`
Make system_server_service an attribute. Temporarily give every system_server_service its own domain in preparation for splitting it and identifying special services or classes of services. Change-Id: I81ffbdbf5eea05e0146fd7fd245f01639b1ae0ef 2014-12-17 00:45:26 +01:00			`-activity_service`
			`-display_service`
			`}:service_manager find;`