platform_system_sepolicy/public/webview_zygote.te

# webview_zygote is an auxiliary zygote process that is used to spawn
# isolated_app processes for rendering untrusted web content.

type webview_zygote, domain;
type webview_zygote_exec, exec_type, file_type;
Add the "webview_zygote" domain. The webview_zygote is a new unprivileged zygote and has its own sockets for listening to fork requests. However the webview_zygote does not run as root (though it does require certain capabilities) and only allows dyntransition to the isolated_app domain. Test: m Test: angler boots Bug: 21643067 Change-Id: I89a72ffe6dcb983c4a44048518efd7efb7ed8e83 2016-09-21 23:01:50 +02:00			`# webview_zygote is an auxiliary zygote process that is used to spawn`
			`# isolated_app processes for rendering untrusted web content.`

Move webview_zygote policy to private This leaves only the existence of webview_zygote domain and its executable's webview_zygote_exec file label as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: Device boots, with Multiproces WebView developer setting enabled, apps with WebView work fine. No new denials. Bug: 31364497 Change-Id: I179476c43a50863ee3b327fc5155847d992a040d 2017-01-26 22:45:31 +01:00			`type webview_zygote, domain;`
Add the "webview_zygote" domain. The webview_zygote is a new unprivileged zygote and has its own sockets for listening to fork requests. However the webview_zygote does not run as root (though it does require certain capabilities) and only allows dyntransition to the isolated_app domain. Test: m Test: angler boots Bug: 21643067 Change-Id: I89a72ffe6dcb983c4a44048518efd7efb7ed8e83 2016-09-21 23:01:50 +02:00			`type webview_zygote_exec, exec_type, file_type;`