2013-09-11 17:37:46 +02:00
|
|
|
#
|
|
|
|
|
# Apps that run with the system UID, e.g. com.android.system.ui,
|
|
|
|
|
# com.android.settings. These are not as privileged as the system
|
|
|
|
|
# server.
|
|
|
|
|
#
|
2015-11-03 18:54:39 +01:00
|
|
|
type system_app, domain, domain_deprecated;
|
2016-12-08 20:23:34 +01:00
|
|
|
|
2014-02-24 16:48:03 +01:00
|
|
|
net_domain(system_app)
|
2014-01-11 08:05:25 +01:00
|
|
|
binder_service(system_app)
|
2013-10-23 19:12:55 +02:00
|
|
|
|
2014-05-07 19:10:02 +02:00
|
|
|
# Read and write /data/data subdirectory.
|
|
|
|
|
allow system_app system_app_data_file:dir create_dir_perms;
|
2015-01-13 14:56:54 +01:00
|
|
|
allow system_app system_app_data_file:{ file lnk_file } create_file_perms;
|
2013-10-23 19:12:55 +02:00
|
|
|
|
2016-01-20 23:36:45 +01:00
|
|
|
# Read and write to /data/misc/user.
|
2014-10-13 13:10:08 +02:00
|
|
|
allow system_app misc_user_data_file:dir create_dir_perms;
|
|
|
|
|
allow system_app misc_user_data_file:file create_file_perms;
|
2014-05-27 20:23:32 +02:00
|
|
|
|
2015-07-31 02:51:04 +02:00
|
|
|
# Access to vold-mounted storage for measuring free space
|
|
|
|
|
allow system_app mnt_media_rw_file:dir search;
|
|
|
|
|
|
2013-10-23 19:12:55 +02:00
|
|
|
# Read wallpaper file.
|
|
|
|
|
allow system_app wallpaper_file:file r_file_perms;
|
|
|
|
|
|
2016-02-25 16:37:06 +01:00
|
|
|
# Read icon file.
|
|
|
|
|
allow system_app icon_file:file r_file_perms;
|
|
|
|
|
|
2013-11-01 18:45:03 +01:00
|
|
|
# Write to properties
|
2016-02-09 00:39:00 +01:00
|
|
|
set_prop(system_app, bluetooth_prop)
|
2015-05-05 03:22:45 +02:00
|
|
|
set_prop(system_app, debug_prop)
|
|
|
|
|
set_prop(system_app, system_prop)
|
|
|
|
|
set_prop(system_app, logd_prop)
|
|
|
|
|
set_prop(system_app, net_radio_prop)
|
|
|
|
|
set_prop(system_app, system_radio_prop)
|
2016-06-01 20:14:14 +02:00
|
|
|
set_prop(system_app, log_tag_prop)
|
2016-06-06 21:18:46 +02:00
|
|
|
userdebug_or_eng(`set_prop(system_app, logpersistd_logging_prop)')
|
2014-06-19 16:27:02 +02:00
|
|
|
auditallow system_app net_radio_prop:property_service set;
|
|
|
|
|
auditallow system_app system_radio_prop:property_service set;
|
2014-03-06 20:47:22 +01:00
|
|
|
|
2016-01-06 18:59:48 +01:00
|
|
|
# ctl interface
|
|
|
|
|
set_prop(system_app, ctl_default_prop)
|
|
|
|
|
set_prop(system_app, ctl_bugreport_prop)
|
|
|
|
|
|
2014-03-06 20:47:22 +01:00
|
|
|
# Create /data/anr/traces.txt.
|
|
|
|
|
allow system_app anr_data_file:dir ra_dir_perms;
|
|
|
|
|
allow system_app anr_data_file:file create_file_perms;
|
2014-05-10 02:47:19 +02:00
|
|
|
|
2014-12-11 16:33:49 +01:00
|
|
|
# Settings need to access app name and icon from asec
|
|
|
|
|
allow system_app asec_apk_file:file r_file_perms;
|
|
|
|
|
|
2015-05-05 00:06:26 +02:00
|
|
|
allow system_app servicemanager:service_manager list;
|
2016-10-29 00:52:15 +02:00
|
|
|
# TODO: scope this down? Too broad?
|
2016-12-05 19:19:11 +01:00
|
|
|
allow system_app { service_manager_type -netd_service -dumpstate_service -installd_service }:service_manager find;
|
2014-07-01 17:38:56 +02:00
|
|
|
|
2014-06-17 23:58:52 +02:00
|
|
|
allow system_app keystore:keystore_key {
|
2015-05-13 23:39:48 +02:00
|
|
|
get_state
|
2014-06-17 23:58:52 +02:00
|
|
|
get
|
|
|
|
|
insert
|
|
|
|
|
delete
|
|
|
|
|
exist
|
2015-05-13 23:39:48 +02:00
|
|
|
list
|
2014-06-17 23:58:52 +02:00
|
|
|
reset
|
|
|
|
|
password
|
|
|
|
|
lock
|
|
|
|
|
unlock
|
2015-05-13 23:39:48 +02:00
|
|
|
is_empty
|
2014-06-17 23:58:52 +02:00
|
|
|
sign
|
|
|
|
|
verify
|
|
|
|
|
grant
|
|
|
|
|
duplicate
|
|
|
|
|
clear_uid
|
2015-05-12 21:33:40 +02:00
|
|
|
user_changed
|
2014-06-17 23:58:52 +02:00
|
|
|
};
|
|
|
|
|
|
2016-01-04 23:23:23 +01:00
|
|
|
# /sys access
|
2016-09-10 01:27:17 +02:00
|
|
|
r_dir_file(system_app, sysfs_type)
|
2016-01-04 23:23:23 +01:00
|
|
|
|
2014-05-10 02:47:19 +02:00
|
|
|
control_logd(system_app)
|
