tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
platform_system_sepolicy/private/platform_app.te

72 lines
2.8 KiB
Text
Raw Normal View History

Move platform_app policy to private This leaves only the existence of platform_app domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules from platform_app_current attribute (as expected). Bug: 31364497 Change-Id: I47bb59fdfc07878c91fd5e207735cd0c07a128da
2017-01-09 23:52:59 +01:00
###
### Apps signed with the platform key.
###
Vendor domains must not use Binder On PRODUCT_FULL_TREBLE devices, non-vendor domains (except vendor apps) are not permitted to use Binder. This commit thus: * groups non-vendor domains using the new "coredomain" attribute, * adds neverallow rules restricting Binder use to coredomain and appdomain only, and * temporarily exempts the domains which are currently violating this rule from this restriction. These domains are grouped using the new "binder_in_vendor_violators" attribute. The attribute is needed because the types corresponding to violators are not exposed to the public policy where the neverallow rules are. Test: mmm system/sepolicy Test: Device boots, no new denials Test: In Chrome, navigate to ip6.me, play a YouTube video Test: YouTube: play a video Test: Netflix: play a movie Test: Google Camera: take a photo, take an HDR+ photo, record video with sound, record slow motion video with sound. Confirm videos play back fine and with sound. Bug: 35870313 Change-Id: I0cd1a80b60bcbde358ce0f7a47b90f4435a45c95
2017-03-23 22:27:32 +01:00
typeattribute platform_app coredomain;
Move platform_app policy to private This leaves only the existence of platform_app domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules from platform_app_current attribute (as expected). Bug: 31364497 Change-Id: I47bb59fdfc07878c91fd5e207735cd0c07a128da
2017-01-09 23:52:59 +01:00
typeattribute platform_app domain_deprecated;
Whitespace fix Because I'm nitpicky. Test: policy compiles Change-Id: I4d886d0d6182d29d7b260cf1f142c47cd32eda29
2016-12-10 05:14:31 +01:00
app_domain(platform_app)
Move platform_app policy to private This leaves only the existence of platform_app domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules from platform_app_current attribute (as expected). Bug: 31364497 Change-Id: I47bb59fdfc07878c91fd5e207735cd0c07a128da
2017-01-09 23:52:59 +01:00
# Access the network.
net_domain(platform_app)
# Access bluetooth.
bluetooth_domain(platform_app)
# Read from /data/local/tmp or /data/data/com.android.shell.
allow platform_app shell_data_file:dir search;
allow platform_app shell_data_file:file { open getattr read };
allow platform_app icon_file:file { open getattr read };
Merge ephemeral data and apk files into app The rules for the two types were the same and /data/app-ephemeral is being removed. Remove these types. Test: Builds Change-Id: I520c026395551ad1362dd2ced53c601d9e6f9b28
2017-01-25 23:55:56 +01:00
# Populate /data/app/vmdl*.tmp, /data/app-private/vmdl*.tmp files
Move platform_app policy to private This leaves only the existence of platform_app domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules from platform_app_current attribute (as expected). Bug: 31364497 Change-Id: I47bb59fdfc07878c91fd5e207735cd0c07a128da
2017-01-09 23:52:59 +01:00
# created by system server.
Merge ephemeral data and apk files into app The rules for the two types were the same and /data/app-ephemeral is being removed. Remove these types. Test: Builds Change-Id: I520c026395551ad1362dd2ced53c601d9e6f9b28
2017-01-25 23:55:56 +01:00
allow platform_app { apk_tmp_file apk_private_tmp_file }:dir rw_dir_perms;
allow platform_app { apk_tmp_file apk_private_tmp_file }:file rw_file_perms;
Move platform_app policy to private This leaves only the existence of platform_app domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules from platform_app_current attribute (as expected). Bug: 31364497 Change-Id: I47bb59fdfc07878c91fd5e207735cd0c07a128da
2017-01-09 23:52:59 +01:00
allow platform_app apk_private_data_file:dir search;
# ASEC
allow platform_app asec_apk_file:dir create_dir_perms;
allow platform_app asec_apk_file:file create_file_perms;
# Access to /data/media.
allow platform_app media_rw_data_file:dir create_dir_perms;
allow platform_app media_rw_data_file:file create_file_perms;
# Write to /cache.
allow platform_app cache_file:dir create_dir_perms;
allow platform_app cache_file:file create_file_perms;
# Direct access to vold-mounted storage under /mnt/media_rw
# This is a performance optimization that allows platform apps to bypass the FUSE layer
allow platform_app mnt_media_rw_file:dir r_dir_perms;
allow platform_app vfat:dir create_dir_perms;
allow platform_app vfat:file create_file_perms;
allow platform_app audioserver_service:service_manager find;
allow platform_app cameraserver_service:service_manager find;
allow platform_app drmserver_service:service_manager find;
allow platform_app mediaserver_service:service_manager find;
rename mediaanalytics->mediametrics, wider access reflect the change from "mediaanalytics" to "mediametrics" Also incorporates a broader access to the service -- e.g. anyone. This reflects that a number of metrics submissions come from application space and not only from our controlled, trusted media related processes. The metrics service (in another commit) checks on the source of any incoming metrics data and limits what is allowed from unprivileged clients. Bug: 34615027 Test: clean build, service running and accessible Change-Id: I657c343ea1faed536c3ee1940f1e7a178e813a42
2017-01-24 21:53:45 +01:00
allow platform_app mediametrics_service:service_manager find;
Move platform_app policy to private This leaves only the existence of platform_app domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules from platform_app_current attribute (as expected). Bug: 31364497 Change-Id: I47bb59fdfc07878c91fd5e207735cd0c07a128da
2017-01-09 23:52:59 +01:00
allow platform_app mediaextractor_service:service_manager find;
allow platform_app mediacodec_service:service_manager find;
allow platform_app mediadrmserver_service:service_manager find;
MediaCAS: adding media.cas to service Also allow media.extractor to use media.cas for descrambling. bug: 22804304 Change-Id: Id283b31badecb11011211a776ba9ff5167a9019d
2016-11-01 01:02:32 +01:00
allow platform_app mediacasserver_service:service_manager find;
Move platform_app policy to private This leaves only the existence of platform_app domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules from platform_app_current attribute (as expected). Bug: 31364497 Change-Id: I47bb59fdfc07878c91fd5e207735cd0c07a128da
2017-01-09 23:52:59 +01:00
allow platform_app persistent_data_block_service:service_manager find;
allow platform_app radio_service:service_manager find;
allow platform_app surfaceflinger_service:service_manager find;
Enable the TimeZoneManagerService Add policy changes to enable a new service. The service is currently switched off in config, but this change is needed before it could be enabled. Bug: 31008728 Test: make droid Merged-In: I29c4509304978afb2187fe2e7f401144c6c3b4c6 Change-Id: I29c4509304978afb2187fe2e7f401144c6c3b4c6
2017-01-11 17:27:02 +01:00
allow platform_app timezone_service:service_manager find;
Move platform_app policy to private This leaves only the existence of platform_app domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules from platform_app_current attribute (as expected). Bug: 31364497 Change-Id: I47bb59fdfc07878c91fd5e207735cd0c07a128da
2017-01-09 23:52:59 +01:00
allow platform_app app_api_service:service_manager find;
allow platform_app system_api_service:service_manager find;
allow platform_app vr_manager_service:service_manager find;
# Access to /data/preloads
allow platform_app preloads_data_file:file r_file_perms;
allow platform_app preloads_data_file:dir r_dir_perms;
Split preloads into media_file and data_file Untrusted apps should only access /data/preloads/media and demo directory. Bug: 36197686 Test: Verified retail mode. Checked non-privileged APK cannot access /data/preloads Change-Id: I8e9c21ff6aba799aa31bf06893cdf60dafc04446
2017-03-14 19:42:03 +01:00
allow platform_app preloads_media_file:file r_file_perms;
allow platform_app preloads_media_file:dir r_dir_perms;
Move platform_app policy to private This leaves only the existence of platform_app domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules from platform_app_current attribute (as expected). Bug: 31364497 Change-Id: I47bb59fdfc07878c91fd5e207735cd0c07a128da
2017-01-09 23:52:59 +01:00
logd: restrict access to /dev/event-log-tags Create an event_log_tags_file label and use it for /dev/event-log-tags. Only trusted system log readers are allowed direct read access to this file, no write access. Untrusted domain requests lack direct access, and are thus checked for credentials via the "plan b" long path socket to the event log tag service. Test: gTest logd-unit-tests, liblog-unit-tests and logcat-unit-tests Bug: 31456426 Bug: 30566487 Change-Id: Ib9b71ca225d4436d764c9bc340ff7b1c9c252a9e
2016-11-08 00:11:39 +01:00
read_runtime_log_tags(platform_app)
relax fuse_device neverallow rules The fuse_device neverallow rules are too aggressive and are inhibiting certain vendor customizations. Relax the /dev/fuse neverallow rules so that they better reflect the security invariants we want to uphold. Bug: 37496487 Test: policy compiles. Change-Id: Ie73b0ba7c76446afc2a7a23ebed1275c977d932d
2017-04-26 20:40:48 +02:00
###
### Neverallow rules
###
# app domains which access /dev/fuse should not run as platform_app
neverallow platform_app fuse_device:chr_file *;
Reference in a new issue Copy permalink