tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

am 7d715164: Do not allow isolated_app to directly open app data files.

Browse source 
* commit '7d7151647f41f562dd324a5def86ee10c234f870':
  Do not allow isolated_app to directly open app data files.
This commit is contained in:
Stephen Smalley 2014-12-02 18:07:47 +00:00 committed by Android Git Automerger
commit 0e8f0230fd
2 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
app.te
View file

@ -46,8 +46,8 @@ allow appdomain appdomain:fifo_file rw_file_perms;
allow appdomain surfaceflinger:unix_stream_socket { read write setopt getattr getopt shutdown };
# App sandbox file accesses.
allow appdomain app_data_file:dir create_dir_perms;
allow appdomain app_data_file:notdevfile_class_set create_file_perms;
allow { appdomain -isolated_app } app_data_file:dir create_dir_perms;
allow { appdomain -isolated_app } app_data_file:notdevfile_class_set create_file_perms;
# lib subdirectory of /data/data dir is system-owned.
allow appdomain system_data_file:dir r_dir_perms;

6
isolated_app.te
View file

@ -12,6 +12,12 @@
type isolated_app, domain;
app_domain(isolated_app)
# Access already open app data files received over Binder or local socket IPC.
allow isolated_app app_data_file:file { read write getattr };
# Isolated apps should not directly open app data files themselves.
neverallow isolated_app app_data_file:file open;
# Isolated apps shouldn't be able to access the driver directly.
neverallow isolated_app gpu_device:file { rw_file_perms execute };