tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

auditallow app_data_file execute am: 4738b93db2

Browse source 
am: ca8749a0b3

Change-Id: Icbde5e0e612e6fe08e17f91713518bb7e724f2b3
This commit is contained in:
Nick Kralevich 2018-08-06 19:19:56 -07:00 committed by android-build-merger
commit 25f763e374
2 changed files with 12 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
private/ephemeral_app.te
View file

@ -23,6 +23,12 @@ allow ephemeral_app { sdcard_type media_rw_data_file }:file {read write getattr
# to their sandbox directory and then execute.
allow ephemeral_app { app_data_file privapp_data_file }:file {r_file_perms execute};
# Executing files from an application home directory violates
# W^X (https://en.wikipedia.org/wiki/W%5EX) constraints (loading executable code
# from a writable file) and is an unsafe application behavior. Test to see if we
# can get rid of it.
auditallow ephemeral_app app_data_file:file execute;
# services
allow ephemeral_app audioserver_service:service_manager find;
allow ephemeral_app cameraserver_service:service_manager find;

6
private/untrusted_app_all.te
View file

@ -24,6 +24,12 @@
# to their sandbox directory and then execute.
allow untrusted_app_all { app_data_file privapp_data_file }:file { rx_file_perms };
# Executing files from an application home directory violates
# W^X (https://en.wikipedia.org/wiki/W%5EX) constraints (loading executable code
# from a writable file) and is an unsafe application behavior. Test to see if we
# can get rid of it.
auditallow untrusted_app_all app_data_file:file { execute execute_no_trans };
# ASEC
allow untrusted_app_all asec_apk_file:file r_file_perms;
allow untrusted_app_all asec_apk_file:dir r_dir_perms;