tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

isolated_app: allow access to pre-opened sdcard FDs am: c121735f42 am: 506cae4729

Browse source 
am: 7089d2bbdd

Change-Id: I4b819ce27c807c4d1b228129df18ee847deaa8f8
This commit is contained in:
Nick Kralevich 2016-11-15 23:05:23 +00:00 committed by android-build-merger
commit 2ef8483264
1 changed files with 13 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
public/isolated_app.te
View file

@ -26,6 +26,14 @@ allow isolated_app webviewupdate_service:service_manager find;
# https://code.google.com/p/chromium/issues/detail?id=475270
allow isolated_app self:process ptrace;
# b/32896414: Allow accessing sdcard file descriptors passed to isolated_apps
# by other processes. Open should never be allowed, and is blocked by
# neverallow rules below.
# TODO: consider removing write/append. We want to limit isolated_apps
# ability to mutate files of any type.
allow isolated_app sdcard_type:file { read write append getattr lock };
auditallow isolated_app sdcard_type:file { write append };
# For webviews, isolated_app processes can be forked from the webview_zygote
# in addition to the zygote. Allow access to resources inherited from the
# webview_zygote process. These rules are specialized copies of the ones in app.te.
@ -89,9 +97,12 @@ neverallow isolated_app *:{
netlink_rdma_socket netlink_crypto_socket
} *;
# Do not allow isolated_app to access external storage
# Do not allow isolated_app to access external storage, except for files passed
# via file descriptors (b/32896414).
neverallow isolated_app { storage_file mnt_user_file sdcard_type }:dir ~getattr;
neverallow isolated_app { storage_file mnt_user_file sdcard_type }:file_class_set *;
neverallow isolated_app { storage_file mnt_user_file }:file_class_set *;
neverallow isolated_app sdcard_type:{ devfile_class_set lnk_file sock_file fifo_file } *;
neverallow isolated_app sdcard_type:file ~{ read write append getattr lock };
# Do not allow USB access
neverallow isolated_app { usb_device usbaccessory_device }:chr_file *;