diff --git a/prebuilts/api/34.0/private/sdk_sandbox.te b/prebuilts/api/34.0/private/sdk_sandbox.te index 9d6abcbf1..3aca881c8 100644 --- a/prebuilts/api/34.0/private/sdk_sandbox.te +++ b/prebuilts/api/34.0/private/sdk_sandbox.te @@ -10,208 +10,86 @@ typeattribute sdk_sandbox coredomain; net_domain(sdk_sandbox) app_domain(sdk_sandbox) -# TODO(b/252967582): remove this rule if it generates too much logs traffic. -auditallow sdk_sandbox { - property_type - # remove expected properties to reduce noise. - -servicemanager_prop - -hwservicemanager_prop - -use_memfd_prop - -binder_cache_system_server_prop - -graphics_config_prop - -persist_wm_debug_prop - -aaudio_config_prop - -adbd_config_prop - -apex_ready_prop - -apexd_select_prop - -arm64_memtag_prop - -audio_prop - -binder_cache_bluetooth_server_prop - -binder_cache_telephony_server_prop - -bluetooth_config_prop - -boot_status_prop - -bootloader_prop - -bq_config_prop - -build_odm_prop - -build_prop - -build_vendor_prop - -camera2_extensions_prop - -camera_calibration_prop - -camera_config_prop - -camerax_extensions_prop - -codec2_config_prop - -config_prop - -cppreopt_prop - -dalvik_config_prop_type - -dalvik_prop - -dalvik_runtime_prop - -dck_prop - -debug_prop - -debuggerd_prop - -default_prop - -device_config_memory_safety_native_boot_prop - -device_config_memory_safety_native_prop - -device_config_nnapi_native_prop - -device_config_runtime_native_boot_prop - -device_config_runtime_native_prop - -dhcp_prop - -dumpstate_prop - -exported3_system_prop - -exported_config_prop - -exported_default_prop - -exported_dumpstate_prop - -exported_pm_prop - -exported_system_prop - -ffs_config_prop - -fingerprint_prop - -framework_status_prop - -gwp_asan_prop - -hal_instrumentation_prop - -hdmi_config_prop - -heapprofd_prop - -hw_timeout_multiplier_prop - -init_service_status_private_prop - -init_service_status_prop - -libc_debug_prop - -lmkd_config_prop - -locale_prop - -localization_prop - -log_file_logger_prop - -log_prop - -log_tag_prop - -logd_prop - -media_config_prop - -media_variant_prop - -mediadrm_config_prop - -module_sdkextensions_prop - -net_radio_prop - -nfc_prop - -nnapi_ext_deny_product_prop - -ota_prop - -packagemanager_config_prop - -pan_result_prop - -permissive_mte_prop - -persist_debug_prop - -persist_sysui_builder_extras_prop - -pm_prop - -powerctl_prop - -property_service_version_prop - -radio_control_prop - -radio_prop - -restorecon_prop - -rollback_test_prop - -sendbug_config_prop - -setupwizard_prop - -shell_prop - -soc_prop - -socket_hook_prop - -sqlite_log_prop - -storagemanager_config_prop - -surfaceflinger_color_prop - -surfaceflinger_prop - -system_prop - -system_user_mode_emulation_prop - -systemsound_config_prop - -telephony_config_prop - -telephony_status_prop - -test_harness_prop - -timezone_prop - -usb_config_prop - -usb_control_prop - -usb_prop - -userdebug_or_eng_prop - -userspace_reboot_config_prop - -userspace_reboot_exported_prop - -userspace_reboot_log_prop - -userspace_reboot_test_prop - -vendor_socket_hook_prop - -vndk_prop - -vold_config_prop - -vold_prop - -vold_status_prop - -vts_config_prop - -vts_status_prop - -wifi_log_prop - -zygote_config_prop - -zygote_wrap_prop - -init_service_status_prop -}:file { getattr open read map }; - # Allow finding services. This is different from ephemeral_app policy. # Adding services manually to the allowlist is preferred hence app_api_service is not used. - -allow sdk_sandbox activity_service:service_manager find; -allow sdk_sandbox activity_task_service:service_manager find; -allow sdk_sandbox appops_service:service_manager find; -allow sdk_sandbox audio_service:service_manager find; -allow sdk_sandbox audioserver_service:service_manager find; -allow sdk_sandbox batteryproperties_service:service_manager find; -allow sdk_sandbox batterystats_service:service_manager find; -allow sdk_sandbox connectivity_service:service_manager find; -allow sdk_sandbox connmetrics_service:service_manager find; -allow sdk_sandbox deviceidle_service:service_manager find; -allow sdk_sandbox display_service:service_manager find; -allow sdk_sandbox dropbox_service:service_manager find; -allow sdk_sandbox font_service:service_manager find; -allow sdk_sandbox game_service:service_manager find; -allow sdk_sandbox gpu_service:service_manager find; -allow sdk_sandbox graphicsstats_service:service_manager find; -allow sdk_sandbox hardware_properties_service:service_manager find; -allow sdk_sandbox hint_service:service_manager find; -allow sdk_sandbox imms_service:service_manager find; -allow sdk_sandbox input_method_service:service_manager find; -allow sdk_sandbox input_service:service_manager find; -allow sdk_sandbox IProxyService_service:service_manager find; -allow sdk_sandbox ipsec_service:service_manager find; -allow sdk_sandbox launcherapps_service:service_manager find; -allow sdk_sandbox legacy_permission_service:service_manager find; -allow sdk_sandbox light_service:service_manager find; -allow sdk_sandbox locale_service:service_manager find; -allow sdk_sandbox media_communication_service:service_manager find; -allow sdk_sandbox mediaextractor_service:service_manager find; -allow sdk_sandbox mediametrics_service:service_manager find; -allow sdk_sandbox media_projection_service:service_manager find; -allow sdk_sandbox media_router_service:service_manager find; -allow sdk_sandbox mediaserver_service:service_manager find; -allow sdk_sandbox media_session_service:service_manager find; -allow sdk_sandbox memtrackproxy_service:service_manager find; -allow sdk_sandbox midi_service:service_manager find; -allow sdk_sandbox netpolicy_service:service_manager find; -allow sdk_sandbox netstats_service:service_manager find; -allow sdk_sandbox network_management_service:service_manager find; -allow sdk_sandbox notification_service:service_manager find; -allow sdk_sandbox package_service:service_manager find; -allow sdk_sandbox permission_checker_service:service_manager find; -allow sdk_sandbox permission_service:service_manager find; -allow sdk_sandbox permissionmgr_service:service_manager find; -allow sdk_sandbox platform_compat_service:service_manager find; -allow sdk_sandbox power_service:service_manager find; -allow sdk_sandbox procstats_service:service_manager find; -allow sdk_sandbox registry_service:service_manager find; -allow sdk_sandbox restrictions_service:service_manager find; -allow sdk_sandbox rttmanager_service:service_manager find; -allow sdk_sandbox search_service:service_manager find; -allow sdk_sandbox selection_toolbar_service:service_manager find; -allow sdk_sandbox sensor_privacy_service:service_manager find; -allow sdk_sandbox sensorservice_service:service_manager find; -allow sdk_sandbox servicediscovery_service:service_manager find; -allow sdk_sandbox settings_service:service_manager find; -allow sdk_sandbox speech_recognition_service:service_manager find; -allow sdk_sandbox statusbar_service:service_manager find; -allow sdk_sandbox storagestats_service:service_manager find; -allow sdk_sandbox surfaceflinger_service:service_manager find; -allow sdk_sandbox telecom_service:service_manager find; -allow sdk_sandbox tethering_service:service_manager find; -allow sdk_sandbox textclassification_service:service_manager find; -allow sdk_sandbox textservices_service:service_manager find; -allow sdk_sandbox texttospeech_service:service_manager find; -allow sdk_sandbox thermal_service:service_manager find; -allow sdk_sandbox translation_service:service_manager find; -allow sdk_sandbox tv_iapp_service:service_manager find; -allow sdk_sandbox tv_input_service:service_manager find; -allow sdk_sandbox uimode_service:service_manager find; -allow sdk_sandbox vcn_management_service:service_manager find; -allow sdk_sandbox webviewupdate_service:service_manager find; +allow sdk_sandbox { + activity_service + activity_task_service + appops_service + audio_service + audioserver_service + batteryproperties_service + batterystats_service + cameraserver_service + connectivity_service + connmetrics_service + deviceidle_service + display_service + dropbox_service + ephemeral_app_api_service + font_service + game_service + gpu_service + graphicsstats_service + hardware_properties_service + hint_service + imms_service + input_method_service + input_service + IProxyService_service + ipsec_service + launcherapps_service + legacy_permission_service + light_service + locale_service + media_communication_service + mediadrmserver_service + mediaextractor_service + mediametrics_service + media_projection_service + media_router_service + mediaserver_service + media_session_service + memtrackproxy_service + midi_service + netpolicy_service + netstats_service + network_management_service + notification_service + package_service + permission_checker_service + permission_service + permissionmgr_service + platform_compat_service + power_service + procstats_service + radio_service + registry_service + restrictions_service + rttmanager_service + search_service + selection_toolbar_service + sensor_privacy_service + sensorservice_service + servicediscovery_service + settings_service + speech_recognition_service + statusbar_service + storagestats_service + surfaceflinger_service + telecom_service + tethering_service + textclassification_service + textservices_service + texttospeech_service + thermal_service + translation_service + tv_iapp_service + tv_input_service + uimode_service + vcn_management_service + webviewupdate_service +}:service_manager find; allow sdk_sandbox system_linker_exec:file execute_no_trans; diff --git a/private/sdk_sandbox.te b/private/sdk_sandbox.te index 9d6abcbf1..3aca881c8 100644 --- a/private/sdk_sandbox.te +++ b/private/sdk_sandbox.te @@ -10,208 +10,86 @@ typeattribute sdk_sandbox coredomain; net_domain(sdk_sandbox) app_domain(sdk_sandbox) -# TODO(b/252967582): remove this rule if it generates too much logs traffic. -auditallow sdk_sandbox { - property_type - # remove expected properties to reduce noise. - -servicemanager_prop - -hwservicemanager_prop - -use_memfd_prop - -binder_cache_system_server_prop - -graphics_config_prop - -persist_wm_debug_prop - -aaudio_config_prop - -adbd_config_prop - -apex_ready_prop - -apexd_select_prop - -arm64_memtag_prop - -audio_prop - -binder_cache_bluetooth_server_prop - -binder_cache_telephony_server_prop - -bluetooth_config_prop - -boot_status_prop - -bootloader_prop - -bq_config_prop - -build_odm_prop - -build_prop - -build_vendor_prop - -camera2_extensions_prop - -camera_calibration_prop - -camera_config_prop - -camerax_extensions_prop - -codec2_config_prop - -config_prop - -cppreopt_prop - -dalvik_config_prop_type - -dalvik_prop - -dalvik_runtime_prop - -dck_prop - -debug_prop - -debuggerd_prop - -default_prop - -device_config_memory_safety_native_boot_prop - -device_config_memory_safety_native_prop - -device_config_nnapi_native_prop - -device_config_runtime_native_boot_prop - -device_config_runtime_native_prop - -dhcp_prop - -dumpstate_prop - -exported3_system_prop - -exported_config_prop - -exported_default_prop - -exported_dumpstate_prop - -exported_pm_prop - -exported_system_prop - -ffs_config_prop - -fingerprint_prop - -framework_status_prop - -gwp_asan_prop - -hal_instrumentation_prop - -hdmi_config_prop - -heapprofd_prop - -hw_timeout_multiplier_prop - -init_service_status_private_prop - -init_service_status_prop - -libc_debug_prop - -lmkd_config_prop - -locale_prop - -localization_prop - -log_file_logger_prop - -log_prop - -log_tag_prop - -logd_prop - -media_config_prop - -media_variant_prop - -mediadrm_config_prop - -module_sdkextensions_prop - -net_radio_prop - -nfc_prop - -nnapi_ext_deny_product_prop - -ota_prop - -packagemanager_config_prop - -pan_result_prop - -permissive_mte_prop - -persist_debug_prop - -persist_sysui_builder_extras_prop - -pm_prop - -powerctl_prop - -property_service_version_prop - -radio_control_prop - -radio_prop - -restorecon_prop - -rollback_test_prop - -sendbug_config_prop - -setupwizard_prop - -shell_prop - -soc_prop - -socket_hook_prop - -sqlite_log_prop - -storagemanager_config_prop - -surfaceflinger_color_prop - -surfaceflinger_prop - -system_prop - -system_user_mode_emulation_prop - -systemsound_config_prop - -telephony_config_prop - -telephony_status_prop - -test_harness_prop - -timezone_prop - -usb_config_prop - -usb_control_prop - -usb_prop - -userdebug_or_eng_prop - -userspace_reboot_config_prop - -userspace_reboot_exported_prop - -userspace_reboot_log_prop - -userspace_reboot_test_prop - -vendor_socket_hook_prop - -vndk_prop - -vold_config_prop - -vold_prop - -vold_status_prop - -vts_config_prop - -vts_status_prop - -wifi_log_prop - -zygote_config_prop - -zygote_wrap_prop - -init_service_status_prop -}:file { getattr open read map }; - # Allow finding services. This is different from ephemeral_app policy. # Adding services manually to the allowlist is preferred hence app_api_service is not used. - -allow sdk_sandbox activity_service:service_manager find; -allow sdk_sandbox activity_task_service:service_manager find; -allow sdk_sandbox appops_service:service_manager find; -allow sdk_sandbox audio_service:service_manager find; -allow sdk_sandbox audioserver_service:service_manager find; -allow sdk_sandbox batteryproperties_service:service_manager find; -allow sdk_sandbox batterystats_service:service_manager find; -allow sdk_sandbox connectivity_service:service_manager find; -allow sdk_sandbox connmetrics_service:service_manager find; -allow sdk_sandbox deviceidle_service:service_manager find; -allow sdk_sandbox display_service:service_manager find; -allow sdk_sandbox dropbox_service:service_manager find; -allow sdk_sandbox font_service:service_manager find; -allow sdk_sandbox game_service:service_manager find; -allow sdk_sandbox gpu_service:service_manager find; -allow sdk_sandbox graphicsstats_service:service_manager find; -allow sdk_sandbox hardware_properties_service:service_manager find; -allow sdk_sandbox hint_service:service_manager find; -allow sdk_sandbox imms_service:service_manager find; -allow sdk_sandbox input_method_service:service_manager find; -allow sdk_sandbox input_service:service_manager find; -allow sdk_sandbox IProxyService_service:service_manager find; -allow sdk_sandbox ipsec_service:service_manager find; -allow sdk_sandbox launcherapps_service:service_manager find; -allow sdk_sandbox legacy_permission_service:service_manager find; -allow sdk_sandbox light_service:service_manager find; -allow sdk_sandbox locale_service:service_manager find; -allow sdk_sandbox media_communication_service:service_manager find; -allow sdk_sandbox mediaextractor_service:service_manager find; -allow sdk_sandbox mediametrics_service:service_manager find; -allow sdk_sandbox media_projection_service:service_manager find; -allow sdk_sandbox media_router_service:service_manager find; -allow sdk_sandbox mediaserver_service:service_manager find; -allow sdk_sandbox media_session_service:service_manager find; -allow sdk_sandbox memtrackproxy_service:service_manager find; -allow sdk_sandbox midi_service:service_manager find; -allow sdk_sandbox netpolicy_service:service_manager find; -allow sdk_sandbox netstats_service:service_manager find; -allow sdk_sandbox network_management_service:service_manager find; -allow sdk_sandbox notification_service:service_manager find; -allow sdk_sandbox package_service:service_manager find; -allow sdk_sandbox permission_checker_service:service_manager find; -allow sdk_sandbox permission_service:service_manager find; -allow sdk_sandbox permissionmgr_service:service_manager find; -allow sdk_sandbox platform_compat_service:service_manager find; -allow sdk_sandbox power_service:service_manager find; -allow sdk_sandbox procstats_service:service_manager find; -allow sdk_sandbox registry_service:service_manager find; -allow sdk_sandbox restrictions_service:service_manager find; -allow sdk_sandbox rttmanager_service:service_manager find; -allow sdk_sandbox search_service:service_manager find; -allow sdk_sandbox selection_toolbar_service:service_manager find; -allow sdk_sandbox sensor_privacy_service:service_manager find; -allow sdk_sandbox sensorservice_service:service_manager find; -allow sdk_sandbox servicediscovery_service:service_manager find; -allow sdk_sandbox settings_service:service_manager find; -allow sdk_sandbox speech_recognition_service:service_manager find; -allow sdk_sandbox statusbar_service:service_manager find; -allow sdk_sandbox storagestats_service:service_manager find; -allow sdk_sandbox surfaceflinger_service:service_manager find; -allow sdk_sandbox telecom_service:service_manager find; -allow sdk_sandbox tethering_service:service_manager find; -allow sdk_sandbox textclassification_service:service_manager find; -allow sdk_sandbox textservices_service:service_manager find; -allow sdk_sandbox texttospeech_service:service_manager find; -allow sdk_sandbox thermal_service:service_manager find; -allow sdk_sandbox translation_service:service_manager find; -allow sdk_sandbox tv_iapp_service:service_manager find; -allow sdk_sandbox tv_input_service:service_manager find; -allow sdk_sandbox uimode_service:service_manager find; -allow sdk_sandbox vcn_management_service:service_manager find; -allow sdk_sandbox webviewupdate_service:service_manager find; +allow sdk_sandbox { + activity_service + activity_task_service + appops_service + audio_service + audioserver_service + batteryproperties_service + batterystats_service + cameraserver_service + connectivity_service + connmetrics_service + deviceidle_service + display_service + dropbox_service + ephemeral_app_api_service + font_service + game_service + gpu_service + graphicsstats_service + hardware_properties_service + hint_service + imms_service + input_method_service + input_service + IProxyService_service + ipsec_service + launcherapps_service + legacy_permission_service + light_service + locale_service + media_communication_service + mediadrmserver_service + mediaextractor_service + mediametrics_service + media_projection_service + media_router_service + mediaserver_service + media_session_service + memtrackproxy_service + midi_service + netpolicy_service + netstats_service + network_management_service + notification_service + package_service + permission_checker_service + permission_service + permissionmgr_service + platform_compat_service + power_service + procstats_service + radio_service + registry_service + restrictions_service + rttmanager_service + search_service + selection_toolbar_service + sensor_privacy_service + sensorservice_service + servicediscovery_service + settings_service + speech_recognition_service + statusbar_service + storagestats_service + surfaceflinger_service + telecom_service + tethering_service + textclassification_service + textservices_service + texttospeech_service + thermal_service + translation_service + tv_iapp_service + tv_input_service + uimode_service + vcn_management_service + webviewupdate_service +}:service_manager find; allow sdk_sandbox system_linker_exec:file execute_no_trans;