tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Allow ephemeral apps network connections"

Browse source
This commit is contained in:
Treehugger Robot 2016-11-14 21:53:15 +00:00 committed by Gerrit Code Review
commit 41301ab74b
2 changed files with 9 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
public/ephemeral_app.te
View file

@ -11,7 +11,7 @@
###
### PackageManager flags an app as ephemeral at install time.
type ephemeral_app, domain;
net_domain(ephemeral_app)
# allow JITing
allow ephemeral_app self:process execmem;
allow ephemeral_app ashmem_device:chr_file execute;
@ -38,6 +38,11 @@ allow ephemeral_app zygote:unix_dgram_socket write;
allow ephemeral_app ephemeral_data_file:dir create_dir_perms;
allow ephemeral_app ephemeral_data_file:{ file sock_file fifo_file } create_file_perms;
# Keychain and user-trusted credentials
r_dir_file(ephemeral_app, keychain_data_file)
allow ephemeral_app misc_user_data_file:dir r_dir_perms;
allow ephemeral_app misc_user_data_file:file r_file_perms;
# Allow apps to read/execute installed binaries
allow ephemeral_app ephemeral_apk_data_file:dir search;
allow ephemeral_app ephemeral_apk_data_file:file { r_file_perms execute };

6
public/net.te
View file

@ -9,9 +9,9 @@ allow netdomain self:{ udp_socket rawip_socket } create_socket_perms;
# Connect to ports.
allow netdomain port_type:tcp_socket name_connect;
# Bind to ports.
allow netdomain node_type:{ tcp_socket udp_socket } node_bind;
allow netdomain port_type:udp_socket name_bind;
allow netdomain port_type:tcp_socket name_bind;
allow {netdomain -ephemeral_app} node_type:{ tcp_socket udp_socket } node_bind;
allow {netdomain -ephemeral_app} port_type:udp_socket name_bind;
allow {netdomain -ephemeral_app} port_type:tcp_socket name_bind;
# See changes to the routing table.
allow netdomain self:netlink_route_socket { create read getattr write setattr lock append bind connect getopt setopt shutdown nlmsg_read };