tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Add ephemeral service access to sdk sandbox

Browse source 
Add some services ephemeral service has access to.
We will steadily restrict this list further based on
testing and requirements for rubidium.

Test: Manual
Bug: b/227745962
Bug: b/227581095

Change-Id: If7bcb8b8de62d408bd4af848b43abca853c93758
This commit is contained in:
Shiwangi Shah 2022-04-01 13:24:20 +00:00
parent 586e350678
commit 48b2b33844
1 changed files with 67 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

71
private/sdk_sandbox.te
View file

@ -12,18 +12,81 @@ app_domain(sdk_sandbox)
# Allow finding services. This is different from ephemeral_app policy.
# Adding services manually to the allowlist is preferred hence app_api_service is not used.
allow sdk_sandbox activity_service:service_manager find;
allow sdk_sandbox activity_task_service:service_manager find;
allow sdk_sandbox audio_service:service_manager find;
# Audit the access to signal that we are still investigating whether sdk_sandbox
# should have access to audio_service
# TODO(b/211632068): remove this line
auditallow sdk_sandbox audio_service:service_manager find;
allow sdk_sandbox activity_service:service_manager find;
allow sdk_sandbox activity_task_service:service_manager find;
allow sdk_sandbox appops_service:service_manager find;
allow sdk_sandbox audio_service:service_manager find;
allow sdk_sandbox audioserver_service:service_manager find;
allow sdk_sandbox batteryproperties_service:service_manager find;
allow sdk_sandbox batterystats_service:service_manager find;
allow sdk_sandbox connectivity_service:service_manager find;
allow sdk_sandbox connmetrics_service:service_manager find;
allow sdk_sandbox deviceidle_service:service_manager find;
allow sdk_sandbox display_service:service_manager find;
allow sdk_sandbox dropbox_service:service_manager find;
allow sdk_sandbox font_service:service_manager find;
allow sdk_sandbox game_service:service_manager find;
allow sdk_sandbox gpu_service:service_manager find;
allow sdk_sandbox graphicsstats_service:service_manager find;
allow sdk_sandbox hint_service:service_manager find;
allow sdk_sandbox imms_service:service_manager find;
allow sdk_sandbox input_method_service:service_manager find;
allow sdk_sandbox input_service:service_manager find;
allow sdk_sandbox IProxyService_service:service_manager find;
allow sdk_sandbox ipsec_service:service_manager find;
allow sdk_sandbox launcherapps_service:service_manager find;
allow sdk_sandbox legacy_permission_service:service_manager find;
allow sdk_sandbox light_service:service_manager find;
allow sdk_sandbox locale_service:service_manager find;
allow sdk_sandbox media_communication_service:service_manager find;
allow sdk_sandbox mediaextractor_service:service_manager find;
allow sdk_sandbox mediametrics_service:service_manager find;
allow sdk_sandbox media_projection_service:service_manager find;
allow sdk_sandbox media_router_service:service_manager find;
allow sdk_sandbox mediaserver_service:service_manager find;
allow sdk_sandbox media_session_service:service_manager find;
allow sdk_sandbox memtrackproxy_service:service_manager find;
allow sdk_sandbox midi_service:service_manager find;
allow sdk_sandbox netpolicy_service:service_manager find;
allow sdk_sandbox netstats_service:service_manager find;
allow sdk_sandbox network_management_service:service_manager find;
allow sdk_sandbox notification_service:service_manager find;
allow sdk_sandbox package_service:service_manager find;
allow sdk_sandbox permission_checker_service:service_manager find;
allow sdk_sandbox permission_service:service_manager find;
allow sdk_sandbox permissionmgr_service:service_manager find;
allow sdk_sandbox platform_compat_service:service_manager find;
allow sdk_sandbox power_service:service_manager find;
allow sdk_sandbox procstats_service:service_manager find;
allow sdk_sandbox registry_service:service_manager find;
allow sdk_sandbox restrictions_service:service_manager find;
allow sdk_sandbox rttmanager_service:service_manager find;
allow sdk_sandbox search_service:service_manager find;
allow sdk_sandbox selection_toolbar_service:service_manager find;
allow sdk_sandbox sensor_privacy_service:service_manager find;
allow sdk_sandbox sensorservice_service:service_manager find;
allow sdk_sandbox servicediscovery_service:service_manager find;
allow sdk_sandbox settings_service:service_manager find;
allow sdk_sandbox speech_recognition_service:service_manager find;
allow sdk_sandbox statusbar_service:service_manager find;
allow sdk_sandbox storagestats_service:service_manager find;
allow sdk_sandbox surfaceflinger_service:service_manager find;
allow sdk_sandbox telecom_service:service_manager find;
allow sdk_sandbox tethering_service:service_manager find;
allow sdk_sandbox textclassification_service:service_manager find;
allow sdk_sandbox textservices_service:service_manager find;
allow sdk_sandbox texttospeech_service:service_manager find;
allow sdk_sandbox thermal_service:service_manager find;
allow sdk_sandbox trust_service:service_manager find;
allow sdk_sandbox translation_service:service_manager find;
allow sdk_sandbox tv_iapp_service:service_manager find;
allow sdk_sandbox tv_input_service:service_manager find;
allow sdk_sandbox uimode_service:service_manager find;
allow sdk_sandbox vcn_management_service:service_manager find;
allow sdk_sandbox webviewupdate_service:service_manager find;
# Write app-specific trace data to the Perfetto traced damon. This requires