tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

update isolated_app service_manager rules

Browse source 
isolated apps should only be able to access 2 services.
Remove access permissions for services inappropriately added,
and add a neverallow rule to prevent regressions.

Change-Id: I2783465c4a22507849b2a64894fb76690a27bc01
This commit is contained in:
Nick Kralevich 2015-03-05 12:10:30 -08:00
parent 723e31efe5
commit 75f34dc392
2 changed files with 14 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
app.te
View file

@ -182,9 +182,9 @@ control_logd(appdomain)
# application inherit logd write socket (urge is to deprecate this long term)
allow appdomain zygote:unix_dgram_socket write;
allow appdomain keystore:keystore_key { test get insert delete exist saw sign verify };
allow { appdomain -isolated_app } keystore:keystore_key { test get insert delete exist saw sign verify };
use_keystore(appdomain)
use_keystore({ appdomain -isolated_app })
###
### Neverallow rules

28
isolated_app.te
View file

@ -15,25 +15,21 @@ app_domain(isolated_app)
# Access already open app data files received over Binder or local socket IPC.
allow isolated_app app_data_file:file { read write getattr };
allow isolated_app activity_service:service_manager find;
allow isolated_app display_service:service_manager find;
#####
##### Neverallow
#####
# Isolated apps should not directly open app data files themselves.
neverallow isolated_app app_data_file:file open;
allow isolated_app radio_service:service_manager find;
allow isolated_app surfaceflinger_service:service_manager find;
allow isolated_app system_server_service:service_manager find;
allow isolated_app tmp_system_server_service:service_manager find;
# address tmp_system_server_service accesses
allow isolated_app activity_service:service_manager find;
allow isolated_app connectivity_service:service_manager find;
allow isolated_app display_service:service_manager find;
allow isolated_app dropbox_service:service_manager find;
service_manager_local_audit_domain(isolated_app)
auditallow isolated_app {
tmp_system_server_service
# b/17487348
# Isolated apps can only access two services,
# activity_service and display_service
neverallow isolated_app {
service_manager_type
-activity_service
-connectivity_service
-display_service
-dropbox_service
}:service_manager find;