tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Loosen system app data neverallows" into oc-dev

Browse source
This commit is contained in:
Alex Klyubin 2017-03-29 20:33:31 +00:00 committed by Android (Google) Code Review
commit ad2e6166c8
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
public/domain.te
View file

@ -656,10 +656,17 @@ neverallow installd system_data_file:file ~{ r_file_perms relabelfrom unlink };
# respect system_app sandboxes
neverallow {
domain
-system_app # its own sandbox
-appdomain # finer-grained rules for appdomain are listed below
-system_server #populate com.android.providers.settings/databases/settings.db.
-installd # creation of app sandbox
} system_app_data_file:dir_file_class_set { create unlink open };
neverallow {
isolated_app
untrusted_app_all # finer-grained rules for appdomain are listed below
ephemeral_app
priv_app
} system_app_data_file:dir_file_class_set { create unlink open };
# Services should respect app sandboxes
neverallow {