Merge "Relax sdk sandbox sepolicy."
This commit is contained in:
Mugdha Lakhani
Gerrit Code Review
commit
b86b8e2e99
1 changed files with 78 additions and 200 deletions
|
|
@ -10,208 +10,86 @@ typeattribute sdk_sandbox coredomain;
|
|||
net_domain(sdk_sandbox)
|
||||
app_domain(sdk_sandbox)
|
||||
|
||||
# TODO(b/252967582): remove this rule if it generates too much logs traffic.
|
||||
auditallow sdk_sandbox {
|
||||
property_type
|
||||
# remove expected properties to reduce noise.
|
||||
-servicemanager_prop
|
||||
-hwservicemanager_prop
|
||||
-use_memfd_prop
|
||||
-binder_cache_system_server_prop
|
||||
-graphics_config_prop
|
||||
-persist_wm_debug_prop
|
||||
-aaudio_config_prop
|
||||
-adbd_config_prop
|
||||
-apex_ready_prop
|
||||
-apexd_select_prop
|
||||
-arm64_memtag_prop
|
||||
-audio_prop
|
||||
-binder_cache_bluetooth_server_prop
|
||||
-binder_cache_telephony_server_prop
|
||||
-bluetooth_config_prop
|
||||
-boot_status_prop
|
||||
-bootloader_prop
|
||||
-bq_config_prop
|
||||
-build_odm_prop
|
||||
-build_prop
|
||||
-build_vendor_prop
|
||||
-camera2_extensions_prop
|
||||
-camera_calibration_prop
|
||||
-camera_config_prop
|
||||
-camerax_extensions_prop
|
||||
-codec2_config_prop
|
||||
-config_prop
|
||||
-cppreopt_prop
|
||||
-dalvik_config_prop_type
|
||||
-dalvik_prop
|
||||
-dalvik_runtime_prop
|
||||
-dck_prop
|
||||
-debug_prop
|
||||
-debuggerd_prop
|
||||
-default_prop
|
||||
-device_config_memory_safety_native_boot_prop
|
||||
-device_config_memory_safety_native_prop
|
||||
-device_config_nnapi_native_prop
|
||||
-device_config_runtime_native_boot_prop
|
||||
-device_config_runtime_native_prop
|
||||
-dhcp_prop
|
||||
-dumpstate_prop
|
||||
-exported3_system_prop
|
||||
-exported_config_prop
|
||||
-exported_default_prop
|
||||
-exported_dumpstate_prop
|
||||
-exported_pm_prop
|
||||
-exported_system_prop
|
||||
-ffs_config_prop
|
||||
-fingerprint_prop
|
||||
-framework_status_prop
|
||||
-gwp_asan_prop
|
||||
-hal_instrumentation_prop
|
||||
-hdmi_config_prop
|
||||
-heapprofd_prop
|
||||
-hw_timeout_multiplier_prop
|
||||
-init_service_status_private_prop
|
||||
-init_service_status_prop
|
||||
-libc_debug_prop
|
||||
-lmkd_config_prop
|
||||
-locale_prop
|
||||
-localization_prop
|
||||
-log_file_logger_prop
|
||||
-log_prop
|
||||
-log_tag_prop
|
||||
-logd_prop
|
||||
-media_config_prop
|
||||
-media_variant_prop
|
||||
-mediadrm_config_prop
|
||||
-module_sdkextensions_prop
|
||||
-net_radio_prop
|
||||
-nfc_prop
|
||||
-nnapi_ext_deny_product_prop
|
||||
-ota_prop
|
||||
-packagemanager_config_prop
|
||||
-pan_result_prop
|
||||
-permissive_mte_prop
|
||||
-persist_debug_prop
|
||||
-persist_sysui_builder_extras_prop
|
||||
-pm_prop
|
||||
-powerctl_prop
|
||||
-property_service_version_prop
|
||||
-radio_control_prop
|
||||
-radio_prop
|
||||
-restorecon_prop
|
||||
-rollback_test_prop
|
||||
-sendbug_config_prop
|
||||
-setupwizard_prop
|
||||
-shell_prop
|
||||
-soc_prop
|
||||
-socket_hook_prop
|
||||
-sqlite_log_prop
|
||||
-storagemanager_config_prop
|
||||
-surfaceflinger_color_prop
|
||||
-surfaceflinger_prop
|
||||
-system_prop
|
||||
-system_user_mode_emulation_prop
|
||||
-systemsound_config_prop
|
||||
-telephony_config_prop
|
||||
-telephony_status_prop
|
||||
-test_harness_prop
|
||||
-timezone_prop
|
||||
-usb_config_prop
|
||||
-usb_control_prop
|
||||
-usb_prop
|
||||
-userdebug_or_eng_prop
|
||||
-userspace_reboot_config_prop
|
||||
-userspace_reboot_exported_prop
|
||||
-userspace_reboot_log_prop
|
||||
-userspace_reboot_test_prop
|
||||
-vendor_socket_hook_prop
|
||||
-vndk_prop
|
||||
-vold_config_prop
|
||||
-vold_prop
|
||||
-vold_status_prop
|
||||
-vts_config_prop
|
||||
-vts_status_prop
|
||||
-wifi_log_prop
|
||||
-zygote_config_prop
|
||||
-zygote_wrap_prop
|
||||
-init_service_status_prop
|
||||
}:file { getattr open read map };
|
||||
|
||||
# Allow finding services. This is different from ephemeral_app policy.
|
||||
# Adding services manually to the allowlist is preferred hence app_api_service is not used.
|
||||
|
||||
allow sdk_sandbox activity_service:service_manager find;
|
||||
allow sdk_sandbox activity_task_service:service_manager find;
|
||||
allow sdk_sandbox appops_service:service_manager find;
|
||||
allow sdk_sandbox audio_service:service_manager find;
|
||||
allow sdk_sandbox audioserver_service:service_manager find;
|
||||
allow sdk_sandbox batteryproperties_service:service_manager find;
|
||||
allow sdk_sandbox batterystats_service:service_manager find;
|
||||
allow sdk_sandbox connectivity_service:service_manager find;
|
||||
allow sdk_sandbox connmetrics_service:service_manager find;
|
||||
allow sdk_sandbox deviceidle_service:service_manager find;
|
||||
allow sdk_sandbox display_service:service_manager find;
|
||||
allow sdk_sandbox dropbox_service:service_manager find;
|
||||
allow sdk_sandbox font_service:service_manager find;
|
||||
allow sdk_sandbox game_service:service_manager find;
|
||||
allow sdk_sandbox gpu_service:service_manager find;
|
||||
allow sdk_sandbox graphicsstats_service:service_manager find;
|
||||
allow sdk_sandbox hardware_properties_service:service_manager find;
|
||||
allow sdk_sandbox hint_service:service_manager find;
|
||||
allow sdk_sandbox imms_service:service_manager find;
|
||||
allow sdk_sandbox input_method_service:service_manager find;
|
||||
allow sdk_sandbox input_service:service_manager find;
|
||||
allow sdk_sandbox IProxyService_service:service_manager find;
|
||||
allow sdk_sandbox ipsec_service:service_manager find;
|
||||
allow sdk_sandbox launcherapps_service:service_manager find;
|
||||
allow sdk_sandbox legacy_permission_service:service_manager find;
|
||||
allow sdk_sandbox light_service:service_manager find;
|
||||
allow sdk_sandbox locale_service:service_manager find;
|
||||
allow sdk_sandbox media_communication_service:service_manager find;
|
||||
allow sdk_sandbox mediaextractor_service:service_manager find;
|
||||
allow sdk_sandbox mediametrics_service:service_manager find;
|
||||
allow sdk_sandbox media_projection_service:service_manager find;
|
||||
allow sdk_sandbox media_router_service:service_manager find;
|
||||
allow sdk_sandbox mediaserver_service:service_manager find;
|
||||
allow sdk_sandbox media_session_service:service_manager find;
|
||||
allow sdk_sandbox memtrackproxy_service:service_manager find;
|
||||
allow sdk_sandbox midi_service:service_manager find;
|
||||
allow sdk_sandbox netpolicy_service:service_manager find;
|
||||
allow sdk_sandbox netstats_service:service_manager find;
|
||||
allow sdk_sandbox network_management_service:service_manager find;
|
||||
allow sdk_sandbox notification_service:service_manager find;
|
||||
allow sdk_sandbox package_service:service_manager find;
|
||||
allow sdk_sandbox permission_checker_service:service_manager find;
|
||||
allow sdk_sandbox permission_service:service_manager find;
|
||||
allow sdk_sandbox permissionmgr_service:service_manager find;
|
||||
allow sdk_sandbox platform_compat_service:service_manager find;
|
||||
allow sdk_sandbox power_service:service_manager find;
|
||||
allow sdk_sandbox procstats_service:service_manager find;
|
||||
allow sdk_sandbox registry_service:service_manager find;
|
||||
allow sdk_sandbox restrictions_service:service_manager find;
|
||||
allow sdk_sandbox rttmanager_service:service_manager find;
|
||||
allow sdk_sandbox search_service:service_manager find;
|
||||
allow sdk_sandbox selection_toolbar_service:service_manager find;
|
||||
allow sdk_sandbox sensor_privacy_service:service_manager find;
|
||||
allow sdk_sandbox sensorservice_service:service_manager find;
|
||||
allow sdk_sandbox servicediscovery_service:service_manager find;
|
||||
allow sdk_sandbox settings_service:service_manager find;
|
||||
allow sdk_sandbox speech_recognition_service:service_manager find;
|
||||
allow sdk_sandbox statusbar_service:service_manager find;
|
||||
allow sdk_sandbox storagestats_service:service_manager find;
|
||||
allow sdk_sandbox surfaceflinger_service:service_manager find;
|
||||
allow sdk_sandbox telecom_service:service_manager find;
|
||||
allow sdk_sandbox tethering_service:service_manager find;
|
||||
allow sdk_sandbox textclassification_service:service_manager find;
|
||||
allow sdk_sandbox textservices_service:service_manager find;
|
||||
allow sdk_sandbox texttospeech_service:service_manager find;
|
||||
allow sdk_sandbox thermal_service:service_manager find;
|
||||
allow sdk_sandbox translation_service:service_manager find;
|
||||
allow sdk_sandbox tv_iapp_service:service_manager find;
|
||||
allow sdk_sandbox tv_input_service:service_manager find;
|
||||
allow sdk_sandbox uimode_service:service_manager find;
|
||||
allow sdk_sandbox vcn_management_service:service_manager find;
|
||||
allow sdk_sandbox webviewupdate_service:service_manager find;
|
||||
allow sdk_sandbox {
|
||||
activity_service
|
||||
activity_task_service
|
||||
appops_service
|
||||
audio_service
|
||||
audioserver_service
|
||||
batteryproperties_service
|
||||
batterystats_service
|
||||
cameraserver_service
|
||||
connectivity_service
|
||||
connmetrics_service
|
||||
deviceidle_service
|
||||
display_service
|
||||
dropbox_service
|
||||
ephemeral_app_api_service
|
||||
font_service
|
||||
game_service
|
||||
gpu_service
|
||||
graphicsstats_service
|
||||
hardware_properties_service
|
||||
hint_service
|
||||
imms_service
|
||||
input_method_service
|
||||
input_service
|
||||
IProxyService_service
|
||||
ipsec_service
|
||||
launcherapps_service
|
||||
legacy_permission_service
|
||||
light_service
|
||||
locale_service
|
||||
media_communication_service
|
||||
mediadrmserver_service
|
||||
mediaextractor_service
|
||||
mediametrics_service
|
||||
media_projection_service
|
||||
media_router_service
|
||||
mediaserver_service
|
||||
media_session_service
|
||||
memtrackproxy_service
|
||||
midi_service
|
||||
netpolicy_service
|
||||
netstats_service
|
||||
network_management_service
|
||||
notification_service
|
||||
package_service
|
||||
permission_checker_service
|
||||
permission_service
|
||||
permissionmgr_service
|
||||
platform_compat_service
|
||||
power_service
|
||||
procstats_service
|
||||
radio_service
|
||||
registry_service
|
||||
restrictions_service
|
||||
rttmanager_service
|
||||
search_service
|
||||
selection_toolbar_service
|
||||
sensor_privacy_service
|
||||
sensorservice_service
|
||||
servicediscovery_service
|
||||
settings_service
|
||||
speech_recognition_service
|
||||
statusbar_service
|
||||
storagestats_service
|
||||
surfaceflinger_service
|
||||
telecom_service
|
||||
tethering_service
|
||||
textclassification_service
|
||||
textservices_service
|
||||
texttospeech_service
|
||||
thermal_service
|
||||
translation_service
|
||||
tv_iapp_service
|
||||
tv_input_service
|
||||
uimode_service
|
||||
vcn_management_service
|
||||
webviewupdate_service
|
||||
}:service_manager find;
|
||||
|
||||
allow sdk_sandbox system_linker_exec:file execute_no_trans;
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue