tequilaOS/platform_system_sepolicy
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Merge "Block SDK 28 app from using proc/net/xt_qtaguid"

Browse source
This commit is contained in:
Treehugger Robot 2018-04-03 23:46:24 +00:00 committed by Gerrit Code Review
commit c69cbe5590
1 changed files with 27 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
public/app.te
View file

@ -170,14 +170,38 @@ userdebug_or_eng(`
')
# Write to /proc/net/xt_qtaguid/ctrl file.
allow appdomain qtaguid_proc:file rw_file_perms;
allow {
untrusted_app_25
untrusted_app_27
ephemeral_app
priv_app
system_app
platform_app
shell
} qtaguid_proc:file rw_file_perms;
r_dir_file({ appdomain -ephemeral_app -isolated_app }, proc_net)
# read /proc/net/xt_qtguid/*stat* to per-app network data usage.
# Exclude isolated app which may not use network sockets.
r_dir_file({ appdomain -isolated_app }, proc_qtaguid_stat)
r_dir_file({
untrusted_app_25
untrusted_app_27
ephemeral_app
priv_app
system_app
platform_app
shell
}, proc_qtaguid_stat)
# Everybody can read the xt_qtaguid resource tracking misc dev.
# So allow all apps to read from /dev/xt_qtaguid.
allow { appdomain -isolated_app } qtaguid_device:chr_file r_file_perms;
allow {
untrusted_app_25
untrusted_app_27
ephemeral_app
priv_app
system_app
platform_app
shell
} qtaguid_device:chr_file r_file_perms;
# Grant GPU access to all processes started by Zygote.
# They need that to render the standard UI.