51bfecf49d
Migrators should be allowed to write to /data/misc/keychain in order to remove it. Similarly /data/misc/user should be writable by system apps. TODO: Revoke zygote's rights to read from /data/misc/keychain on behalf of some preloaded security classes. Bug: 17811821 Change-Id: I9e9c6883cff1dca3755732225404909c16a0e547
61 lines
2.4 KiB
Text
61 lines
2.4 KiB
Text
# zygote
|
|
type zygote, domain;
|
|
type zygote_exec, exec_type, file_type;
|
|
|
|
init_daemon_domain(zygote)
|
|
typeattribute zygote mlstrustedsubject;
|
|
# Override DAC on files and switch uid/gid.
|
|
allow zygote self:capability { dac_override setgid setuid fowner chown };
|
|
# Drop capabilities from bounding set.
|
|
allow zygote self:capability setpcap;
|
|
# Switch SELinux context to app domains.
|
|
allow zygote self:process setcurrent;
|
|
allow zygote system_server:process dyntransition;
|
|
allow zygote appdomain:process dyntransition;
|
|
# Allow zygote to read app /proc/pid dirs (b/10455872)
|
|
allow zygote appdomain:dir { getattr search };
|
|
allow zygote appdomain:file { r_file_perms };
|
|
# Move children into the peer process group.
|
|
allow zygote system_server:process { getpgid setpgid };
|
|
allow zygote appdomain:process { getpgid setpgid };
|
|
# Read system data.
|
|
allow zygote system_data_file:dir r_dir_perms;
|
|
allow zygote system_data_file:file r_file_perms;
|
|
# Read system security data.
|
|
allow zygote keychain_data_file:dir r_dir_perms;
|
|
allow zygote keychain_data_file:file r_file_perms;
|
|
# Write to /data/dalvik-cache.
|
|
allow zygote dalvikcache_data_file:dir create_dir_perms;
|
|
allow zygote dalvikcache_data_file:file create_file_perms;
|
|
# Write to /data/resource-cache
|
|
allow zygote resourcecache_data_file:dir rw_dir_perms;
|
|
allow zygote resourcecache_data_file:file create_file_perms;
|
|
# For art.
|
|
allow zygote dalvikcache_data_file:file execute;
|
|
# Execute dexopt.
|
|
allow zygote system_file:file x_file_perms;
|
|
allow zygote dex2oat_exec:file rx_file_perms;
|
|
# Control cgroups.
|
|
allow zygote cgroup:dir create_dir_perms;
|
|
allow zygote self:capability sys_admin;
|
|
# Check validity of SELinux context before use.
|
|
selinux_check_context(zygote)
|
|
# Check SELinux permissions.
|
|
selinux_check_access(zygote)
|
|
# Read /seapp_contexts and /data/security/seapp_contexts
|
|
security_access_policy(zygote)
|
|
|
|
# Native bridge functionality requires that zygote replaces
|
|
# /proc/cpuinfo with /system/lib/<ISA>/cpuinfo using a bind mount
|
|
allow zygote proc_cpuinfo:file mounton;
|
|
|
|
# Setting up /storage/emulated.
|
|
allow zygote rootfs:dir mounton;
|
|
allow zygote sdcard_type:dir { write search setattr create add_name mounton };
|
|
dontaudit zygote self:capability fsetid;
|
|
allow zygote tmpfs:dir { write create add_name setattr mounton search };
|
|
allow zygote tmpfs:filesystem mount;
|
|
allow zygote labeledfs:filesystem remount;
|
|
|
|
# Handle --invoke-with command when launching Zygote with a wrapper command.
|
|
allow zygote zygote_exec:file rx_file_perms;
|