a833763ba0
Add levelFrom=user to the entries for apps other than those that run in the predefined platform UIDs (e.g. system, nfc, radio, ...). This causes libselinux to assign a per-user category set computed from the user ID portion of the Linux UID to each app process and its /data/data/<pkgdir> or /data/user/N/<pkgdir> directory. These per-user category sets can be seen in the last field of ps -Z output for apps and ls -Z /data/data or /data/user/N output for the package directories. With this applied, apps running on behalf of one user cannot read or write files created by apps running on behalf of another user, even if the file is world-readable or -writable. Similar isolation is enforced over process interactions (including /proc/pid file access), local socket communications, and System V IPC, as expressed in the set of constraints defined in the mls configuration. At present, Binder IPC is not restricted by the mls configuration; if desired, there is a constraint in the configuration that can be uncommented to also apply isolation on direct binder IPC, although communication will still be possible indirectly via the system_server. Bug: 13507660 Change-Id: I3972f846ff5e7363799ba521f1258d662b18d64e Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
52 lines
2.3 KiB
Text
52 lines
2.3 KiB
Text
# Input selectors:
|
|
# isSystemServer (boolean)
|
|
# isOwner (boolean)
|
|
# user (string)
|
|
# seinfo (string)
|
|
# name (string)
|
|
# path (string)
|
|
# sebool (string)
|
|
# isSystemServer=true can only be used once.
|
|
# An unspecified isSystemServer defaults to false.
|
|
# isOwner=true will only match for the owner/primary user.
|
|
# isOwner=false will only match for secondary users.
|
|
# If unspecified, the entry can match either case.
|
|
# An unspecified string selector will match any value.
|
|
# A user string selector that ends in * will perform a prefix match.
|
|
# user=_app will match any regular app UID.
|
|
# user=_isolated will match any isolated service UID.
|
|
# All specified input selectors in an entry must match (i.e. logical AND).
|
|
# Matching is case-insensitive.
|
|
#
|
|
# Precedence rules:
|
|
# (1) isSystemServer=true before isSystemServer=false.
|
|
# (2) Specified isOwner= before unspecified isOwner= boolean.
|
|
# (3) Specified user= string before unspecified user= string.
|
|
# (4) Fixed user= string before user= prefix (i.e. ending in *).
|
|
# (5) Longer user= prefix before shorter user= prefix.
|
|
# (6) Specified seinfo= string before unspecified seinfo= string.
|
|
# (7) Specified name= string before unspecified name= string.
|
|
# (8) Specified path= string before unspecified path= string.
|
|
# (9) Specified sebool= string before unspecified sebool= string.
|
|
#
|
|
# Outputs:
|
|
# domain (string)
|
|
# type (string)
|
|
# levelFrom (string; one of none, all, app, or user)
|
|
# level (string)
|
|
# Only entries that specify domain= will be used for app process labeling.
|
|
# Only entries that specify type= will be used for app directory labeling.
|
|
# levelFrom=user is only supported for _app or _isolated UIDs.
|
|
# levelFrom=app or levelFrom=all is only supported for _app UIDs.
|
|
# level may be used to specify a fixed level for any UID.
|
|
#
|
|
isSystemServer=true domain=system_server
|
|
user=system domain=system_app type=system_app_data_file
|
|
user=bluetooth domain=bluetooth type=bluetooth_data_file
|
|
user=nfc domain=nfc type=nfc_data_file
|
|
user=radio domain=radio type=radio_data_file
|
|
user=shared_relro domain=shared_relro
|
|
user=shell domain=shell type=shell_data_file
|
|
user=_isolated domain=isolated_app levelFrom=user
|
|
user=_app seinfo=platform domain=platform_app type=app_data_file levelFrom=user
|
|
user=_app domain=untrusted_app type=app_data_file levelFrom=user
|