38b8fc8f13
From the commit that added these rules, this appears to have been an artifact of having dumpstate running in the init domain. Change-Id: Iec2b9c3f5673d0e2cce9a0bf297e23555c423e87 Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
22 lines
778 B
Text
22 lines
778 B
Text
###
|
|
### Services with isolatedProcess=true in their manifest.
|
|
###
|
|
### This file defines the rules for isolated apps. An "isolated
|
|
### app" is an APP with UID between AID_ISOLATED_START (99000)
|
|
### and AID_ISOLATED_END (99999).
|
|
###
|
|
### isolated_app includes all the appdomain rules, plus the
|
|
### additional following rules:
|
|
###
|
|
|
|
type isolated_app, domain;
|
|
app_domain(isolated_app)
|
|
|
|
# Already connected, unnamed sockets being passed over some other IPC
|
|
# hence no sock_file or connectto permission. This appears to be how
|
|
# Chrome works, may need to be updated as more apps using isolated services
|
|
# are examined.
|
|
allow isolated_app appdomain:unix_stream_socket { read write };
|
|
|
|
allow isolated_app dalvikcache_data_file:file execute;
|
|
allow isolated_app apk_data_file:dir getattr;
|