fb15c9f12f
Bug: 116512211 Test: Builds, boots, including upcoming changes needing this Change-Id: I6f119368c5a4f7ac6c0325915dff60124c5a6399
28 lines
1.2 KiB
Text
28 lines
1.2 KiB
Text
# TODO: deal with tmpfs_domain pub/priv split properly
|
|
# Read system properties managed by zygote.
|
|
allow appdomain zygote_tmpfs:file read;
|
|
|
|
# Read from (but not create) system_server buffers transferred through
|
|
# ashmem, e.g. battery stats.
|
|
allow appdomain system_server_tmpfs:file read;
|
|
|
|
# Get info from priv_app through ashmem, such as contact
|
|
# info etc.
|
|
allow appdomain priv_app_tmpfs:file read;
|
|
|
|
neverallow appdomain system_server:udp_socket {
|
|
accept append bind create ioctl listen lock name_bind
|
|
relabelfrom relabelto setattr shutdown };
|
|
|
|
# Transition to a non-app domain.
|
|
# Exception for the shell and su domains, can transition to runas, etc.
|
|
# Exception for crash_dump to allow for app crash reporting.
|
|
# Exception for renderscript binaries (/system/bin/bcc, /system/bin/ld.mc)
|
|
# to allow renderscript to create privileged executable files.
|
|
neverallow { appdomain -shell userdebug_or_eng(`-su') }
|
|
{ domain -appdomain -crash_dump -rs }:process { transition };
|
|
neverallow { appdomain -shell userdebug_or_eng(`-su') }
|
|
{ domain -appdomain }:process { dyntransition };
|
|
|
|
# Disallow apps from using IP memory store
|
|
neverallow { appdomain -shell } ipmemorystore_service:service_manager *;
|