b729aa6c5e
Checkin apps use /data/misc_ce/<id>/checkin to backup the checkin metadata. So users won't lose the checkin tokens when they clear the app's storage. One example is when GMScore is used for checkin, users may clear GMScore data via "settings". If the device accidentally loses the token without backup, it won't be able to checkin again until factory reset. The contents in checkin dir will be cleaned up when a user is removed from the device. We also plan to add Gmscore test to ensure the dir is cleaned up at checkin time, thus prevent other Gmscore modules from using this storage by mistake. Bug: 197636740 Test: boot device, check selinux label, check gmscore writes to the new dir Change-Id: If3ff5e0fb75b4d49ce80d91b0086b58db002e4fb
144 lines
5.8 KiB
Text
144 lines
5.8 KiB
Text
###
|
|
### A domain for further sandboxing the PrebuiltGMSCore app.
|
|
###
|
|
typeattribute gmscore_app coredomain;
|
|
|
|
app_domain(gmscore_app)
|
|
|
|
allow gmscore_app sysfs_type:dir search;
|
|
# Read access to /sys/class/net/wlan*/address
|
|
r_dir_file(gmscore_app, sysfs_net)
|
|
# Read access to /sys/block/zram*/mm_stat
|
|
r_dir_file(gmscore_app, sysfs_zram)
|
|
|
|
r_dir_file(gmscore_app, rootfs)
|
|
|
|
# Allow GMS core to open kernel config for OTA matching through libvintf
|
|
allow gmscore_app config_gz:file { open read getattr };
|
|
|
|
# Allow GMS core to communicate with update_engine for A/B update.
|
|
binder_call(gmscore_app, update_engine)
|
|
allow gmscore_app update_engine_service:service_manager find;
|
|
|
|
# Allow GMS core to communicate with dumpsys storaged.
|
|
binder_call(gmscore_app, storaged)
|
|
allow gmscore_app storaged_service:service_manager find;
|
|
|
|
# Allow GMS core to access system_update_service (e.g. to publish pending
|
|
# system update info).
|
|
allow gmscore_app system_update_service:service_manager find;
|
|
|
|
# Allow GMS core to communicate with statsd.
|
|
binder_call(gmscore_app, statsd)
|
|
|
|
# Allow GMS core to generate unique hardware IDs
|
|
allow gmscore_app keystore:keystore_key gen_unique_id;
|
|
allow gmscore_app keystore:keystore2_key gen_unique_id;
|
|
|
|
# Allow GMS core to access /sys/fs/selinux/policyvers for compatibility check
|
|
allow gmscore_app selinuxfs:file r_file_perms;
|
|
|
|
# suppress denials for non-API accesses.
|
|
dontaudit gmscore_app exec_type:file r_file_perms;
|
|
dontaudit gmscore_app device:dir r_dir_perms;
|
|
dontaudit gmscore_app fs_bpf:dir r_dir_perms;
|
|
dontaudit gmscore_app net_dns_prop:file r_file_perms;
|
|
dontaudit gmscore_app proc:file r_file_perms;
|
|
dontaudit gmscore_app proc_interrupts:file r_file_perms;
|
|
dontaudit gmscore_app proc_modules:file r_file_perms;
|
|
dontaudit gmscore_app proc_net:file r_file_perms;
|
|
dontaudit gmscore_app proc_stat:file r_file_perms;
|
|
dontaudit gmscore_app proc_version:file r_file_perms;
|
|
dontaudit gmscore_app sysfs:dir r_dir_perms;
|
|
dontaudit gmscore_app sysfs:file r_file_perms;
|
|
dontaudit gmscore_app sysfs_android_usb:file r_file_perms;
|
|
dontaudit gmscore_app sysfs_dm:file r_file_perms;
|
|
dontaudit gmscore_app sysfs_loop:file r_file_perms;
|
|
dontaudit gmscore_app { wifi_prop wifi_hal_prop }:file r_file_perms;
|
|
dontaudit gmscore_app mirror_data_file:dir search;
|
|
dontaudit gmscore_app mnt_vendor_file:dir search;
|
|
|
|
# Access the network
|
|
net_domain(gmscore_app)
|
|
|
|
# webview crash handling depends on self ptrace (b/27697529, b/20150694, b/19277529#comment7)
|
|
allow gmscore_app self:process ptrace;
|
|
|
|
# Allow loading executable code from writable priv-app home
|
|
# directories. This is a W^X violation, however, it needs
|
|
# to be supported for now for the following reasons.
|
|
# * /data/user_*/0/*/code_cache/* POSSIBLE uses (b/117841367)
|
|
# 1) com.android.opengl.shaders_cache
|
|
# 2) com.android.skia.shaders_cache
|
|
# 3) com.android.renderscript.cache
|
|
# * /data/user_de/0/com.google.android.gms/app_chimera
|
|
# TODO: Tighten (b/112357170)
|
|
allow gmscore_app privapp_data_file:file execute;
|
|
|
|
# Chrome Crashpad uses the the dynamic linker to load native executables
|
|
# from an APK (b/112050209, crbug.com/928422)
|
|
allow gmscore_app system_linker_exec:file execute_no_trans;
|
|
|
|
allow gmscore_app privapp_data_file:lnk_file create_file_perms;
|
|
|
|
# /proc access
|
|
allow gmscore_app proc_vmstat:file r_file_perms;
|
|
|
|
# Allow interaction with gpuservice
|
|
binder_call(gmscore_app, gpuservice)
|
|
allow gmscore_app gpu_service:service_manager find;
|
|
|
|
# find services that expose both @SystemAPI and normal APIs.
|
|
allow gmscore_app app_api_service:service_manager find;
|
|
allow gmscore_app system_api_service:service_manager find;
|
|
allow gmscore_app audioserver_service:service_manager find;
|
|
allow gmscore_app cameraserver_service:service_manager find;
|
|
allow gmscore_app drmserver_service:service_manager find;
|
|
allow gmscore_app mediadrmserver_service:service_manager find;
|
|
allow gmscore_app mediaextractor_service:service_manager find;
|
|
allow gmscore_app mediametrics_service:service_manager find;
|
|
allow gmscore_app mediaserver_service:service_manager find;
|
|
allow gmscore_app network_watchlist_service:service_manager find;
|
|
allow gmscore_app nfc_service:service_manager find;
|
|
allow gmscore_app oem_lock_service:service_manager find;
|
|
allow gmscore_app persistent_data_block_service:service_manager find;
|
|
allow gmscore_app radio_service:service_manager find;
|
|
allow gmscore_app recovery_service:service_manager find;
|
|
allow gmscore_app stats_service:service_manager find;
|
|
|
|
# Used by Finsky / Android "Verify Apps" functionality when
|
|
# running "adb install foo.apk".
|
|
allow gmscore_app shell_data_file:file r_file_perms;
|
|
allow gmscore_app shell_data_file:dir r_dir_perms;
|
|
|
|
# Write to /cache.
|
|
allow gmscore_app { cache_file cache_recovery_file }:dir create_dir_perms;
|
|
allow gmscore_app { cache_file cache_recovery_file }:file create_file_perms;
|
|
# /cache is a symlink to /data/cache on some devices. Allow reading the link.
|
|
allow gmscore_app cache_file:lnk_file r_file_perms;
|
|
|
|
# Write to /data/ota_package for OTA packages.
|
|
allow gmscore_app ota_package_file:dir rw_dir_perms;
|
|
allow gmscore_app ota_package_file:file create_file_perms;
|
|
|
|
# Write the checkin metadata to /data/misc_ce/<userid>/checkin
|
|
allow gmscore_app checkin_data_file:dir rw_dir_perms;
|
|
allow gmscore_app checkin_data_file:file create_file_perms;
|
|
|
|
# Used by Finsky / Android "Verify Apps" functionality when
|
|
# running "adb install foo.apk".
|
|
allow gmscore_app shell_data_file:file r_file_perms;
|
|
allow gmscore_app shell_data_file:dir r_dir_perms;
|
|
|
|
# b/18504118: Allow reads from /data/anr/traces.txt
|
|
allow gmscore_app anr_data_file:file r_file_perms;
|
|
|
|
# b/148974132: com.android.vending needs this
|
|
allow gmscore_app priv_app:tcp_socket { read write };
|
|
|
|
# b/168059475 Allow GMSCore to read Virtual AB properties to determine
|
|
# if device supports VAB.
|
|
get_prop(gmscore_app, virtual_ab_prop)
|
|
|
|
# b/186488185: Allow GMSCore to read dck properties
|
|
get_prop(gmscore_app, dck_prop)
|