92dfa31f78
The current policy would allow any application that were to "magically" get a sensitive UID into the coresponding sensitive domain. Rather then only using UID as an input selector, require seinfo=platform. Change-Id: I8a7490ed55bdcd3e4a116aece2c3522b384024ec
52 lines
2.3 KiB
Text
52 lines
2.3 KiB
Text
# Input selectors:
|
|
# isSystemServer (boolean)
|
|
# isOwner (boolean)
|
|
# user (string)
|
|
# seinfo (string)
|
|
# name (string)
|
|
# path (string)
|
|
# sebool (string)
|
|
# isSystemServer=true can only be used once.
|
|
# An unspecified isSystemServer defaults to false.
|
|
# isOwner=true will only match for the owner/primary user.
|
|
# isOwner=false will only match for secondary users.
|
|
# If unspecified, the entry can match either case.
|
|
# An unspecified string selector will match any value.
|
|
# A user string selector that ends in * will perform a prefix match.
|
|
# user=_app will match any regular app UID.
|
|
# user=_isolated will match any isolated service UID.
|
|
# All specified input selectors in an entry must match (i.e. logical AND).
|
|
# Matching is case-insensitive.
|
|
#
|
|
# Precedence rules:
|
|
# (1) isSystemServer=true before isSystemServer=false.
|
|
# (2) Specified isOwner= before unspecified isOwner= boolean.
|
|
# (3) Specified user= string before unspecified user= string.
|
|
# (4) Fixed user= string before user= prefix (i.e. ending in *).
|
|
# (5) Longer user= prefix before shorter user= prefix.
|
|
# (6) Specified seinfo= string before unspecified seinfo= string.
|
|
# (7) Specified name= string before unspecified name= string.
|
|
# (8) Specified path= string before unspecified path= string.
|
|
# (9) Specified sebool= string before unspecified sebool= string.
|
|
#
|
|
# Outputs:
|
|
# domain (string)
|
|
# type (string)
|
|
# levelFrom (string; one of none, all, app, or user)
|
|
# level (string)
|
|
# Only entries that specify domain= will be used for app process labeling.
|
|
# Only entries that specify type= will be used for app directory labeling.
|
|
# levelFrom=user is only supported for _app or _isolated UIDs.
|
|
# levelFrom=app or levelFrom=all is only supported for _app UIDs.
|
|
# level may be used to specify a fixed level for any UID.
|
|
#
|
|
isSystemServer=true domain=system_server
|
|
user=system seinfo=platform domain=system_app type=system_app_data_file
|
|
user=bluetooth seinfo=platform domain=bluetooth type=bluetooth_data_file
|
|
user=nfc seinfo=platform domain=nfc type=nfc_data_file
|
|
user=radio seinfo=platform domain=radio type=radio_data_file
|
|
user=shared_relro seinfo=platform domain=shared_relro
|
|
user=shell seinfo=platform domain=shell type=shell_data_file
|
|
user=_isolated domain=isolated_app levelFrom=user
|
|
user=_app seinfo=platform domain=platform_app type=app_data_file levelFrom=user
|
|
user=_app domain=untrusted_app type=app_data_file levelFrom=user
|