b93f26fd89
Bug: 224796470 Bug: 203670791 Bug: 204989872 Bug: 211761016 Bug: 217543371 Bug: 217559719 Bug: 215105355 Bug: 220320098 Test: make, ensure device boots Change-Id: Ia96ae5407f5a83390ce1b610da0d49264e90d7e2 Merged-In: Ib085c49f29dab47268e479fe5266490a66adaa87 Merged-In: I2215ffe74e0fa19ff936e90c08c4ebfd177e5258 Merged-In: I478c9a16032dc1f1286f5295fc080cbe574f09c9 Merged-In: Ibf478466e5d6ab0ee08fca4da3b4bae974a82db0 Merged-In: I5d519605d9fbe80c7b4c9fb6572bc72425f6e90a Merged-In: I05d2071e023d0de8a93dcd111674f8d8102a21ce Merged-In: I6572a7a5c46c52c9421d0e9c9fc653ddbd6de145 Merged-In: I1b6d1a778cb658bdfd930b684e4ba0640031b226 Merged-In: I9fb98e0caee75bdaaa35d11d174004505f236799
67 lines
2.1 KiB
XML
67 lines
2.1 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<policy>
|
|
|
|
<!--
|
|
|
|
* A signature is a hex encoded X.509 certificate or a tag defined in
|
|
keys.conf and is required for each signer tag. The signature can
|
|
either appear as a set of attached cert child tags or as an attribute.
|
|
* A signer tag must contain a seinfo tag XOR multiple package stanzas.
|
|
* Each signer/package tag is allowed to contain one seinfo tag. This tag
|
|
represents additional info that each app can use in setting a SELinux security
|
|
context on the eventual process as well as the apps data directory.
|
|
* seinfo assignments are made according to the following rules:
|
|
- Stanzas with package name refinements will be checked first.
|
|
- Stanzas w/o package name refinements will be checked second.
|
|
- The "default" seinfo label is automatically applied.
|
|
|
|
* valid stanzas can take one of the following forms:
|
|
|
|
// single cert protecting seinfo
|
|
<signer signature="@PLATFORM" >
|
|
<seinfo value="platform" />
|
|
</signer>
|
|
|
|
// multiple certs protecting seinfo (all contained certs must match)
|
|
<signer>
|
|
<cert signature="@PLATFORM1"/>
|
|
<cert signature="@PLATFORM2"/>
|
|
<seinfo value="platform" />
|
|
</signer>
|
|
|
|
// single cert protecting explicitly named app
|
|
<signer signature="@PLATFORM" >
|
|
<package name="com.android.foo">
|
|
<seinfo value="bar" />
|
|
</package>
|
|
</signer>
|
|
|
|
// multiple certs protecting explicitly named app (all certs must match)
|
|
<signer>
|
|
<cert signature="@PLATFORM1"/>
|
|
<cert signature="@PLATFORM2"/>
|
|
<package name="com.android.foo">
|
|
<seinfo value="bar" />
|
|
</package>
|
|
</signer>
|
|
-->
|
|
|
|
<!-- Platform dev key in AOSP -->
|
|
<signer signature="@PLATFORM" >
|
|
<seinfo value="platform" />
|
|
</signer>
|
|
|
|
<!-- Sdk Sandbox key -->
|
|
<signer signature="@SDK_SANDBOX" >
|
|
<seinfo value="sdk_sandbox" />
|
|
</signer>
|
|
|
|
<!-- Media key in AOSP -->
|
|
<signer signature="@MEDIA" >
|
|
<seinfo value="media" />
|
|
</signer>
|
|
|
|
<signer signature="@NETWORK_STACK" >
|
|
<seinfo value="network_stack" />
|
|
</signer>
|
|
</policy>
|