fee49159e7
Introduce a net_radio_prop type for net. properties that can be set by radio or system. Introduce a system_radio_prop type for sys. properties that can be set by radio or system. Introduce a dhcp_prop type for properties that can be set by dhcp or system. Drop the rild_prop vs radio_prop distinction; this was an early experiment to see if we could separate properties settable by rild versus other radio UID processes but it did not pan out. Remove the ability to set properties from unconfineddomain. Allow init to set any property. Allow recovery to set ctl_default_prop to restart adbd. Change-Id: I5ccafcb31ec4004dfefcec8718907f6b6f3e0dfd Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
45 lines
1.8 KiB
Text
45 lines
1.8 KiB
Text
#
|
|
# Apps that run with the system UID, e.g. com.android.system.ui,
|
|
# com.android.settings. These are not as privileged as the system
|
|
# server.
|
|
#
|
|
type system_app, domain;
|
|
app_domain(system_app)
|
|
net_domain(system_app)
|
|
binder_service(system_app)
|
|
|
|
# Read and write /data/data subdirectory.
|
|
allow system_app system_app_data_file:dir create_dir_perms;
|
|
allow system_app system_app_data_file:file create_file_perms;
|
|
|
|
# Read and write to other system-owned /data directories, such as
|
|
# /data/system/cache and /data/misc/keychain.
|
|
allow system_app system_data_file:dir create_dir_perms;
|
|
allow system_app system_data_file:file create_file_perms;
|
|
# Audit writes to these directories and files so we can identify
|
|
# and possibly move these directories into their own type in the future.
|
|
auditallow system_app system_data_file:dir { create setattr add_name remove_name rmdir rename };
|
|
auditallow system_app system_data_file:file { create setattr append write link unlink rename };
|
|
|
|
# Read wallpaper file.
|
|
allow system_app wallpaper_file:file r_file_perms;
|
|
|
|
# Write to dalvikcache.
|
|
allow system_app dalvikcache_data_file:file { write setattr };
|
|
|
|
# Write to properties
|
|
unix_socket_connect(system_app, property, init)
|
|
allow system_app debug_prop:property_service set;
|
|
allow system_app net_radio_prop:property_service set;
|
|
allow system_app system_radio_prop:property_service set;
|
|
auditallow system_app net_radio_prop:property_service set;
|
|
auditallow system_app system_radio_prop:property_service set;
|
|
allow system_app system_prop:property_service set;
|
|
allow system_app ctl_bugreport_prop:property_service set;
|
|
allow system_app logd_prop:property_service set;
|
|
|
|
# Create /data/anr/traces.txt.
|
|
allow system_app anr_data_file:dir ra_dir_perms;
|
|
allow system_app anr_data_file:file create_file_perms;
|
|
|
|
control_logd(system_app)
|