android_system_sepolicy/public/system_server.te

#
# System Server aka system_server spawned by zygote.
# Most of the framework services run in this process.
#
type system_server, domain;
type system_server_tmpfs, file_type, mlstrustedobject;
1/2: Rename domain "system" to "system_server". This is a follow-up CL to the extraction of "system_app" domain from the "system" domain which left the "system" domain encompassing just the system_server. Since this change cannot be made atomically across different repositories, it temporarily adds a typealias "server" pointing to "system_server". Once all other repositories have been switched to "system_server", this alias will be removed. Change-Id: I90a6850603dcf60049963462c5572d36de62bc00 2013-09-13 15:59:04 -07:00			`#`
			`# System Server aka system_server spawned by zygote.`
			`# Most of the framework services run in this process.`
			`#`
Move system_server policy to private This leaves only the existence of system_server domain as public API. All other rules are implementation details of this domain's policy and are thus now private. Test: No change to policy according to sesearch, except for disappearance of all allow rules to do with system_server_current except those created by other domains' allow rules referencing system_server domain from public and vendor policies. Bug: 31364497 Change-Id: Ifd76fa83c046b9327883eb6f0bbcd2113f2dd1a4 2017-02-06 15:39:36 -08:00			`type system_server, domain;`
Initial selinux policy support for memfd Move all app tmpfs types to appdomain_tmpfs. These are still protected by mls categories and DAC. TODO clean up other app tmpfs types in a separate change. Treble-ize tmpfs passing between graphics composer HAL and surfaceflinger. Bug: 122854450 Test: boot Blueline with memfd enabled. Change-Id: Ib98aaba062f10972af6ae80fb85b7a0f60a32eee 2019-01-29 14:43:45 -08:00			`type system_server_tmpfs, file_type, mlstrustedobject;`