PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Don't open appfuse files in apps.

Browse Source 
Previously we published appfuse mount points to apps and apps open
appfuse file by themselves. We changed the design and we don't allow
apps to access appfuse mount point. Instead system server opens a file
on appfuse mount points and passes FD to apps.

The change updates apps and system server policies to adopt new design.

Bug: 29970149
Test: None
Change-Id: I0b35fee9816f61565705eecb88a472754ccffdca
This commit is contained in:
Daichi Hirono 2016-12-05 10:49:35 +09:00
parent 828433c892
commit 7ae1d23745
2 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
public/app.te
View File

@ -252,8 +252,7 @@ allow { appdomain -isolated_app } hal_graphics_allocator:fd use;
allow appdomain proc_meminfo:file r_file_perms;
# For app fuse.
allow appdomain app_fuse_file:dir rw_dir_perms;
allow appdomain app_fuse_file:file rw_file_perms;
allow appdomain app_fuse_file:file { getattr read append write };
###
### CTS-specific rules

2
public/system_server.te
View File

@ -559,6 +559,8 @@ userdebug_or_eng(`
# For AppFuse.
allow system_server vold:fd use;
allow system_server fuse_device:chr_file { read write ioctl getattr };
allow system_server app_fuse_file:dir rw_dir_perms;
allow system_server app_fuse_file:file { read write open getattr append };
# For configuring sdcardfs
allow system_server configfs:dir { create_dir_perms };