PWN-Hunter/android_system_sepolicy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge "Allow Instant/V2 apps to load code from /data/data"

Browse Source 
am: 7c6627768b

Change-Id: I20f956cd6cfbd198dc8e72fb7d3bfeadeb2f09d5
This commit is contained in:
Chad Brubaker 2017-11-14 01:13:20 +00:00 committed by android-build-merger
commit ba87a9aa31
2 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
private/ephemeral_app.te
View File

@ -19,6 +19,10 @@ app_domain(ephemeral_app)
# Allow ephemeral apps to read/write files in visible storage if provided fds # Allow ephemeral apps to read/write files in visible storage if provided fds
allow ephemeral_app { sdcard_type media_rw_data_file }:file {read write getattr ioctl lock append}; allow ephemeral_app { sdcard_type media_rw_data_file }:file {read write getattr ioctl lock append};
# Some apps ship with shared libraries and binaries that they write out
# to their sandbox directory and then execute.
allow ephemeral_app app_data_file:file {r_file_perms execute};
# services # services
allow ephemeral_app audioserver_service:service_manager find; allow ephemeral_app audioserver_service:service_manager find;
allow ephemeral_app cameraserver_service:service_manager find; allow ephemeral_app cameraserver_service:service_manager find;
@ -35,8 +39,7 @@ allow ephemeral_app ephemeral_app_api_service:service_manager find;
### neverallow rules ### neverallow rules
### ###
# Executable content should never be loaded from an ephemeral app home directory. neverallow ephemeral_app app_data_file:file execute_no_trans;
neverallow ephemeral_app app_data_file:file { execute execute_no_trans };
# Receive or send uevent messages. # Receive or send uevent messages.
neverallow ephemeral_app domain:netlink_kobject_uevent_socket *; neverallow ephemeral_app domain:netlink_kobject_uevent_socket *;

1
private/seapp_contexts
View File

@ -105,7 +105,6 @@ user=_isolated domain=isolated_app levelFrom=user
user=_app seinfo=media domain=mediaprovider name=android.process.media type=app_data_file levelFrom=user user=_app seinfo=media domain=mediaprovider name=android.process.media type=app_data_file levelFrom=user
user=_app seinfo=platform domain=platform_app type=app_data_file levelFrom=user user=_app seinfo=platform domain=platform_app type=app_data_file levelFrom=user
user=_app isV2App=true isEphemeralApp=true domain=ephemeral_app type=app_data_file levelFrom=user user=_app isV2App=true isEphemeralApp=true domain=ephemeral_app type=app_data_file levelFrom=user
user=_app isV2App=true domain=untrusted_v2_app type=app_data_file levelFrom=user
user=_app isPrivApp=true domain=priv_app type=app_data_file levelFrom=user user=_app isPrivApp=true domain=priv_app type=app_data_file levelFrom=user
user=_app minTargetSdkVersion=26 domain=untrusted_app type=app_data_file levelFrom=user user=_app minTargetSdkVersion=26 domain=untrusted_app type=app_data_file levelFrom=user
user=_app domain=untrusted_app_25 type=app_data_file levelFrom=user user=_app domain=untrusted_app_25 type=app_data_file levelFrom=user