b9760aa0d5
Platform (any of the apps signed by build keys, i.e. platform|release|shared|media) apps expect to be able to share files with each other or with third party apps by passing open files or pathnames over Binder. Therefore, we switch to only enforcing the per-app process and file isolation via SELinux on third party apps, not platform apps. Make the platform app domains mlstrustedsubjects so that they can access any files created by third party apps. Introduce a new platform_app_data_file type for platform apps so that we can mark it as a mlstrustedobject and allow third party apps to read/write files created by the platform apps. Specify this new type for the platform app entries in seapp_contexts. Remove levelFromUid=true for the platform apps in seapp_contexts since we are no longer enforcing per-app separation among them.
93 lines
3.2 KiB
Plaintext
93 lines
3.2 KiB
Plaintext
# Filesystem types
|
|
type labeledfs, fs_type;
|
|
type pipefs, fs_type;
|
|
type sockfs, fs_type;
|
|
type rootfs, fs_type;
|
|
type proc, fs_type;
|
|
type qtaguid_proc, fs_type, mlstrustedobject;
|
|
type selinuxfs, fs_type;
|
|
type cgroup, fs_type, mlstrustedobject;
|
|
type sysfs, fs_type, mlstrustedobject;
|
|
type sysfs_writable, fs_type, sysfs_type, mlstrustedobject;
|
|
type sysfs_nfc_power_writable, fs_type, sysfs_type, mlstrustedobject;
|
|
type inotify, fs_type, mlstrustedobject;
|
|
type devpts, fs_type;
|
|
type tmpfs, fs_type;
|
|
type shm, fs_type;
|
|
type mqueue, fs_type;
|
|
type sdcard, fs_type, mlstrustedobject;
|
|
type debugfs, fs_type, mlstrustedobject;
|
|
|
|
# File types
|
|
type unlabeled, file_type;
|
|
# Default type for anything under /system.
|
|
type system_file, file_type;
|
|
# Default type for anything under /data.
|
|
type system_data_file, file_type, data_file_type;
|
|
# /data/drm - DRM plugin data
|
|
type drm_data_file, file_type, data_file_type;
|
|
# /data/anr - ANR traces
|
|
type anr_data_file, file_type, data_file_type, mlstrustedobject;
|
|
# /data/tombstones - core dumps
|
|
type tombstone_data_file, file_type, data_file_type;
|
|
# /data/app - user-installed apps
|
|
type apk_data_file, file_type, data_file_type;
|
|
type apk_tmp_file, file_type, data_file_type, mlstrustedobject;
|
|
# /data/dalvik-cache
|
|
type dalvikcache_data_file, file_type, data_file_type;
|
|
# /data/local - writable by shell
|
|
type shell_data_file, file_type, data_file_type;
|
|
# /data/gps
|
|
type gps_data_file, file_type, data_file_type;
|
|
# /data/misc subdirectories
|
|
type bluetoothd_data_file, file_type, data_file_type;
|
|
type bluetooth_data_file, file_type, data_file_type;
|
|
type keystore_data_file, file_type, data_file_type;
|
|
type vpn_data_file, file_type, data_file_type;
|
|
type systemkeys_data_file, file_type, data_file_type;
|
|
type wifi_data_file, file_type, data_file_type;
|
|
type radio_data_file, file_type, data_file_type;
|
|
type nfc_data_file, file_type, data_file_type;
|
|
type camera_calibration_file, file_type, data_file_type;
|
|
# /data/data subdirectories - app sandboxes
|
|
type app_data_file, file_type, data_file_type;
|
|
type platform_app_data_file, file_type, data_file_type, mlstrustedobject;
|
|
# Default type for anything under /cache
|
|
type cache_file, file_type, mlstrustedobject;
|
|
# Default type for anything under /efs
|
|
type efs_file, file_type;
|
|
# Type for wallpaper file.
|
|
type wallpaper_file, file_type, mlstrustedobject;
|
|
|
|
# All devices have bluetooth efs files. But they
|
|
# vary per device, so this type is used in per
|
|
# defice policy
|
|
type bluetooth_efs_file, file_type;
|
|
|
|
# Socket types
|
|
type bluetooth_socket, file_type;
|
|
type dbus_socket, file_type;
|
|
type dnsproxyd_socket, file_type, mlstrustedobject;
|
|
type gps_socket, file_type;
|
|
type installd_socket, file_type;
|
|
type keystore_socket, file_type;
|
|
type netd_socket, file_type;
|
|
type property_socket, file_type;
|
|
type qemud_socket, file_type;
|
|
type rild_socket, file_type;
|
|
type rild_debug_socket, file_type;
|
|
type system_wpa_socket, file_type;
|
|
type vold_socket, file_type;
|
|
type wpa_socket, file_type;
|
|
type zygote_socket, file_type;
|
|
|
|
# UART (for GPS) control proc file
|
|
type gps_control, file_type;
|
|
|
|
# Allow files to be created in their appropriate filesystems.
|
|
allow fs_type self:filesystem associate;
|
|
allow sysfs_type sysfs:filesystem associate;
|
|
allow file_type labeledfs:filesystem associate;
|
|
allow file_type tmpfs:filesystem associate;
|
|
allow dev_type tmpfs:filesystem associate;
|