system_server.te

#
# System Server aka system_server spawned by zygote.
# Most of the framework services run in this process.
#
type system_server, domain, mlstrustedsubject;
permissive_or_unconfined(system_server)

# Define a type for tmpfs-backed ashmem regions.
tmpfs_domain(system_server)

# Dalvik Compiler JIT Mapping.
allow system_server self:process execmem;
allow system_server ashmem_device:chr_file execute;
allow system_server system_server_tmpfs:file execute;

# For art.
allow system_server dalvikcache_data_file:file execute;

# Child of the zygote.
allow system_server zygote:fd use;
allow system_server zygote:process sigchld;
allow system_server zygote_tmpfs:file read;

# Needed to close the zygote socket, which involves getopt / getattr
# This should be deleted after b/12061011 is fixed
allow system_server zygote:unix_stream_socket { getopt getattr };

# system server gets network and bluetooth permissions.
net_domain(system_server)
bluetooth_domain(system_server)

# These are the capabilities assigned by the zygote to the
# system server.
allow system_server self:capability {
    kill
    net_admin
    net_bind_service
    net_broadcast
    net_raw
    sys_boot
    sys_module
    sys_nice
    sys_resource
    sys_time
    sys_tty_config
};

allow system_server self:capability2 block_suspend;

# Triggered by /proc/pid accesses, not allowed.
dontaudit system_server self:capability sys_ptrace;

# Trigger module auto-load.
allow system_server kernel:system module_request;

# Use netlink uevent sockets.
allow system_server self:netlink_kobject_uevent_socket *;

# Kill apps.
allow system_server appdomain:process { sigkill signal };

# Set scheduling info for apps.
allow system_server appdomain:process { getsched setsched };
allow system_server mediaserver:process { getsched setsched };

# Read /proc data for apps.
allow system_server appdomain:dir r_dir_perms;
allow system_server appdomain:{ file lnk_file } rw_file_perms;

# Read/Write to /proc/net/xt_qtaguid/ctrl and and /dev/xt_qtaguid.