Skip to content
Snippets Groups Projects
Commit 0aa47bbf authored by Alex Klyubin's avatar Alex Klyubin Committed by android-build-merger
Browse files

Merge "Loosen system app data neverallows" into oc-dev

am: ad2e6166

Change-Id: I58039b5d0a6f5b79aea7ef46cc7ecf06461adfad
parents 0e5890c5 ad2e6166
No related branches found
No related tags found
No related merge requests found
......@@ -656,10 +656,17 @@ neverallow installd system_data_file:file ~{ r_file_perms relabelfrom unlink };
# respect system_app sandboxes
neverallow {
domain
-system_app # its own sandbox
-appdomain # finer-grained rules for appdomain are listed below
-system_server #populate com.android.providers.settings/databases/settings.db.
-installd # creation of app sandbox
} system_app_data_file:dir_file_class_set { create unlink open };
neverallow {
isolated_app
untrusted_app_all # finer-grained rules for appdomain are listed below
ephemeral_app
priv_app
} system_app_data_file:dir_file_class_set { create unlink open };
# Services should respect app sandboxes
neverallow {
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment