From 7d01a99a7106711b0e466d0bafad2077645453c6 Mon Sep 17 00:00:00 2001 From: Chad Brubaker <cbrubaker@google.com> Date: Thu, 30 Mar 2017 15:50:56 -0700 Subject: [PATCH] Further lock down access to services from ephemeral apps This removes access to * contexthub_service * device_policy_service * ethernet_service * fingerprint_service * shortcut_service * trust_service * usb_service Test: cts-tradefed run commandAndExit cts-dev -m CtsAppSecurityHostTestCases -t android.appsecurity.cts.EphemeralTest Bug: 33349998 Change-Id: Iad9302041d7674ae6ebeb1c559c64d13df62c304 --- public/service.te | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/public/service.te b/public/service.te index 444f82a57..0b4e00b4a 100644 --- a/public/service.te +++ b/public/service.te @@ -45,7 +45,7 @@ type battery_service, system_server_service, service_manager_type; type bluetooth_manager_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; type cameraproxy_service, system_server_service, service_manager_type; type clipboard_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; -type contexthub_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; +type contexthub_service, app_api_service, system_server_service, service_manager_type; type IProxyService_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; type commontime_management_service, system_server_service, service_manager_type; type companion_device_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; @@ -59,7 +59,7 @@ type country_detector_service, app_api_service, ephemeral_app_api_service, syste type coverage_service, system_server_service, service_manager_type; type cpuinfo_service, system_api_service, system_server_service, service_manager_type; type dbinfo_service, system_api_service, system_server_service, service_manager_type; -type device_policy_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; +type device_policy_service, app_api_service, system_server_service, service_manager_type; type deviceidle_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; type device_identifiers_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; type devicestoragemonitor_service, system_server_service, service_manager_type; @@ -70,8 +70,8 @@ type netd_listener_service, system_server_service, service_manager_type; type DockObserver_service, system_server_service, service_manager_type; type dreams_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; type dropbox_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; -type ethernet_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; -type fingerprint_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; +type ethernet_service, app_api_service, system_server_service, service_manager_type; +type fingerprint_service, app_api_service, system_server_service, service_manager_type; type gfxinfo_service, system_api_service, system_server_service, service_manager_type; type graphicsstats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; type hardware_service, system_server_service, service_manager_type; @@ -118,19 +118,19 @@ type sensorservice_service, app_api_service, ephemeral_app_api_service, system_s type serial_service, system_api_service, system_server_service, service_manager_type; type servicediscovery_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; type settings_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; -type shortcut_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; +type shortcut_service, app_api_service, system_server_service, service_manager_type; type statusbar_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; type storagestats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; type task_service, system_server_service, service_manager_type; type textclassification_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; type textservices_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; type telecom_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; -type trust_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; +type trust_service, app_api_service, system_server_service, service_manager_type; type tv_input_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; type uimode_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; type updatelock_service, system_api_service, system_server_service, service_manager_type; type usagestats_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; -type usb_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; +type usb_service, app_api_service, system_server_service, service_manager_type; type user_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; type vibrator_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; type voiceinteraction_service, app_api_service, ephemeral_app_api_service, system_server_service, service_manager_type; -- GitLab