diff --git a/private/bug_map b/private/bug_map index 6f78f4a457ce779d4f9a4e805655f8aa4835adc0..cb49904ea7b40acfc857f698cb440d9ade19f74c 100644 --- a/private/bug_map +++ b/private/bug_map @@ -29,7 +29,6 @@ platform_app nfc_data_file dir 74331887 postinstall postinstall capability 77958490 postinstall_dexopt postinstall_dexopt capability 77958490 postinstall_dexopt user_profile_data_file file 77958490 -priv_app system_data_file dir 72811052 profman apk_data_file dir 77922323 radio statsdw_socket sock_file 78456764 statsd hal_health_default binder 77919007 @@ -38,7 +37,5 @@ system_server crash_dump process 73128755 system_server logd_socket sock_file 64734187 system_server sdcardfs file 77856826 system_server zygote process 77856826 -untrusted_app_25 system_data_file dir 72550646 -untrusted_app_27 system_data_file dir 72550646 usbd usbd capability 72472544 zygote untrusted_app_25 process 77925912 diff --git a/private/priv_app.te b/private/priv_app.te index 3355502cea4c97249d0597a76cc271216cf342a1..37d864f80130c4a91d3620d51525a2997dda3cbd 100644 --- a/private/priv_app.te +++ b/private/priv_app.te @@ -182,6 +182,12 @@ dontaudit priv_app { wifi_prop exported_wifi_prop }:file read; allow priv_app system_server:udp_socket { connect getattr read recvfrom sendto write getopt setopt }; +# Attempts to write to system_data_file is generally a sign +# that apps are attempting to access encrypted storage before +# the ACTION_USER_UNLOCKED intent is delivered. Suppress this +# denial to prevent apps from spamming the logs. +dontaudit priv_app system_data_file:dir write; + ### ### neverallow rules ### diff --git a/private/untrusted_app_all.te b/private/untrusted_app_all.te index b2c4f407c5ab46204606f5eecd944d333567375c..c9bf65fa68e025dcafca0061c6d3fda4ebd69faf 100644 --- a/private/untrusted_app_all.te +++ b/private/untrusted_app_all.te @@ -150,3 +150,9 @@ userdebug_or_eng(` -proc_net_vpn }:{ dir file lnk_file } { getattr open read }; ') + +# Attempts to write to system_data_file is generally a sign +# that apps are attempting to access encrypted storage before +# the ACTION_USER_UNLOCKED intent is delivered. Suppress this +# denial to prevent third party apps from spamming the logs. +dontaudit untrusted_app_all system_data_file:dir write;