diff --git a/untrusted_app.te b/untrusted_app.te index a92323e96a1edb4366fee7c7c74738ea5844e1ab..1b2d89e2847ec449f07a173192a5dc3529177963 100644 --- a/untrusted_app.te +++ b/untrusted_app.te @@ -148,3 +148,21 @@ neverallow untrusted_app { cache_file cache_recovery_file }:file ~{ read getattr # Do not allow untrusted_app to set system properties. neverallow untrusted_app property_socket:sock_file write; neverallow untrusted_app property_type:property_service set; + +# Do not allow untrusted_app to create/unlink files outside of its sandbox, +# internal storage or sdcard. +# World accessible data locations allow application to fill the device +# with unaccounted for data. This data will not get removed during +# application un-installation. +neverallow untrusted_app { + fs_type + -fuse # sdcard + file_type + -app_data_file # The apps sandbox itself + -media_rw_data_file # Internal storage. Known that apps can + # leave artfacts here after uninstall. + userdebug_or_eng(` + -method_trace_data_file # only on ro.debuggable=1 + -coredump_file # userdebug/eng only + ') +}:dir_file_class_set { create unlink };