diff --git a/app.te b/app.te index 3081f53887f2dff6e05daf5a1a1be25850b44e04..11e5f336619771454edfb797b971f28775c4349b 100644 --- a/app.te +++ b/app.te @@ -48,10 +48,6 @@ allow appdomain surfaceflinger:unix_stream_socket { read write setopt getattr ge allow appdomain app_data_file:dir create_dir_perms; allow appdomain app_data_file:notdevfile_class_set create_file_perms; -# Read/write data files created by the platform apps if they -# were passed to the app via binder or local IPC. Do not allow open. -allow appdomain platform_app_data_file:file { getattr read write }; - # lib subdirectory of /data/data dir is system-owned. allow appdomain system_data_file:dir r_dir_perms; allow appdomain system_data_file:file { execute execute_no_trans open }; diff --git a/drmserver.te b/drmserver.te index a11700c1b9cee3750e25e3f2f365b4ded1cd15cc..b4191118d699b56be26d8d2111b774e792dc43b4 100644 --- a/drmserver.te +++ b/drmserver.te @@ -20,7 +20,6 @@ allow drmserver sdcard_type:dir search; allow drmserver drm_data_file:dir create_dir_perms; allow drmserver drm_data_file:file create_file_perms; allow drmserver tee_device:chr_file rw_file_perms; -allow drmserver platform_app_data_file:file { read write getattr }; allow drmserver app_data_file:file { read write getattr }; allow drmserver sdcard_type:file { read write getattr }; r_dir_file(drmserver, efs_file) diff --git a/file.te b/file.te index f1bcafdbd2ee26354fe30809e9671549b1279615..3d85bcf725905aad53280e906ef28b220600cf7e 100644 --- a/file.te +++ b/file.te @@ -76,7 +76,8 @@ type zoneinfo_data_file, file_type, data_file_type; typealias audio_data_file alias audio_firmware_file; # /data/data subdirectories - app sandboxes type app_data_file, file_type, data_file_type; -type platform_app_data_file, file_type, data_file_type, mlstrustedobject; +# Compatibility with type name used in Android 4.3 and 4.4. +typealias app_data_file alias platform_app_data_file; # Default type for anything under /cache type cache_file, file_type, mlstrustedobject; # Type for /cache/.*\.{data|restore} and default diff --git a/installd.te b/installd.te index 7c72158717ddd8628c756768f931b4ca353f905d..b9c2125726579b496a61de6821e3091ce8c0e9a9 100644 --- a/installd.te +++ b/installd.te @@ -24,7 +24,6 @@ selinux_check_context(installd) # Read /seapp_contexts and /data/security/seapp_contexts security_access_policy(installd) # ASEC -allow installd platform_app_data_file:lnk_file { create setattr }; allow installd app_data_file:lnk_file { create setattr }; allow installd asec_apk_file:file r_file_perms; allow installd bluetooth_data_file:lnk_file { create setattr }; diff --git a/media_app.te b/media_app.te index 099e0a6ff8def1101b19ccc69260a2c6137b8b66..cebf79ce49c79ae7314df8168f02f0c08326d71b 100644 --- a/media_app.te +++ b/media_app.te @@ -18,7 +18,7 @@ allow media_app download_file:dir rw_dir_perms; allow media_app download_file:file create_file_perms; # Allow platform apps to mark platform app data files as download files relabelto_domain(media_app) -allow media_app platform_app_data_file:dir relabelfrom; +allow media_app app_data_file:dir relabelfrom; allow media_app download_file:dir relabelto; # inherits from platformappdomain.te diff --git a/mediaserver.te b/mediaserver.te index 1019fc729171cb2e3330498667794bd97417c840..faec50dadf94b48fe343410fa208ad65ecd1be0f 100644 --- a/mediaserver.te +++ b/mediaserver.te @@ -22,7 +22,6 @@ allow mediaserver media_data_file:dir create_dir_perms; allow mediaserver media_data_file:file create_file_perms; allow mediaserver app_data_file:dir search; allow mediaserver app_data_file:file rw_file_perms; -allow mediaserver platform_app_data_file:file { getattr read }; allow mediaserver sdcard_type:file write; allow mediaserver { gpu_device graphics_device }:chr_file rw_file_perms; allow mediaserver video_device:dir r_dir_perms; diff --git a/platformappdomain.te b/platformappdomain.te index 701a63694699c1b1f29b8debe29a49500d68f942..5ba86017b1d3ac15a918bc26a78a341a4760ddaa 100644 --- a/platformappdomain.te +++ b/platformappdomain.te @@ -3,19 +3,14 @@ # These rules are inherited by any domain that includes platform_app_domain(). # Presently this consists of the four app domains corresponding to apps # signed by one of the four build keys: platform_app, shared_app, media_app, -# release_app. These app domains use platform_app_data_file rather -# than app_data_file for their /data/data directories (as specified via -# type= in seapp_contexts) and have greater permissions to specific +# release_app. These app domains have greater permissions to specific # directories owned by groups that are restricted to apps with # Android permissions that are signature|system. -# App sandbox file accesses. -allow platformappdomain platform_app_data_file:dir create_dir_perms; -allow platformappdomain platform_app_data_file:notdevfile_class_set create_file_perms; -allow platformappdomain platform_app_data_file:file execute; # Access to /data/media. allow platformappdomain media_rw_data_file:dir create_dir_perms; allow platformappdomain media_rw_data_file:file create_file_perms; + # Write to /cache. allow platformappdomain cache_file:dir create_dir_perms; allow platformappdomain cache_file:file create_file_perms; diff --git a/seapp_contexts b/seapp_contexts index 0a7809511c9d8bb20e09ee8b098674e2b2ba21fd..05f04869246375aa095a8aff430dc2f96f517ba8 100644 --- a/seapp_contexts +++ b/seapp_contexts @@ -40,10 +40,10 @@ user=bluetooth domain=bluetooth type=bluetooth_data_file user=nfc domain=nfc type=nfc_data_file user=radio domain=radio type=radio_data_file user=_app domain=untrusted_app type=app_data_file -user=_app seinfo=platform domain=platform_app type=platform_app_data_file -user=_app seinfo=shared domain=shared_app type=platform_app_data_file -user=_app seinfo=media domain=media_app type=platform_app_data_file +user=_app seinfo=platform domain=platform_app type=app_data_file +user=_app seinfo=shared domain=shared_app type=app_data_file +user=_app seinfo=media domain=media_app type=app_data_file user=_app seinfo=media name=com.android.providers.downloads path=cache* type=download_file -user=_app seinfo=release domain=release_app type=platform_app_data_file +user=_app seinfo=release domain=release_app type=app_data_file user=_isolated domain=isolated_app user=shell domain=shell type=shell_data_file diff --git a/surfaceflinger.te b/surfaceflinger.te index 126824791bbf3e5b2ec14d35abe379e94a5a62cd..cb67855ba2f177e7040dbb9acd3deeb8abfb429d 100644 --- a/surfaceflinger.te +++ b/surfaceflinger.te @@ -42,7 +42,6 @@ allow surfaceflinger ctl_default_prop:property_service set; # Use open files supplied by an app. allow surfaceflinger appdomain:fd use; -allow surfaceflinger platform_app_data_file:file { read write }; allow surfaceflinger app_data_file:file { read write }; # Use open file provided by bootanim.