Skip to content
Snippets Groups Projects
Commit f77a0b15 authored by android-build-team Robot's avatar android-build-team Robot
Browse files

Merge cherrypicks of [3134552, 3130583, 3131953, 3131954, 3131955, 3131956,...

Merge cherrypicks of [3134552, 3130583, 3131953, 3131954, 3131955, 3131956, 3131957, 3131958, 3131959, 3132062, 3132336, 3131074, 3133939, 3131024, 3131025, 3131026, 3130584, 3130879, 3130880] into oc-mr1-release

Change-Id: If68afda5ce15c6fd6b6868f115e2975c2aeb1320
......@@ -19,6 +19,10 @@ app_domain(ephemeral_app)
# Allow ephemeral apps to read/write files in visible storage if provided fds
allow ephemeral_app { sdcard_type media_rw_data_file }:file {read write getattr ioctl lock append};
# Some apps ship with shared libraries and binaries that they write out
# to their sandbox directory and then execute.
allow ephemeral_app app_data_file:file {r_file_perms execute};
# services
allow ephemeral_app audioserver_service:service_manager find;
allow ephemeral_app cameraserver_service:service_manager find;
......@@ -35,8 +39,7 @@ allow ephemeral_app ephemeral_app_api_service:service_manager find;
### neverallow rules
###
# Executable content should never be loaded from an ephemeral app home directory.
neverallow ephemeral_app app_data_file:file { execute execute_no_trans };
neverallow ephemeral_app app_data_file:file execute_no_trans;
# Receive or send uevent messages.
neverallow ephemeral_app domain:netlink_kobject_uevent_socket *;
......
......@@ -105,7 +105,6 @@ user=_isolated domain=isolated_app levelFrom=user
user=_app seinfo=media domain=mediaprovider name=android.process.media type=app_data_file levelFrom=user
user=_app seinfo=platform domain=platform_app type=app_data_file levelFrom=user
user=_app isV2App=true isEphemeralApp=true domain=ephemeral_app type=app_data_file levelFrom=user
user=_app isV2App=true domain=untrusted_v2_app type=app_data_file levelFrom=user
user=_app isPrivApp=true domain=priv_app type=app_data_file levelFrom=user
user=_app minTargetSdkVersion=26 domain=untrusted_app type=app_data_file levelFrom=user
user=_app domain=untrusted_app_25 type=app_data_file levelFrom=user
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment