untrusted_app.te 1.69 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12
###
### Untrusted apps.
###
### This file defines the rules for untrusted apps. An "untrusted
### app" is an APP with UID between APP_AID (10000)
### and AID_ISOLATED_START (99000).
###
### untrusted_app includes all the appdomain rules, plus the
### additional following rules:
###

type untrusted_app, domain;
13
permissive untrusted_app;
14 15 16
app_domain(untrusted_app)
net_domain(untrusted_app)
bluetooth_domain(untrusted_app)
17 18 19 20 21 22 23 24 25 26 27 28 29 30 31

allow untrusted_app tun_device:chr_file rw_file_perms;

# Internal SDCard rw access.
allow untrusted_app sdcard_internal:dir create_dir_perms;
allow untrusted_app sdcard_internal:file create_file_perms;

# External SDCard rw access.
allow untrusted_app sdcard_external:dir create_dir_perms;
allow untrusted_app sdcard_external:file create_file_perms;

# ASEC
allow untrusted_app asec_apk_file:dir { getattr };
allow untrusted_app asec_apk_file:file r_file_perms;

32
# Create tcp/udp sockets
33
allow untrusted_app node_type:{ tcp_socket udp_socket } node_bind;
34
allow untrusted_app self:{ tcp_socket udp_socket } { create_socket_perms accept listen };
35 36 37
# Bind to a particular hostname/address/interface (e.g., localhost) instead of
# ANY. Normally, apps should not be listening on all interfaces.
allow untrusted_app port:{ tcp_socket udp_socket } name_bind;
38 39 40

# Allow the allocation and use of ptys
# Used by: https://play.google.com/store/apps/details?id=jackpal.androidterm
41
create_pty(untrusted_app)
42 43 44 45 46

# Used by Finsky / Android "Verify Apps" functionality when
# running "adb install foo.apk".
# TODO: Long term, we don't want apps probing into shell data files.
# Figure out a way to remove these rules.
47
allow untrusted_app shell_data_file:file r_file_perms;
48
allow untrusted_app shell_data_file:dir r_dir_perms;