1###
2### Apps that run with the system UID, e.g. com.android.system.ui,
3### com.android.settings.  These are not as privileged as the system
4### server.
5###
6
7typeattribute system_app coredomain;
8typeattribute system_app domain_deprecated;
9
10app_domain(system_app)
11net_domain(system_app)
12binder_service(system_app)
13
14# android.ui and system.ui
15allow system_app rootfs:dir getattr;
16
17# Read and write /data/data subdirectory.
18allow system_app system_app_data_file:dir create_dir_perms;
19allow system_app system_app_data_file:{ file lnk_file } create_file_perms;
20
21# Read and write to /data/misc/user.
22allow system_app misc_user_data_file:dir create_dir_perms;
23allow system_app misc_user_data_file:file create_file_perms;
24
25# Access to vold-mounted storage for measuring free space
26allow system_app mnt_media_rw_file:dir search;
27
28# Read wallpaper file.
29allow system_app wallpaper_file:file r_file_perms;
30
31# Read icon file.
32allow system_app icon_file:file r_file_perms;
33
34# Write to properties
35set_prop(system_app, bluetooth_prop)
36set_prop(system_app, debug_prop)
37set_prop(system_app, system_prop)
38set_prop(system_app, logd_prop)
39set_prop(system_app, net_radio_prop)
40set_prop(system_app, system_radio_prop)
41set_prop(system_app, log_tag_prop)
42userdebug_or_eng(`set_prop(system_app, logpersistd_logging_prop)')
43auditallow system_app net_radio_prop:property_service set;
44auditallow system_app system_radio_prop:property_service set;
45
46# ctl interface
47set_prop(system_app, ctl_default_prop)
48set_prop(system_app, ctl_bugreport_prop)
49
50# Create /data/anr/traces.txt.
51allow system_app anr_data_file:dir ra_dir_perms;
52allow system_app anr_data_file:file create_file_perms;
53
54# Settings need to access app name and icon from asec
55allow system_app asec_apk_file:file r_file_perms;
56
57# Allow system apps to interact with incidentd
58binder_call(system_app, incidentd)
59
60allow system_app servicemanager:service_manager list;
61# TODO: scope this down? Too broad?
62allow system_app { service_manager_type -netd_service -dumpstate_service -installd_service -virtual_touchpad_service -vr_hwc_service }:service_manager find;
63
64allow system_app keystore:keystore_key {
65    get_state
66    get
67    insert
68    delete
69    exist
70    list
71    reset
72    password
73    lock
74    unlock
75    is_empty
76    sign
77    verify
78    grant
79    duplicate
80    clear_uid
81    user_changed
82};
83
84# /sys access
85r_dir_file(system_app, sysfs_type)
86
87control_logd(system_app)
88read_runtime_log_tags(system_app)
89
90###
91### Neverallow rules
92###
93
94# app domains which access /dev/fuse should not run as system_app
95neverallow system_app fuse_device:chr_file *;
96