1# Allow apps to read the Test Harness Mode property. This property is used in
2# the implementation of ActivityManager.isDeviceInTestHarnessMode()
3get_prop(appdomain, test_harness_prop)
4
5get_prop(appdomain, boot_status_prop)
6get_prop(appdomain, dalvik_config_prop)
7get_prop(appdomain, media_config_prop)
8get_prop(appdomain, packagemanager_config_prop)
9get_prop(appdomain, radio_control_prop)
10get_prop(appdomain, surfaceflinger_color_prop)
11get_prop(appdomain, systemsound_config_prop)
12get_prop(appdomain, telephony_config_prop)
13get_prop(appdomain, userspace_reboot_config_prop)
14get_prop(appdomain, vold_config_prop)
15get_prop(appdomain, adbd_config_prop)
16get_prop(appdomain, dck_prop)
17
18# Allow ART to be configurable via device_config properties
19# (ART "runs" inside the app process)
20get_prop(appdomain, device_config_runtime_native_prop)
21get_prop(appdomain, device_config_runtime_native_boot_prop)
22
23userdebug_or_eng(`perfetto_producer({ appdomain })')
24
25# Prevent apps from causing presubmit failures.
26# Apps can cause selinux denials by accessing CE storage
27# and/or external storage. In either case, the selinux denial is
28# not the cause of the failure, but just a symptom that
29# storage isn't ready. Many apps handle the failure appropriately.
30#
31# Apps cannot access external storage before it becomes available.
32dontaudit appdomain storage_stub_file:dir getattr;
33# Attempts to write to system_data_file is generally a sign
34# that apps are attempting to access encrypted storage before
35# the ACTION_USER_UNLOCKED intent is delivered. Apps are not
36# allowed to write to CE storage before it's available.
37# Attempting to do so will be blocked by both selinux and unix
38# permissions.
39dontaudit appdomain system_data_file:dir write;
40# Apps should not be reading vendor-defined properties.
41dontaudit appdomain vendor_default_prop:file read;
42
43# Access to /mnt/media_rw/<vol> (limited by DAC to apps with external_storage gid)
44allow appdomain mnt_media_rw_file:dir search;
45
46neverallow appdomain system_server:udp_socket {
47        accept append bind create ioctl listen lock name_bind
48        relabelfrom relabelto setattr shutdown };
49
50# Transition to a non-app domain.
51# Exception for the shell and su domains, can transition to runas, etc.
52# Exception for crash_dump to allow for app crash reporting.
53# Exception for renderscript binaries (/system/bin/bcc, /system/bin/ld.mc)
54# to allow renderscript to create privileged executable files.
55neverallow { appdomain -shell userdebug_or_eng(`-su') }
56    { domain -appdomain -crash_dump -rs }:process { transition };
57neverallow { appdomain -shell userdebug_or_eng(`-su') }
58    { domain -appdomain }:process { dyntransition };
59
60# Don't allow regular apps access to storage configuration properties.
61neverallow { appdomain -mediaprovider_app } storage_config_prop:file no_rw_file_perms;
62
63# Allow to read sendbug.preferred.domain
64get_prop(appdomain, sendbug_config_prop)
65
66# Allow to read graphics related properties.
67get_prop(appdomain, graphics_config_prop)
68
69# Allow to read persist.config.calibration_fac
70get_prop(appdomain, camera_calibration_prop)
71
72# Allow to read db.log.detailed, db.log.slow_query_threshold*
73get_prop(appdomain, sqlite_log_prop)
74
75# Allow font file read by apps.
76allow appdomain font_data_file:file r_file_perms;
77allow appdomain font_data_file:dir r_dir_perms;
78
79# Enter /data/misc/apexdata/
80allow appdomain apex_module_data_file:dir search;
81# Read /data/misc/apexdata/com.android.art, execute signed AOT artifacts.
82allow appdomain apex_art_data_file:dir r_dir_perms;
83allow appdomain apex_art_data_file:file rx_file_perms;
84
85# Allow access to tombstones if an fd to one is given to you.
86# This is restricted by unix permissions, so an app must go through system_server to get one.
87allow appdomain tombstone_data_file:file { getattr read };
88neverallow appdomain tombstone_data_file:file ~{ getattr read };
89
90# Sensitive app domains are not allowed to execute from /data
91# to prevent persistence attacks and ensure all code is executed
92# from read-only locations.
93neverallow {
94  bluetooth
95  isolated_app
96  nfc
97  radio
98  shared_relro
99  system_app
100} {
101  data_file_type
102  -apex_art_data_file
103  -dalvikcache_data_file
104  -system_data_file # shared libs in apks
105  -apk_data_file
106}:file no_x_file_perms;
107