1type keystore, domain; 2type keystore_exec, exec_type, file_type; 3 4# keystore daemon 5typeattribute keystore mlstrustedsubject; 6binder_use(keystore) 7binder_service(keystore) 8binder_call(keystore, system_server) 9 10allow keystore keystore_data_file:dir create_dir_perms; 11allow keystore keystore_data_file:notdevfile_class_set create_file_perms; 12allow keystore keystore_exec:file { getattr }; 13 14add_service(keystore, keystore_service) 15allow keystore sec_key_att_app_id_provider_service:service_manager find; 16 17# Check SELinux permissions. 18selinux_check_access(keystore) 19 20r_dir_file(keystore, cgroup) 21 22### 23### Neverallow rules 24### 25### Protect ourself from others 26### 27 28neverallow { domain -keystore } keystore_data_file:dir ~{ open create read getattr setattr search relabelto ioctl }; 29neverallow { domain -keystore } keystore_data_file:notdevfile_class_set ~{ relabelto getattr }; 30 31neverallow { domain -keystore -init } keystore_data_file:dir *; 32neverallow { domain -keystore -init } keystore_data_file:notdevfile_class_set *; 33 34neverallow * keystore:process ptrace; 35