• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1###
2### Apps signed with the platform key.
3###
4
5typeattribute platform_app coredomain;
6
7app_domain(platform_app)
8
9# Access the network.
10net_domain(platform_app)
11# Access bluetooth.
12bluetooth_domain(platform_app)
13# Read from /data/local/tmp or /data/data/com.android.shell.
14allow platform_app shell_data_file:dir search;
15allow platform_app shell_data_file:file { open getattr read };
16allow platform_app icon_file:file { open getattr read };
17# Populate /data/app/vmdl*.tmp, /data/app-private/vmdl*.tmp files
18# created by system server.
19allow platform_app { apk_tmp_file apk_private_tmp_file }:dir rw_dir_perms;
20allow platform_app { apk_tmp_file apk_private_tmp_file }:file rw_file_perms;
21allow platform_app apk_private_data_file:dir search;
22# ASEC
23allow platform_app asec_apk_file:dir create_dir_perms;
24allow platform_app asec_apk_file:file create_file_perms;
25
26# Access to /data/media.
27allow platform_app media_rw_data_file:dir create_dir_perms;
28allow platform_app media_rw_data_file:file create_file_perms;
29
30# Write to /cache.
31allow platform_app cache_file:dir create_dir_perms;
32allow platform_app cache_file:file create_file_perms;
33
34# Direct access to vold-mounted storage under /mnt/media_rw
35# This is a performance optimization that allows platform apps to bypass the FUSE layer
36allow platform_app mnt_media_rw_file:dir r_dir_perms;
37allow platform_app sdcard_type:dir create_dir_perms;
38allow platform_app sdcard_type:file create_file_perms;
39
40# com.android.systemui
41allow platform_app rootfs:dir getattr;
42
43# com.android.captiveportallogin reads /proc/vmstat
44allow platform_app {
45  proc_vmstat
46}:file r_file_perms;
47
48# /proc/net access.
49# TODO(b/9496886) Audit access for removal.
50r_dir_file(platform_app, proc_net_type)
51userdebug_or_eng(`
52  auditallow platform_app proc_net_type:{ dir file lnk_file } { getattr open read };
53')
54
55allow platform_app audioserver_service:service_manager find;
56allow platform_app cameraserver_service:service_manager find;
57allow platform_app drmserver_service:service_manager find;
58allow platform_app mediaserver_service:service_manager find;
59allow platform_app mediametrics_service:service_manager find;
60allow platform_app mediaextractor_service:service_manager find;
61allow platform_app mediacodec_service:service_manager find;
62allow platform_app mediadrmserver_service:service_manager find;
63allow platform_app persistent_data_block_service:service_manager find;
64allow platform_app radio_service:service_manager find;
65allow platform_app thermal_service:service_manager find;
66allow platform_app timezone_service:service_manager find;
67allow platform_app app_api_service:service_manager find;
68allow platform_app system_api_service:service_manager find;
69allow platform_app vr_manager_service:service_manager find;
70allow platform_app gpu_service:service_manager find;
71allow platform_app stats_service:service_manager find;
72
73# Allow platform apps to interact with gpuservice
74binder_call(platform_app, gpuservice)
75
76# Allow platform apps to log via statsd.
77allow platform_app statsd:binder call;
78
79# Access to /data/preloads
80allow platform_app preloads_data_file:file r_file_perms;
81allow platform_app preloads_data_file:dir r_dir_perms;
82allow platform_app preloads_media_file:file r_file_perms;
83allow platform_app preloads_media_file:dir r_dir_perms;
84
85read_runtime_log_tags(platform_app)
86
87# allow platform apps to use UDP sockets provided by the system server but not
88# modify them other than to connect
89allow platform_app system_server:udp_socket {
90        connect getattr read recvfrom sendto write getopt setopt };
91
92# allow platform apps to connect to the property service
93set_prop(platform_app, test_boot_reason_prop)
94
95# allow platform apps to create symbolic link
96allow platform_app app_data_file:lnk_file create_file_perms;
97
98###
99### Neverallow rules
100###
101
102# app domains which access /dev/fuse should not run as platform_app
103neverallow platform_app fuse_device:chr_file *;
104