• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1# The entries in this file define how security contexts for apps are determined.
2# Each entry lists input selectors, used to match the app, and outputs which are
3# used to determine the security contexts for matching apps.
4#
5# Input selectors:
6#       isSystemServer (boolean)
7#       isEphemeralApp (boolean)
8#       isOwner (boolean)
9#       user (string)
10#       seinfo (string)
11#       name (string)
12#       path (string)
13#       isPrivApp (boolean)
14#       minTargetSdkVersion (unsigned integer)
15#       fromRunAs (boolean)
16#
17# All specified input selectors in an entry must match (i.e. logical AND).
18# An unspecified string or boolean selector with no default will match any
19# value.
20# A user, name, or path string selector that ends in * will perform a prefix
21# match.
22# String matching is case-insensitive.
23# See external/selinux/libselinux/src/android/android_platform.c,
24# seapp_context_lookup().
25#
26# isSystemServer=true only matches the system server.
27# An unspecified isSystemServer defaults to false.
28# isEphemeralApp=true will match apps marked by PackageManager as Ephemeral
29# isOwner=true will only match for the owner/primary user.
30# user=_app will match any regular app process.
31# user=_isolated will match any isolated service process.
32# Other values of user are matched against the name associated with the process
33# UID.
34# seinfo= matches aginst the seinfo tag for the app, determined from
35# mac_permissions.xml files.
36# The ':' character is reserved and may not be used in seinfo.
37# name= matches against the package name of the app.
38# path= matches against the directory path when labeling app directories.
39# isPrivApp=true will only match for applications preinstalled in
40#       /system/priv-app.
41# minTargetSdkVersion will match applications with a targetSdkVersion
42#       greater than or equal to the specified value. If unspecified,
43#       it has a default value of 0.
44# fromRunAs=true means the process being labeled is started by run-as. Default
45# is false.
46#
47# Precedence: entries are compared using the following rules, in the order shown
48# (see external/selinux/libselinux/src/android/android_platform.c,
49# seapp_context_cmp()).
50#       (1) isSystemServer=true before isSystemServer=false.
51#       (2) Specified isEphemeralApp= before unspecified isEphemeralApp=
52#             boolean.
53#       (3) Specified isOwner= before unspecified isOwner= boolean.
54#       (4) Specified user= string before unspecified user= string;
55#             more specific user= string before less specific user= string.
56#       (5) Specified seinfo= string before unspecified seinfo= string.
57#       (6) Specified name= string before unspecified name= string;
58#             more specific name= string before less specific name= string.
59#       (7) Specified path= string before unspecified path= string.
60#             more specific name= string before less specific name= string.
61#       (8) Specified isPrivApp= before unspecified isPrivApp= boolean.
62#       (9) Higher value of minTargetSdkVersion= before lower value of
63#              minTargetSdkVersion= integer. Note that minTargetSdkVersion=
64#              defaults to 0 if unspecified.
65#       (10) fromRunAs=true before fromRunAs=false.
66# (A fixed selector is more specific than a prefix, i.e. ending in *, and a
67# longer prefix is more specific than a shorter prefix.)
68# Apps are checked against entries in precedence order until the first match,
69# regardless of their order in this file.
70#
71# Duplicate entries, i.e. with identical input selectors, are not allowed.
72#
73# Outputs:
74#       domain (string)
75#       type (string)
76#       levelFrom (string; one of none, all, app, or user)
77#       level (string)
78#
79# domain= determines the label to be used for the app process; entries
80# without domain= are ignored for this purpose.
81# type= specifies the label to be used for the app data directory; entries
82# without type= are ignored for this purpose.
83# levelFrom and level are used to determine the level (sensitivity + categories)
84# for MLS/MCS.
85# levelFrom=none omits the level.
86# levelFrom=app determines the level from the process UID.
87# levelFrom=user determines the level from the user ID.
88# levelFrom=all determines the level from both UID and user ID.
89#
90# levelFrom=user is only supported for _app or _isolated UIDs.
91# levelFrom=app or levelFrom=all is only supported for _app UIDs.
92# level may be used to specify a fixed level for any UID.
93#
94# For backwards compatibility levelFromUid=true is equivalent to levelFrom=app
95# and levelFromUid=false is equivalent to levelFrom=none.
96#
97#
98# Neverallow Assertions
99# Additional compile time assertion checks for the rules in this file can be
100# added as well. The assertion
101# rules are lines beginning with the keyword neverallow. Full support for PCRE
102# regular expressions exists on all input and output selectors. Neverallow
103# rules are never output to the built seapp_contexts file. Like all keywords,
104# neverallows are case-insensitive. A neverallow is asserted when all key value
105# inputs are matched on a key value rule line.
106#
107
108# only the system server can be in system_server domain
109neverallow isSystemServer=false domain=system_server
110neverallow isSystemServer="" domain=system_server
111
112# system domains should never be assigned outside of system uid
113neverallow user=((?!system).)* domain=system_app
114neverallow user=((?!system).)* type=system_app_data_file
115
116# anything with a non-known uid with a specified name should have a specified seinfo
117neverallow user=_app name=.* seinfo=""
118neverallow user=_app name=.* seinfo=default
119
120# neverallow shared relro to any other domain
121# and neverallow any other uid into shared_relro
122neverallow user=shared_relro domain=((?!shared_relro).)*
123neverallow user=((?!shared_relro).)* domain=shared_relro
124
125# neverallow non-isolated uids into isolated_app domain
126# and vice versa
127neverallow user=_isolated domain=((?!isolated_app).)*
128neverallow user=((?!_isolated).)* domain=isolated_app
129
130# uid shell should always be in shell domain, however non-shell
131# uid's can be in shell domain
132neverallow user=shell domain=((?!shell).)*
133
134# only the package named com.android.shell can run in the shell domain
135neverallow domain=shell name=((?!com\.android\.shell).)*
136neverallow user=shell name=((?!com\.android\.shell).)*
137
138# Ephemeral Apps must run in the ephemeral_app domain
139neverallow isEphemeralApp=true domain=((?!ephemeral_app).)*
140
141isSystemServer=true domain=system_server_startup
142
143user=_app seinfo=platform name=com.android.traceur domain=traceur_app type=app_data_file levelFrom=all
144user=system seinfo=platform domain=system_app type=system_app_data_file
145user=bluetooth seinfo=platform domain=bluetooth type=bluetooth_data_file
146user=network_stack seinfo=network_stack domain=network_stack levelFrom=all type=radio_data_file
147user=nfc seinfo=platform domain=nfc type=nfc_data_file
148user=secure_element seinfo=platform domain=secure_element levelFrom=all
149user=radio seinfo=platform domain=radio type=radio_data_file
150user=shared_relro domain=shared_relro
151user=shell seinfo=platform domain=shell name=com.android.shell type=shell_data_file
152user=webview_zygote seinfo=webview_zygote domain=webview_zygote
153user=_isolated domain=isolated_app levelFrom=user
154user=_app seinfo=app_zygote domain=app_zygote levelFrom=user
155user=_app seinfo=media domain=mediaprovider name=android.process.media type=app_data_file levelFrom=user
156user=_app seinfo=platform domain=platform_app type=app_data_file levelFrom=user
157user=_app isEphemeralApp=true domain=ephemeral_app type=app_data_file levelFrom=all
158user=_app isPrivApp=true domain=priv_app type=privapp_data_file levelFrom=user
159user=_app minTargetSdkVersion=29 domain=untrusted_app type=app_data_file levelFrom=all
160user=_app minTargetSdkVersion=28 domain=untrusted_app_27 type=app_data_file levelFrom=all
161user=_app minTargetSdkVersion=26 domain=untrusted_app_27 type=app_data_file levelFrom=user
162user=_app domain=untrusted_app_25 type=app_data_file levelFrom=user
163user=_app minTargetSdkVersion=28 fromRunAs=true domain=runas_app levelFrom=all
164user=_app fromRunAs=true domain=runas_app levelFrom=user
165