1# Allow apps to read the Test Harness Mode property. This property is used in 2# the implementation of ActivityManager.isDeviceInTestHarnessMode() 3get_prop(appdomain, test_harness_prop) 4 5neverallow appdomain system_server:udp_socket { 6 accept append bind create ioctl listen lock name_bind 7 relabelfrom relabelto setattr shutdown }; 8 9# Transition to a non-app domain. 10# Exception for the shell and su domains, can transition to runas, etc. 11# Exception for crash_dump to allow for app crash reporting. 12# Exception for renderscript binaries (/system/bin/bcc, /system/bin/ld.mc) 13# to allow renderscript to create privileged executable files. 14neverallow { appdomain -shell userdebug_or_eng(`-su') } 15 { domain -appdomain -crash_dump -rs }:process { transition }; 16neverallow { appdomain -shell userdebug_or_eng(`-su') } 17 { domain -appdomain }:process { dyntransition }; 18