1type simpleperf_app_runner, domain, mlstrustedsubject; 2type simpleperf_app_runner_exec, system_file_type, exec_type, file_type; 3 4# run simpleperf_app_runner in adb shell. 5allow simpleperf_app_runner adbd:fd use; 6allow simpleperf_app_runner shell:fd use; 7allow simpleperf_app_runner devpts:chr_file { read write ioctl }; 8 9# simpleperf_app_runner reads package information. 10allow simpleperf_app_runner system_data_file:file r_file_perms; 11allow simpleperf_app_runner system_data_file:lnk_file getattr; 12allow simpleperf_app_runner packages_list_file:file r_file_perms; 13 14# The app's data dir may be accessed through a symlink. 15allow simpleperf_app_runner system_data_file:lnk_file read; 16 17# simpleperf_app_runner switches to the app UID/GID. 18allow simpleperf_app_runner self:global_capability_class_set { setuid setgid }; 19 20# simpleperf_app_runner switches to the app security context. 21selinux_check_context(simpleperf_app_runner) # validate context 22allow simpleperf_app_runner self:process setcurrent; 23allow simpleperf_app_runner untrusted_app_all:process dyntransition; # setcon 24 25# simpleperf_app_runner/libselinux needs access to seapp_contexts_file to 26# determine which domain to transition to. 27allow simpleperf_app_runner seapp_contexts_file:file r_file_perms; 28 29# simpleperf_app_runner passes pipe fds. 30allow simpleperf_app_runner shell:fifo_file read; 31 32# simpleperf_app_runner checks shell data paths. 33# simpleperf_app_runner passes shell data fds. 34allow simpleperf_app_runner shell_data_file:dir { getattr search }; 35allow simpleperf_app_runner shell_data_file:file { getattr write }; 36 37### 38### neverallow rules 39### 40 41# simpleperf_app_runner cannot have capabilities other than CAP_SETUID and CAP_SETGID 42neverallow simpleperf_app_runner self:global_capability_class_set ~{ setuid setgid }; 43neverallow simpleperf_app_runner self:global_capability2_class_set *; 44