1# Allow apps to read the Test Harness Mode property. This property is used in 2# the implementation of ActivityManager.isDeviceInTestHarnessMode() 3get_prop(appdomain, test_harness_prop) 4 5get_prop(appdomain, adbd_config_prop) 6 7userdebug_or_eng(`perfetto_producer({ appdomain })') 8 9# Prevent apps from causing presubmit failures. 10# Apps can cause selinux denials by accessing CE storage 11# and/or external storage. In either case, the selinux denial is 12# not the cause of the failure, but just a symptom that 13# storage isn't ready. Many apps handle the failure appropriately. 14# 15# Apps cannot access external storage before it becomes available. 16dontaudit appdomain storage_stub_file:dir getattr; 17# Attempts to write to system_data_file is generally a sign 18# that apps are attempting to access encrypted storage before 19# the ACTION_USER_UNLOCKED intent is delivered. Apps are not 20# allowed to write to CE storage before it's available. 21# Attempting to do so will be blocked by both selinux and unix 22# permissions. 23dontaudit appdomain system_data_file:dir write; 24# Apps should not be reading vendor-defined properties. 25dontaudit appdomain vendor_default_prop:file read; 26 27neverallow appdomain system_server:udp_socket { 28 accept append bind create ioctl listen lock name_bind 29 relabelfrom relabelto setattr shutdown }; 30 31# Transition to a non-app domain. 32# Exception for the shell and su domains, can transition to runas, etc. 33# Exception for crash_dump to allow for app crash reporting. 34# Exception for renderscript binaries (/system/bin/bcc, /system/bin/ld.mc) 35# to allow renderscript to create privileged executable files. 36neverallow { appdomain -shell userdebug_or_eng(`-su') } 37 { domain -appdomain -crash_dump -rs }:process { transition }; 38neverallow { appdomain -shell userdebug_or_eng(`-su') } 39 { domain -appdomain }:process { dyntransition }; 40 41# Don't allow regular apps access to storage configuration properties. 42neverallow { appdomain -mediaprovider_app } storage_config_prop:file no_rw_file_perms; 43 44# Allow to read graphics related properties. 45get_prop(appdomain, graphics_config_prop) 46