• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1###
2### Apps that run with the system UID, e.g. com.android.system.ui,
3### com.android.settings.  These are not as privileged as the system
4### server.
5###
6
7typeattribute system_app coredomain;
8
9app_domain(system_app)
10net_domain(system_app)
11binder_service(system_app)
12
13# android.ui and system.ui
14allow system_app rootfs:dir getattr;
15
16# Read and write /data/data subdirectory.
17allow system_app system_app_data_file:dir create_dir_perms;
18allow system_app system_app_data_file:{ file lnk_file } create_file_perms;
19
20# Read and write to /data/misc/user.
21allow system_app misc_user_data_file:dir create_dir_perms;
22allow system_app misc_user_data_file:file create_file_perms;
23
24# Access to vold-mounted storage for measuring free space
25allow system_app mnt_media_rw_file:dir search;
26
27# Access to apex files stored on /data (b/136063500)
28# Needed so that Settings can access NOTICE files inside apex
29# files located in the assets/ directory.
30allow system_app apex_data_file:dir search;
31allow system_app staging_data_file:file r_file_perms;
32
33# Read wallpaper file.
34allow system_app wallpaper_file:file r_file_perms;
35
36# Read icon file.
37allow system_app icon_file:file r_file_perms;
38
39# Write to properties
40set_prop(system_app, bluetooth_a2dp_offload_prop)
41set_prop(system_app, bluetooth_audio_hal_prop)
42set_prop(system_app, bluetooth_prop)
43set_prop(system_app, debug_prop)
44set_prop(system_app, system_prop)
45set_prop(system_app, exported_bluetooth_prop)
46set_prop(system_app, exported_system_prop)
47set_prop(system_app, exported2_system_prop)
48set_prop(system_app, exported3_system_prop)
49set_prop(system_app, logd_prop)
50set_prop(system_app, net_radio_prop)
51set_prop(system_app, system_radio_prop)
52set_prop(system_app, exported_system_radio_prop)
53set_prop(system_app, log_tag_prop)
54userdebug_or_eng(`set_prop(system_app, logpersistd_logging_prop)')
55auditallow system_app net_radio_prop:property_service set;
56auditallow system_app system_radio_prop:property_service set;
57auditallow system_app exported_system_radio_prop:property_service set;
58# Allow Settings to enable Dynamic System Update
59set_prop(system_app, dynamic_system_prop)
60
61# ctl interface
62set_prop(system_app, ctl_default_prop)
63set_prop(system_app, ctl_bugreport_prop)
64
65# Create /data/anr/traces.txt.
66allow system_app anr_data_file:dir ra_dir_perms;
67allow system_app anr_data_file:file create_file_perms;
68
69# Settings need to access app name and icon from asec
70allow system_app asec_apk_file:file r_file_perms;
71
72# Allow system apps (like Settings) to interact with statsd
73binder_call(system_app, statsd)
74
75# Allow system apps to interact with incidentd
76binder_call(system_app, incidentd)
77
78# Allow system apps to interact with gpuservice
79binder_call(system_app, gpuservice)
80
81allow system_app servicemanager:service_manager list;
82# TODO: scope this down? Too broad?
83allow system_app {
84  service_manager_type
85  -apex_service
86  -dnsresolver_service
87  -dumpstate_service
88  -installd_service
89  -iorapd_service
90  -lpdump_service
91  -netd_service
92  -system_suspend_control_service
93  -virtual_touchpad_service
94  -vold_service
95  -vr_hwc_service
96}:service_manager find;
97# suppress denials for services system_app should not be accessing.
98dontaudit system_app {
99  dnsresolver_service
100  dumpstate_service
101  installd_service
102  iorapd_service
103  netd_service
104  virtual_touchpad_service
105  vold_service
106  vr_hwc_service
107}:service_manager find;
108
109allow system_app keystore:keystore_key {
110    get_state
111    get
112    insert
113    delete
114    exist
115    list
116    reset
117    password
118    lock
119    unlock
120    is_empty
121    sign
122    verify
123    grant
124    duplicate
125    clear_uid
126    user_changed
127};
128
129# settings app reads /proc/version
130allow system_app {
131  proc_version
132}:file r_file_perms;
133
134# Settings app writes to /dev/stune/foreground/tasks.
135allow system_app cgroup:file w_file_perms;
136
137control_logd(system_app)
138read_runtime_log_tags(system_app)
139get_prop(system_app, device_logging_prop)
140
141# allow system apps to use UDP sockets provided by the system server but not
142# modify them other than to connect
143allow system_app system_server:udp_socket {
144        connect getattr read recvfrom sendto write getopt setopt };
145
146###
147### Neverallow rules
148###
149
150# app domains which access /dev/fuse should not run as system_app
151neverallow system_app fuse_device:chr_file *;
152