1### 2### Apps that run with the system UID, e.g. com.android.system.ui, 3### com.android.settings. These are not as privileged as the system 4### server. 5### 6 7typeattribute system_app coredomain; 8 9app_domain(system_app) 10net_domain(system_app) 11binder_service(system_app) 12 13# android.ui and system.ui 14allow system_app rootfs:dir getattr; 15 16# Read and write /data/data subdirectory. 17allow system_app system_app_data_file:dir create_dir_perms; 18allow system_app system_app_data_file:{ file lnk_file } create_file_perms; 19 20# Read and write to /data/misc/user. 21allow system_app misc_user_data_file:dir create_dir_perms; 22allow system_app misc_user_data_file:file create_file_perms; 23 24# Access to vold-mounted storage for measuring free space 25allow system_app mnt_media_rw_file:dir search; 26 27# Access to apex files stored on /data (b/136063500) 28# Needed so that Settings can access NOTICE files inside apex 29# files located in the assets/ directory. 30allow system_app apex_data_file:dir search; 31allow system_app staging_data_file:file r_file_perms; 32 33# Read wallpaper file. 34allow system_app wallpaper_file:file r_file_perms; 35 36# Read icon file. 37allow system_app icon_file:file r_file_perms; 38 39# Write to properties 40set_prop(system_app, bluetooth_a2dp_offload_prop) 41set_prop(system_app, bluetooth_audio_hal_prop) 42set_prop(system_app, bluetooth_prop) 43set_prop(system_app, debug_prop) 44set_prop(system_app, system_prop) 45set_prop(system_app, exported_bluetooth_prop) 46set_prop(system_app, exported_system_prop) 47set_prop(system_app, exported2_system_prop) 48set_prop(system_app, exported3_system_prop) 49set_prop(system_app, logd_prop) 50set_prop(system_app, net_radio_prop) 51set_prop(system_app, system_radio_prop) 52set_prop(system_app, exported_system_radio_prop) 53set_prop(system_app, log_tag_prop) 54userdebug_or_eng(`set_prop(system_app, logpersistd_logging_prop)') 55auditallow system_app net_radio_prop:property_service set; 56auditallow system_app system_radio_prop:property_service set; 57auditallow system_app exported_system_radio_prop:property_service set; 58# Allow Settings to enable Dynamic System Update 59set_prop(system_app, dynamic_system_prop) 60 61# ctl interface 62set_prop(system_app, ctl_default_prop) 63set_prop(system_app, ctl_bugreport_prop) 64 65# Create /data/anr/traces.txt. 66allow system_app anr_data_file:dir ra_dir_perms; 67allow system_app anr_data_file:file create_file_perms; 68 69# Settings need to access app name and icon from asec 70allow system_app asec_apk_file:file r_file_perms; 71 72# Allow system apps (like Settings) to interact with statsd 73binder_call(system_app, statsd) 74 75# Allow system apps to interact with incidentd 76binder_call(system_app, incidentd) 77 78# Allow system apps to interact with gpuservice 79binder_call(system_app, gpuservice) 80 81allow system_app servicemanager:service_manager list; 82# TODO: scope this down? Too broad? 83allow system_app { 84 service_manager_type 85 -apex_service 86 -dnsresolver_service 87 -dumpstate_service 88 -installd_service 89 -iorapd_service 90 -lpdump_service 91 -netd_service 92 -system_suspend_control_service 93 -virtual_touchpad_service 94 -vold_service 95 -vr_hwc_service 96}:service_manager find; 97# suppress denials for services system_app should not be accessing. 98dontaudit system_app { 99 dnsresolver_service 100 dumpstate_service 101 installd_service 102 iorapd_service 103 netd_service 104 virtual_touchpad_service 105 vold_service 106 vr_hwc_service 107}:service_manager find; 108 109allow system_app keystore:keystore_key { 110 get_state 111 get 112 insert 113 delete 114 exist 115 list 116 reset 117 password 118 lock 119 unlock 120 is_empty 121 sign 122 verify 123 grant 124 duplicate 125 clear_uid 126 user_changed 127}; 128 129# settings app reads /proc/version 130allow system_app { 131 proc_version 132}:file r_file_perms; 133 134# Settings app writes to /dev/stune/foreground/tasks. 135allow system_app cgroup:file w_file_perms; 136 137control_logd(system_app) 138read_runtime_log_tags(system_app) 139get_prop(system_app, device_logging_prop) 140 141# allow system apps to use UDP sockets provided by the system server but not 142# modify them other than to connect 143allow system_app system_server:udp_socket { 144 connect getattr read recvfrom sendto write getopt setopt }; 145 146### 147### Neverallow rules 148### 149 150# app domains which access /dev/fuse should not run as system_app 151neverallow system_app fuse_device:chr_file *; 152