1# The entries in this file define how security contexts for apps are determined. 2# Each entry lists input selectors, used to match the app, and outputs which are 3# used to determine the security contexts for matching apps. 4# 5# Input selectors: 6# isSystemServer (boolean) 7# isEphemeralApp (boolean) 8# user (string) 9# seinfo (string) 10# name (string) 11# isPrivApp (boolean) 12# minTargetSdkVersion (unsigned integer) 13# fromRunAs (boolean) 14# isIsolatedComputeApp (boolean) 15# isSdkSandboxNext (boolean) 16# 17# All specified input selectors in an entry must match (i.e. logical AND). 18# An unspecified string or boolean selector with no default will match any 19# value. 20# A user, or name string selector that ends in * will perform a prefix 21# match. 22# String matching is case-insensitive. 23# See external/selinux/libselinux/src/android/android_platform.c, 24# seapp_context_lookup(). 25# 26# isSystemServer=true only matches the system server. 27# An unspecified isSystemServer defaults to false. 28# isEphemeralApp=true will match apps marked by PackageManager as Ephemeral 29# user=_app will match any regular app process. 30# user=_isolated will match any isolated service process. 31# user=_sdksandbox will match sdk sandbox process for an app. 32# Other values of user are matched against the name associated with the process 33# UID. 34# seinfo= matches aginst the seinfo tag for the app, determined from 35# mac_permissions.xml files. 36# The ':' character is reserved and may not be used in seinfo. 37# name= matches against the package name of the app. 38# isPrivApp=true will only match for applications preinstalled in 39# /system/priv-app. 40# minTargetSdkVersion will match applications with a targetSdkVersion 41# greater than or equal to the specified value. If unspecified, 42# it has a default value of 0. 43# fromRunAs=true means the process being labeled is started by run-as. Default 44# is false. 45# isIsolatedComputeApp=true means the process re-uses an isolated Uid but not 46# restricted to run in an isolated_app domain. Processes match this selector will 47# be mapped to isolated_compute_app by default. It is expected to be used together 48# with user=_isolated. This selector should not be used unless it is intended 49# to provide isolated processes with relaxed security restrictions. 50# 51# isSdkSandboxNext=true means sdk sandbox processes will get 52# sdk_sandbox_next sepolicy applied to them. 53# 54# Precedence: entries are compared using the following rules, in the order shown 55# (see external/selinux/libselinux/src/android/android_platform.c, 56# seapp_context_cmp()). 57# (1) isSystemServer=true before isSystemServer=false. 58# (2) Specified isEphemeralApp= before unspecified isEphemeralApp= 59# boolean. 60# (3) Specified user= string before unspecified user= string; 61# more specific user= string before less specific user= string. 62# (4) Specified seinfo= string before unspecified seinfo= string. 63# (5) Specified name= string before unspecified name= string; 64# more specific name= string before less specific name= string. 65# (6) Specified isPrivApp= before unspecified isPrivApp= boolean. 66# (7) Higher value of minTargetSdkVersion= before lower value of 67# minTargetSdkVersion= integer. Note that minTargetSdkVersion= 68# defaults to 0 if unspecified. 69# (8) fromRunAs=true before fromRunAs=false. 70# (9) isIsolatedComputeApp=true before isIsolatedComputeApp=false 71# (10) isSdkSandboxNext=true before isSdkSandboxNext=false 72# (A fixed selector is more specific than a prefix, i.e. ending in *, and a 73# longer prefix is more specific than a shorter prefix.) 74# Apps are checked against entries in precedence order until the first match, 75# regardless of their order in this file. 76# 77# Duplicate entries, i.e. with identical input selectors, are not allowed. 78# 79# Outputs: 80# domain (string) 81# type (string) 82# levelFrom (string; one of none, all, app, or user) 83# level (string) 84# 85# domain= determines the label to be used for the app process; entries 86# without domain= are ignored for this purpose. 87# type= specifies the label to be used for the app data directory; entries 88# without type= are ignored for this purpose. The label specified must 89# have the app_data_file_type attribute. 90# levelFrom and level are used to determine the level (sensitivity + categories) 91# for MLS/MCS. 92# levelFrom=none omits the level. 93# levelFrom=app determines the level from the process UID. 94# levelFrom=user determines the level from the user ID. 95# levelFrom=all determines the level from both UID and user ID. 96# 97# levelFrom=user is only supported for _app or _isolated UIDs. 98# levelFrom=app or levelFrom=all is only supported for _app UIDs. 99# level may be used to specify a fixed level for any UID. 100# 101# For backwards compatibility levelFromUid=true is equivalent to levelFrom=app 102# and levelFromUid=false is equivalent to levelFrom=none. 103# 104# 105# Neverallow Assertions 106# Additional compile time assertion checks for the rules in this file can be 107# added as well. The assertion 108# rules are lines beginning with the keyword neverallow. Full support for PCRE 109# regular expressions exists on all input and output selectors. Neverallow 110# rules are never output to the built seapp_contexts file. Like all keywords, 111# neverallows are case-insensitive. A neverallow is asserted when all key value 112# inputs are matched on a key value rule line. 113# 114 115# only the system server can be assigned the system_server domains 116neverallow isSystemServer=false domain=system_server 117neverallow isSystemServer=false domain=system_server_startup 118neverallow isSystemServer="" domain=system_server 119neverallow isSystemServer="" domain=system_server_startup 120 121# system domains should never be assigned outside of system uid 122neverallow user=((?!system).)* domain=system_app 123neverallow user=((?!system).)* type=system_app_data_file 124 125# any non priv-app with a non-known uid with a specified name should have a specified 126# seinfo 127neverallow user=_app isPrivApp=false name=.* seinfo="" 128neverallow user=_app isPrivApp=false name=.* seinfo=default 129 130# neverallow shared relro to any other domain 131# and neverallow any other uid into shared_relro 132neverallow user=shared_relro domain=((?!shared_relro).)* 133neverallow user=((?!shared_relro).)* domain=shared_relro 134 135# neverallow non-isolated uids into isolated_app domain 136# and vice versa 137neverallow user=_isolated isIsolatedComputeApp=false domain=((?!isolated_app).)* 138neverallow user=((?!_isolated).)* domain=isolated_app 139 140# neverallow isolatedComputeApp into domains other than isolated_compute_app 141neverallow user=_isolated isIsolatedComputeApp=true domain=((?!isolated_compute_app).)* 142 143# uid shell should always be in shell domain, however non-shell 144# uid's can be in shell domain 145neverallow user=shell domain=((?!shell).)* 146 147# only the package named com.android.shell can run in the shell domain 148neverallow domain=shell name=((?!com\.android\.shell).)* 149neverallow user=shell name=((?!com\.android\.shell).)* 150 151# Ephemeral Apps must run in the ephemeral_app domain 152neverallow isEphemeralApp=true domain=((?!ephemeral_app).)* 153 154isSystemServer=true domain=system_server_startup 155 156# sdksandbox must run in an sdksandbox domain 157neverallow user=_sdksandbox domain=((?!sdk_sandbox).)* 158 159user=_app seinfo=platform name=com.android.traceur domain=traceur_app type=app_data_file levelFrom=all 160user=system seinfo=platform domain=system_app type=system_app_data_file 161user=system seinfo=platform isPrivApp=true name=com.android.DeviceAsWebcam domain=device_as_webcam type=system_app_data_file levelFrom=all 162user=bluetooth seinfo=bluetooth domain=bluetooth type=bluetooth_data_file 163user=network_stack seinfo=network_stack domain=network_stack type=radio_data_file 164user=nfc seinfo=platform domain=nfc type=nfc_data_file 165user=secure_element seinfo=platform domain=secure_element levelFrom=all 166user=radio seinfo=platform domain=radio type=radio_data_file 167user=shared_relro domain=shared_relro levelFrom=all 168user=shell seinfo=platform domain=shell name=com.android.shell type=shell_data_file 169user=webview_zygote seinfo=webview_zygote domain=webview_zygote 170user=_isolated domain=isolated_app levelFrom=user 171user=_isolated isIsolatedComputeApp=true domain=isolated_compute_app levelFrom=user 172user=_sdksandbox domain=sdk_sandbox_34 type=sdk_sandbox_data_file levelFrom=all 173user=_sdksandbox isSdkSandboxNext=true domain=sdk_sandbox_next type=sdk_sandbox_data_file levelFrom=all 174user=_app seinfo=app_zygote domain=app_zygote levelFrom=user 175user=_app seinfo=media domain=mediaprovider type=app_data_file levelFrom=user 176user=_app seinfo=platform domain=platform_app type=app_data_file levelFrom=user 177user=_app isEphemeralApp=true domain=ephemeral_app type=app_data_file levelFrom=all 178user=_app isPrivApp=true domain=priv_app type=privapp_data_file levelFrom=user 179user=_app isPrivApp=true name=com.google.android.permissioncontroller domain=permissioncontroller_app type=privapp_data_file levelFrom=all 180user=_app seinfo=media isPrivApp=true name=com.android.providers.media.module domain=mediaprovider_app type=privapp_data_file levelFrom=all 181user=_app seinfo=media isPrivApp=true name=com.android.providers.media.module:* domain=mediaprovider_app type=privapp_data_file levelFrom=all 182user=_app isPrivApp=true name=com.google.android.providers.media.module domain=mediaprovider_app type=privapp_data_file levelFrom=all 183user=_app isPrivApp=true name=com.google.android.providers.media.module:* domain=mediaprovider_app type=privapp_data_file levelFrom=all 184user=_app seinfo=platform isPrivApp=true name=com.android.permissioncontroller domain=permissioncontroller_app type=privapp_data_file levelFrom=all 185user=_app isPrivApp=true name=com.android.vzwomatrigger domain=vzwomatrigger_app type=privapp_data_file levelFrom=all 186user=_app isPrivApp=true name=com.android.rkpdapp domain=rkpdapp type=privapp_data_file levelFrom=user 187user=_app isPrivApp=true name=com.google.android.rkpdapp domain=rkpdapp type=privapp_data_file levelFrom=user 188user=_app isPrivApp=true name=com.google.android.gms domain=gmscore_app type=privapp_data_file levelFrom=user 189user=_app isPrivApp=true name=com.google.android.gms.* domain=gmscore_app type=privapp_data_file levelFrom=user 190user=_app isPrivApp=true name=com.google.android.gms:* domain=gmscore_app type=privapp_data_file levelFrom=user 191user=_app isPrivApp=true name=com.google.android.gsf domain=gmscore_app type=privapp_data_file levelFrom=user 192user=_app minTargetSdkVersion=34 domain=untrusted_app type=app_data_file levelFrom=all 193user=_app minTargetSdkVersion=32 domain=untrusted_app_32 type=app_data_file levelFrom=all 194user=_app minTargetSdkVersion=30 domain=untrusted_app_30 type=app_data_file levelFrom=all 195user=_app minTargetSdkVersion=29 domain=untrusted_app_29 type=app_data_file levelFrom=all 196user=_app minTargetSdkVersion=28 domain=untrusted_app_27 type=app_data_file levelFrom=all 197user=_app minTargetSdkVersion=26 domain=untrusted_app_27 type=app_data_file levelFrom=user 198user=_app domain=untrusted_app_25 type=app_data_file levelFrom=user 199user=_app minTargetSdkVersion=28 fromRunAs=true domain=runas_app levelFrom=all 200user=_app fromRunAs=true domain=runas_app levelFrom=user 201