1typeattribute simpleperf_app_runner coredomain; 2 3domain_auto_trans(shell, simpleperf_app_runner_exec, simpleperf_app_runner) 4 5# run simpleperf_app_runner in adb shell. 6allow simpleperf_app_runner adbd:fd use; 7allow simpleperf_app_runner adbd:unix_stream_socket { read write }; 8allow simpleperf_app_runner shell:fd use; 9allow simpleperf_app_runner devpts:chr_file { read write ioctl }; 10 11# simpleperf_app_runner reads package information. 12allow simpleperf_app_runner system_data_file:file r_file_perms; 13allow simpleperf_app_runner system_data_file:lnk_file getattr; 14allow simpleperf_app_runner packages_list_file:file r_file_perms; 15 16# The app's data dir may be accessed through a symlink. 17allow simpleperf_app_runner system_data_file:lnk_file read; 18 19# simpleperf_app_runner switches to the app UID/GID. 20allow simpleperf_app_runner self:global_capability_class_set { setuid setgid }; 21 22# simpleperf_app_runner switches to the app security context. 23selinux_check_context(simpleperf_app_runner) # validate context 24allow simpleperf_app_runner self:process setcurrent; 25allow simpleperf_app_runner { ephemeral_app isolated_app platform_app priv_app untrusted_app_all }:process dyntransition; # setcon 26 27# simpleperf_app_runner/libselinux needs access to seapp_contexts_file to 28# determine which domain to transition to. 29allow simpleperf_app_runner seapp_contexts_file:file r_file_perms; 30 31# simpleperf_app_runner passes pipe fds. 32# simpleperf_app_runner writes app type (debuggable or profileable) to pipe fds. 33allow simpleperf_app_runner shell:fifo_file { getattr read write }; 34 35# simpleperf_app_runner checks shell data paths. 36# simpleperf_app_runner passes shell data fds. 37allow simpleperf_app_runner shell_data_file:dir { getattr search }; 38allow simpleperf_app_runner shell_data_file:file { getattr write }; 39 40### 41### neverallow rules 42### 43 44# simpleperf_app_runner cannot have capabilities other than CAP_SETUID and CAP_SETGID 45neverallow simpleperf_app_runner self:global_capability_class_set ~{ setuid setgid }; 46neverallow simpleperf_app_runner self:global_capability2_class_set *; 47