| Nick Kralevich | 748fdef | 2013-07-12 16:33:29 -0700 | [diff] [blame] | 1 | ### |
| 2 | ### Apps signed with the media key. |
| 3 | ### |
| 4 | |
| 5 | type media_app, domain; |
| Nick Kralevich | 748fdef | 2013-07-12 16:33:29 -0700 | [diff] [blame] | 6 | app_domain(media_app) |
| 7 | platform_app_domain(media_app) |
| 8 | # Access the network. |
| 9 | net_domain(media_app) |
| Stephen Smalley | 5637099 | 2013-10-23 13:12:55 -0400 | [diff] [blame] | 10 | # Access /dev/mtp_usb. |
| 11 | allow media_app mtp_device:chr_file rw_file_perms; |
| 12 | # Write to /cache. |
| 13 | allow media_app cache_file:dir rw_dir_perms; |
| 14 | allow media_app cache_file:file create_file_perms; |
| 15 | # Stat /cache/lost+found |
| 16 | allow media_app unlabeled:file getattr; |
| 17 | allow media_app unlabeled:dir getattr; |
| 18 | # Stat /cache/backup |
| 19 | allow media_app cache_backup_file:file getattr; |
| 20 | allow media_app cache_backup_file:dir getattr; |
| 21 | # Read files in the rootdir (in particular, file_contexts for restorecon). |
| 22 | allow media_app rootfs:file r_file_perms; |
| 23 | allow media_app download_file:dir rw_dir_perms; |
| 24 | allow media_app download_file:file create_file_perms; |
| 25 | # Allow platform apps to mark platform app data files as download files |
| Nick Kralevich | 748fdef | 2013-07-12 16:33:29 -0700 | [diff] [blame] | 26 | relabelto_domain(media_app) |
| Stephen Smalley | 5637099 | 2013-10-23 13:12:55 -0400 | [diff] [blame] | 27 | allow media_app platform_app_data_file:dir relabelfrom; |
| Nick Kralevich | 748fdef | 2013-07-12 16:33:29 -0700 | [diff] [blame] | 28 | allow media_app download_file:dir relabelto; |