| Stephen Smalley | 8840fa7 | 2013-09-11 11:37:46 -0400 | [diff] [blame] | 1 | # |
| 2 | # Apps that run with the system UID, e.g. com.android.system.ui, |
| 3 | # com.android.settings. These are not as privileged as the system |
| 4 | # server. |
| 5 | # |
| 6 | type system_app, domain; |
| Stephen Smalley | 8840fa7 | 2013-09-11 11:37:46 -0400 | [diff] [blame] | 7 | app_domain(system_app) |
| Stephen Smalley | 85708ec | 2014-02-24 10:48:03 -0500 | [diff] [blame] | 8 | net_domain(system_app) |
| Nick Kralevich | 2e7a301 | 2014-01-10 23:05:25 -0800 | [diff] [blame] | 9 | binder_service(system_app) |
| Stephen Smalley | 5637099 | 2013-10-23 13:12:55 -0400 | [diff] [blame] | 10 | |
| Stephen Smalley | 91a4f8d | 2014-05-07 13:10:02 -0400 | [diff] [blame] | 11 | # Read and write /data/data subdirectory. |
| 12 | allow system_app system_app_data_file:dir create_dir_perms; |
| 13 | allow system_app system_app_data_file:file create_file_perms; |
| Stephen Smalley | 5637099 | 2013-10-23 13:12:55 -0400 | [diff] [blame] | 14 | |
| Robin Lee | 51bfecf | 2014-10-13 12:10:08 +0100 | [diff] [blame] | 15 | # Read /data/misc/keychain subdirectory. |
| 16 | allow system_app keychain_data_file:dir r_dir_perms; |
| 17 | allow system_app keychain_data_file:file r_file_perms; |
| 18 | |
| Stephen Smalley | f1ea707 | 2014-05-27 14:23:32 -0400 | [diff] [blame] | 19 | # Read and write to other system-owned /data directories, such as |
| Robin Lee | 51bfecf | 2014-10-13 12:10:08 +0100 | [diff] [blame] | 20 | # /data/system/cache and /data/misc/user. |
| Stephen Smalley | f1ea707 | 2014-05-27 14:23:32 -0400 | [diff] [blame] | 21 | allow system_app system_data_file:dir create_dir_perms; |
| 22 | allow system_app system_data_file:file create_file_perms; |
| Robin Lee | 51bfecf | 2014-10-13 12:10:08 +0100 | [diff] [blame] | 23 | allow system_app misc_user_data_file:dir create_dir_perms; |
| 24 | allow system_app misc_user_data_file:file create_file_perms; |
| Stephen Smalley | f1ea707 | 2014-05-27 14:23:32 -0400 | [diff] [blame] | 25 | # Audit writes to these directories and files so we can identify |
| 26 | # and possibly move these directories into their own type in the future. |
| 27 | auditallow system_app system_data_file:dir { create setattr add_name remove_name rmdir rename }; |
| 28 | auditallow system_app system_data_file:file { create setattr append write link unlink rename }; |
| 29 | |
| Stephen Smalley | 5637099 | 2013-10-23 13:12:55 -0400 | [diff] [blame] | 30 | # Read wallpaper file. |
| 31 | allow system_app wallpaper_file:file r_file_perms; |
| 32 | |
| Nick Kralevich | dd1ec6d | 2013-11-01 10:45:03 -0700 | [diff] [blame] | 33 | # Write to properties |
| Nick Kralevich | 3e78000 | 2013-12-10 16:40:49 -0800 | [diff] [blame] | 34 | unix_socket_connect(system_app, property, init) |
| 35 | allow system_app debug_prop:property_service set; |
| Stephen Smalley | fee4915 | 2014-06-19 10:27:02 -0400 | [diff] [blame] | 36 | allow system_app net_radio_prop:property_service set; |
| 37 | allow system_app system_radio_prop:property_service set; |
| 38 | auditallow system_app net_radio_prop:property_service set; |
| 39 | auditallow system_app system_radio_prop:property_service set; |
| Nick Kralevich | dd1ec6d | 2013-11-01 10:45:03 -0700 | [diff] [blame] | 40 | allow system_app system_prop:property_service set; |
| Stephen Smalley | 1c0c010 | 2014-03-06 14:47:22 -0500 | [diff] [blame] | 41 | allow system_app ctl_bugreport_prop:property_service set; |
| Mark Salyzyn | 9e7bbf6 | 2014-06-12 12:47:22 -0700 | [diff] [blame] | 42 | allow system_app logd_prop:property_service set; |
| Stephen Smalley | 1c0c010 | 2014-03-06 14:47:22 -0500 | [diff] [blame] | 43 | |
| 44 | # Create /data/anr/traces.txt. |
| 45 | allow system_app anr_data_file:dir ra_dir_perms; |
| 46 | allow system_app anr_data_file:file create_file_perms; |
| Mark Salyzyn | c52d738 | 2014-05-09 17:47:19 -0700 | [diff] [blame] | 47 | |
| Pawit Pornkitprasan | 9d94204 | 2014-12-11 22:33:49 +0700 | [diff] [blame] | 48 | # Settings need to access app name and icon from asec |
| 49 | allow system_app asec_apk_file:file r_file_perms; |
| 50 | |
| Riley Spahn | b1ec3df | 2014-07-01 08:38:56 -0700 | [diff] [blame] | 51 | allow system_app system_app_service:service_manager add; |
| 52 | |
| Riley Spahn | 1196d2a | 2014-06-17 14:58:52 -0700 | [diff] [blame] | 53 | allow system_app keystore:keystore_key { |
| 54 | test |
| 55 | get |
| 56 | insert |
| 57 | delete |
| 58 | exist |
| 59 | saw |
| 60 | reset |
| 61 | password |
| 62 | lock |
| 63 | unlock |
| 64 | zero |
| 65 | sign |
| 66 | verify |
| 67 | grant |
| 68 | duplicate |
| 69 | clear_uid |
| 70 | }; |
| 71 | |
| Mark Salyzyn | c52d738 | 2014-05-09 17:47:19 -0700 | [diff] [blame] | 72 | control_logd(system_app) |