Skip to content
Snippets Groups Projects
Select Git revision
  • test default
1 result
Blame Permalink
  • Stephen Smalley's avatar
    2c347e0a
    Drop obsolete keystore_socket type and rules. · 2c347e0a
    Stephen Smalley authored 
    
Change I6dacdc43bcc1a56e47655e37e825ee6a205eb56b switched
the keystore to using binder instead of a socket, so this
socket type and rules have been unused for a while.  The type
was only ever assigned to a /dev/socket socket file (tmpfs) so
there is no issue with removing the type (no persistent files
will have this xattr value).

Change-Id: Id584233c58f6276774c3432ea76878aca28d6280
Signed-off-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
    2c347e0a
    History
    Drop obsolete keystore_socket type and rules.
    Stephen Smalley authored 
    
Change I6dacdc43bcc1a56e47655e37e825ee6a205eb56b switched
the keystore to using binder instead of a socket, so this
socket type and rules have been unused for a while.  The type
was only ever assigned to a /dev/socket socket file (tmpfs) so
there is no issue with removing the type (no persistent files
will have this xattr value).

Change-Id: Id584233c58f6276774c3432ea76878aca28d6280
Signed-off-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
system_app.te 1.07 KiB 
#
# Apps that run with the system UID, e.g. com.android.system.ui,
# com.android.settings.  These are not as privileged as the system
# server.
#
type system_app, domain;
permissive_or_unconfined(system_app)
app_domain(system_app)
net_domain(system_app)
binder_service(system_app)

# Perform binder IPC to any app domain.
binder_call(system_app, appdomain)

# Read and write system data files.
# May want to split into separate types.
allow system_app system_data_file:dir create_dir_perms;
allow system_app system_data_file:file create_file_perms;

# Read wallpaper file.
allow system_app wallpaper_file:file r_file_perms;

# Write to dalvikcache.
allow system_app dalvikcache_data_file:file { write setattr };

# Read SELinux enforcing status.
selinux_getenforce(system_app)

# Settings app reads sdcard for storage stats
allow system_app sdcard_type:dir r_dir_perms;

# Write to properties
unix_socket_connect(system_app, property, init)
allow system_app debug_prop:property_service set;
allow system_app radio_prop:property_service set;
allow system_app system_prop:property_service set;