diff --git a/app.te b/app.te index cd1d7752d188a1c0e32dd84058e040dba9fd8742..b8833dbf1698cccc81d2f795f73408f29841735b 100644 --- a/app.te +++ b/app.te @@ -95,6 +95,7 @@ allow appdomain appdomain:unix_stream_socket { getopt getattr read write shutdow # to any app that has backup ability. Hence, no open permissions here. allow appdomain backup_data_file:file { read write getattr }; allow appdomain cache_backup_file:file { read write getattr }; +allow appdomain cache_backup_file:dir getattr; # Backup ability using 'adb backup' allow appdomain system_data_file:lnk_file getattr; diff --git a/attributes b/attributes index bbc3d922b526715874d894f5542be086155bb0b5..69654e32b79dd5f077a3cd06afd6565a928e39d9 100644 --- a/attributes +++ b/attributes @@ -65,8 +65,5 @@ attribute bluetoothdomain; # All domains used for binder service domains. attribute binderservicedomain; -# Allow domains used for platform (signed by build key) apps. -attribute platformappdomain; - # All domains which are allowed the "relabelto" permission attribute relabeltodomain; diff --git a/mac_permissions.xml b/mac_permissions.xml index f9f631bac60da90f6af679ebe515302201d6b922..baaaf324c1fa2d86ec6528dd8c7246acb5f09544 100644 --- a/mac_permissions.xml +++ b/mac_permissions.xml @@ -26,21 +26,6 @@ <seinfo value="platform" /> </signer> - <!-- Media dev key in AOSP --> - <signer signature="@MEDIA" > - <seinfo value="media" /> - </signer> - - <!-- shared dev key in AOSP --> - <signer signature="@SHARED" > - <seinfo value="shared" /> - </signer> - - <!-- release dev key in AOSP --> - <signer signature="@RELEASE" > - <seinfo value="release" /> - </signer> - <!-- All other keys --> <default> <seinfo value="default" /> diff --git a/media_app.te b/media_app.te deleted file mode 100644 index 5075cdfb2e56c71e783038e3b673da182b791d31..0000000000000000000000000000000000000000 --- a/media_app.te +++ /dev/null @@ -1,17 +0,0 @@ -### -### Apps signed with the media key. -### - -type media_app, domain; -app_domain(media_app) -platform_app_domain(media_app) -binder_service(media_app) -# Access the network. -net_domain(media_app) -# Access /dev/mtp_usb. -allow media_app mtp_device:chr_file rw_file_perms; -# Stat /cache/backup -allow media_app cache_backup_file:file getattr; -allow media_app cache_backup_file:dir getattr; - -# inherits from platformappdomain.te diff --git a/platform_app.te b/platform_app.te index ba8ed4b219e5161a0218e0ce099509be81fc045c..6cac4ee30c76af948692b3597bb9e09fa9302034 100644 --- a/platform_app.te +++ b/platform_app.te @@ -5,7 +5,6 @@ type platform_app, domain; permissive_or_unconfined(platform_app) app_domain(platform_app) -platform_app_domain(platform_app) # Access the network. net_domain(platform_app) # Access bluetooth. @@ -22,4 +21,10 @@ allow platform_app apk_private_data_file:dir search; allow platform_app asec_apk_file:dir create_dir_perms; allow platform_app asec_apk_file:file create_file_perms; -# inherits from platformappdomain.te +# Access to /data/media. +allow platform_app media_rw_data_file:dir create_dir_perms; +allow platform_app media_rw_data_file:file create_file_perms; + +# Write to /cache. +allow platform_app cache_file:dir create_dir_perms; +allow platform_app cache_file:file create_file_perms; diff --git a/platformappdomain.te b/platformappdomain.te deleted file mode 100644 index 5ba86017b1d3ac15a918bc26a78a341a4760ddaa..0000000000000000000000000000000000000000 --- a/platformappdomain.te +++ /dev/null @@ -1,16 +0,0 @@ -# -# Rules for all platform app domains. -# These rules are inherited by any domain that includes platform_app_domain(). -# Presently this consists of the four app domains corresponding to apps -# signed by one of the four build keys: platform_app, shared_app, media_app, -# release_app. These app domains have greater permissions to specific -# directories owned by groups that are restricted to apps with -# Android permissions that are signature|system. - -# Access to /data/media. -allow platformappdomain media_rw_data_file:dir create_dir_perms; -allow platformappdomain media_rw_data_file:file create_file_perms; - -# Write to /cache. -allow platformappdomain cache_file:dir create_dir_perms; -allow platformappdomain cache_file:file create_file_perms; diff --git a/release_app.te b/release_app.te deleted file mode 100644 index 4dc78e7383aa5218d028556097a8b417ce3090b0..0000000000000000000000000000000000000000 --- a/release_app.te +++ /dev/null @@ -1,14 +0,0 @@ -### -### Apps signed with the release key (testkey in AOSP). -### - -type release_app, domain; -permissive_or_unconfined(release_app) -app_domain(release_app) -platform_app_domain(release_app) -# Access the network. -net_domain(release_app) -# Access bluetooth. -bluetooth_domain(release_app) - -# inherits from platformappdomain.te diff --git a/seapp_contexts b/seapp_contexts index ff0964a28f6635b3c63f00aca3c8e63aaa852263..7b217fbf04cf3c590ee75b32695ac645c1b56766 100644 --- a/seapp_contexts +++ b/seapp_contexts @@ -40,9 +40,6 @@ user=bluetooth domain=bluetooth type=bluetooth_data_file user=nfc domain=nfc type=nfc_data_file user=radio domain=radio type=radio_data_file user=shell domain=shell type=shell_data_file -user=_app domain=untrusted_app type=app_data_file -user=_app seinfo=platform domain=platform_app type=app_data_file -user=_app seinfo=shared domain=shared_app type=app_data_file -user=_app seinfo=media domain=media_app type=app_data_file -user=_app seinfo=release domain=release_app type=app_data_file user=_isolated domain=isolated_app +user=_app seinfo=platform domain=platform_app type=app_data_file +user=_app domain=untrusted_app type=app_data_file diff --git a/shared_app.te b/shared_app.te deleted file mode 100644 index ef72735291236cd7e5086e504f4fbab58dcd4000..0000000000000000000000000000000000000000 --- a/shared_app.te +++ /dev/null @@ -1,14 +0,0 @@ -### -### Apps signed with the shared key. -### - -type shared_app, domain; -permissive_or_unconfined(shared_app) -app_domain(shared_app) -platform_app_domain(shared_app) -# Access the network. -net_domain(shared_app) -# Access bluetooth. -bluetooth_domain(shared_app) - -# inherits from platformappdomain.te diff --git a/te_macros b/te_macros index 3d170f4fb5d9a45d582bb9a7b01a39547b6ac144..ddae3dff2ba7fbae4a393d47cada255bc1149c56 100644 --- a/te_macros +++ b/te_macros @@ -118,14 +118,6 @@ define(`relabelto_domain', ` typeattribute $1 relabeltodomain; ') -##################################### -# platform_app_domain(domain) -# Allow permissions specific to platform apps. -define(`platform_app_domain', ` -typeattribute $1 platformappdomain; -typeattribute $1 mlstrustedsubject; -') - ##################################### # net_domain(domain) # Allow a base set of permissions required for network access. diff --git a/untrusted_app.te b/untrusted_app.te index e60bfff57acf828ef4f0c547c36d3d43307ec19d..ebde0eb82d8b88c2e987e0bce6fa6802b846b352 100644 --- a/untrusted_app.te +++ b/untrusted_app.te @@ -10,7 +10,7 @@ ### and AID_ISOLATED_START (99000) if the app has no specific seinfo ### value as determined from mac_permissions.xml. In current AOSP, this ### domain is assigned to all non-system apps as well as to any system apps -### that are not signed by one of the four platform keys. To move +### that are not signed by the platform key. To move ### a system app into a specific domain, add a signer entry for it to ### mac_permissions.xml and assign it one of the pre-existing seinfo values ### or define and use a new seinfo value in both mac_permissions.xml and @@ -48,3 +48,19 @@ create_pty(untrusted_app) # Figure out a way to remove these rules. allow untrusted_app shell_data_file:file r_file_perms; allow untrusted_app shell_data_file:dir r_dir_perms; + +# +# Rules migrated from old app domains coalesced into untrusted_app. +# This includes what used to be media_app, shared_app, and release_app. +# + +# Access /dev/mtp_usb. +allow untrusted_app mtp_device:chr_file rw_file_perms; + +# Access to /data/media. +allow untrusted_app media_rw_data_file:dir create_dir_perms; +allow untrusted_app media_rw_data_file:file create_file_perms; + +# Write to /cache. +allow untrusted_app cache_file:dir create_dir_perms; +allow untrusted_app cache_file:file create_file_perms;