diff --git a/private/ephemeral_app.te b/private/ephemeral_app.te index f75a87dd24639e995a93aff06e42944a4aeada88..f28d28f04b4ea1bc939d29b48850c3a2d36eadab 100644 --- a/private/ephemeral_app.te +++ b/private/ephemeral_app.te @@ -23,12 +23,6 @@ allow ephemeral_app { sdcard_type media_rw_data_file }:file {read write getattr # to their sandbox directory and then execute. allow ephemeral_app { app_data_file privapp_data_file }:file {r_file_perms execute}; -# Executing files from an application home directory violates -# W^X (https://en.wikipedia.org/wiki/W%5EX) constraints (loading executable code -# from a writable file) and is an unsafe application behavior. Test to see if we -# can get rid of it. -auditallow ephemeral_app app_data_file:file execute; - # services allow ephemeral_app audioserver_service:service_manager find; allow ephemeral_app cameraserver_service:service_manager find; diff --git a/private/untrusted_app_all.te b/private/untrusted_app_all.te index fdda73031e18fa381b61a57942aba8a720e0d1ce..11cea6ea2baf434ea2e9fc65cefccdd73a0ef6a9 100644 --- a/private/untrusted_app_all.te +++ b/private/untrusted_app_all.te @@ -24,12 +24,6 @@ # to their sandbox directory and then execute. allow untrusted_app_all { app_data_file privapp_data_file }:file { rx_file_perms }; -# Executing files from an application home directory violates -# W^X (https://en.wikipedia.org/wiki/W%5EX) constraints (loading executable code -# from a writable file) and is an unsafe application behavior. Test to see if we -# can get rid of it. -auditallow untrusted_app_all app_data_file:file { execute execute_no_trans }; - # ASEC allow untrusted_app_all asec_apk_file:file r_file_perms; allow untrusted_app_all asec_apk_file:dir r_dir_perms;