diff --git a/private/app.te b/private/app.te index f21887e928760cfe17f188e08ede35dc4f1bc776..ed2d8b6081fd72a94adbd7c12700280c4a1db34a 100644 --- a/private/app.te +++ b/private/app.te @@ -87,11 +87,12 @@ allow appdomain oemfs:file rx_file_perms; # Execute the shell or other system executables. allow { appdomain -ephemeral_app -untrusted_v2_app } shell_exec:file rx_file_perms; -allow { appdomain -ephemeral_app -untrusted_v2_app } system_file:file rx_file_perms; +allow { appdomain -ephemeral_app -untrusted_v2_app } system_file:file x_file_perms; allow { appdomain -ephemeral_app -untrusted_v2_app } toolbox_exec:file rx_file_perms; # Renderscript needs the ability to read directories on /system -r_dir_file(appdomain, system_file) +allow appdomain system_file:dir r_dir_perms; +allow appdomain system_file:lnk_file { getattr open read }; # Execute dex2oat when apps call dexclassloader allow appdomain dex2oat_exec:file rx_file_perms; diff --git a/private/app_neverallows.te b/private/app_neverallows.te index 15ab764c48b94b297ac957aa21f1e18b809e3991..5e47b68db0b07bdfdbda50746648ab6ed2a1ad93 100644 --- a/private/app_neverallows.te +++ b/private/app_neverallows.te @@ -100,3 +100,7 @@ neverallow all_untrusted_apps proc:file { no_rw_file_perms no_x_file_perms }; # Do not allow untrusted apps access to preloads data files neverallow all_untrusted_apps preloads_data_file:file no_rw_file_perms; + +# Locking of files on /system could lead to denial of service attacks +# against privileged system components +neverallow all_untrusted_apps system_file:file lock;