Skip to content
Snippets Groups Projects
Commit f4fefd92 authored by Nick Kralevich's avatar Nick Kralevich Committed by Gerrit Code Review
Browse files

Merge "domain: keep others out of system app sandbox"

parents 2f722694 5470ffeb
Branches caf_migration/LA.UM.8.6.2.c27
No related merge requests found
Show whitespace changes
Inline Side-by-side
Showing
with 8 additions and 0 deletions
domain.te
+ 8
− 0
View file @ f4fefd92
...@@ -419,6 +419,14 @@ neverallow { ...@@ -419,6 +419,14 @@ neverallow {
# to installd # to installd
neverallow installd system_data_file:file ~{ r_file_perms relabelfrom unlink }; neverallow installd system_data_file:file ~{ r_file_perms relabelfrom unlink };
# respect system_app sandboxes
neverallow {
domain
-system_app # its own sandbox
-system_server #populate com.android.providers.settings/databases/settings.db.
-installd # creation of app sandbox
} system_app_data_file:dir_file_class_set { create unlink };
# #
# Only these domains should transition to shell domain. This domain is # Only these domains should transition to shell domain. This domain is
# permissible for the "shell user". If you need a process to exec a shell # permissible for the "shell user". If you need a process to exec a shell
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment