commit 307049222a841a16d2a3ec7cbaf656380922c41a
author Charles Chen <liangyuchen@google.com> Sun Jan 15 05:41:42 2023 +0000
committer Charles Chen <liangyuchen@google.com> Fri Jan 27 14:36:40 2023 +0000
tree 5df88800330834e13ad809dde355fe8e85d26b7a
parent 3445819d5acbc0d9fff1f5c6141d8264f5c7f782

Update seapp_contexts with isIsolatedComputeApp selector

Provide isIsolatedComputeApp selector for apps reusing _isolated user to run in domains other than isolated_app. Processes match the selector will have a default domain isolated_compute_app assigned. Also updated _isolated neverallow statements.

Bug: 265540209
Bug: 265746493
Test: m && atest --host libselinux_test with change on android_unittest.cpp
Change-Id: Ia05954aa6a9a9a07d6a8d1e3235a89e7b37dead9

tools/check_seapp.c

diff --git a/tools/check_seapp.c b/tools/check_seapp.c
index 7795e3a..e57a6b3 100644
--- a/tools/check_seapp.c
+++ b/tools/check_seapp.c
@@ -213,6 +213,7 @@
                 { .name = "isPrivApp",      .dir = dir_in, .fn_validate = validate_bool },
                 { .name = "minTargetSdkVersion", .dir = dir_in, .fn_validate = validate_uint },
                 { .name = "fromRunAs",       .dir = dir_in, .fn_validate = validate_bool },
+                { .name = "isIsolatedComputeApp", .dir = dir_in, .fn_validate = validate_bool },
                 /*Outputs*/
                 { .name = "domain",         .dir = dir_out, .fn_validate = validate_domain  },
                 { .name = "type",           .dir = dir_out, .fn_validate = validate_type  },