Make Android Studio Instant Run work again
system/sepolicy commit ffa2b61330c93bac780cde9eb5bc72ae60cd910b made
run-as spawned processes run in the runas_app SELinux domain, instead of
the untrusted_app domain.
https://android-review.googlesource.com/q/topic:%22runas_exec%22+(status:open%20OR%20status:merged)
This broke unix socket connections from untrusted_app* to runas_app.
This functionality is used by Android Studio for the Instant Run
feature. See https://developer.android.com/studio/run/
Allow untrusted_apps to connect to listening abstract sockets hosted by
runas_app.
Addresses the following denial:
01-23 11:11:56.084 16272 16272 W e.myapplication: type=1400 audit(0.0:68): avc: denied { connectto } for path=006972736F636B6574000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 scontext=u:r:untrusted_app_27:s0:c169,c256,c512,c768 tcontext=u:r:runas_app:s0:c169,c256,c512,c768 tclass=unix_stream_socket permissive=0 app=com.example.myapplication
01-23 11:11:56.086 16272 16272 V SwapperAgent: Prior agent invocations in this VM: 1
01-23 11:11:56.088 16272 16272 E SwapperAgent: Could not connect to socket
Change-Id: Ia1203f44aebcbec0ff858b8316e147cba7a048a2
Fixes: 123297648
Test: acleung manual testing
diff --git a/private/untrusted_app_all.te b/private/untrusted_app_all.te
index a4af4e7..9b91806 100644
--- a/private/untrusted_app_all.te
+++ b/private/untrusted_app_all.te
@@ -100,6 +100,12 @@
# gdbserver for ndk-gdb ptrace attaches to app process.
allow untrusted_app_all self:process ptrace;
+# Android Studio Instant Run has the application connect to a
+# runas_app socket listening in the abstract namespace.
+# https://developer.android.com/studio/run/
+# b/123297648
+allow untrusted_app_all runas_app:unix_stream_socket connectto;
+
# Cts: HwRngTest
allow untrusted_app_all sysfs_hwrandom:dir search;
allow untrusted_app_all sysfs_hwrandom:file r_file_perms;