commit 9bc81125ef0f20c9187a6e0269b53643092b70bf
author Ashwini Oruganti <ashfall@google.com> Mon Oct 21 15:28:00 2019 -0700
committer Ashwini Oruganti <ashfall@google.com> Wed Oct 30 14:59:12 2019 -0700
tree 4a5fc8b221af07cc571b8dae8110e3d4acdc4212
parent 94b0e84094c103b94bdf9573e609e01f638f7ab6

Create a separate domain for permissioncontroller

This creates an SELinux domain for permissioncontroller and moves it out of the
priv_app SELinux domain.

Bug: 142672293
Test: Flashed a device with this build and verified
com.google.android.permissioncontroller runs in the
permissioncontroller_app domain.
Change-Id: Ieb2e4cb806d18aaeb2e5c458e138975d1d5b64fe

private/keys.conf

diff --git a/private/keys.conf b/private/keys.conf
index 362e73d..8c899b6 100644
--- a/private/keys.conf
+++ b/private/keys.conf
@@ -17,6 +17,9 @@
 [@NETWORK_STACK]
 ALL : $MAINLINE_SEPOLICY_DEV_CERTIFICATES/networkstack.x509.pem
 
+[@PERMISSION_CONTROLLER]
+ALL: $DEFAULT_SYSTEM_DEV_CERTIFICATE/com_google_android_permissioncontroller-container.x509.pem
+
 [@SHARED]
 ALL : $DEFAULT_SYSTEM_DEV_CERTIFICATE/shared.x509.pem
 

private/mac_permissions.xml

diff --git a/private/mac_permissions.xml b/private/mac_permissions.xml
index 7fc37c1..5095a2a 100644
--- a/private/mac_permissions.xml
+++ b/private/mac_permissions.xml
@@ -59,4 +59,10 @@
     <signer signature="@NETWORK_STACK" >
       <seinfo value="network_stack" />
     </signer>
+
+    <signer signature="@PERMISSION_CONTROLLER" >
+        <package name="com.google.android.permissioncontroller">
+            <seinfo value="permission_controller" />
+        </package>
+    </signer>
 </policy>

private/permissioncontroller_app.te

diff --git a/private/permissioncontroller_app.te b/private/permissioncontroller_app.te
new file mode 100644
index 0000000..32fa9bd
--- /dev/null
+++ b/private/permissioncontroller_app.te
@@ -0,0 +1,27 @@
+###
+### A domain for further sandboxing the GooglePermissionController app.
+###
+type permissioncontroller_app, domain;
+
+# Allow everything.
+# TODO(b/142672293): remove when no selinux denials are triggered for this
+# domain
+# STOPSHIP(b/142672293): monitor http://go/sedenials for any denials around
+# `permissioncontroller_app` and remove this line once we are confident about
+# this having the right set of permissions.
+userdebug_or_eng(`permissive permissioncontroller_app;')
+
+app_domain(permissioncontroller_app)
+
+# Allow interaction with gpuservice
+binder_call(permissioncontroller_app, gpuservice)
+allow permissioncontroller_app gpu_service:service_manager find;
+
+# Allow interaction with role_service
+allow permissioncontroller_app role_service:service_manager find;
+
+# Allow interaction with usagestats_service
+allow permissioncontroller_app usagestats_service:service_manager find;
+
+# Allow interaction with activity_service
+allow permissioncontroller_app activity_service:service_manager find;

private/seapp_contexts

diff --git a/private/seapp_contexts b/private/seapp_contexts
index c74bd2c..3651389 100644
--- a/private/seapp_contexts
+++ b/private/seapp_contexts
@@ -156,6 +156,7 @@
 user=_app seinfo=platform domain=platform_app type=app_data_file levelFrom=user
 user=_app isEphemeralApp=true domain=ephemeral_app type=app_data_file levelFrom=all
 user=_app isPrivApp=true domain=priv_app type=privapp_data_file levelFrom=user
+user=_app seinfo=permission_controller isPrivApp=true name=com.google.android.permissioncontroller domain=permissioncontroller_app type=privapp_data_file levelFrom=all
 user=_app minTargetSdkVersion=29 domain=untrusted_app type=app_data_file levelFrom=all
 user=_app minTargetSdkVersion=28 domain=untrusted_app_27 type=app_data_file levelFrom=all
 user=_app minTargetSdkVersion=26 domain=untrusted_app_27 type=app_data_file levelFrom=user