Add system_api_service and app_api_service attributes.
System services differ in designed access level. Add attributes reflecting this
distinction and label services appropriately. Begin moving access to the newly
labeled services by removing them from tmp_system_server_service into the newly
made system_server_service attribute. Reflect the move of system_server_service
from a type to an attribute by removing access to system_server_service where
appropriate.
Change-Id: I7fd06823328daaea6d6f96e4d6bd00332382230b
diff --git a/attributes b/attributes
index af9af8e..f35c83f 100644
--- a/attributes
+++ b/attributes
@@ -44,6 +44,13 @@
# All service_manager types formerly given system_server_service type
attribute tmp_system_server_service;
+attribute system_server_service;
+
+# services which should be available to all but isolated apps
+attribute app_api_service;
+
+# services which export only system_api
+attribute system_api_service;
# All types used for services managed by service_manager.
attribute service_manager_type;
diff --git a/bluetooth.te b/bluetooth.te
index 7d81e09..c670b17 100644
--- a/bluetooth.te
+++ b/bluetooth.te
@@ -53,8 +53,9 @@
allow bluetooth mediaserver_service:service_manager find;
allow bluetooth radio_service:service_manager find;
allow bluetooth surfaceflinger_service:service_manager find;
-allow bluetooth system_server_service:service_manager find;
allow bluetooth tmp_system_server_service:service_manager find;
+allow bluetooth app_api_service:service_manager find;
+allow bluetooth system_api_service:service_manager find;
service_manager_local_audit_domain(bluetooth)
auditallow bluetooth {
diff --git a/drmserver.te b/drmserver.te
index e52d679..418ce39 100644
--- a/drmserver.te
+++ b/drmserver.te
@@ -50,7 +50,6 @@
allow drmserver oemfs:file r_file_perms;
allow drmserver drmserver_service:service_manager { add find };
-allow drmserver system_server_service:service_manager find;
allow drmserver tmp_system_server_service:service_manager find;
service_manager_local_audit_domain(drmserver)
diff --git a/mediaserver.te b/mediaserver.te
index 23abb0f..77b54a3 100644
--- a/mediaserver.te
+++ b/mediaserver.te
@@ -80,7 +80,6 @@
allow mediaserver drmserver_service:service_manager find;
allow mediaserver mediaserver_service:service_manager { add find };
-allow mediaserver system_server_service:service_manager find;
allow mediaserver surfaceflinger_service:service_manager find;
allow mediaserver tmp_system_server_service:service_manager find;
diff --git a/nfc.te b/nfc.te
index de482f4..34e8228 100644
--- a/nfc.te
+++ b/nfc.te
@@ -23,8 +23,9 @@
allow nfc nfc_service:service_manager { add find };
allow nfc radio_service:service_manager find;
allow nfc surfaceflinger_service:service_manager find;
-allow nfc system_server_service:service_manager find;
allow nfc tmp_system_server_service:service_manager find;
+allow nfc app_api_service:service_manager find;
+allow nfc system_api_service:service_manager find;
service_manager_local_audit_domain(nfc)
auditallow nfc {
diff --git a/platform_app.te b/platform_app.te
index 92ac5ad..d16ea1b 100644
--- a/platform_app.te
+++ b/platform_app.te
@@ -32,8 +32,9 @@
allow platform_app mediaserver_service:service_manager find;
allow platform_app radio_service:service_manager find;
allow platform_app surfaceflinger_service:service_manager find;
-allow platform_app system_server_service:service_manager find;
allow platform_app tmp_system_server_service:service_manager find;
+allow platform_app app_api_service:service_manager find;
+allow platform_app system_api_service:service_manager find;
service_manager_local_audit_domain(platform_app)
auditallow platform_app {
diff --git a/radio.te b/radio.te
index 4ecf43c..19a9aec 100644
--- a/radio.te
+++ b/radio.te
@@ -34,8 +34,9 @@
allow radio mediaserver_service:service_manager find;
allow radio radio_service:service_manager { add find };
allow radio surfaceflinger_service:service_manager find;
-allow radio system_server_service:service_manager find;
allow radio tmp_system_server_service:service_manager find;
+allow radio app_api_service:service_manager find;
+allow radio system_api_service:service_manager find;
service_manager_local_audit_domain(radio)
auditallow radio {
diff --git a/service.te b/service.te
index 156e534..eafe163 100644
--- a/service.te
+++ b/service.te
@@ -10,8 +10,6 @@
type surfaceflinger_service, service_manager_type;
type system_app_service, service_manager_type;
-type system_server_service, service_manager_type;
-
# system_server_services broken down
type accessibility_service, tmp_system_server_service, service_manager_type;
type account_service, tmp_system_server_service, service_manager_type;
@@ -27,31 +25,31 @@
type bluetooth_manager_service, tmp_system_server_service, service_manager_type;
type clipboard_service, tmp_system_server_service, service_manager_type;
type IMms_service, tmp_system_server_service, service_manager_type;
-type IProxyService_service, tmp_system_server_service, service_manager_type;
+type IProxyService_service, system_api_service, system_server_service, service_manager_type;
type commontime_management_service, tmp_system_server_service, service_manager_type;
type connectivity_service, tmp_system_server_service, service_manager_type;
-type consumer_ir_service, tmp_system_server_service, service_manager_type;
+type consumer_ir_service, app_api_service, system_server_service, service_manager_type;
type content_service, tmp_system_server_service, service_manager_type;
type country_detector_service, tmp_system_server_service, service_manager_type;
-type cpuinfo_service, tmp_system_server_service, service_manager_type;
-type dbinfo_service, tmp_system_server_service, service_manager_type;
+type cpuinfo_service, system_api_service, system_server_service, service_manager_type;
+type dbinfo_service, system_api_service, system_server_service, service_manager_type;
type device_policy_service, tmp_system_server_service, service_manager_type;
type deviceidle_service, tmp_system_server_service, service_manager_type;
-type devicestoragemonitor_service, tmp_system_server_service, service_manager_type;
+type devicestoragemonitor_service, system_server_service, service_manager_type;
type diskstats_service, tmp_system_server_service, service_manager_type;
type display_service, tmp_system_server_service, service_manager_type;
-type DockObserver_service, tmp_system_server_service, service_manager_type;
+type DockObserver_service, system_server_service, service_manager_type;
type dreams_service, tmp_system_server_service, service_manager_type;
type dropbox_service, tmp_system_server_service, service_manager_type;
type ethernet_service, tmp_system_server_service, service_manager_type;
type fingerprint_service, tmp_system_server_service, service_manager_type;
-type gfxinfo_service, tmp_system_server_service, service_manager_type;
+type gfxinfo_service, system_api_service, system_server_service, service_manager_type;
type graphicsstats_service, tmp_system_server_service, service_manager_type;
type hardware_service, tmp_system_server_service, service_manager_type;
type hdmi_control_service, tmp_system_server_service, service_manager_type;
type input_method_service, tmp_system_server_service, service_manager_type;
type input_service, tmp_system_server_service, service_manager_type;
-type imms_service, tmp_system_server_service, service_manager_type;
+type imms_service, app_api_service, system_server_service, service_manager_type;
type jobscheduler_service, tmp_system_server_service, service_manager_type;
type launcherapps_service, tmp_system_server_service, service_manager_type;
type location_service, tmp_system_server_service, service_manager_type;
@@ -59,8 +57,8 @@
type media_projection_service, tmp_system_server_service, service_manager_type;
type media_router_service, tmp_system_server_service, service_manager_type;
type media_session_service, tmp_system_server_service, service_manager_type;
-type meminfo_service, tmp_system_server_service, service_manager_type;
-type midi_service, tmp_system_server_service, service_manager_type;
+type meminfo_service, system_api_service, system_server_service, service_manager_type;
+type midi_service, app_api_service, system_server_service, service_manager_type;
type mount_service, tmp_system_server_service, service_manager_type;
type netpolicy_service, tmp_system_server_service, service_manager_type;
type netstats_service, tmp_system_server_service, service_manager_type;
@@ -76,7 +74,7 @@
type procstats_service, tmp_system_server_service, service_manager_type;
type restrictions_service, tmp_system_server_service, service_manager_type;
type rttmanager_service, tmp_system_server_service, service_manager_type;
-type samplingprofiler_service, tmp_system_server_service, service_manager_type;
+type samplingprofiler_service, system_server_service, service_manager_type;
type scheduling_policy_service, tmp_system_server_service, service_manager_type;
type search_service, tmp_system_server_service, service_manager_type;
type sensorservice_service, tmp_system_server_service, service_manager_type;
@@ -86,8 +84,9 @@
type task_service, tmp_system_server_service, service_manager_type;
type registry_service, tmp_system_server_service, service_manager_type;
type textservices_service, tmp_system_server_service, service_manager_type;
+type telecom_service, tmp_system_server_service, service_manager_type;
type trust_service, tmp_system_server_service, service_manager_type;
-type tv_input_service, tmp_system_server_service, service_manager_type;
+type tv_input_service, app_api_service, system_server_service, service_manager_type;
type uimode_service, tmp_system_server_service, service_manager_type;
type updatelock_service, tmp_system_server_service, service_manager_type;
type usagestats_service, tmp_system_server_service, service_manager_type;
@@ -98,6 +97,6 @@
type wallpaper_service, tmp_system_server_service, service_manager_type;
type webviewupdate_service, tmp_system_server_service, service_manager_type;
type wifip2p_service, tmp_system_server_service, service_manager_type;
-type wifiscanner_service, tmp_system_server_service, service_manager_type;
+type wifiscanner_service, system_api_service, system_server_service, service_manager_type;
type wifi_service, tmp_system_server_service, service_manager_type;
type window_service, tmp_system_server_service, service_manager_type;
diff --git a/service_contexts b/service_contexts
index 223f99f..322f349 100644
--- a/service_contexts
+++ b/service_contexts
@@ -106,7 +106,7 @@
statusbar u:object_r:statusbar_service:s0
SurfaceFlinger u:object_r:surfaceflinger_service:s0
task u:object_r:task_service:s0
-telecom u:object_r:system_server_service:s0
+telecom u:object_r:telecom_service:s0
telephony.registry u:object_r:registry_service:s0
textservices u:object_r:textservices_service:s0
trust u:object_r:trust_service:s0
diff --git a/shared_relro.te b/shared_relro.te
index 1a7e2d0..c97ab5c 100644
--- a/shared_relro.te
+++ b/shared_relro.te
@@ -10,7 +10,6 @@
allow shared_relro shared_relro_file:file create_file_perms;
# Needs to contact the "webviewupdate" and "activity" services
-allow shared_relro system_server_service:service_manager find;
allow shared_relro tmp_system_server_service:service_manager find;
service_manager_local_audit_domain(shared_relro)
diff --git a/surfaceflinger.te b/surfaceflinger.te
index a6ba5d9..007be96 100644
--- a/surfaceflinger.te
+++ b/surfaceflinger.te
@@ -61,7 +61,6 @@
# media.player service
allow surfaceflinger mediaserver_service:service_manager find;
allow surfaceflinger surfaceflinger_service:service_manager { add find };
-allow surfaceflinger system_server_service:service_manager find;
allow surfaceflinger tmp_system_server_service:service_manager find;
service_manager_local_audit_domain(surfaceflinger)
diff --git a/system_app.te b/system_app.te
index 6740dcd..6e91dd0 100644
--- a/system_app.te
+++ b/system_app.te
@@ -53,8 +53,9 @@
allow system_app radio_service:service_manager find;
allow system_app surfaceflinger_service:service_manager find;
allow system_app system_app_service:service_manager add;
-allow system_app system_server_service:service_manager find;
allow system_app tmp_system_server_service:service_manager find;
+allow system_app app_api_service:service_manager find;
+allow system_app system_api_service:service_manager find;
service_manager_local_audit_domain(system_app)
auditallow system_app {
diff --git a/untrusted_app.te b/untrusted_app.te
index a93885a..b090fe4 100644
--- a/untrusted_app.te
+++ b/untrusted_app.te
@@ -81,8 +81,11 @@
allow untrusted_app nfc_service:service_manager find;
allow untrusted_app radio_service:service_manager find;
allow untrusted_app surfaceflinger_service:service_manager find;
-allow untrusted_app system_server_service:service_manager find;
allow untrusted_app tmp_system_server_service:service_manager find;
+allow untrusted_app app_api_service:service_manager find;
+
+# TODO: remove this once priv-apps are no longer running in untrusted_app
+allow untrusted_app system_api_service:service_manager find;
service_manager_local_audit_domain(untrusted_app)
auditallow untrusted_app {