Prevent non-system apps from read ro.usb.uvc.enabled
ro.us.uvc.enabled should not be readable from apps that can't or
shouldn't act on UVC support. This means all non-system apps. This CL
adds an explicit neverallow rule to prevent all appdomains (except
system_app and device_as_webcam).
Bug: 242344221
Bug: 242344229
Test: Build passes, manually confirmed that non-system apps cannot
access the property
Change-Id: I1a40c3c3cb10cebfc9ddb791a06f26fcc9342ed9
diff --git a/private/property.te b/private/property.te
index 5383300..4f806d4 100644
--- a/private/property.te
+++ b/private/property.te
@@ -687,3 +687,10 @@
-init
-vendor_init
} usb_uvc_enabled_prop:property_service set;
+
+# Disallow non system apps from reading ro.usb.uvc.enabled
+neverallow {
+ appdomain
+ -system_app
+ -device_as_webcam
+} usb_uvc_enabled_prop:file no_rw_file_perms;