blob: 20c9820ceb647f6412c4e5f62834ec892af7dedc [file] [log] [blame]
Alex Klyubinc42d1342017-01-09 14:52:59 -08001###
2### Apps signed with the platform key.
3###
4
Alex Klyubinf5446eb2017-03-23 14:27:32 -07005typeattribute platform_app coredomain;
Alex Klyubinc42d1342017-01-09 14:52:59 -08006
Nick Kralevichb56e6ef2016-12-09 20:14:31 -08007app_domain(platform_app)
Alex Klyubinc42d1342017-01-09 14:52:59 -08008
9# Access the network.
10net_domain(platform_app)
11# Access bluetooth.
12bluetooth_domain(platform_app)
13# Read from /data/local/tmp or /data/data/com.android.shell.
14allow platform_app shell_data_file:dir search;
15allow platform_app shell_data_file:file { open getattr read };
16allow platform_app icon_file:file { open getattr read };
Chad Brubaker4c40d732017-01-25 14:55:56 -080017# Populate /data/app/vmdl*.tmp, /data/app-private/vmdl*.tmp files
Alex Klyubinc42d1342017-01-09 14:52:59 -080018# created by system server.
Chad Brubaker4c40d732017-01-25 14:55:56 -080019allow platform_app { apk_tmp_file apk_private_tmp_file }:dir rw_dir_perms;
20allow platform_app { apk_tmp_file apk_private_tmp_file }:file rw_file_perms;
Alex Klyubinc42d1342017-01-09 14:52:59 -080021allow platform_app apk_private_data_file:dir search;
22# ASEC
23allow platform_app asec_apk_file:dir create_dir_perms;
24allow platform_app asec_apk_file:file create_file_perms;
25
26# Access to /data/media.
27allow platform_app media_rw_data_file:dir create_dir_perms;
28allow platform_app media_rw_data_file:file create_file_perms;
29
30# Write to /cache.
31allow platform_app cache_file:dir create_dir_perms;
32allow platform_app cache_file:file create_file_perms;
33
34# Direct access to vold-mounted storage under /mnt/media_rw
35# This is a performance optimization that allows platform apps to bypass the FUSE layer
36allow platform_app mnt_media_rw_file:dir r_dir_perms;
Jeff Sharkey000cafc2018-03-30 12:22:54 -060037allow platform_app sdcard_type:dir create_dir_perms;
38allow platform_app sdcard_type:file create_file_perms;
Alex Klyubinc42d1342017-01-09 14:52:59 -080039
Jeff Vander Stoepa12aad42017-07-10 20:39:50 -070040# com.android.systemui
41allow platform_app rootfs:dir getattr;
Beth Thibodeaua279bdb2021-09-14 13:44:49 -040042get_prop(platform_app, radio_cdma_ecm_prop)
Jeff Vander Stoepa12aad42017-07-10 20:39:50 -070043
Jeff Vander Stoepc15d54e2017-07-25 16:43:49 -070044# com.android.captiveportallogin reads /proc/vmstat
Tri Vo06d7dca2018-01-10 12:51:51 -080045allow platform_app {
46 proc_vmstat
47}:file r_file_perms;
Jeff Vander Stoepc15d54e2017-07-25 16:43:49 -070048
Jeff Vander Stoep7a4af302018-04-10 12:47:48 -070049# /proc/net access.
50# TODO(b/9496886) Audit access for removal.
51r_dir_file(platform_app, proc_net_type)
52userdebug_or_eng(`
53 auditallow platform_app proc_net_type:{ dir file lnk_file } { getattr open read };
54')
55
Alex Klyubinc42d1342017-01-09 14:52:59 -080056allow platform_app audioserver_service:service_manager find;
57allow platform_app cameraserver_service:service_manager find;
58allow platform_app drmserver_service:service_manager find;
59allow platform_app mediaserver_service:service_manager find;
Ray Essick39185402017-01-24 12:53:45 -080060allow platform_app mediametrics_service:service_manager find;
Alex Klyubinc42d1342017-01-09 14:52:59 -080061allow platform_app mediaextractor_service:service_manager find;
Alex Klyubinc42d1342017-01-09 14:52:59 -080062allow platform_app mediadrmserver_service:service_manager find;
63allow platform_app persistent_data_block_service:service_manager find;
64allow platform_app radio_service:service_manager find;
Todd Poynorbbc692c2017-07-12 18:12:52 -070065allow platform_app thermal_service:service_manager find;
Neil Fullerca595e12017-01-11 16:27:02 +000066allow platform_app timezone_service:service_manager find;
Alex Klyubinc42d1342017-01-09 14:52:59 -080067allow platform_app app_api_service:service_manager find;
68allow platform_app system_api_service:service_manager find;
69allow platform_app vr_manager_service:service_manager find;
joshmccloskey6f5a7b82019-02-07 14:02:06 -080070allow platform_app stats_service:service_manager find;
Yiwei Zhang544d6b32019-02-07 15:00:55 -080071
joshmccloskey6f5a7b82019-02-07 14:02:06 -080072# Allow platform apps to log via statsd.
Jeffrey Huang215dd2a2019-12-12 10:17:58 -080073binder_call(platform_app, statsd)
joshmccloskey6f5a7b82019-02-07 14:02:06 -080074
Chris Wailes3486acb2021-06-07 14:20:47 -070075# Allow platform applications to find and call artd for testing
76userdebug_or_eng(`
77 allow platform_app artd_service:service_manager find;
78 binder_call(platform_app, artd)
79')
80
Alex Klyubinc42d1342017-01-09 14:52:59 -080081# Access to /data/preloads
82allow platform_app preloads_data_file:file r_file_perms;
83allow platform_app preloads_data_file:dir r_dir_perms;
Fyodor Kupolovb238fe62017-03-14 11:42:03 -070084allow platform_app preloads_media_file:file r_file_perms;
85allow platform_app preloads_media_file:dir r_dir_perms;
Alex Klyubinc42d1342017-01-09 14:52:59 -080086
Mark Salyzynd33a9a12016-11-07 15:11:39 -080087read_runtime_log_tags(platform_app)
Nick Kralevich45766d42017-04-26 11:40:48 -070088
Nathan Haroldee268642017-12-14 18:20:30 -080089# allow platform apps to use UDP sockets provided by the system server but not
90# modify them other than to connect
Nathan Harold252b0152018-03-27 06:34:54 -070091allow platform_app system_server:udp_socket {
92 connect getattr read recvfrom sendto write getopt setopt };
Nathan Haroldee268642017-12-14 18:20:30 -080093
Mark Salyzyn3443caf2015-10-24 16:20:18 -070094# allow platform apps to connect to the property service
95set_prop(platform_app, test_boot_reason_prop)
96
Inseob Kim04f435c2020-07-07 12:46:24 +090097# allow platform apps to read keyguard.no_require_sim
98get_prop(platform_app, keyguard_config_prop)
99
Weilun Due2a8a142021-02-17 17:54:30 +0000100# allow platform apps to read qemu.hw.mainkeys
101get_prop(platform_app, qemu_hw_prop)
102
felkachang0c402012019-01-30 15:44:24 +0800103# allow platform apps to create symbolic link
104allow platform_app app_data_file:lnk_file create_file_perms;
105
Adam Shih25437152020-12-07 16:30:29 +0800106# suppress denials caused by debugfs_tracing
107dontaudit platform_app debugfs_tracing:file rw_file_perms;
108
Lalit Magantid6ff0c72021-06-10 14:10:45 +0100109# Allow platform apps to act as Perfetto producers.
110perfetto_producer(platform_app)
111
Lalit Magantibb197bb2022-02-01 16:01:07 +0000112# TODO(b/217368496): remove this.
113can_profile_heap(platform_app)
114can_profile_perf(platform_app)
115
Alan Stokesf96cd652021-09-07 12:25:38 +0100116# Allow platform apps to create VMs
117virtualizationservice_use(platform_app)
118
Nick Kralevich45766d42017-04-26 11:40:48 -0700119###
120### Neverallow rules
121###
122
123# app domains which access /dev/fuse should not run as platform_app
124neverallow platform_app fuse_device:chr_file *;