blob: eaa0c16d7d903b5747756b26e148ca8fe162a5d2 [file] [log] [blame]
Stephen Smalley2dd4e512012-01-04 12:33:27 -05001# Input selectors:
2# isSystemServer (boolean)
3# user (string)
4# seinfo (string)
5# name (string)
Stephen Smalley6139de52014-02-19 10:54:41 -05006# path (string)
Stephen Smalleydd31ddf2012-07-27 17:08:21 -04007# sebool (string)
Stephen Smalley2dd4e512012-01-04 12:33:27 -05008# isSystemServer=true can only be used once.
Stephen Smalleydd31ddf2012-07-27 17:08:21 -04009# An unspecified isSystemServer defaults to false.
Stephen Smalley2dd4e512012-01-04 12:33:27 -050010# An unspecified string selector will match any value.
11# A user string selector that ends in * will perform a prefix match.
Stephen Smalley3ac1d262012-09-24 10:16:03 -040012# user=_app will match any regular app UID.
13# user=_isolated will match any isolated service UID.
Stephen Smalley2dd4e512012-01-04 12:33:27 -050014# All specified input selectors in an entry must match (i.e. logical AND).
15# Matching is case-insensitive.
16# Precedence rules:
17# (1) isSystemServer=true before isSystemServer=false.
18# (2) Specified user= string before unspecified user= string.
19# (3) Fixed user= string before user= prefix (i.e. ending in *).
20# (4) Longer user= prefix before shorter user= prefix.
21# (5) Specified seinfo= string before unspecified seinfo= string.
22# (6) Specified name= string before unspecified name= string.
Stephen Smalley6139de52014-02-19 10:54:41 -050023# (7) Specified path= string before unspecified path= string.
24# (8) Specified sebool= string before unspecified sebool= string.
Stephen Smalley2dd4e512012-01-04 12:33:27 -050025#
26# Outputs:
27# domain (string)
28# type (string)
Stephen Smalley38084142012-11-28 10:46:18 -050029# levelFrom (string; one of none, all, app, or user)
Stephen Smalley2dd4e512012-01-04 12:33:27 -050030# level (string)
31# Only entries that specify domain= will be used for app process labeling.
32# Only entries that specify type= will be used for app directory labeling.
Stephen Smalley38084142012-11-28 10:46:18 -050033# levelFrom=user is only supported for _app or _isolated UIDs.
34# levelFrom=app or levelFrom=all is only supported for _app UIDs.
Stephen Smalley2dd4e512012-01-04 12:33:27 -050035# level may be used to specify a fixed level for any UID.
36#
Alex Klyubin1fdee112013-09-13 15:59:04 -070037isSystemServer=true domain=system_server
Stephen Smalley2dd4e512012-01-04 12:33:27 -050038user=system domain=system_app type=system_data_file
Stephen Smalley61c80d52012-11-16 09:06:47 -050039user=bluetooth domain=bluetooth type=bluetooth_data_file
Stephen Smalley2dd4e512012-01-04 12:33:27 -050040user=nfc domain=nfc type=nfc_data_file
41user=radio domain=radio type=radio_data_file
Stephen Smalley86734682014-02-24 13:21:56 -050042user=_app domain=untrusted_app type=app_data_file
Stephen Smalleydc88dca2014-03-12 13:31:14 -040043user=_app seinfo=platform domain=platform_app type=app_data_file
44user=_app seinfo=shared domain=shared_app type=app_data_file
45user=_app seinfo=media domain=media_app type=app_data_file
Stephen Smalleydc88dca2014-03-12 13:31:14 -040046user=_app seinfo=release domain=release_app type=app_data_file
Joshua Brindlef26d8132012-09-25 18:52:54 -040047user=_isolated domain=isolated_app
Nick Kralevich59444362013-06-27 10:48:36 -070048user=shell domain=shell type=shell_data_file