| Victor Hsieh | b415c73 | 2021-12-14 11:06:23 -0800 | [diff] [blame^] | 1 | # Declare ART properties for CompOS |
| 2 | system_public_prop(dalvik_config_prop) |
| 3 | system_restricted_prop(device_config_runtime_native_prop) |
| 4 | |
| Inseob Kim | 5ee61a7 | 2021-09-17 19:31:45 +0900 | [diff] [blame] | 5 | # Don't audit legacy ctl. property handling. We only want the newer permission check to appear |
| 6 | # in the audit log |
| 7 | dontaudit domain { |
| 8 | ctl_console_prop |
| 9 | ctl_default_prop |
| 10 | ctl_fuse_prop |
| 11 | }:property_service set; |
| 12 | |
| Inseob Kim | e138997 | 2021-07-19 07:48:34 +0000 | [diff] [blame] | 13 | ### |
| 14 | ### Neverallow rules |
| 15 | ### |
| 16 | |
| 17 | neverallow { |
| 18 | domain |
| 19 | -init |
| 20 | -microdroid_manager |
| 21 | } vmsecret_keymint_prop:property_service set; |
| 22 | |
| 23 | neverallow { |
| 24 | domain |
| 25 | -init |
| 26 | -microdroid_manager |
| 27 | -hal_keymint_server |
| 28 | } vmsecret_keymint_prop:file no_rw_file_perms; |
| Jiyong Park | 27bb6c6 | 2021-09-06 15:39:31 +0900 | [diff] [blame] | 29 | |
| 30 | # microdroid_manager_roothash_prop can only be set by microdroid_manager |
| 31 | # and read by apkdmverity |
| 32 | neverallow { |
| 33 | domain |
| 34 | -init |
| 35 | -microdroid_manager |
| 36 | } microdroid_manager_roothash_prop:property_service set; |
| 37 | |
| 38 | neverallow { |
| 39 | domain |
| 40 | -init |
| 41 | -microdroid_manager |
| 42 | -apkdmverity |
| 43 | } microdroid_manager_roothash_prop:file no_rw_file_perms; |