| Alex Klyubin | b5853c3 | 2017-01-05 17:18:32 -0800 | [diff] [blame] | 1 | ### |
| 2 | ### Apps that run with the system UID, e.g. com.android.system.ui, |
| 3 | ### com.android.settings. These are not as privileged as the system |
| 4 | ### server. |
| 5 | ### |
| 6 | |
| 7 | typeattribute system_app domain_deprecated; |
| 8 | |
| dcashman | 3e8dbf0 | 2016-12-08 11:23:34 -0800 | [diff] [blame] | 9 | app_domain(system_app) |
| Alex Klyubin | b5853c3 | 2017-01-05 17:18:32 -0800 | [diff] [blame] | 10 | net_domain(system_app) |
| 11 | binder_service(system_app) |
| 12 | |
| 13 | # Read and write /data/data subdirectory. |
| 14 | allow system_app system_app_data_file:dir create_dir_perms; |
| 15 | allow system_app system_app_data_file:{ file lnk_file } create_file_perms; |
| 16 | |
| 17 | # Read and write to /data/misc/user. |
| 18 | allow system_app misc_user_data_file:dir create_dir_perms; |
| 19 | allow system_app misc_user_data_file:file create_file_perms; |
| 20 | |
| 21 | # Access to vold-mounted storage for measuring free space |
| 22 | allow system_app mnt_media_rw_file:dir search; |
| 23 | |
| 24 | # Read wallpaper file. |
| 25 | allow system_app wallpaper_file:file r_file_perms; |
| 26 | |
| 27 | # Read icon file. |
| 28 | allow system_app icon_file:file r_file_perms; |
| 29 | |
| 30 | # Write to properties |
| 31 | set_prop(system_app, bluetooth_prop) |
| 32 | set_prop(system_app, debug_prop) |
| 33 | set_prop(system_app, system_prop) |
| 34 | set_prop(system_app, logd_prop) |
| 35 | set_prop(system_app, net_radio_prop) |
| 36 | set_prop(system_app, system_radio_prop) |
| 37 | set_prop(system_app, log_tag_prop) |
| 38 | userdebug_or_eng(`set_prop(system_app, logpersistd_logging_prop)') |
| 39 | auditallow system_app net_radio_prop:property_service set; |
| 40 | auditallow system_app system_radio_prop:property_service set; |
| 41 | |
| 42 | # ctl interface |
| 43 | set_prop(system_app, ctl_default_prop) |
| 44 | set_prop(system_app, ctl_bugreport_prop) |
| 45 | |
| 46 | # Create /data/anr/traces.txt. |
| 47 | allow system_app anr_data_file:dir ra_dir_perms; |
| 48 | allow system_app anr_data_file:file create_file_perms; |
| 49 | |
| 50 | # Settings need to access app name and icon from asec |
| 51 | allow system_app asec_apk_file:file r_file_perms; |
| 52 | |
| 53 | allow system_app servicemanager:service_manager list; |
| 54 | # TODO: scope this down? Too broad? |
| 55 | allow system_app { service_manager_type -netd_service -dumpstate_service -installd_service }:service_manager find; |
| 56 | |
| 57 | allow system_app keystore:keystore_key { |
| 58 | get_state |
| 59 | get |
| 60 | insert |
| 61 | delete |
| 62 | exist |
| 63 | list |
| 64 | reset |
| 65 | password |
| 66 | lock |
| 67 | unlock |
| 68 | is_empty |
| 69 | sign |
| 70 | verify |
| 71 | grant |
| 72 | duplicate |
| 73 | clear_uid |
| 74 | user_changed |
| 75 | }; |
| 76 | |
| 77 | # /sys access |
| 78 | r_dir_file(system_app, sysfs_type) |
| 79 | |
| 80 | control_logd(system_app) |