1#
2# Apps that run with the system UID, e.g. com.android.system.ui,
3# com.android.settings.  These are not as privileged as the system
4# server.
5#
6type system_app, domain;
7app_domain(system_app)
8
9# Perform binder IPC to any app domain.
10binder_call(system_app, appdomain)
11binder_transfer(system_app, appdomain)
12
13# Read and write system data files.
14# May want to split into separate types.
15allow system_app system_data_file:dir create_dir_perms;
16allow system_app system_data_file:file create_file_perms;
17
18# Read wallpaper file.
19allow system_app wallpaper_file:file r_file_perms;
20
21# Write to dalvikcache.
22allow system_app dalvikcache_data_file:file { write setattr };
23
24# Talk to keystore.
25unix_socket_connect(system_app, keystore, keystore)
26
27# Read SELinux enforcing status.
28selinux_getenforce(system_app)
29
30bool settings_manage_selinux true;
31if (settings_manage_selinux) {
32# Allow settings app to set SELinux to enforcing
33selinux_setenforce(system_app)
34
35# Allow settings app to set SELinux booleans
36selinux_setbool(system_app)
37}
38
39#
40# System Server aka system_server spawned by zygote.
41# Most of the framework services run in this process.
42#
43type system, domain, mlstrustedsubject;
44
45# Child of the zygote.
46allow system zygote:fd use;
47allow system zygote:process sigchld;
48allow system zygote_tmpfs:file read;
49
50# system server gets network and bluetooth permissions.
51net_domain(system)
52bluetooth_domain(system)
53
54# These are the capabilities assigned by the zygote to the
55# system server.
56# XXX See if we can remove some of these.
57allow system self:capability { kill net_bind_service net_broadcast net_admin net_raw sys_module sys_boot sys_nice sys_resource sys_time sys_tty_config };
58
59# Use netlink uevent sockets.
60allow system self:netlink_kobject_uevent_socket *;
61
62# Kill apps.
63allow system appdomain:process { sigkill signal };
64
65# Set scheduling info for apps.
66allow system appdomain:process setsched;
67
68# Read /proc data for apps.
69allow system appdomain:dir r_dir_perms;
70allow system appdomain:{ file lnk_file } rw_file_perms;
71
72# Write to /proc/net/xt_qtaguid/ctrl.
73# XXX Split /proc/net into its own type.
74allow system proc:file write;
75
76# Notify init of death.
77allow system init:process sigchld;
78
79# Talk to init and various daemons via sockets.
80unix_socket_connect(system, property, init)
81unix_socket_connect(system, qemud, qemud)
82unix_socket_connect(system, installd, installd)
83unix_socket_connect(system, netd, netd)
84unix_socket_connect(system, vold, vold)
85unix_socket_connect(system, zygote, zygote)
86unix_socket_connect(system, keystore, keystore)
87unix_socket_connect(system, dbus, dbusd)
88unix_socket_connect(system, gps, gpsd)
89unix_socket_connect(system, bluetooth, bluetoothd)
90unix_socket_send(system, wpa, wpa)
91
92# Perform Binder IPC.
93tmpfs_domain(system)
94binder_use(system)
95binder_call(system, binderservicedomain)
96binder_call(system, appdomain)
97binder_service(system)
98# Transfer other Binder references.
99binder_transfer(system, binderservicedomain)
100binder_transfer(system, appdomain)
101
102# Read /proc/pid files for Binder clients.
103r_dir_file(system, appdomain)
104r_dir_file(system, mediaserver)
105allow system appdomain:process getattr;
106allow system mediaserver:process getattr;
107
108# Specify any arguments to zygote.
109allow system self:zygote *;
110
111# Check SELinux permissions.
112selinux_check_access(system)
113
114# XXX Label sysfs files with a specific type?
115allow system sysfs:file rw_file_perms;
116allow system sysfs_nfc_power_writable:file rw_file_perms;
117
118# Access devices.
119allow system device:dir r_dir_perms;
120allow system device:chr_file rw_file_perms;
121allow system akm_device:chr_file rw_file_perms;
122allow system accelerometer_device:chr_file rw_file_perms;
123allow system alarm_device:chr_file rw_file_perms;
124allow system graphics_device:dir search;
125allow system graphics_device:chr_file rw_file_perms;
126allow system input_device:dir r_dir_perms;
127allow system input_device:chr_file rw_file_perms;
128allow system tty_device:chr_file rw_file_perms;
129allow system urandom_device:chr_file rw_file_perms;
130allow system video_device:chr_file rw_file_perms;
131allow system qemu_device:chr_file rw_file_perms;
132
133# Manage data files.
134allow system data_file_type:dir create_dir_perms;
135allow system data_file_type:notdevfile_class_set create_file_perms;
136
137# Read /file_contexts.
138allow system rootfs:file r_file_perms;
139
140# Relabel apk files.
141allow system apk_tmp_file:file { relabelfrom relabelto };
142allow system apk_data_file:file { relabelfrom relabelto };
143
144# Relabel wallpaper.
145allow system system_data_file:file relabelfrom;
146allow system wallpaper_file:file relabelto;
147allow system wallpaper_file:file r_file_perms;
148
149# Property Service write
150allow system system_prop:property_service set;
151allow system radio_prop:property_service set;
152
153# ctl interface
154allow system ctl_default_prop:property_service set;
155
156# Create a socket for receiving info from wpa.
157type_transition system wifi_data_file:sock_file system_wpa_socket;
158allow system system_wpa_socket:sock_file create_file_perms;
159
160# Manage cache files.
161allow system cache_file:dir create_dir_perms;
162allow system cache_file:file create_file_perms;
163
164# Run system programs, e.g. dexopt.
165allow system system_file:file x_file_perms;
166
167# Allow reading of /proc/pid data for other domains.
168# XXX dontaudit candidate
169allow system domain:dir r_dir_perms;
170allow system domain:file r_file_perms;
171