1#
2# Apps that run with the system UID, e.g. com.android.system.ui,
3# com.android.settings.  These are not as privileged as the system
4# server.
5#
6type system_app, domain;
7app_domain(system_app)
8net_domain(system_app)
9binder_service(system_app)
10
11# Read and write /data/data subdirectory.
12allow system_app system_app_data_file:dir create_dir_perms;
13allow system_app system_app_data_file:file create_file_perms;
14
15# Read /data/misc/keychain subdirectory.
16allow system_app keychain_data_file:dir r_dir_perms;
17allow system_app keychain_data_file:file r_file_perms;
18
19# Read and write to other system-owned /data directories, such as
20# /data/system/cache and /data/misc/user.
21allow system_app system_data_file:dir create_dir_perms;
22allow system_app system_data_file:file create_file_perms;
23allow system_app misc_user_data_file:dir create_dir_perms;
24allow system_app misc_user_data_file:file create_file_perms;
25# Audit writes to these directories and files so we can identify
26# and possibly move these directories into their own type in the future.
27auditallow system_app system_data_file:dir { create setattr add_name remove_name rmdir rename };
28auditallow system_app system_data_file:file { create setattr append write link unlink rename };
29
30# Read wallpaper file.
31allow system_app wallpaper_file:file r_file_perms;
32
33# Write to properties
34unix_socket_connect(system_app, property, init)
35allow system_app debug_prop:property_service set;
36allow system_app net_radio_prop:property_service set;
37allow system_app system_radio_prop:property_service set;
38auditallow system_app net_radio_prop:property_service set;
39auditallow system_app system_radio_prop:property_service set;
40allow system_app system_prop:property_service set;
41allow system_app ctl_bugreport_prop:property_service set;
42allow system_app logd_prop:property_service set;
43
44# Create /data/anr/traces.txt.
45allow system_app anr_data_file:dir ra_dir_perms;
46allow system_app anr_data_file:file create_file_perms;
47
48allow system_app system_app_service:service_manager add;
49
50allow system_app keystore:keystore_key {
51	test
52	get
53	insert
54	delete
55	exist
56	saw
57	reset
58	password
59	lock
60	unlock
61	zero
62	sign
63	verify
64	grant
65	duplicate
66	clear_uid
67};
68
69control_logd(system_app)
70