untrusted_app.te revision 623975fa5aece708032aaf29689d73e1f3a615e7 
1###
2### Untrusted apps.
3###
4### This file defines the rules for untrusted apps. An "untrusted
5### app" is an APP with UID between APP_AID (10000)
6### and AID_ISOLATED_START (99000).
7###
8### untrusted_app includes all the appdomain rules, plus the
9### additional following rules:
10###
11
12type untrusted_app, domain;
13permissive_or_unconfined(untrusted_app)
14app_domain(untrusted_app)
15net_domain(untrusted_app)
16bluetooth_domain(untrusted_app)
17
18# Some apps ship with shared libraries and binaries that they write out
19# to their sandbox directory and then execute.
20allow untrusted_app app_data_file:file rx_file_perms;
21
22allow untrusted_app tun_device:chr_file rw_file_perms;
23
24# Internal SDCard rw access.
25allow untrusted_app sdcard_internal:dir create_dir_perms;
26allow untrusted_app sdcard_internal:file create_file_perms;
27
28# External SDCard rw access.
29allow untrusted_app sdcard_external:dir create_dir_perms;
30allow untrusted_app sdcard_external:file create_file_perms;
31
32# ASEC
33allow untrusted_app asec_apk_file:dir { getattr };
34allow untrusted_app asec_apk_file:file r_file_perms;
35
36# Create tcp/udp sockets
37allow untrusted_app node_type:{ tcp_socket udp_socket } node_bind;
38allow untrusted_app self:{ tcp_socket udp_socket } { create_socket_perms accept listen };
39# Bind to a particular hostname/address/interface (e.g., localhost) instead of
40# ANY. Normally, apps should not be listening on all interfaces.
41allow untrusted_app port:{ tcp_socket udp_socket } name_bind;
42
43# Allow the allocation and use of ptys
44# Used by: https://play.google.com/store/apps/details?id=jackpal.androidterm
45create_pty(untrusted_app)
46
47# Used by Finsky / Android "Verify Apps" functionality when
48# running "adb install foo.apk".
49# TODO: Long term, we don't want apps probing into shell data files.
50# Figure out a way to remove these rules.
51allow untrusted_app shell_data_file:file r_file_perms;
52allow untrusted_app shell_data_file:dir r_dir_perms;
53