1###
2### Apps that run with the system UID, e.g. com.android.system.ui,
3### com.android.settings.  These are not as privileged as the system
4### server.
5###
6
7typeattribute system_app coredomain;
8typeattribute system_app domain_deprecated;
9
10app_domain(system_app)
11net_domain(system_app)
12binder_service(system_app)
13
14# Read and write /data/data subdirectory.
15allow system_app system_app_data_file:dir create_dir_perms;
16allow system_app system_app_data_file:{ file lnk_file } create_file_perms;
17
18# Read and write to /data/misc/user.
19allow system_app misc_user_data_file:dir create_dir_perms;
20allow system_app misc_user_data_file:file create_file_perms;
21
22# Access to vold-mounted storage for measuring free space
23allow system_app mnt_media_rw_file:dir search;
24
25# Read wallpaper file.
26allow system_app wallpaper_file:file r_file_perms;
27
28# Read icon file.
29allow system_app icon_file:file r_file_perms;
30
31# Write to properties
32set_prop(system_app, bluetooth_prop)
33set_prop(system_app, debug_prop)
34set_prop(system_app, system_prop)
35set_prop(system_app, logd_prop)
36set_prop(system_app, net_radio_prop)
37set_prop(system_app, system_radio_prop)
38set_prop(system_app, log_tag_prop)
39userdebug_or_eng(`set_prop(system_app, logpersistd_logging_prop)')
40auditallow system_app net_radio_prop:property_service set;
41auditallow system_app system_radio_prop:property_service set;
42
43# ctl interface
44set_prop(system_app, ctl_default_prop)
45set_prop(system_app, ctl_bugreport_prop)
46
47# Create /data/anr/traces.txt.
48allow system_app anr_data_file:dir ra_dir_perms;
49allow system_app anr_data_file:file create_file_perms;
50
51# Settings need to access app name and icon from asec
52allow system_app asec_apk_file:file r_file_perms;
53
54# Allow system apps to interact with incidentd
55binder_call(system_app, incidentd)
56
57allow system_app servicemanager:service_manager list;
58# TODO: scope this down? Too broad?
59allow system_app { service_manager_type -netd_service -dumpstate_service -installd_service -virtual_touchpad_service -vr_hwc_service }:service_manager find;
60
61allow system_app keystore:keystore_key {
62    get_state
63    get
64    insert
65    delete
66    exist
67    list
68    reset
69    password
70    lock
71    unlock
72    is_empty
73    sign
74    verify
75    grant
76    duplicate
77    clear_uid
78    user_changed
79};
80
81# /sys access
82r_dir_file(system_app, sysfs_type)
83
84control_logd(system_app)
85read_runtime_log_tags(system_app)
86
87###
88### Neverallow rules
89###
90
91# app domains which access /dev/fuse should not run as system_app
92neverallow system_app fuse_device:chr_file *;
93