1### 2### Apps that run with the system UID, e.g. com.android.system.ui, 3### com.android.settings. These are not as privileged as the system 4### server. 5### 6 7typeattribute system_app coredomain; 8 9app_domain(system_app) 10net_domain(system_app) 11binder_service(system_app) 12 13# android.ui and system.ui 14allow system_app rootfs:dir getattr; 15 16# Read and write /data/data subdirectory. 17allow system_app system_app_data_file:dir create_dir_perms; 18allow system_app system_app_data_file:{ file lnk_file } create_file_perms; 19 20# Read and write to /data/misc/user. 21allow system_app misc_user_data_file:dir create_dir_perms; 22allow system_app misc_user_data_file:file create_file_perms; 23 24# Access to vold-mounted storage for measuring free space 25allow system_app mnt_media_rw_file:dir search; 26 27# Read wallpaper file. 28allow system_app wallpaper_file:file r_file_perms; 29 30# Read icon file. 31allow system_app icon_file:file r_file_perms; 32 33# Write to properties 34set_prop(system_app, bluetooth_a2dp_offload_prop) 35set_prop(system_app, bluetooth_prop) 36set_prop(system_app, debug_prop) 37set_prop(system_app, system_prop) 38set_prop(system_app, exported_bluetooth_prop) 39set_prop(system_app, exported_system_prop) 40set_prop(system_app, exported2_system_prop) 41set_prop(system_app, exported3_system_prop) 42set_prop(system_app, logd_prop) 43set_prop(system_app, net_radio_prop) 44set_prop(system_app, system_radio_prop) 45set_prop(system_app, exported_system_radio_prop) 46set_prop(system_app, log_tag_prop) 47userdebug_or_eng(`set_prop(system_app, logpersistd_logging_prop)') 48auditallow system_app net_radio_prop:property_service set; 49auditallow system_app system_radio_prop:property_service set; 50auditallow system_app exported_system_radio_prop:property_service set; 51 52# ctl interface 53set_prop(system_app, ctl_default_prop) 54set_prop(system_app, ctl_bugreport_prop) 55 56# Create /data/anr/traces.txt. 57allow system_app anr_data_file:dir ra_dir_perms; 58allow system_app anr_data_file:file create_file_perms; 59 60# Settings need to access app name and icon from asec 61allow system_app asec_apk_file:file r_file_perms; 62 63# Allow system apps (like Settings) to interact with statsd 64binder_call(system_app, statsd) 65 66# Allow system apps to interact with incidentd 67binder_call(system_app, incidentd) 68 69allow system_app servicemanager:service_manager list; 70# TODO: scope this down? Too broad? 71allow system_app { 72 service_manager_type 73 -dumpstate_service 74 -installd_service 75 -netd_service 76 -virtual_touchpad_service 77 -vold_service 78 -vr_hwc_service 79}:service_manager find; 80# suppress denials for services system_app should not be accessing. 81dontaudit system_app { 82 dumpstate_service 83 installd_service 84 netd_service 85 virtual_touchpad_service 86 vold_service 87 vr_hwc_service 88}:service_manager find; 89 90allow system_app keystore:keystore_key { 91 get_state 92 get 93 insert 94 delete 95 exist 96 list 97 reset 98 password 99 lock 100 unlock 101 is_empty 102 sign 103 verify 104 grant 105 duplicate 106 clear_uid 107 user_changed 108}; 109 110# settings app reads /proc/version 111allow system_app { 112 proc_version 113}:file r_file_perms; 114 115control_logd(system_app) 116read_runtime_log_tags(system_app) 117get_prop(system_app, device_logging_prop) 118 119# allow system apps to use UDP sockets provided by the system server but not 120# modify them other than to connect 121allow system_app system_server:udp_socket { 122 connect getattr read recvfrom sendto write getopt setopt }; 123 124### 125### Neverallow rules 126### 127 128# app domains which access /dev/fuse should not run as system_app 129neverallow system_app fuse_device:chr_file *; 130