1# Allow apps to read the Test Harness Mode property. This property is used in
2# the implementation of ActivityManager.isDeviceInTestHarnessMode()
3get_prop(appdomain, test_harness_prop)
4
5userdebug_or_eng(`perfetto_producer({ appdomain })')
6
7# Prevent apps from causing presubmit failures.
8# Apps can cause selinux denials by accessing CE storage
9# and/or external storage. In either case, the selinux denial is
10# not the cause of the failure, but just a symptom that
11# storage isn't ready. Many apps handle the failure appropriately.
12#
13# Apps cannot access external storage before it becomes available.
14dontaudit appdomain storage_stub_file:dir getattr;
15# Attempts to write to system_data_file is generally a sign
16# that apps are attempting to access encrypted storage before
17# the ACTION_USER_UNLOCKED intent is delivered. Apps are not
18# allowed to write to CE storage before it's available.
19# Attempting to do so will be blocked by both selinux and unix
20# permissions.
21dontaudit appdomain system_data_file:dir write;
22# Apps should not be reading vendor-defined properties.
23dontaudit appdomain vendor_default_prop:file read;
24
25neverallow appdomain system_server:udp_socket {
26        accept append bind create ioctl listen lock name_bind
27        relabelfrom relabelto setattr shutdown };
28
29# Transition to a non-app domain.
30# Exception for the shell and su domains, can transition to runas, etc.
31# Exception for crash_dump to allow for app crash reporting.
32# Exception for renderscript binaries (/system/bin/bcc, /system/bin/ld.mc)
33# to allow renderscript to create privileged executable files.
34neverallow { appdomain -shell userdebug_or_eng(`-su') }
35    { domain -appdomain -crash_dump -rs }:process { transition };
36neverallow { appdomain -shell userdebug_or_eng(`-su') }
37    { domain -appdomain }:process { dyntransition };
38
39# Don't allow regular apps access to storage configuration properties.
40neverallow { appdomain -mediaprovider_app } storage_config_prop:file no_rw_file_perms;
41
42# Allow to read graphics related properties.
43get_prop(appdomain, graphics_config_prop)
44