1###
2### AutoPlay apps.
3###
4### This file defines the security policy for apps with the autoplay
5### feature.
6###
7### The autoplay_app domain is a reduced permissions sandbox allowing
8### ephemeral applications to be safely installed and run. Non ephemeral
9### applications may also opt-in to autoplay to take advantage of the
10### additional security features.
11###
12### PackageManager flags an app as autoplay at install time.
13type autoplay_app, domain;
14
15# allow JITing
16allow autoplay_app self:process execmem;
17allow autoplay_app ashmem_device:chr_file execute;
18
19# Define and allow access to our own type for ashmem regions.
20# Label ashmem objects with our own unique type.
21tmpfs_domain(autoplay_app)
22# Map with PROT_EXEC.
23allow autoplay_app autoplay_app_tmpfs:file execute;
24
25# Read system properties managed by zygote.
26allow autoplay_app zygote_tmpfs:file read;
27
28# Send logcat messages to logd.
29write_logd(autoplay_app)
30
31# Receive and use open file descriptors inherited from zygote.
32allow autoplay_app zygote:fd use;
33
34# Notify zygote of death;
35allow autoplay_app zygote:process sigchld;
36
37# application inherit logd write socket (urge is to deprecate this long term)
38allow autoplay_app zygote:unix_dgram_socket write;
39
40# App sandbox file accesses.
41allow autoplay_app autoplay_data_file:dir create_dir_perms;
42allow autoplay_app autoplay_data_file:{ file sock_file fifo_file } create_file_perms;
43
44# For art.
45allow autoplay_app dalvikcache_data_file:file { execute r_file_perms };
46allow autoplay_app dalvikcache_data_file:lnk_file r_file_perms;
47allow autoplay_app dalvikcache_data_file:dir getattr;
48
49# Grant GPU access. autoplay_app needs that to render the standard UI.
50allow autoplay_app gpu_device:chr_file rw_file_perms;
51
52# Use the Binder.
53binder_use(autoplay_app)
54# Perform binder IPC to binder services.
55binder_call(autoplay_app, surfaceflinger)
56binder_call(autoplay_app, system_server)
57
58# Allow read access to ion memory allocation device
59allow autoplay_app ion_device:chr_file { read open };
60
61# Use pipes and sockets provided by system_server via binder or local socket.
62allow autoplay_app system_server:fifo_file rw_file_perms;
63allow autoplay_app system_server:unix_stream_socket { read write setopt getattr getopt shutdown };
64allow autoplay_app system_server:tcp_socket { read write getattr getopt shutdown };
65
66# Inherit or receive open files from system_server.
67allow autoplay_app system_server:fd use;
68
69# Communicate with surfaceflinger.
70allow autoplay_app surfaceflinger:unix_stream_socket { read write setopt getattr getopt shutdown };
71
72# Read files already opened under /data.
73allow autoplay_app system_data_file:file { getattr read };
74allow autoplay_app system_data_file:lnk_file read;
75
76# System file accesses. Check for libraries
77allow autoplay_app system_file:dir getattr;
78
79# services
80allow autoplay_app accessibility_service:service_manager find;
81allow autoplay_app activity_service:service_manager find;
82allow autoplay_app assetatlas_service:service_manager find;
83allow autoplay_app connectivity_service:service_manager find;
84allow autoplay_app display_service:service_manager find;
85allow autoplay_app graphicsstats_service:service_manager find;
86allow autoplay_app input_method_service:service_manager find;
87allow autoplay_app input_service:service_manager find;
88allow autoplay_app surfaceflinger_service:service_manager find;
89allow autoplay_app textservices_service:service_manager find;
90
91###
92### neverallow rules
93###
94
95# Receive or send uevent messages.
96neverallow autoplay_app domain:netlink_kobject_uevent_socket *;
97
98# Receive or send generic netlink messages
99neverallow autoplay_app domain:netlink_socket *;
100
101# Too much leaky information in debugfs. It's a security
102# best practice to ensure these files aren't readable.
103neverallow autoplay_app debugfs:file read;
104
105# execute gpu_device
106neverallow autoplay_app gpu_device:chr_file execute;
107
108# access files in /sys with the default sysfs label
109neverallow autoplay_app sysfs:file *;
110