1###
2### Apps signed with the platform key.
3###
4
5typeattribute platform_app coredomain;
6
7app_domain(platform_app)
8
9# Access the network.
10net_domain(platform_app)
11# Access bluetooth.
12bluetooth_domain(platform_app)
13# Read from /data/local/tmp or /data/data/com.android.shell.
14allow platform_app shell_data_file:dir search;
15allow platform_app shell_data_file:file { open getattr read };
16allow platform_app icon_file:file { open getattr read };
17# Populate /data/app/vmdl*.tmp, /data/app-private/vmdl*.tmp files
18# created by system server.
19allow platform_app { apk_tmp_file apk_private_tmp_file }:dir rw_dir_perms;
20allow platform_app { apk_tmp_file apk_private_tmp_file }:file rw_file_perms;
21allow platform_app apk_private_data_file:dir search;
22# ASEC
23allow platform_app asec_apk_file:dir create_dir_perms;
24allow platform_app asec_apk_file:file create_file_perms;
25
26# Access to /data/media.
27allow platform_app media_rw_data_file:dir create_dir_perms;
28allow platform_app media_rw_data_file:file create_file_perms;
29
30# Write to /cache.
31allow platform_app cache_file:dir create_dir_perms;
32allow platform_app cache_file:file create_file_perms;
33
34# Direct access to vold-mounted storage under /mnt/media_rw
35# This is a performance optimization that allows platform apps to bypass the FUSE layer
36allow platform_app mnt_media_rw_file:dir r_dir_perms;
37allow platform_app sdcard_type:dir create_dir_perms;
38allow platform_app sdcard_type:file create_file_perms;
39
40# com.android.systemui
41allow platform_app rootfs:dir getattr;
42
43# com.android.captiveportallogin reads /proc/vmstat
44allow platform_app {
45  proc_vmstat
46}:file r_file_perms;
47
48allow platform_app audioserver_service:service_manager find;
49allow platform_app cameraserver_service:service_manager find;
50allow platform_app drmserver_service:service_manager find;
51allow platform_app mediaserver_service:service_manager find;
52allow platform_app mediametrics_service:service_manager find;
53allow platform_app mediaextractor_service:service_manager find;
54allow platform_app mediacodec_service:service_manager find;
55allow platform_app mediadrmserver_service:service_manager find;
56allow platform_app persistent_data_block_service:service_manager find;
57allow platform_app radio_service:service_manager find;
58allow platform_app thermal_service:service_manager find;
59allow platform_app timezone_service:service_manager find;
60allow platform_app app_api_service:service_manager find;
61allow platform_app system_api_service:service_manager find;
62allow platform_app vr_manager_service:service_manager find;
63
64# Access to /data/preloads
65allow platform_app preloads_data_file:file r_file_perms;
66allow platform_app preloads_data_file:dir r_dir_perms;
67allow platform_app preloads_media_file:file r_file_perms;
68allow platform_app preloads_media_file:dir r_dir_perms;
69
70read_runtime_log_tags(platform_app)
71
72# allow platform apps to use UDP sockets provided by the system server but not
73# modify them other than to connect
74allow platform_app system_server:udp_socket {
75        connect getattr read recvfrom sendto write getopt setopt };
76
77# allow platform apps to connect to the property service
78set_prop(platform_app, test_boot_reason_prop)
79
80###
81### Neverallow rules
82###
83
84# app domains which access /dev/fuse should not run as platform_app
85neverallow platform_app fuse_device:chr_file *;
86