123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191 |
- allow untrusted_app_all privapp_data_file:file { r_file_perms execute };
- allow untrusted_app_all app_data_file:file { r_file_perms execute };
- auditallow untrusted_app_all app_data_file:file execute;
- allow untrusted_app_all system_linker_exec:file execute_no_trans;
- allow untrusted_app_all privapp_data_file:lnk_file r_file_perms;
- allow untrusted_app_all app_data_file:{ lnk_file sock_file fifo_file } create_file_perms;
- allow untrusted_app_all app_exec_data_file:file { r_file_perms execute unlink };
- allow untrusted_app_all asec_apk_file:file r_file_perms;
- allow untrusted_app_all asec_apk_file:dir r_dir_perms;
- allow untrusted_app_all asec_public_file:file { execute };
- allow untrusted_app_all shell_data_file:file r_file_perms;
- allow untrusted_app_all shell_data_file:dir r_dir_perms;
- allow untrusted_app_all trace_data_file:file { getattr read };
- neverallow untrusted_app_all trace_data_file:dir *;
- neverallow untrusted_app_all trace_data_file:file { no_w_file_perms open };
- allow untrusted_app_all { apk_tmp_file apk_private_tmp_file }:file {read getattr};
- allow untrusted_app_all system_app_data_file:file { read write getattr };
- allow untrusted_app_all media_rw_data_file:dir create_dir_perms;
- allow untrusted_app_all media_rw_data_file:file create_file_perms;
- allow untrusted_app_all mnt_media_rw_file:dir search;
- allow untrusted_app_all servicemanager:service_manager list;
- allow untrusted_app_all audioserver_service:service_manager find;
- allow untrusted_app_all cameraserver_service:service_manager find;
- allow untrusted_app_all drmserver_service:service_manager find;
- allow untrusted_app_all mediaserver_service:service_manager find;
- allow untrusted_app_all mediaextractor_service:service_manager find;
- allow untrusted_app_all mediacodec_service:service_manager find;
- allow untrusted_app_all mediametrics_service:service_manager find;
- allow untrusted_app_all mediadrmserver_service:service_manager find;
- allow untrusted_app_all nfc_service:service_manager find;
- allow untrusted_app_all radio_service:service_manager find;
- allow untrusted_app_all app_api_service:service_manager find;
- allow untrusted_app_all vr_manager_service:service_manager find;
- allow untrusted_app_all gpu_service:service_manager find;
- binder_call(untrusted_app_all, gpuservice)
- userdebug_or_eng(`
- allow untrusted_app_all perfprofd_data_file:file r_file_perms;
- allow untrusted_app_all perfprofd_data_file:dir r_dir_perms;
- ')
- allow untrusted_app_all self:process ptrace;
- allow untrusted_app_all runas_app:unix_stream_socket connectto;
- allow untrusted_app_all runas_app:process sigchld;
- allow untrusted_app_all sysfs_hwrandom:dir search;
- allow untrusted_app_all sysfs_hwrandom:file r_file_perms;
- allow untrusted_app_all preloads_media_file:dir r_dir_perms;
- allow untrusted_app_all preloads_media_file:file r_file_perms;
- allow untrusted_app_all preloads_data_file:dir search;
- allow untrusted_app_all vendor_app_file:dir { open getattr read search };
- allow untrusted_app_all vendor_app_file:file { r_file_perms execute };
- allow untrusted_app_all vendor_app_file:lnk_file { open getattr read };
- allow untrusted_app_all traced:fd use;
- allow untrusted_app_all traced_tmpfs:file { read write getattr map };
- unix_socket_connect(untrusted_app_all, traced_producer, traced)
- can_profile_heap(untrusted_app_all)
- allow untrusted_app_all system_server:udp_socket {
- connect getattr read recvfrom sendto write getopt setopt };
- domain_auto_trans(untrusted_app_all, rs_exec, rs)
- dontaudit untrusted_app_all net_dns_prop:file read;
- dontaudit untrusted_app_all proc_stat:file read;
- dontaudit untrusted_app_all proc_vmstat:file read;
- dontaudit untrusted_app_all proc_uptime:file read;
- create_pty(untrusted_app_all)
- dontaudit untrusted_app_all system_data_file:dir write;
- userdebug_or_eng(`
- allow untrusted_app_all debugfs_kcov:file rw_file_perms;
- allowxperm untrusted_app_all debugfs_kcov:file ioctl { KCOV_INIT_TRACE KCOV_ENABLE KCOV_DISABLE };
- ')
- binder_call(untrusted_app_all, ashmemd)
- allow untrusted_app_all ashmem_device:chr_file { getattr read ioctl lock map append write };
|