xref: /aosp_15_r20/system/sepolicy/prebuilts/api/29.0/private/app.te (revision e4a36f4174b17bbab9dc043f4a65dc8d87377290) 
1*e4a36f41SAndroid Build Coastguard Worker# Allow apps to read the Test Harness Mode property. This property is used in
2*e4a36f41SAndroid Build Coastguard Worker# the implementation of ActivityManager.isDeviceInTestHarnessMode()
3*e4a36f41SAndroid Build Coastguard Workerget_prop(appdomain, test_harness_prop)
4*e4a36f41SAndroid Build Coastguard Worker
5*e4a36f41SAndroid Build Coastguard Workerneverallow appdomain system_server:udp_socket {
6*e4a36f41SAndroid Build Coastguard Worker        accept append bind create ioctl listen lock name_bind
7*e4a36f41SAndroid Build Coastguard Worker        relabelfrom relabelto setattr shutdown };
8*e4a36f41SAndroid Build Coastguard Worker
9*e4a36f41SAndroid Build Coastguard Worker# Transition to a non-app domain.
10*e4a36f41SAndroid Build Coastguard Worker# Exception for the shell and su domains, can transition to runas, etc.
11*e4a36f41SAndroid Build Coastguard Worker# Exception for crash_dump to allow for app crash reporting.
12*e4a36f41SAndroid Build Coastguard Worker# Exception for renderscript binaries (/system/bin/bcc, /system/bin/ld.mc)
13*e4a36f41SAndroid Build Coastguard Worker# to allow renderscript to create privileged executable files.
14*e4a36f41SAndroid Build Coastguard Workerneverallow { appdomain -shell userdebug_or_eng(`-su') }
15*e4a36f41SAndroid Build Coastguard Worker    { domain -appdomain -crash_dump -rs }:process { transition };
16*e4a36f41SAndroid Build Coastguard Workerneverallow { appdomain -shell userdebug_or_eng(`-su') }
17*e4a36f41SAndroid Build Coastguard Worker    { domain -appdomain }:process { dyntransition };
18