xref: /aosp_15_r20/system/sepolicy/prebuilts/api/33.0/private/zygote.te (revision e4a36f4174b17bbab9dc043f4a65dc8d87377290)
1*e4a36f41SAndroid Build Coastguard Worker# zygote
2*e4a36f41SAndroid Build Coastguard Workertypeattribute zygote coredomain;
3*e4a36f41SAndroid Build Coastguard Workertypeattribute zygote mlstrustedsubject;
4*e4a36f41SAndroid Build Coastguard Worker
5*e4a36f41SAndroid Build Coastguard Workerinit_daemon_domain(zygote)
6*e4a36f41SAndroid Build Coastguard Workertmpfs_domain(zygote)
7*e4a36f41SAndroid Build Coastguard Worker
8*e4a36f41SAndroid Build Coastguard Workerread_runtime_log_tags(zygote)
9*e4a36f41SAndroid Build Coastguard Worker
10*e4a36f41SAndroid Build Coastguard Worker# Override DAC on files and switch uid/gid.
11*e4a36f41SAndroid Build Coastguard Workerallow zygote self:global_capability_class_set { dac_override dac_read_search setgid setuid fowner chown };
12*e4a36f41SAndroid Build Coastguard Worker
13*e4a36f41SAndroid Build Coastguard Worker# Drop capabilities from bounding set.
14*e4a36f41SAndroid Build Coastguard Workerallow zygote self:global_capability_class_set setpcap;
15*e4a36f41SAndroid Build Coastguard Worker
16*e4a36f41SAndroid Build Coastguard Worker# Switch SELinux context to app domains.
17*e4a36f41SAndroid Build Coastguard Workerallow zygote self:process setcurrent;
18*e4a36f41SAndroid Build Coastguard Workerallow zygote system_server_startup:process dyntransition;
19*e4a36f41SAndroid Build Coastguard Workerallow zygote appdomain:process dyntransition;
20*e4a36f41SAndroid Build Coastguard Workerallow zygote webview_zygote:process dyntransition;
21*e4a36f41SAndroid Build Coastguard Workerallow zygote app_zygote:process dyntransition;
22*e4a36f41SAndroid Build Coastguard Worker
23*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to read app /proc/pid dirs (b/10455872).
24*e4a36f41SAndroid Build Coastguard Workerallow zygote appdomain:dir { getattr search };
25*e4a36f41SAndroid Build Coastguard Workerallow zygote appdomain:file { r_file_perms };
26*e4a36f41SAndroid Build Coastguard Worker
27*e4a36f41SAndroid Build Coastguard Workeruserfaultfd_use(zygote)
28*e4a36f41SAndroid Build Coastguard Worker
29*e4a36f41SAndroid Build Coastguard Worker# Move children into the peer process group.
30*e4a36f41SAndroid Build Coastguard Workerallow zygote system_server:process { getpgid setpgid };
31*e4a36f41SAndroid Build Coastguard Workerallow zygote appdomain:process { getpgid setpgid };
32*e4a36f41SAndroid Build Coastguard Workerallow zygote webview_zygote:process { getpgid setpgid };
33*e4a36f41SAndroid Build Coastguard Workerallow zygote app_zygote:process { getpgid setpgid };
34*e4a36f41SAndroid Build Coastguard Worker
35*e4a36f41SAndroid Build Coastguard Worker# Read system data.
36*e4a36f41SAndroid Build Coastguard Workerallow zygote system_data_file:dir r_dir_perms;
37*e4a36f41SAndroid Build Coastguard Workerallow zygote system_data_file:file r_file_perms;
38*e4a36f41SAndroid Build Coastguard Worker
39*e4a36f41SAndroid Build Coastguard Worker# Write to /data/dalvik-cache.
40*e4a36f41SAndroid Build Coastguard Workerallow zygote dalvikcache_data_file:dir create_dir_perms;
41*e4a36f41SAndroid Build Coastguard Workerallow zygote dalvikcache_data_file:file create_file_perms;
42*e4a36f41SAndroid Build Coastguard Worker
43*e4a36f41SAndroid Build Coastguard Worker# Create symlinks in /data/dalvik-cache.
44*e4a36f41SAndroid Build Coastguard Workerallow zygote dalvikcache_data_file:lnk_file create_file_perms;
45*e4a36f41SAndroid Build Coastguard Worker
46*e4a36f41SAndroid Build Coastguard Worker# Write to /data/resource-cache.
47*e4a36f41SAndroid Build Coastguard Workerallow zygote resourcecache_data_file:dir rw_dir_perms;
48*e4a36f41SAndroid Build Coastguard Workerallow zygote resourcecache_data_file:file create_file_perms;
49*e4a36f41SAndroid Build Coastguard Worker
50*e4a36f41SAndroid Build Coastguard Worker# For updateability, the zygote may fetch the current boot
51*e4a36f41SAndroid Build Coastguard Worker# classpath from the dalvik cache. Integrity of the files
52*e4a36f41SAndroid Build Coastguard Worker# is ensured by fsverity protection (checked in art_apex_boot_integrity).
53*e4a36f41SAndroid Build Coastguard Workerallow zygote dalvikcache_data_file:file execute;
54*e4a36f41SAndroid Build Coastguard Worker
55*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to find files in APEX data directories.
56*e4a36f41SAndroid Build Coastguard Workerallow zygote apex_module_data_file:dir search;
57*e4a36f41SAndroid Build Coastguard Worker
58*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to find and map files created by on device signing.
59*e4a36f41SAndroid Build Coastguard Workerallow zygote apex_art_data_file:dir { getattr search };
60*e4a36f41SAndroid Build Coastguard Workerallow zygote apex_art_data_file:file { r_file_perms execute };
61*e4a36f41SAndroid Build Coastguard Worker
62*e4a36f41SAndroid Build Coastguard Worker# Bind mount on /data/data and mounted volumes
63*e4a36f41SAndroid Build Coastguard Workerallow zygote { system_data_file mnt_expand_file }:dir mounton;
64*e4a36f41SAndroid Build Coastguard Worker
65*e4a36f41SAndroid Build Coastguard Worker# Relabel /data/user /data/user_de /data/data and /data/misc_{ce,de}/<user-id>/sdksandbox
66*e4a36f41SAndroid Build Coastguard Workerallow zygote tmpfs:{ dir lnk_file } relabelfrom;
67*e4a36f41SAndroid Build Coastguard Workerallow zygote system_data_file:{ dir lnk_file } relabelto;
68*e4a36f41SAndroid Build Coastguard Workerallow zygote sdk_sandbox_system_data_file:dir { search relabelto };
69*e4a36f41SAndroid Build Coastguard Worker
70*e4a36f41SAndroid Build Coastguard Worker# Zygote opens /mnt/expand to mount CE DE storage on each vol
71*e4a36f41SAndroid Build Coastguard Workerallow zygote mnt_expand_file:dir { open read search relabelto };
72*e4a36f41SAndroid Build Coastguard Worker
73*e4a36f41SAndroid Build Coastguard Worker# Bind mount subdirectories on /data/misc/profiles/cur and /data/misc/profiles/ref
74*e4a36f41SAndroid Build Coastguard Workerallow zygote { user_profile_root_file user_profile_data_file }:dir { mounton search };
75*e4a36f41SAndroid Build Coastguard Worker
76*e4a36f41SAndroid Build Coastguard Worker# Create and bind dirs on /data/data
77*e4a36f41SAndroid Build Coastguard Workerallow zygote tmpfs:dir { create_dir_perms mounton };
78*e4a36f41SAndroid Build Coastguard Worker
79*e4a36f41SAndroid Build Coastguard Worker# Goes into media directory and bind mount obb directory
80*e4a36f41SAndroid Build Coastguard Workerallow zygote media_rw_data_file:dir { getattr search };
81*e4a36f41SAndroid Build Coastguard Worker
82*e4a36f41SAndroid Build Coastguard Worker# Bind mount on top of existing mounted obb and data directory
83*e4a36f41SAndroid Build Coastguard Workerallow zygote media_rw_data_file:dir { mounton };
84*e4a36f41SAndroid Build Coastguard Worker
85*e4a36f41SAndroid Build Coastguard Worker# Read if sdcardfs is supported
86*e4a36f41SAndroid Build Coastguard Workerallow zygote proc_filesystems:file r_file_perms;
87*e4a36f41SAndroid Build Coastguard Worker
88*e4a36f41SAndroid Build Coastguard Worker# Create symlink for /data/user/0
89*e4a36f41SAndroid Build Coastguard Workerallow zygote tmpfs:lnk_file create;
90*e4a36f41SAndroid Build Coastguard Worker
91*e4a36f41SAndroid Build Coastguard Workerallow zygote mirror_data_file:dir r_dir_perms;
92*e4a36f41SAndroid Build Coastguard Worker
93*e4a36f41SAndroid Build Coastguard Worker# Get inode of directories for app data isolation
94*e4a36f41SAndroid Build Coastguard Workerallow zygote {
95*e4a36f41SAndroid Build Coastguard Worker  app_data_file_type
96*e4a36f41SAndroid Build Coastguard Worker  system_data_file
97*e4a36f41SAndroid Build Coastguard Worker  mnt_expand_file
98*e4a36f41SAndroid Build Coastguard Worker  sdk_sandbox_system_data_file
99*e4a36f41SAndroid Build Coastguard Worker}:dir getattr;
100*e4a36f41SAndroid Build Coastguard Worker
101*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to create JIT memory.
102*e4a36f41SAndroid Build Coastguard Workerallow zygote self:process execmem;
103*e4a36f41SAndroid Build Coastguard Workerallow zygote zygote_tmpfs:file execute;
104*e4a36f41SAndroid Build Coastguard Workerallow zygote ashmem_libcutils_device:chr_file execute;
105*e4a36f41SAndroid Build Coastguard Worker
106*e4a36f41SAndroid Build Coastguard Worker# Execute idmap and dex2oat within zygote's own domain.
107*e4a36f41SAndroid Build Coastguard Worker# TODO:  Should either of these be transitioned to the same domain
108*e4a36f41SAndroid Build Coastguard Worker# used by installd or stay in-domain for zygote?
109*e4a36f41SAndroid Build Coastguard Workerallow zygote idmap_exec:file rx_file_perms;
110*e4a36f41SAndroid Build Coastguard Workerallow zygote dex2oat_exec:file rx_file_perms;
111*e4a36f41SAndroid Build Coastguard Worker
112*e4a36f41SAndroid Build Coastguard Worker# Allow apps access to /vendor/overlay
113*e4a36f41SAndroid Build Coastguard Workerr_dir_file(zygote, vendor_overlay_file)
114*e4a36f41SAndroid Build Coastguard Worker
115*e4a36f41SAndroid Build Coastguard Worker# Control cgroups.
116*e4a36f41SAndroid Build Coastguard Workerallow zygote cgroup:dir create_dir_perms;
117*e4a36f41SAndroid Build Coastguard Workerallow zygote cgroup:{ file lnk_file } { r_file_perms setattr };
118*e4a36f41SAndroid Build Coastguard Workerallow zygote cgroup_v2:dir create_dir_perms;
119*e4a36f41SAndroid Build Coastguard Workerallow zygote cgroup_v2:{ file lnk_file } { r_file_perms setattr };
120*e4a36f41SAndroid Build Coastguard Workerallow zygote self:global_capability_class_set sys_admin;
121*e4a36f41SAndroid Build Coastguard Worker
122*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to stat the files that it opens. The zygote must
123*e4a36f41SAndroid Build Coastguard Worker# be able to inspect them so that it can reopen them on fork
124*e4a36f41SAndroid Build Coastguard Worker# if necessary: b/30963384.
125*e4a36f41SAndroid Build Coastguard Workerallow zygote pmsg_device:chr_file getattr;
126*e4a36f41SAndroid Build Coastguard Workerallow zygote debugfs_trace_marker:file getattr;
127*e4a36f41SAndroid Build Coastguard Worker
128*e4a36f41SAndroid Build Coastguard Worker# Get seapp_contexts
129*e4a36f41SAndroid Build Coastguard Workerallow zygote seapp_contexts_file:file r_file_perms;
130*e4a36f41SAndroid Build Coastguard Worker# Check validity of SELinux context before use.
131*e4a36f41SAndroid Build Coastguard Workerselinux_check_context(zygote)
132*e4a36f41SAndroid Build Coastguard Worker# Check SELinux permissions.
133*e4a36f41SAndroid Build Coastguard Workerselinux_check_access(zygote)
134*e4a36f41SAndroid Build Coastguard Worker
135*e4a36f41SAndroid Build Coastguard Worker# Native bridge functionality requires that zygote replaces
136*e4a36f41SAndroid Build Coastguard Worker# /proc/cpuinfo with /system/lib/<ISA>/cpuinfo using a bind mount
137*e4a36f41SAndroid Build Coastguard Workerallow zygote proc_cpuinfo:file mounton;
138*e4a36f41SAndroid Build Coastguard Worker
139*e4a36f41SAndroid Build Coastguard Worker# Allow remounting rootfs as MS_SLAVE.
140*e4a36f41SAndroid Build Coastguard Workerallow zygote rootfs:dir mounton;
141*e4a36f41SAndroid Build Coastguard Workerallow zygote tmpfs:filesystem { mount unmount };
142*e4a36f41SAndroid Build Coastguard Workerallow zygote fuse:filesystem { unmount };
143*e4a36f41SAndroid Build Coastguard Workerallow zygote sdcardfs:filesystem { unmount };
144*e4a36f41SAndroid Build Coastguard Workerallow zygote labeledfs:filesystem { unmount };
145*e4a36f41SAndroid Build Coastguard Worker
146*e4a36f41SAndroid Build Coastguard Worker# Allow creating user-specific storage source if started before vold.
147*e4a36f41SAndroid Build Coastguard Workerallow zygote mnt_user_file:dir { create_dir_perms mounton };
148*e4a36f41SAndroid Build Coastguard Workerallow zygote mnt_user_file:lnk_file create_file_perms;
149*e4a36f41SAndroid Build Coastguard Workerallow zygote mnt_user_file:file create_file_perms;
150*e4a36f41SAndroid Build Coastguard Worker
151*e4a36f41SAndroid Build Coastguard Worker# Allow mounting user-specific storage source if started before vold.
152*e4a36f41SAndroid Build Coastguard Workerallow zygote mnt_pass_through_file:dir { create_dir_perms mounton };
153*e4a36f41SAndroid Build Coastguard Worker
154*e4a36f41SAndroid Build Coastguard Worker# Allowed to mount user-specific storage into place
155*e4a36f41SAndroid Build Coastguard Workerallow zygote storage_file:dir { search mounton };
156*e4a36f41SAndroid Build Coastguard Worker
157*e4a36f41SAndroid Build Coastguard Worker# Allow mounting and creating files, dirs on sdcardfs.
158*e4a36f41SAndroid Build Coastguard Workerallow zygote { sdcard_type fuse }:dir { create_dir_perms mounton };
159*e4a36f41SAndroid Build Coastguard Workerallow zygote { sdcard_type fuse }:file { create_file_perms };
160*e4a36f41SAndroid Build Coastguard Worker
161*e4a36f41SAndroid Build Coastguard Worker# Handle --invoke-with command when launching Zygote with a wrapper command.
162*e4a36f41SAndroid Build Coastguard Workerallow zygote zygote_exec:file rx_file_perms;
163*e4a36f41SAndroid Build Coastguard Worker
164*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to write to statsd.
165*e4a36f41SAndroid Build Coastguard Workerunix_socket_send(zygote, statsdw, statsd)
166*e4a36f41SAndroid Build Coastguard Worker
167*e4a36f41SAndroid Build Coastguard Worker# Root fs.
168*e4a36f41SAndroid Build Coastguard Workerr_dir_file(zygote, rootfs)
169*e4a36f41SAndroid Build Coastguard Worker
170*e4a36f41SAndroid Build Coastguard Worker# System file accesses.
171*e4a36f41SAndroid Build Coastguard Workerr_dir_file(zygote, system_file)
172*e4a36f41SAndroid Build Coastguard Worker
173*e4a36f41SAndroid Build Coastguard Worker# /oem accesses.
174*e4a36f41SAndroid Build Coastguard Workerallow zygote oemfs:dir search;
175*e4a36f41SAndroid Build Coastguard Worker
176*e4a36f41SAndroid Build Coastguard Workeruserdebug_or_eng(`
177*e4a36f41SAndroid Build Coastguard Worker  # Allow zygote to create and write method traces in /data/misc/trace.
178*e4a36f41SAndroid Build Coastguard Worker  allow zygote method_trace_data_file:dir w_dir_perms;
179*e4a36f41SAndroid Build Coastguard Worker  allow zygote method_trace_data_file:file { create w_file_perms };
180*e4a36f41SAndroid Build Coastguard Worker')
181*e4a36f41SAndroid Build Coastguard Worker
182*e4a36f41SAndroid Build Coastguard Workerallow zygote ion_device:chr_file r_file_perms;
183*e4a36f41SAndroid Build Coastguard Workerallow zygote tmpfs:dir r_dir_perms;
184*e4a36f41SAndroid Build Coastguard Worker
185*e4a36f41SAndroid Build Coastguard Workerallow zygote same_process_hal_file:file { execute read open getattr map };
186*e4a36f41SAndroid Build Coastguard Worker
187*e4a36f41SAndroid Build Coastguard Worker# Allow the zygote to access storage properties to check if sdcardfs is enabled.
188*e4a36f41SAndroid Build Coastguard Workerget_prop(zygote, storage_config_prop);
189*e4a36f41SAndroid Build Coastguard Worker
190*e4a36f41SAndroid Build Coastguard Worker# Let the zygote access overlays so it can initialize the AssetManager.
191*e4a36f41SAndroid Build Coastguard Workerget_prop(zygote, overlay_prop)
192*e4a36f41SAndroid Build Coastguard Workerget_prop(zygote, exported_overlay_prop)
193*e4a36f41SAndroid Build Coastguard Worker
194*e4a36f41SAndroid Build Coastguard Worker# Allow the zygote to access the runtime feature flag properties.
195*e4a36f41SAndroid Build Coastguard Workerget_prop(zygote, device_config_runtime_native_prop)
196*e4a36f41SAndroid Build Coastguard Workerget_prop(zygote, device_config_runtime_native_boot_prop)
197*e4a36f41SAndroid Build Coastguard Worker
198*e4a36f41SAndroid Build Coastguard Worker# Allow the zygote to access window manager native boot feature flags
199*e4a36f41SAndroid Build Coastguard Worker# to initialize WindowManager static properties.
200*e4a36f41SAndroid Build Coastguard Workerget_prop(zygote, device_config_window_manager_native_boot_prop)
201*e4a36f41SAndroid Build Coastguard Worker
202*e4a36f41SAndroid Build Coastguard Worker# ingore spurious denials
203*e4a36f41SAndroid Build Coastguard Worker# fsetid can be checked as a consequence of chmod when using cgroup v2 uid/pid hierarchy. This is
204*e4a36f41SAndroid Build Coastguard Worker# done to determine if the file should inherit setgid. In this case, setgid on the file is
205*e4a36f41SAndroid Build Coastguard Worker# undesirable, so suppress the denial.
206*e4a36f41SAndroid Build Coastguard Workerdontaudit zygote self:global_capability_class_set { sys_resource fsetid };
207*e4a36f41SAndroid Build Coastguard Worker
208*e4a36f41SAndroid Build Coastguard Worker# Ignore spurious denials calling access() on fuse.
209*e4a36f41SAndroid Build Coastguard Worker# Also ignore read and open as sdcardfs may read and open dir when app tries to access a dir that
210*e4a36f41SAndroid Build Coastguard Worker# doesn't exist.
211*e4a36f41SAndroid Build Coastguard Worker# TODO(b/151316657): avoid the denials
212*e4a36f41SAndroid Build Coastguard Workerdontaudit zygote media_rw_data_file:dir  { read open setattr };
213*e4a36f41SAndroid Build Coastguard Worker
214*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to use ashmem fds from system_server.
215*e4a36f41SAndroid Build Coastguard Workerallow zygote system_server:fd use;
216*e4a36f41SAndroid Build Coastguard Worker
217*e4a36f41SAndroid Build Coastguard Worker# Send unsolicited message to system_server
218*e4a36f41SAndroid Build Coastguard Workerunix_socket_send(zygote, system_unsolzygote, system_server)
219*e4a36f41SAndroid Build Coastguard Worker
220*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to access media_variant_prop for static initialization
221*e4a36f41SAndroid Build Coastguard Workerget_prop(zygote, media_variant_prop)
222*e4a36f41SAndroid Build Coastguard Worker
223*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to access odsign verification status
224*e4a36f41SAndroid Build Coastguard Workerget_prop(zygote, odsign_prop)
225*e4a36f41SAndroid Build Coastguard Worker
226*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to read ro.control_privapp_permissions and ro.cp_system_other_odex
227*e4a36f41SAndroid Build Coastguard Workerget_prop(zygote, packagemanager_config_prop)
228*e4a36f41SAndroid Build Coastguard Worker
229*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to read qemu.sf.lcd_density
230*e4a36f41SAndroid Build Coastguard Workerget_prop(zygote, qemu_sf_lcd_density_prop)
231*e4a36f41SAndroid Build Coastguard Worker
232*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to read /apex/apex-info-list.xml
233*e4a36f41SAndroid Build Coastguard Workerallow zygote apex_info_file:file r_file_perms;
234*e4a36f41SAndroid Build Coastguard Worker
235*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to canonicalize vendor APEX paths. This is used when zygote is checking the
236*e4a36f41SAndroid Build Coastguard Worker# preinstalled path of APEXes that contain runtime resource overlays for the 'android' package.
237*e4a36f41SAndroid Build Coastguard Workerallow zygote vendor_apex_file:dir { getattr search };
238*e4a36f41SAndroid Build Coastguard Workerallow zygote vendor_apex_file:file { getattr };
239*e4a36f41SAndroid Build Coastguard Worker
240*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to query for compression/features.
241*e4a36f41SAndroid Build Coastguard Workerr_dir_file(zygote, sysfs_fs_f2fs)
242*e4a36f41SAndroid Build Coastguard Worker
243*e4a36f41SAndroid Build Coastguard Worker###
244*e4a36f41SAndroid Build Coastguard Worker### neverallow rules
245*e4a36f41SAndroid Build Coastguard Worker###
246*e4a36f41SAndroid Build Coastguard Worker
247*e4a36f41SAndroid Build Coastguard Worker# Ensure that all types assigned to app processes are included
248*e4a36f41SAndroid Build Coastguard Worker# in the appdomain attribute, so that all allow and neverallow rules
249*e4a36f41SAndroid Build Coastguard Worker# written on appdomain are applied to all app processes.
250*e4a36f41SAndroid Build Coastguard Worker# This is achieved by ensuring that it is impossible for zygote to
251*e4a36f41SAndroid Build Coastguard Worker# setcon (dyntransition) to any types other than those associated
252*e4a36f41SAndroid Build Coastguard Worker# with appdomain plus system_server_startup, webview_zygote and
253*e4a36f41SAndroid Build Coastguard Worker# app_zygote.
254*e4a36f41SAndroid Build Coastguard Workerneverallow zygote ~{
255*e4a36f41SAndroid Build Coastguard Worker  appdomain
256*e4a36f41SAndroid Build Coastguard Worker  system_server_startup
257*e4a36f41SAndroid Build Coastguard Worker  webview_zygote
258*e4a36f41SAndroid Build Coastguard Worker  app_zygote
259*e4a36f41SAndroid Build Coastguard Worker}:process dyntransition;
260*e4a36f41SAndroid Build Coastguard Worker
261*e4a36f41SAndroid Build Coastguard Worker# Zygote should never execute anything from /data except for
262*e4a36f41SAndroid Build Coastguard Worker# /data/dalvik-cache files or files generated during on-device
263*e4a36f41SAndroid Build Coastguard Worker# signing under /data/misc/apexdata/com.android.art/.
264*e4a36f41SAndroid Build Coastguard Workerneverallow zygote {
265*e4a36f41SAndroid Build Coastguard Worker  data_file_type
266*e4a36f41SAndroid Build Coastguard Worker  -apex_art_data_file # map PROT_EXEC
267*e4a36f41SAndroid Build Coastguard Worker  -dalvikcache_data_file # map PROT_EXEC
268*e4a36f41SAndroid Build Coastguard Worker}:file no_x_file_perms;
269*e4a36f41SAndroid Build Coastguard Worker
270*e4a36f41SAndroid Build Coastguard Worker# Do not allow access to Bluetooth-related system properties and files
271*e4a36f41SAndroid Build Coastguard Workerneverallow zygote {
272*e4a36f41SAndroid Build Coastguard Worker  bluetooth_a2dp_offload_prop
273*e4a36f41SAndroid Build Coastguard Worker  bluetooth_audio_hal_prop
274*e4a36f41SAndroid Build Coastguard Worker  bluetooth_prop
275*e4a36f41SAndroid Build Coastguard Worker  exported_bluetooth_prop
276*e4a36f41SAndroid Build Coastguard Worker}:file create_file_perms;
277*e4a36f41SAndroid Build Coastguard Worker
278*e4a36f41SAndroid Build Coastguard Worker# Zygote should not be able to access app private data.
279*e4a36f41SAndroid Build Coastguard Workerneverallow zygote app_data_file_type:dir ~getattr;
280