1*e4a36f41SAndroid Build Coastguard Worker# zygote 2*e4a36f41SAndroid Build Coastguard Workertypeattribute zygote coredomain; 3*e4a36f41SAndroid Build Coastguard Workertypeattribute zygote mlstrustedsubject; 4*e4a36f41SAndroid Build Coastguard Worker 5*e4a36f41SAndroid Build Coastguard Workerinit_daemon_domain(zygote) 6*e4a36f41SAndroid Build Coastguard Workertmpfs_domain(zygote) 7*e4a36f41SAndroid Build Coastguard Worker 8*e4a36f41SAndroid Build Coastguard Workerread_runtime_log_tags(zygote) 9*e4a36f41SAndroid Build Coastguard Worker 10*e4a36f41SAndroid Build Coastguard Worker# Override DAC on files and switch uid/gid. 11*e4a36f41SAndroid Build Coastguard Workerallow zygote self:global_capability_class_set { dac_override dac_read_search setgid setuid fowner chown }; 12*e4a36f41SAndroid Build Coastguard Worker 13*e4a36f41SAndroid Build Coastguard Worker# Drop capabilities from bounding set. 14*e4a36f41SAndroid Build Coastguard Workerallow zygote self:global_capability_class_set setpcap; 15*e4a36f41SAndroid Build Coastguard Worker 16*e4a36f41SAndroid Build Coastguard Worker# Switch SELinux context to app domains. 17*e4a36f41SAndroid Build Coastguard Workerallow zygote self:process setcurrent; 18*e4a36f41SAndroid Build Coastguard Workerallow zygote system_server_startup:process dyntransition; 19*e4a36f41SAndroid Build Coastguard Workerallow zygote appdomain:process dyntransition; 20*e4a36f41SAndroid Build Coastguard Workerallow zygote webview_zygote:process dyntransition; 21*e4a36f41SAndroid Build Coastguard Workerallow zygote app_zygote:process dyntransition; 22*e4a36f41SAndroid Build Coastguard Worker 23*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to read app /proc/pid dirs (b/10455872). 24*e4a36f41SAndroid Build Coastguard Workerallow zygote appdomain:dir { getattr search }; 25*e4a36f41SAndroid Build Coastguard Workerallow zygote appdomain:file { r_file_perms }; 26*e4a36f41SAndroid Build Coastguard Worker 27*e4a36f41SAndroid Build Coastguard Workeruserfaultfd_use(zygote) 28*e4a36f41SAndroid Build Coastguard Worker 29*e4a36f41SAndroid Build Coastguard Worker# Move children into the peer process group. 30*e4a36f41SAndroid Build Coastguard Workerallow zygote system_server:process { getpgid setpgid }; 31*e4a36f41SAndroid Build Coastguard Workerallow zygote appdomain:process { getpgid setpgid }; 32*e4a36f41SAndroid Build Coastguard Workerallow zygote webview_zygote:process { getpgid setpgid }; 33*e4a36f41SAndroid Build Coastguard Workerallow zygote app_zygote:process { getpgid setpgid }; 34*e4a36f41SAndroid Build Coastguard Worker 35*e4a36f41SAndroid Build Coastguard Worker# Read system data. 36*e4a36f41SAndroid Build Coastguard Workerallow zygote system_data_file:dir r_dir_perms; 37*e4a36f41SAndroid Build Coastguard Workerallow zygote system_data_file:file r_file_perms; 38*e4a36f41SAndroid Build Coastguard Worker 39*e4a36f41SAndroid Build Coastguard Worker# Write to /data/dalvik-cache. 40*e4a36f41SAndroid Build Coastguard Workerallow zygote dalvikcache_data_file:dir create_dir_perms; 41*e4a36f41SAndroid Build Coastguard Workerallow zygote dalvikcache_data_file:file create_file_perms; 42*e4a36f41SAndroid Build Coastguard Worker 43*e4a36f41SAndroid Build Coastguard Worker# Create symlinks in /data/dalvik-cache. 44*e4a36f41SAndroid Build Coastguard Workerallow zygote dalvikcache_data_file:lnk_file create_file_perms; 45*e4a36f41SAndroid Build Coastguard Worker 46*e4a36f41SAndroid Build Coastguard Worker# Write to /data/resource-cache. 47*e4a36f41SAndroid Build Coastguard Workerallow zygote resourcecache_data_file:dir rw_dir_perms; 48*e4a36f41SAndroid Build Coastguard Workerallow zygote resourcecache_data_file:file create_file_perms; 49*e4a36f41SAndroid Build Coastguard Worker 50*e4a36f41SAndroid Build Coastguard Worker# For updateability, the zygote may fetch the current boot 51*e4a36f41SAndroid Build Coastguard Worker# classpath from the dalvik cache. Integrity of the files 52*e4a36f41SAndroid Build Coastguard Worker# is ensured by fsverity protection (checked in art_apex_boot_integrity). 53*e4a36f41SAndroid Build Coastguard Workerallow zygote dalvikcache_data_file:file execute; 54*e4a36f41SAndroid Build Coastguard Worker 55*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to find files in APEX data directories. 56*e4a36f41SAndroid Build Coastguard Workerallow zygote apex_module_data_file:dir search; 57*e4a36f41SAndroid Build Coastguard Worker 58*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to find and map files created by on device signing. 59*e4a36f41SAndroid Build Coastguard Workerallow zygote apex_art_data_file:dir { getattr search }; 60*e4a36f41SAndroid Build Coastguard Workerallow zygote apex_art_data_file:file { r_file_perms execute }; 61*e4a36f41SAndroid Build Coastguard Worker 62*e4a36f41SAndroid Build Coastguard Worker# Bind mount on /data/data and mounted volumes 63*e4a36f41SAndroid Build Coastguard Workerallow zygote { system_data_file mnt_expand_file }:dir mounton; 64*e4a36f41SAndroid Build Coastguard Worker 65*e4a36f41SAndroid Build Coastguard Worker# Relabel /data/user /data/user_de /data/data and /data/misc_{ce,de}/<user-id>/sdksandbox 66*e4a36f41SAndroid Build Coastguard Workerallow zygote tmpfs:{ dir lnk_file } relabelfrom; 67*e4a36f41SAndroid Build Coastguard Workerallow zygote system_data_file:{ dir lnk_file } relabelto; 68*e4a36f41SAndroid Build Coastguard Workerallow zygote sdk_sandbox_system_data_file:dir { search relabelto }; 69*e4a36f41SAndroid Build Coastguard Worker 70*e4a36f41SAndroid Build Coastguard Worker# Zygote opens /mnt/expand to mount CE DE storage on each vol 71*e4a36f41SAndroid Build Coastguard Workerallow zygote mnt_expand_file:dir { open read search relabelto }; 72*e4a36f41SAndroid Build Coastguard Worker 73*e4a36f41SAndroid Build Coastguard Worker# Bind mount subdirectories on /data/misc/profiles/cur and /data/misc/profiles/ref 74*e4a36f41SAndroid Build Coastguard Workerallow zygote { user_profile_root_file user_profile_data_file }:dir { mounton search }; 75*e4a36f41SAndroid Build Coastguard Worker 76*e4a36f41SAndroid Build Coastguard Worker# Create and bind dirs on /data/data 77*e4a36f41SAndroid Build Coastguard Workerallow zygote tmpfs:dir { create_dir_perms mounton }; 78*e4a36f41SAndroid Build Coastguard Worker 79*e4a36f41SAndroid Build Coastguard Worker# Goes into media directory and bind mount obb directory 80*e4a36f41SAndroid Build Coastguard Workerallow zygote media_rw_data_file:dir { getattr search }; 81*e4a36f41SAndroid Build Coastguard Worker 82*e4a36f41SAndroid Build Coastguard Worker# Bind mount on top of existing mounted obb and data directory 83*e4a36f41SAndroid Build Coastguard Workerallow zygote media_rw_data_file:dir { mounton }; 84*e4a36f41SAndroid Build Coastguard Worker 85*e4a36f41SAndroid Build Coastguard Worker# Read if sdcardfs is supported 86*e4a36f41SAndroid Build Coastguard Workerallow zygote proc_filesystems:file r_file_perms; 87*e4a36f41SAndroid Build Coastguard Worker 88*e4a36f41SAndroid Build Coastguard Worker# Create symlink for /data/user/0 89*e4a36f41SAndroid Build Coastguard Workerallow zygote tmpfs:lnk_file create; 90*e4a36f41SAndroid Build Coastguard Worker 91*e4a36f41SAndroid Build Coastguard Workerallow zygote mirror_data_file:dir r_dir_perms; 92*e4a36f41SAndroid Build Coastguard Worker 93*e4a36f41SAndroid Build Coastguard Worker# Get inode of directories for app data isolation 94*e4a36f41SAndroid Build Coastguard Workerallow zygote { 95*e4a36f41SAndroid Build Coastguard Worker app_data_file_type 96*e4a36f41SAndroid Build Coastguard Worker system_data_file 97*e4a36f41SAndroid Build Coastguard Worker mnt_expand_file 98*e4a36f41SAndroid Build Coastguard Worker sdk_sandbox_system_data_file 99*e4a36f41SAndroid Build Coastguard Worker}:dir getattr; 100*e4a36f41SAndroid Build Coastguard Worker 101*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to create JIT memory. 102*e4a36f41SAndroid Build Coastguard Workerallow zygote self:process execmem; 103*e4a36f41SAndroid Build Coastguard Workerallow zygote zygote_tmpfs:file execute; 104*e4a36f41SAndroid Build Coastguard Workerallow zygote ashmem_libcutils_device:chr_file execute; 105*e4a36f41SAndroid Build Coastguard Worker 106*e4a36f41SAndroid Build Coastguard Worker# Execute idmap and dex2oat within zygote's own domain. 107*e4a36f41SAndroid Build Coastguard Worker# TODO: Should either of these be transitioned to the same domain 108*e4a36f41SAndroid Build Coastguard Worker# used by installd or stay in-domain for zygote? 109*e4a36f41SAndroid Build Coastguard Workerallow zygote idmap_exec:file rx_file_perms; 110*e4a36f41SAndroid Build Coastguard Workerallow zygote dex2oat_exec:file rx_file_perms; 111*e4a36f41SAndroid Build Coastguard Worker 112*e4a36f41SAndroid Build Coastguard Worker# Allow apps access to /vendor/overlay 113*e4a36f41SAndroid Build Coastguard Workerr_dir_file(zygote, vendor_overlay_file) 114*e4a36f41SAndroid Build Coastguard Worker 115*e4a36f41SAndroid Build Coastguard Worker# Control cgroups. 116*e4a36f41SAndroid Build Coastguard Workerallow zygote cgroup:dir create_dir_perms; 117*e4a36f41SAndroid Build Coastguard Workerallow zygote cgroup:{ file lnk_file } { r_file_perms setattr }; 118*e4a36f41SAndroid Build Coastguard Workerallow zygote cgroup_v2:dir create_dir_perms; 119*e4a36f41SAndroid Build Coastguard Workerallow zygote cgroup_v2:{ file lnk_file } { r_file_perms setattr }; 120*e4a36f41SAndroid Build Coastguard Workerallow zygote self:global_capability_class_set sys_admin; 121*e4a36f41SAndroid Build Coastguard Worker 122*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to stat the files that it opens. The zygote must 123*e4a36f41SAndroid Build Coastguard Worker# be able to inspect them so that it can reopen them on fork 124*e4a36f41SAndroid Build Coastguard Worker# if necessary: b/30963384. 125*e4a36f41SAndroid Build Coastguard Workerallow zygote pmsg_device:chr_file getattr; 126*e4a36f41SAndroid Build Coastguard Workerallow zygote debugfs_trace_marker:file getattr; 127*e4a36f41SAndroid Build Coastguard Worker 128*e4a36f41SAndroid Build Coastguard Worker# Get seapp_contexts 129*e4a36f41SAndroid Build Coastguard Workerallow zygote seapp_contexts_file:file r_file_perms; 130*e4a36f41SAndroid Build Coastguard Worker# Check validity of SELinux context before use. 131*e4a36f41SAndroid Build Coastguard Workerselinux_check_context(zygote) 132*e4a36f41SAndroid Build Coastguard Worker# Check SELinux permissions. 133*e4a36f41SAndroid Build Coastguard Workerselinux_check_access(zygote) 134*e4a36f41SAndroid Build Coastguard Worker 135*e4a36f41SAndroid Build Coastguard Worker# Native bridge functionality requires that zygote replaces 136*e4a36f41SAndroid Build Coastguard Worker# /proc/cpuinfo with /system/lib/<ISA>/cpuinfo using a bind mount 137*e4a36f41SAndroid Build Coastguard Workerallow zygote proc_cpuinfo:file mounton; 138*e4a36f41SAndroid Build Coastguard Worker 139*e4a36f41SAndroid Build Coastguard Worker# Allow remounting rootfs as MS_SLAVE. 140*e4a36f41SAndroid Build Coastguard Workerallow zygote rootfs:dir mounton; 141*e4a36f41SAndroid Build Coastguard Workerallow zygote tmpfs:filesystem { mount unmount }; 142*e4a36f41SAndroid Build Coastguard Workerallow zygote fuse:filesystem { unmount }; 143*e4a36f41SAndroid Build Coastguard Workerallow zygote sdcardfs:filesystem { unmount }; 144*e4a36f41SAndroid Build Coastguard Workerallow zygote labeledfs:filesystem { unmount }; 145*e4a36f41SAndroid Build Coastguard Worker 146*e4a36f41SAndroid Build Coastguard Worker# Allow creating user-specific storage source if started before vold. 147*e4a36f41SAndroid Build Coastguard Workerallow zygote mnt_user_file:dir { create_dir_perms mounton }; 148*e4a36f41SAndroid Build Coastguard Workerallow zygote mnt_user_file:lnk_file create_file_perms; 149*e4a36f41SAndroid Build Coastguard Workerallow zygote mnt_user_file:file create_file_perms; 150*e4a36f41SAndroid Build Coastguard Worker 151*e4a36f41SAndroid Build Coastguard Worker# Allow mounting user-specific storage source if started before vold. 152*e4a36f41SAndroid Build Coastguard Workerallow zygote mnt_pass_through_file:dir { create_dir_perms mounton }; 153*e4a36f41SAndroid Build Coastguard Worker 154*e4a36f41SAndroid Build Coastguard Worker# Allowed to mount user-specific storage into place 155*e4a36f41SAndroid Build Coastguard Workerallow zygote storage_file:dir { search mounton }; 156*e4a36f41SAndroid Build Coastguard Worker 157*e4a36f41SAndroid Build Coastguard Worker# Allow mounting and creating files, dirs on sdcardfs. 158*e4a36f41SAndroid Build Coastguard Workerallow zygote { sdcard_type fuse }:dir { create_dir_perms mounton }; 159*e4a36f41SAndroid Build Coastguard Workerallow zygote { sdcard_type fuse }:file { create_file_perms }; 160*e4a36f41SAndroid Build Coastguard Worker 161*e4a36f41SAndroid Build Coastguard Worker# Handle --invoke-with command when launching Zygote with a wrapper command. 162*e4a36f41SAndroid Build Coastguard Workerallow zygote zygote_exec:file rx_file_perms; 163*e4a36f41SAndroid Build Coastguard Worker 164*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to write to statsd. 165*e4a36f41SAndroid Build Coastguard Workerunix_socket_send(zygote, statsdw, statsd) 166*e4a36f41SAndroid Build Coastguard Worker 167*e4a36f41SAndroid Build Coastguard Worker# Root fs. 168*e4a36f41SAndroid Build Coastguard Workerr_dir_file(zygote, rootfs) 169*e4a36f41SAndroid Build Coastguard Worker 170*e4a36f41SAndroid Build Coastguard Worker# System file accesses. 171*e4a36f41SAndroid Build Coastguard Workerr_dir_file(zygote, system_file) 172*e4a36f41SAndroid Build Coastguard Worker 173*e4a36f41SAndroid Build Coastguard Worker# /oem accesses. 174*e4a36f41SAndroid Build Coastguard Workerallow zygote oemfs:dir search; 175*e4a36f41SAndroid Build Coastguard Worker 176*e4a36f41SAndroid Build Coastguard Workeruserdebug_or_eng(` 177*e4a36f41SAndroid Build Coastguard Worker # Allow zygote to create and write method traces in /data/misc/trace. 178*e4a36f41SAndroid Build Coastguard Worker allow zygote method_trace_data_file:dir w_dir_perms; 179*e4a36f41SAndroid Build Coastguard Worker allow zygote method_trace_data_file:file { create w_file_perms }; 180*e4a36f41SAndroid Build Coastguard Worker') 181*e4a36f41SAndroid Build Coastguard Worker 182*e4a36f41SAndroid Build Coastguard Workerallow zygote ion_device:chr_file r_file_perms; 183*e4a36f41SAndroid Build Coastguard Workerallow zygote tmpfs:dir r_dir_perms; 184*e4a36f41SAndroid Build Coastguard Worker 185*e4a36f41SAndroid Build Coastguard Workerallow zygote same_process_hal_file:file { execute read open getattr map }; 186*e4a36f41SAndroid Build Coastguard Worker 187*e4a36f41SAndroid Build Coastguard Worker# Allow the zygote to access storage properties to check if sdcardfs is enabled. 188*e4a36f41SAndroid Build Coastguard Workerget_prop(zygote, storage_config_prop); 189*e4a36f41SAndroid Build Coastguard Worker 190*e4a36f41SAndroid Build Coastguard Worker# Let the zygote access overlays so it can initialize the AssetManager. 191*e4a36f41SAndroid Build Coastguard Workerget_prop(zygote, overlay_prop) 192*e4a36f41SAndroid Build Coastguard Workerget_prop(zygote, exported_overlay_prop) 193*e4a36f41SAndroid Build Coastguard Worker 194*e4a36f41SAndroid Build Coastguard Worker# Allow the zygote to access the runtime feature flag properties. 195*e4a36f41SAndroid Build Coastguard Workerget_prop(zygote, device_config_runtime_native_prop) 196*e4a36f41SAndroid Build Coastguard Workerget_prop(zygote, device_config_runtime_native_boot_prop) 197*e4a36f41SAndroid Build Coastguard Worker 198*e4a36f41SAndroid Build Coastguard Worker# Allow the zygote to access window manager native boot feature flags 199*e4a36f41SAndroid Build Coastguard Worker# to initialize WindowManager static properties. 200*e4a36f41SAndroid Build Coastguard Workerget_prop(zygote, device_config_window_manager_native_boot_prop) 201*e4a36f41SAndroid Build Coastguard Worker 202*e4a36f41SAndroid Build Coastguard Worker# ingore spurious denials 203*e4a36f41SAndroid Build Coastguard Worker# fsetid can be checked as a consequence of chmod when using cgroup v2 uid/pid hierarchy. This is 204*e4a36f41SAndroid Build Coastguard Worker# done to determine if the file should inherit setgid. In this case, setgid on the file is 205*e4a36f41SAndroid Build Coastguard Worker# undesirable, so suppress the denial. 206*e4a36f41SAndroid Build Coastguard Workerdontaudit zygote self:global_capability_class_set { sys_resource fsetid }; 207*e4a36f41SAndroid Build Coastguard Worker 208*e4a36f41SAndroid Build Coastguard Worker# Ignore spurious denials calling access() on fuse. 209*e4a36f41SAndroid Build Coastguard Worker# Also ignore read and open as sdcardfs may read and open dir when app tries to access a dir that 210*e4a36f41SAndroid Build Coastguard Worker# doesn't exist. 211*e4a36f41SAndroid Build Coastguard Worker# TODO(b/151316657): avoid the denials 212*e4a36f41SAndroid Build Coastguard Workerdontaudit zygote media_rw_data_file:dir { read open setattr }; 213*e4a36f41SAndroid Build Coastguard Worker 214*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to use ashmem fds from system_server. 215*e4a36f41SAndroid Build Coastguard Workerallow zygote system_server:fd use; 216*e4a36f41SAndroid Build Coastguard Worker 217*e4a36f41SAndroid Build Coastguard Worker# Send unsolicited message to system_server 218*e4a36f41SAndroid Build Coastguard Workerunix_socket_send(zygote, system_unsolzygote, system_server) 219*e4a36f41SAndroid Build Coastguard Worker 220*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to access media_variant_prop for static initialization 221*e4a36f41SAndroid Build Coastguard Workerget_prop(zygote, media_variant_prop) 222*e4a36f41SAndroid Build Coastguard Worker 223*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to access odsign verification status 224*e4a36f41SAndroid Build Coastguard Workerget_prop(zygote, odsign_prop) 225*e4a36f41SAndroid Build Coastguard Worker 226*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to read ro.control_privapp_permissions and ro.cp_system_other_odex 227*e4a36f41SAndroid Build Coastguard Workerget_prop(zygote, packagemanager_config_prop) 228*e4a36f41SAndroid Build Coastguard Worker 229*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to read qemu.sf.lcd_density 230*e4a36f41SAndroid Build Coastguard Workerget_prop(zygote, qemu_sf_lcd_density_prop) 231*e4a36f41SAndroid Build Coastguard Worker 232*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to read /apex/apex-info-list.xml 233*e4a36f41SAndroid Build Coastguard Workerallow zygote apex_info_file:file r_file_perms; 234*e4a36f41SAndroid Build Coastguard Worker 235*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to canonicalize vendor APEX paths. This is used when zygote is checking the 236*e4a36f41SAndroid Build Coastguard Worker# preinstalled path of APEXes that contain runtime resource overlays for the 'android' package. 237*e4a36f41SAndroid Build Coastguard Workerallow zygote vendor_apex_file:dir { getattr search }; 238*e4a36f41SAndroid Build Coastguard Workerallow zygote vendor_apex_file:file { getattr }; 239*e4a36f41SAndroid Build Coastguard Worker 240*e4a36f41SAndroid Build Coastguard Worker# Allow zygote to query for compression/features. 241*e4a36f41SAndroid Build Coastguard Workerr_dir_file(zygote, sysfs_fs_f2fs) 242*e4a36f41SAndroid Build Coastguard Worker 243*e4a36f41SAndroid Build Coastguard Worker### 244*e4a36f41SAndroid Build Coastguard Worker### neverallow rules 245*e4a36f41SAndroid Build Coastguard Worker### 246*e4a36f41SAndroid Build Coastguard Worker 247*e4a36f41SAndroid Build Coastguard Worker# Ensure that all types assigned to app processes are included 248*e4a36f41SAndroid Build Coastguard Worker# in the appdomain attribute, so that all allow and neverallow rules 249*e4a36f41SAndroid Build Coastguard Worker# written on appdomain are applied to all app processes. 250*e4a36f41SAndroid Build Coastguard Worker# This is achieved by ensuring that it is impossible for zygote to 251*e4a36f41SAndroid Build Coastguard Worker# setcon (dyntransition) to any types other than those associated 252*e4a36f41SAndroid Build Coastguard Worker# with appdomain plus system_server_startup, webview_zygote and 253*e4a36f41SAndroid Build Coastguard Worker# app_zygote. 254*e4a36f41SAndroid Build Coastguard Workerneverallow zygote ~{ 255*e4a36f41SAndroid Build Coastguard Worker appdomain 256*e4a36f41SAndroid Build Coastguard Worker system_server_startup 257*e4a36f41SAndroid Build Coastguard Worker webview_zygote 258*e4a36f41SAndroid Build Coastguard Worker app_zygote 259*e4a36f41SAndroid Build Coastguard Worker}:process dyntransition; 260*e4a36f41SAndroid Build Coastguard Worker 261*e4a36f41SAndroid Build Coastguard Worker# Zygote should never execute anything from /data except for 262*e4a36f41SAndroid Build Coastguard Worker# /data/dalvik-cache files or files generated during on-device 263*e4a36f41SAndroid Build Coastguard Worker# signing under /data/misc/apexdata/com.android.art/. 264*e4a36f41SAndroid Build Coastguard Workerneverallow zygote { 265*e4a36f41SAndroid Build Coastguard Worker data_file_type 266*e4a36f41SAndroid Build Coastguard Worker -apex_art_data_file # map PROT_EXEC 267*e4a36f41SAndroid Build Coastguard Worker -dalvikcache_data_file # map PROT_EXEC 268*e4a36f41SAndroid Build Coastguard Worker}:file no_x_file_perms; 269*e4a36f41SAndroid Build Coastguard Worker 270*e4a36f41SAndroid Build Coastguard Worker# Do not allow access to Bluetooth-related system properties and files 271*e4a36f41SAndroid Build Coastguard Workerneverallow zygote { 272*e4a36f41SAndroid Build Coastguard Worker bluetooth_a2dp_offload_prop 273*e4a36f41SAndroid Build Coastguard Worker bluetooth_audio_hal_prop 274*e4a36f41SAndroid Build Coastguard Worker bluetooth_prop 275*e4a36f41SAndroid Build Coastguard Worker exported_bluetooth_prop 276*e4a36f41SAndroid Build Coastguard Worker}:file create_file_perms; 277*e4a36f41SAndroid Build Coastguard Worker 278*e4a36f41SAndroid Build Coastguard Worker# Zygote should not be able to access app private data. 279*e4a36f41SAndroid Build Coastguard Workerneverallow zygote app_data_file_type:dir ~getattr; 280