1### 2### Untrusted_29. 3### 4### This file defines the rules for untrusted apps running with 5### targetSdkVersion = 29. 6### 7### See public/untrusted_app.te for more information about which apps are 8### placed in this selinux domain. 9### 10 11typeattribute untrusted_app_29 coredomain; 12 13app_domain(untrusted_app_29) 14untrusted_app_domain(untrusted_app_29) 15net_domain(untrusted_app_29) 16bluetooth_domain(untrusted_app_29) 17 18# allow sending RTM_GETNEIGH{TBL} messages. 19allow untrusted_app_29 self:netlink_route_socket nlmsg_getneigh; 20auditallow untrusted_app_29 self:netlink_route_socket nlmsg_getneigh; 21 22# Connect to mdnsd via mdnsd socket. 23unix_socket_connect(untrusted_app_29, mdnsd, mdnsd) 24userdebug_or_eng(` 25 auditallow untrusted_app_29 mdnsd_socket:sock_file write; 26 auditallow untrusted_app_29 mdnsd:unix_stream_socket connectto; 27') 28 29# Allow calling inotify on APKs for backwards compatibility. This is disallowed 30# for targetSdkVersion>=34 to remove a sidechannel. 31allow untrusted_app_29 apk_data_file:dir { watch watch_reads }; 32allow untrusted_app_29 apk_data_file:file { watch watch_reads }; 33userdebug_or_eng(` 34 auditallow untrusted_app_29 apk_data_file:dir { watch watch_reads }; 35 auditallow untrusted_app_29 apk_data_file:file { watch watch_reads }; 36') 37