1### 2### Untrusted apps. 3### 4### This file defines the rules for untrusted apps running with 5### 31 < targetSdkVersion <= 33. 6### 7### See public/untrusted_app.te for more information about which apps are 8### placed in this selinux domain. 9### 10 11typeattribute untrusted_app_32 coredomain; 12 13app_domain(untrusted_app_32) 14untrusted_app_domain(untrusted_app_32) 15net_domain(untrusted_app_32) 16bluetooth_domain(untrusted_app_32) 17 18# Allow webview to access fd shared by sdksandbox for experiments data 19# TODO(b/229249719): Will not be supported in Android U 20allow untrusted_app_32 sdk_sandbox_data_file:fd use; 21allow untrusted_app_32 sdk_sandbox_data_file:file write; 22 23neverallow untrusted_app_32 sdk_sandbox_data_file:file { open create }; 24 25# Connect to mdnsd via mdnsd socket. 26unix_socket_connect(untrusted_app_32, mdnsd, mdnsd) 27userdebug_or_eng(` 28 auditallow untrusted_app_32 mdnsd_socket:sock_file write; 29 auditallow untrusted_app_32 mdnsd:unix_stream_socket connectto; 30') 31 32# Allow calling inotify on APKs for backwards compatibility. This is disallowed 33# for targetSdkVersion>=34 to remove a sidechannel. 34allow untrusted_app_32 apk_data_file:dir { watch watch_reads }; 35allow untrusted_app_32 apk_data_file:file { watch watch_reads }; 36userdebug_or_eng(` 37 auditallow untrusted_app_32 apk_data_file:dir { watch watch_reads }; 38 auditallow untrusted_app_32 apk_data_file:file { watch watch_reads }; 39') 40