1# MLS override can't be used to access private app data. 2 3# Apps should not normally be mlstrustedsubject, but if they must be 4# they cannot use this to access app private data files; their own app 5# data files must use a different label. 6 7neverallow { 8 mlstrustedsubject 9 -artd # compile secondary dex files 10 -installd 11} { 12 app_data_file 13 privapp_data_file 14 is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_content_file') 15}:file ~{ read write map getattr ioctl lock append }; 16 17neverallow { 18 mlstrustedsubject 19 -artd # compile secondary dex files 20 -installd 21} { 22 app_data_file 23 privapp_data_file 24 is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_content_file') 25}:dir ~{ read getattr search }; 26 27is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, ` 28 neverallow { 29 mlstrustedsubject 30 -artd # compile secondary dex files 31 -installd 32 -vold # encryption of storage areas 33 -vold_prepare_subdirs # creation of storage area directories 34 } { storage_area_dir storage_area_app_dir }:dir ~{ read getattr search }; 35') 36 37neverallow { 38 mlstrustedsubject 39 -artd # compile secondary dex files 40 -installd 41 -system_server 42 -adbd 43 -runas 44 -zygote 45} { 46 app_data_file 47 privapp_data_file 48 is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, `storage_area_content_file') 49}:dir { read getattr search }; 50 51is_flag_enabled(RELEASE_UNLOCKED_STORAGE_API, ` 52 neverallow { 53 mlstrustedsubject 54 -artd # compile secondary dex files 55 -installd 56 -system_server 57 -adbd 58 -runas 59 -vold # encryption of storage area directories 60 -vold_prepare_subdirs # creation of storage area directories 61 -zygote 62 } { storage_area_dir storage_area_app_dir }:dir { read getattr search }; 63') 64