1*e4a36f41SAndroid Build Coastguard Worker### 2*e4a36f41SAndroid Build Coastguard Worker### Untrusted apps. 3*e4a36f41SAndroid Build Coastguard Worker### 4*e4a36f41SAndroid Build Coastguard Worker### This file defines the rules for untrusted apps running with 5*e4a36f41SAndroid Build Coastguard Worker### targetSdkVersion >= 34. 6*e4a36f41SAndroid Build Coastguard Worker### 7*e4a36f41SAndroid Build Coastguard Worker### See public/untrusted_app.te for more information about which apps are 8*e4a36f41SAndroid Build Coastguard Worker### placed in this selinux domain. 9*e4a36f41SAndroid Build Coastguard Worker### 10*e4a36f41SAndroid Build Coastguard Worker 11*e4a36f41SAndroid Build Coastguard Workertypeattribute untrusted_app coredomain; 12*e4a36f41SAndroid Build Coastguard Worker 13*e4a36f41SAndroid Build Coastguard Workerapp_domain(untrusted_app) 14*e4a36f41SAndroid Build Coastguard Workeruntrusted_app_domain(untrusted_app) 15*e4a36f41SAndroid Build Coastguard Workernet_domain(untrusted_app) 16*e4a36f41SAndroid Build Coastguard Workerbluetooth_domain(untrusted_app) 17*e4a36f41SAndroid Build Coastguard Worker 18*e4a36f41SAndroid Build Coastguard Worker# Allow webview to access fd shared by sdksandbox for experiments data 19*e4a36f41SAndroid Build Coastguard Worker# TODO(b/229249719): Will not be supported in Android U 20*e4a36f41SAndroid Build Coastguard Workerallow untrusted_app sdk_sandbox_data_file:fd use; 21*e4a36f41SAndroid Build Coastguard Workerallow untrusted_app sdk_sandbox_data_file:file write; 22*e4a36f41SAndroid Build Coastguard Worker 23*e4a36f41SAndroid Build Coastguard Workerneverallow untrusted_app sdk_sandbox_data_file:file { open create }; 24