1*e4a36f41SAndroid Build Coastguard Worker### 2*e4a36f41SAndroid Build Coastguard Worker### Untrusted apps. 3*e4a36f41SAndroid Build Coastguard Worker### 4*e4a36f41SAndroid Build Coastguard Worker### This file defines the rules for untrusted apps running with 5*e4a36f41SAndroid Build Coastguard Worker### 29 < targetSdkVersion <= 31. 6*e4a36f41SAndroid Build Coastguard Worker### 7*e4a36f41SAndroid Build Coastguard Worker### See public/untrusted_app.te for more information about which apps are 8*e4a36f41SAndroid Build Coastguard Worker### placed in this selinux domain. 9*e4a36f41SAndroid Build Coastguard Worker### 10*e4a36f41SAndroid Build Coastguard Worker### TODO(b/192334803): Merge this policy into untrusted_app_29 when possible 11*e4a36f41SAndroid Build Coastguard Worker### 12*e4a36f41SAndroid Build Coastguard Worker 13*e4a36f41SAndroid Build Coastguard Workertypeattribute untrusted_app_30 coredomain; 14*e4a36f41SAndroid Build Coastguard Worker 15*e4a36f41SAndroid Build Coastguard Workerapp_domain(untrusted_app_30) 16*e4a36f41SAndroid Build Coastguard Workeruntrusted_app_domain(untrusted_app_30) 17*e4a36f41SAndroid Build Coastguard Workernet_domain(untrusted_app_30) 18*e4a36f41SAndroid Build Coastguard Workerbluetooth_domain(untrusted_app_30) 19*e4a36f41SAndroid Build Coastguard Worker 20*e4a36f41SAndroid Build Coastguard Worker# allow sending RTM_GETNEIGH{TBL} messages. 21*e4a36f41SAndroid Build Coastguard Workerallow untrusted_app_30 self:netlink_route_socket nlmsg_getneigh; 22*e4a36f41SAndroid Build Coastguard Workerauditallow untrusted_app_30 self:netlink_route_socket nlmsg_getneigh; 23*e4a36f41SAndroid Build Coastguard Worker 24*e4a36f41SAndroid Build Coastguard Worker# Connect to mdnsd via mdnsd socket. 25*e4a36f41SAndroid Build Coastguard Workerunix_socket_connect(untrusted_app_30, mdnsd, mdnsd) 26*e4a36f41SAndroid Build Coastguard Workeruserdebug_or_eng(` 27*e4a36f41SAndroid Build Coastguard Worker auditallow untrusted_app_30 mdnsd_socket:sock_file write; 28*e4a36f41SAndroid Build Coastguard Worker auditallow untrusted_app_30 mdnsd:unix_stream_socket connectto; 29*e4a36f41SAndroid Build Coastguard Worker') 30*e4a36f41SAndroid Build Coastguard Worker 31*e4a36f41SAndroid Build Coastguard Worker# Allow calling inotify on APKs for backwards compatibility. This is disallowed 32*e4a36f41SAndroid Build Coastguard Worker# for targetSdkVersion>=34 to remove a sidechannel. 33*e4a36f41SAndroid Build Coastguard Workerallow untrusted_app_30 apk_data_file:dir { watch watch_reads }; 34*e4a36f41SAndroid Build Coastguard Workerallow untrusted_app_30 apk_data_file:file { watch watch_reads }; 35*e4a36f41SAndroid Build Coastguard Workeruserdebug_or_eng(` 36*e4a36f41SAndroid Build Coastguard Worker auditallow untrusted_app_30 apk_data_file:dir { watch watch_reads }; 37*e4a36f41SAndroid Build Coastguard Worker auditallow untrusted_app_30 apk_data_file:file { watch watch_reads }; 38*e4a36f41SAndroid Build Coastguard Worker') 39