1###
2### Ephemeral apps.
3###
4### This file defines the security policy for apps with the ephemeral
5### feature.
6###
7### The ephemeral_app domain is a reduced permissions sandbox allowing
8### ephemeral applications to be safely installed and run. Non ephemeral
9### applications may also opt-in to ephemeral to take advantage of the
10### additional security features.
11###
12### PackageManager flags an app as ephemeral at install time.
13
14typeattribute ephemeral_app coredomain;
15
16net_domain(ephemeral_app)
17app_domain(ephemeral_app)
18
19# Allow ephemeral apps to read/write files in visible storage if provided fds
20allow ephemeral_app { sdcard_type media_rw_data_file }:file {read write getattr ioctl lock append};
21
22# Some apps ship with shared libraries and binaries that they write out
23# to their sandbox directory and then execute.
24allow ephemeral_app app_data_file:file {r_file_perms execute};
25
26# services
27allow ephemeral_app audioserver_service:service_manager find;
28allow ephemeral_app cameraserver_service:service_manager find;
29allow ephemeral_app mediaserver_service:service_manager find;
30allow ephemeral_app mediaextractor_service:service_manager find;
31allow ephemeral_app mediacodec_service:service_manager find;
32allow ephemeral_app mediametrics_service:service_manager find;
33allow ephemeral_app mediadrmserver_service:service_manager find;
34allow ephemeral_app surfaceflinger_service:service_manager find;
35allow ephemeral_app radio_service:service_manager find;
36allow ephemeral_app ephemeral_app_api_service:service_manager find;
37
38###
39### neverallow rules
40###
41
42neverallow ephemeral_app app_data_file:file execute_no_trans;
43
44# Receive or send uevent messages.
45neverallow ephemeral_app domain:netlink_kobject_uevent_socket *;
46
47# Receive or send generic netlink messages
48neverallow ephemeral_app domain:netlink_socket *;
49
50# Too much leaky information in debugfs. It's a security
51# best practice to ensure these files aren't readable.
52neverallow ephemeral_app debugfs:file read;
53
54# execute gpu_device
55neverallow ephemeral_app gpu_device:chr_file execute;
56
57# access files in /sys with the default sysfs label
58neverallow ephemeral_app sysfs:file *;
59
60# Avoid reads from generically labeled /proc files
61# Create a more specific label if needed
62neverallow ephemeral_app proc:file { no_rw_file_perms no_x_file_perms };
63
64# Directly access external storage
65neverallow ephemeral_app { sdcard_type media_rw_data_file }:file {open create};
66neverallow ephemeral_app { sdcard_type media_rw_data_file }:dir search;
67
68# Avoid reads to proc_net, it contains too much device wide information about
69# ongoing connections.
70neverallow ephemeral_app proc_net:file no_rw_file_perms;
71