prebuilts/api/29.0/private/seapp_contexts - LeafOS-Project/android_system_sepolicy - Gitiles

 # The entries in this file define how security contexts for apps are determined.
 # Each entry lists input selectors, used to match the app, and outputs which are
 # used to determine the security contexts for matching apps.
 #
 # Input selectors:
 #       isSystemServer (boolean)
 #       isEphemeralApp (boolean)
 #       isOwner (boolean)
 #       user (string)
 #       seinfo (string)
 #       name (string)
 #       path (string)
 #       isPrivApp (boolean)
 #       minTargetSdkVersion (unsigned integer)
 #       fromRunAs (boolean)
 #
 # All specified input selectors in an entry must match (i.e. logical AND).
 # An unspecified string or boolean selector with no default will match any
 # value.
 # A user, name, or path string selector that ends in * will perform a prefix
 # match.
 # String matching is case-insensitive.
 # See external/selinux/libselinux/src/android/android_platform.c,
 # seapp_context_lookup().
 #
 # isSystemServer=true only matches the system server.
 # An unspecified isSystemServer defaults to false.
 # isEphemeralApp=true will match apps marked by PackageManager as Ephemeral
 # isOwner=true will only match for the owner/primary user.
 # user=_app will match any regular app process.
 # user=_isolated will match any isolated service process.
 # Other values of user are matched against the name associated with the process
 # UID.
 # seinfo= matches aginst the seinfo tag for the app, determined from
 # mac_permissions.xml files.
 # The ':' character is reserved and may not be used in seinfo.
 # name= matches against the package name of the app.
 # path= matches against the directory path when labeling app directories.
 # isPrivApp=true will only match for applications preinstalled in
 #       /system/priv-app.
 # minTargetSdkVersion will match applications with a targetSdkVersion
 #       greater than or equal to the specified value. If unspecified,
 #       it has a default value of 0.
 # fromRunAs=true means the process being labeled is started by run-as. Default
 # is false.
 #
 # Precedence: entries are compared using the following rules, in the order shown
 # (see external/selinux/libselinux/src/android/android_platform.c,
 # seapp_context_cmp()).
 #       (1) isSystemServer=true before isSystemServer=false.
 #       (2) Specified isEphemeralApp= before unspecified isEphemeralApp=
 #             boolean.
 #       (3) Specified isOwner= before unspecified isOwner= boolean.
 #       (4) Specified user= string before unspecified user= string;
 #             more specific user= string before less specific user= string.
 #       (5) Specified seinfo= string before unspecified seinfo= string.
 #       (6) Specified name= string before unspecified name= string;
 #             more specific name= string before less specific name= string.
 #       (7) Specified path= string before unspecified path= string.
 #             more specific name= string before less specific name= string.
 #       (8) Specified isPrivApp= before unspecified isPrivApp= boolean.
 #       (9) Higher value of minTargetSdkVersion= before lower value of
 #              minTargetSdkVersion= integer. Note that minTargetSdkVersion=
 #              defaults to 0 if unspecified.
 #       (10) fromRunAs=true before fromRunAs=false.
 # (A fixed selector is more specific than a prefix, i.e. ending in *, and a
 # longer prefix is more specific than a shorter prefix.)
 # Apps are checked against entries in precedence order until the first match,
 # regardless of their order in this file.
 #
 # Duplicate entries, i.e. with identical input selectors, are not allowed.
 #
 # Outputs:
 #       domain (string)
 #       type (string)
 #       levelFrom (string; one of none, all, app, or user)
 #       level (string)
 #
 # domain= determines the label to be used for the app process; entries
 # without domain= are ignored for this purpose.
 # type= specifies the label to be used for the app data directory; entries
 # without type= are ignored for this purpose.
 # levelFrom and level are used to determine the level (sensitivity + categories)
 # for MLS/MCS.
 # levelFrom=none omits the level.
 # levelFrom=app determines the level from the process UID.
 # levelFrom=user determines the level from the user ID.
 # levelFrom=all determines the level from both UID and user ID.
 #
 # levelFrom=user is only supported for _app or _isolated UIDs.
 # levelFrom=app or levelFrom=all is only supported for _app UIDs.
 # level may be used to specify a fixed level for any UID.
 #
 # For backwards compatibility levelFromUid=true is equivalent to levelFrom=app
 # and levelFromUid=false is equivalent to levelFrom=none.
 #
 #
 # Neverallow Assertions
 # Additional compile time assertion checks for the rules in this file can be
 # added as well. The assertion
 # rules are lines beginning with the keyword neverallow. Full support for PCRE
 # regular expressions exists on all input and output selectors. Neverallow
 # rules are never output to the built seapp_contexts file. Like all keywords,
 # neverallows are case-insensitive. A neverallow is asserted when all key value
 # inputs are matched on a key value rule line.
 #

 # only the system server can be in system_server domain
 neverallow isSystemServer=false domain=system_server
 neverallow isSystemServer="" domain=system_server

 # system domains should never be assigned outside of system uid
 neverallow user=((?!system).)* domain=system_app
 neverallow user=((?!system).)* type=system_app_data_file

 # anything with a non-known uid with a specified name should have a specified seinfo
 neverallow user=_app name=.* seinfo=""
 neverallow user=_app name=.* seinfo=default

 # neverallow shared relro to any other domain
 # and neverallow any other uid into shared_relro
 neverallow user=shared_relro domain=((?!shared_relro).)*
 neverallow user=((?!shared_relro).)* domain=shared_relro

 # neverallow non-isolated uids into isolated_app domain
 # and vice versa
 neverallow user=_isolated domain=((?!isolated_app).)*
 neverallow user=((?!_isolated).)* domain=isolated_app

 # uid shell should always be in shell domain, however non-shell
 # uid's can be in shell domain
 neverallow user=shell domain=((?!shell).)*

 # only the package named com.android.shell can run in the shell domain
 neverallow domain=shell name=((?!com\.android\.shell).)*
 neverallow user=shell name=((?!com\.android\.shell).)*

 # Ephemeral Apps must run in the ephemeral_app domain
 neverallow isEphemeralApp=true domain=((?!ephemeral_app).)*

 isSystemServer=true domain=system_server_startup

 user=_app seinfo=platform name=com.android.traceur domain=traceur_app type=app_data_file levelFrom=all
 user=system seinfo=platform domain=system_app type=system_app_data_file
 user=bluetooth seinfo=platform domain=bluetooth type=bluetooth_data_file
 user=network_stack seinfo=network_stack domain=network_stack levelFrom=all type=radio_data_file
 user=nfc seinfo=platform domain=nfc type=nfc_data_file
 user=secure_element seinfo=platform domain=secure_element levelFrom=all
 user=radio seinfo=platform domain=radio type=radio_data_file
 user=shared_relro domain=shared_relro
 user=shell seinfo=platform domain=shell name=com.android.shell type=shell_data_file
 user=webview_zygote seinfo=webview_zygote domain=webview_zygote
 user=_isolated domain=isolated_app levelFrom=all
 user=_app seinfo=app_zygote domain=app_zygote levelFrom=all
 user=_app seinfo=media domain=mediaprovider name=android.process.media type=app_data_file levelFrom=user
 user=_app seinfo=platform domain=platform_app type=app_data_file levelFrom=user
 user=_app isEphemeralApp=true domain=ephemeral_app type=app_data_file levelFrom=all
 user=_app isPrivApp=true domain=priv_app type=privapp_data_file levelFrom=user
 user=_app minTargetSdkVersion=29 domain=untrusted_app type=app_data_file levelFrom=all
 user=_app minTargetSdkVersion=28 domain=untrusted_app_27 type=app_data_file levelFrom=all
 user=_app minTargetSdkVersion=26 domain=untrusted_app_27 type=app_data_file levelFrom=user
 user=_app domain=untrusted_app_25 type=app_data_file levelFrom=user
 user=_app minTargetSdkVersion=28 fromRunAs=true domain=runas_app levelFrom=all
 user=_app fromRunAs=true domain=runas_app levelFrom=user
	# The entries in this file define how security contexts for apps are determined.
	# Each entry lists input selectors, used to match the app, and outputs which are
	# used to determine the security contexts for matching apps.
	#
	# Input selectors:
	# isSystemServer (boolean)
	# isEphemeralApp (boolean)
	# isOwner (boolean)
	# user (string)
	# seinfo (string)
	# name (string)
	# path (string)
	# isPrivApp (boolean)
	# minTargetSdkVersion (unsigned integer)
	# fromRunAs (boolean)
	#
	# All specified input selectors in an entry must match (i.e. logical AND).
	# An unspecified string or boolean selector with no default will match any
	# value.
	# A user, name, or path string selector that ends in * will perform a prefix
	# match.
	# String matching is case-insensitive.
	# See external/selinux/libselinux/src/android/android_platform.c,
	# seapp_context_lookup().
	#
	# isSystemServer=true only matches the system server.
	# An unspecified isSystemServer defaults to false.
	# isEphemeralApp=true will match apps marked by PackageManager as Ephemeral
	# isOwner=true will only match for the owner/primary user.
	# user=_app will match any regular app process.
	# user=_isolated will match any isolated service process.
	# Other values of user are matched against the name associated with the process
	# UID.
	# seinfo= matches aginst the seinfo tag for the app, determined from
	# mac_permissions.xml files.
	# The ':' character is reserved and may not be used in seinfo.
	# name= matches against the package name of the app.
	# path= matches against the directory path when labeling app directories.
	# isPrivApp=true will only match for applications preinstalled in
	# /system/priv-app.
	# minTargetSdkVersion will match applications with a targetSdkVersion
	# greater than or equal to the specified value. If unspecified,
	# it has a default value of 0.
	# fromRunAs=true means the process being labeled is started by run-as. Default
	# is false.
	#
	# Precedence: entries are compared using the following rules, in the order shown
	# (see external/selinux/libselinux/src/android/android_platform.c,
	# seapp_context_cmp()).
	# (1) isSystemServer=true before isSystemServer=false.
	# (2) Specified isEphemeralApp= before unspecified isEphemeralApp=
	# boolean.
	# (3) Specified isOwner= before unspecified isOwner= boolean.
	# (4) Specified user= string before unspecified user= string;
	# more specific user= string before less specific user= string.
	# (5) Specified seinfo= string before unspecified seinfo= string.
	# (6) Specified name= string before unspecified name= string;
	# more specific name= string before less specific name= string.
	# (7) Specified path= string before unspecified path= string.
	# more specific name= string before less specific name= string.
	# (8) Specified isPrivApp= before unspecified isPrivApp= boolean.
	# (9) Higher value of minTargetSdkVersion= before lower value of
	# minTargetSdkVersion= integer. Note that minTargetSdkVersion=
	# defaults to 0 if unspecified.
	# (10) fromRunAs=true before fromRunAs=false.
	# (A fixed selector is more specific than a prefix, i.e. ending in *, and a
	# longer prefix is more specific than a shorter prefix.)
	# Apps are checked against entries in precedence order until the first match,
	# regardless of their order in this file.
	#
	# Duplicate entries, i.e. with identical input selectors, are not allowed.
	#
	# Outputs:
	# domain (string)
	# type (string)
	# levelFrom (string; one of none, all, app, or user)
	# level (string)
	#
	# domain= determines the label to be used for the app process; entries
	# without domain= are ignored for this purpose.
	# type= specifies the label to be used for the app data directory; entries
	# without type= are ignored for this purpose.
	# levelFrom and level are used to determine the level (sensitivity + categories)
	# for MLS/MCS.
	# levelFrom=none omits the level.
	# levelFrom=app determines the level from the process UID.
	# levelFrom=user determines the level from the user ID.
	# levelFrom=all determines the level from both UID and user ID.
	#
	# levelFrom=user is only supported for _app or _isolated UIDs.
	# levelFrom=app or levelFrom=all is only supported for _app UIDs.
	# level may be used to specify a fixed level for any UID.
	#
	# For backwards compatibility levelFromUid=true is equivalent to levelFrom=app
	# and levelFromUid=false is equivalent to levelFrom=none.
	#
	#
	# Neverallow Assertions
	# Additional compile time assertion checks for the rules in this file can be
	# added as well. The assertion
	# rules are lines beginning with the keyword neverallow. Full support for PCRE
	# regular expressions exists on all input and output selectors. Neverallow
	# rules are never output to the built seapp_contexts file. Like all keywords,
	# neverallows are case-insensitive. A neverallow is asserted when all key value
	# inputs are matched on a key value rule line.
	#

	# only the system server can be in system_server domain
	neverallow isSystemServer=false domain=system_server
	neverallow isSystemServer="" domain=system_server

	# system domains should never be assigned outside of system uid
	neverallow user=((?!system).)* domain=system_app
	neverallow user=((?!system).)* type=system_app_data_file

	# anything with a non-known uid with a specified name should have a specified seinfo
	neverallow user=_app name=.* seinfo=""
	neverallow user=_app name=.* seinfo=default

	# neverallow shared relro to any other domain
	# and neverallow any other uid into shared_relro
	neverallow user=shared_relro domain=((?!shared_relro).)*
	neverallow user=((?!shared_relro).)* domain=shared_relro

	# neverallow non-isolated uids into isolated_app domain
	# and vice versa
	neverallow user=_isolated domain=((?!isolated_app).)*
	neverallow user=((?!_isolated).)* domain=isolated_app

	# uid shell should always be in shell domain, however non-shell
	# uid's can be in shell domain
	neverallow user=shell domain=((?!shell).)*

	# only the package named com.android.shell can run in the shell domain
	neverallow domain=shell name=((?!com\.android\.shell).)*
	neverallow user=shell name=((?!com\.android\.shell).)*

	# Ephemeral Apps must run in the ephemeral_app domain
	neverallow isEphemeralApp=true domain=((?!ephemeral_app).)*

	isSystemServer=true domain=system_server_startup

	user=_app seinfo=platform name=com.android.traceur domain=traceur_app type=app_data_file levelFrom=all
	user=system seinfo=platform domain=system_app type=system_app_data_file
	user=bluetooth seinfo=platform domain=bluetooth type=bluetooth_data_file
	user=network_stack seinfo=network_stack domain=network_stack levelFrom=all type=radio_data_file
	user=nfc seinfo=platform domain=nfc type=nfc_data_file
	user=secure_element seinfo=platform domain=secure_element levelFrom=all
	user=radio seinfo=platform domain=radio type=radio_data_file
	user=shared_relro domain=shared_relro
	user=shell seinfo=platform domain=shell name=com.android.shell type=shell_data_file
	user=webview_zygote seinfo=webview_zygote domain=webview_zygote
	user=_isolated domain=isolated_app levelFrom=all
	user=_app seinfo=app_zygote domain=app_zygote levelFrom=all
	user=_app seinfo=media domain=mediaprovider name=android.process.media type=app_data_file levelFrom=user
	user=_app seinfo=platform domain=platform_app type=app_data_file levelFrom=user
	user=_app isEphemeralApp=true domain=ephemeral_app type=app_data_file levelFrom=all
	user=_app isPrivApp=true domain=priv_app type=privapp_data_file levelFrom=user
	user=_app minTargetSdkVersion=29 domain=untrusted_app type=app_data_file levelFrom=all
	user=_app minTargetSdkVersion=28 domain=untrusted_app_27 type=app_data_file levelFrom=all
	user=_app minTargetSdkVersion=26 domain=untrusted_app_27 type=app_data_file levelFrom=user
	user=_app domain=untrusted_app_25 type=app_data_file levelFrom=user
	user=_app minTargetSdkVersion=28 fromRunAs=true domain=runas_app levelFrom=all
	user=_app fromRunAs=true domain=runas_app levelFrom=user