diff options
| author | Riley Spahn <rileyspahn@google.com> | 2014-07-07 09:27:53 -0700 |
|---|---|---|
| committer | Riley Spahn <rileyspahn@google.com> | 2014-07-07 12:47:07 -0700 |
| commit | 76206abc9f5140e85da2d4e4845eca2c4f3a6ad5 (patch) | |
| tree | 5006673d1aad903a5d53ea394a2d6e2b0996a76b /untrusted_app.te | |
| parent | 5b2ed833571ec039490d6f8359a50a03fd96e0fe (diff) | |
| download | android_external_sepolicy-76206abc9f5140e85da2d4e4845eca2c4f3a6ad5.tar.gz android_external_sepolicy-76206abc9f5140e85da2d4e4845eca2c4f3a6ad5.tar.bz2 android_external_sepolicy-76206abc9f5140e85da2d4e4845eca2c4f3a6ad5.zip | |
Add neverallow rules further restricing service_manager.
Add a neverallow rule that prevents domain from adding a
default_android_service. Add a neverallow rule that prevents
untrusted_app from ever adding a service through
servicemanager.
Change-Id: I963671fb1224147bb49ec8f0b6be0dcc91c23156
Diffstat (limited to 'untrusted_app.te')
| -rw-r--r-- | untrusted_app.te | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/untrusted_app.te b/untrusted_app.te index 50a02da..35b3248 100644 --- a/untrusted_app.te +++ b/untrusted_app.te @@ -71,3 +71,8 @@ allow untrusted_app cache_file:file create_file_perms; # Too much leaky information in debugfs. It's a security # best practice to ensure these files aren't readable. neverallow untrusted_app debugfs:file read; + +# Do not allow untrusted apps to register services. +# Only trusted components of Android should be registering +# services. +neverallow untrusted_app service_manager_type:service_manager add; |