diff options
| author | William Roberts <william.c.roberts@intel.com> | 2016-02-08 16:20:50 -0800 |
|---|---|---|
| committer | Nick Kralevich <nnk@google.com> | 2016-02-09 13:32:58 -0800 |
| commit | bd0768cc93e6c934ccec62e521228fecddb5d61b (patch) | |
| tree | 6be4c74e8eeb08e8cc394b19f3b05756aef932b5 | |
| parent | eebdb473079c1b0cefadf372d0139519ac1465ac (diff) | |
| download | sepolicy-bd0768cc93e6c934ccec62e521228fecddb5d61b.tar.gz | |
untrusted_app: confine filesystem creation to sandbox
untrusted_apps could be allowed to create/unlink files in world
accessible /data locations. These applications could create
files in a way that would need cap dac_override to remove from
the system when they are uninstalled and/or leave orphaned
data behind.
Keep untrusted_app file creation to sandbox, sdcard and media
locations.
Change-Id: Ife680cb9425dad8223651f16b9be8a3179839ec3
Signed-off-by: William Roberts <william.c.roberts@intel.com>
| -rw-r--r-- | untrusted_app.te | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/untrusted_app.te b/untrusted_app.te index a92323e..1b2d89e 100644 --- a/untrusted_app.te +++ b/untrusted_app.te @@ -148,3 +148,21 @@ neverallow untrusted_app { cache_file cache_recovery_file }:file ~{ read getattr # Do not allow untrusted_app to set system properties. neverallow untrusted_app property_socket:sock_file write; neverallow untrusted_app property_type:property_service set; + +# Do not allow untrusted_app to create/unlink files outside of its sandbox, +# internal storage or sdcard. +# World accessible data locations allow application to fill the device +# with unaccounted for data. This data will not get removed during +# application un-installation. +neverallow untrusted_app { + fs_type + -fuse # sdcard + file_type + -app_data_file # The apps sandbox itself + -media_rw_data_file # Internal storage. Known that apps can + # leave artfacts here after uninstall. + userdebug_or_eng(` + -method_trace_data_file # only on ro.debuggable=1 + -coredump_file # userdebug/eng only + ') +}:dir_file_class_set { create unlink }; |