Sync 34.0 prebuilts with udc-d1-dev (2)
Because of some incorrect usages of Merged-In, udc-d1-dev and
udc-d1-dev-plus-aosp's 34.0 prebuilts are diverged a little.
Ignore-AOSP-First: not related to AOSP
Bug: 288517951
Test: build
Change-Id: Ida3cdae407a72a6770c7562cdf3c12a89f8b717c
Merged-In: I621d375b1af07bc6e0abf14aeaed18a7d421bf92
diff --git a/prebuilts/api/34.0/private/sdk_sandbox.te b/prebuilts/api/34.0/private/sdk_sandbox.te
deleted file mode 100644
index 4806e6d..0000000
--- a/prebuilts/api/34.0/private/sdk_sandbox.te
+++ /dev/null
@@ -1,304 +0,0 @@
-###
-### SDK Sandbox process.
-###
-### This file defines the security policy for the sdk sandbox processes.
-
-type sdk_sandbox, domain;
-
-typeattribute sdk_sandbox coredomain;
-
-net_domain(sdk_sandbox)
-app_domain(sdk_sandbox)
-
-# TODO(b/252967582): remove this rule if it generates too much logs traffic.
-auditallow sdk_sandbox {
- property_type
- # remove expected properties to reduce noise.
- -servicemanager_prop
- -hwservicemanager_prop
- -use_memfd_prop
- -binder_cache_system_server_prop
- -graphics_config_prop
- -persist_wm_debug_prop
- -aaudio_config_prop
- -adbd_config_prop
- -apex_ready_prop
- -apexd_select_prop
- -arm64_memtag_prop
- -audio_prop
- -binder_cache_bluetooth_server_prop
- -binder_cache_telephony_server_prop
- -bluetooth_config_prop
- -boot_status_prop
- -bootloader_prop
- -bq_config_prop
- -build_odm_prop
- -build_prop
- -build_vendor_prop
- -camera2_extensions_prop
- -camera_calibration_prop
- -camera_config_prop
- -camerax_extensions_prop
- -codec2_config_prop
- -config_prop
- -cppreopt_prop
- -dalvik_config_prop_type
- -dalvik_prop
- -dalvik_runtime_prop
- -dck_prop
- -debug_prop
- -debuggerd_prop
- -default_prop
- -device_config_memory_safety_native_boot_prop
- -device_config_memory_safety_native_prop
- -device_config_nnapi_native_prop
- -device_config_runtime_native_boot_prop
- -device_config_runtime_native_prop
- -dhcp_prop
- -dumpstate_prop
- -exported3_system_prop
- -exported_config_prop
- -exported_default_prop
- -exported_dumpstate_prop
- -exported_pm_prop
- -exported_system_prop
- -ffs_config_prop
- -fingerprint_prop
- -framework_status_prop
- -gwp_asan_prop
- -hal_instrumentation_prop
- -hdmi_config_prop
- -heapprofd_prop
- -hw_timeout_multiplier_prop
- -init_service_status_private_prop
- -init_service_status_prop
- -libc_debug_prop
- -lmkd_config_prop
- -locale_prop
- -localization_prop
- -log_file_logger_prop
- -log_prop
- -log_tag_prop
- -logd_prop
- -media_config_prop
- -media_variant_prop
- -mediadrm_config_prop
- -module_sdkextensions_prop
- -net_radio_prop
- -nfc_prop
- -nnapi_ext_deny_product_prop
- -ota_prop
- -packagemanager_config_prop
- -pan_result_prop
- -permissive_mte_prop
- -persist_debug_prop
- -persist_sysui_builder_extras_prop
- -pm_prop
- -powerctl_prop
- -property_service_version_prop
- -radio_control_prop
- -radio_prop
- -restorecon_prop
- -rollback_test_prop
- -sendbug_config_prop
- -setupwizard_prop
- -shell_prop
- -soc_prop
- -socket_hook_prop
- -sqlite_log_prop
- -storagemanager_config_prop
- -surfaceflinger_color_prop
- -surfaceflinger_prop
- -system_prop
- -system_user_mode_emulation_prop
- -systemsound_config_prop
- -telephony_config_prop
- -telephony_status_prop
- -test_harness_prop
- -timezone_prop
- -usb_config_prop
- -usb_control_prop
- -usb_prop
- -userdebug_or_eng_prop
- -userspace_reboot_config_prop
- -userspace_reboot_exported_prop
- -userspace_reboot_log_prop
- -userspace_reboot_test_prop
- -vendor_socket_hook_prop
- -vndk_prop
- -vold_config_prop
- -vold_prop
- -vold_status_prop
- -vts_config_prop
- -vts_status_prop
- -wifi_log_prop
- -zygote_config_prop
- -zygote_wrap_prop
- -init_service_status_prop
-}:file { getattr open read map };
-
-# Allow finding services. This is different from ephemeral_app policy.
-# Adding services manually to the allowlist is preferred hence app_api_service is not used.
-
-allow sdk_sandbox activity_service:service_manager find;
-allow sdk_sandbox activity_task_service:service_manager find;
-allow sdk_sandbox appops_service:service_manager find;
-allow sdk_sandbox audio_service:service_manager find;
-allow sdk_sandbox audioserver_service:service_manager find;
-allow sdk_sandbox batteryproperties_service:service_manager find;
-allow sdk_sandbox batterystats_service:service_manager find;
-allow sdk_sandbox connectivity_service:service_manager find;
-allow sdk_sandbox connmetrics_service:service_manager find;
-allow sdk_sandbox deviceidle_service:service_manager find;
-allow sdk_sandbox display_service:service_manager find;
-allow sdk_sandbox dropbox_service:service_manager find;
-allow sdk_sandbox font_service:service_manager find;
-allow sdk_sandbox game_service:service_manager find;
-allow sdk_sandbox gpu_service:service_manager find;
-allow sdk_sandbox graphicsstats_service:service_manager find;
-allow sdk_sandbox hardware_properties_service:service_manager find;
-allow sdk_sandbox hint_service:service_manager find;
-allow sdk_sandbox imms_service:service_manager find;
-allow sdk_sandbox input_method_service:service_manager find;
-allow sdk_sandbox input_service:service_manager find;
-allow sdk_sandbox IProxyService_service:service_manager find;
-allow sdk_sandbox ipsec_service:service_manager find;
-allow sdk_sandbox launcherapps_service:service_manager find;
-allow sdk_sandbox legacy_permission_service:service_manager find;
-allow sdk_sandbox light_service:service_manager find;
-allow sdk_sandbox locale_service:service_manager find;
-allow sdk_sandbox media_communication_service:service_manager find;
-allow sdk_sandbox mediaextractor_service:service_manager find;
-allow sdk_sandbox mediametrics_service:service_manager find;
-allow sdk_sandbox media_projection_service:service_manager find;
-allow sdk_sandbox media_router_service:service_manager find;
-allow sdk_sandbox mediaserver_service:service_manager find;
-allow sdk_sandbox media_session_service:service_manager find;
-allow sdk_sandbox memtrackproxy_service:service_manager find;
-allow sdk_sandbox midi_service:service_manager find;
-allow sdk_sandbox netpolicy_service:service_manager find;
-allow sdk_sandbox netstats_service:service_manager find;
-allow sdk_sandbox network_management_service:service_manager find;
-allow sdk_sandbox notification_service:service_manager find;
-allow sdk_sandbox package_service:service_manager find;
-allow sdk_sandbox permission_checker_service:service_manager find;
-allow sdk_sandbox permission_service:service_manager find;
-allow sdk_sandbox permissionmgr_service:service_manager find;
-allow sdk_sandbox platform_compat_service:service_manager find;
-allow sdk_sandbox power_service:service_manager find;
-allow sdk_sandbox procstats_service:service_manager find;
-allow sdk_sandbox registry_service:service_manager find;
-allow sdk_sandbox restrictions_service:service_manager find;
-allow sdk_sandbox rttmanager_service:service_manager find;
-allow sdk_sandbox search_service:service_manager find;
-allow sdk_sandbox selection_toolbar_service:service_manager find;
-allow sdk_sandbox sensor_privacy_service:service_manager find;
-allow sdk_sandbox sensorservice_service:service_manager find;
-allow sdk_sandbox servicediscovery_service:service_manager find;
-allow sdk_sandbox settings_service:service_manager find;
-allow sdk_sandbox speech_recognition_service:service_manager find;
-allow sdk_sandbox statusbar_service:service_manager find;
-allow sdk_sandbox storagestats_service:service_manager find;
-allow sdk_sandbox surfaceflinger_service:service_manager find;
-allow sdk_sandbox telecom_service:service_manager find;
-allow sdk_sandbox tethering_service:service_manager find;
-allow sdk_sandbox textclassification_service:service_manager find;
-allow sdk_sandbox textservices_service:service_manager find;
-allow sdk_sandbox texttospeech_service:service_manager find;
-allow sdk_sandbox thermal_service:service_manager find;
-allow sdk_sandbox translation_service:service_manager find;
-allow sdk_sandbox tv_iapp_service:service_manager find;
-allow sdk_sandbox tv_input_service:service_manager find;
-allow sdk_sandbox uimode_service:service_manager find;
-allow sdk_sandbox vcn_management_service:service_manager find;
-allow sdk_sandbox webviewupdate_service:service_manager find;
-
-allow sdk_sandbox system_linker_exec:file execute_no_trans;
-
-# Required to read CTS tests data from the shell_data_file location.
-allow sdk_sandbox shell_data_file:file r_file_perms;
-allow sdk_sandbox shell_data_file:dir r_dir_perms;
-
-# allow sdk sandbox to use UDP sockets provided by the system server but not
-# modify them other than to connect
-allow sdk_sandbox system_server:udp_socket {
- connect getattr read recvfrom sendto write getopt setopt };
-
-# allow sandbox to search in sdk system server directory
-# additionally, for webview to work, getattr has been permitted
-allow sdk_sandbox sdk_sandbox_system_data_file:dir { getattr search };
-# allow sandbox to create files and dirs in sdk data directory
-allow sdk_sandbox sdk_sandbox_data_file:dir create_dir_perms;
-allow sdk_sandbox sdk_sandbox_data_file:file create_file_perms;
-
-###
-### neverallow rules
-###
-
-neverallow sdk_sandbox { app_data_file privapp_data_file sdk_sandbox_data_file }:file { execute execute_no_trans };
-
-# Receive or send uevent messages.
-neverallow sdk_sandbox domain:netlink_kobject_uevent_socket *;
-
-# Receive or send generic netlink messages
-neverallow sdk_sandbox domain:netlink_socket *;
-
-# Too much leaky information in debugfs. It's a security
-# best practice to ensure these files aren't readable.
-neverallow sdk_sandbox debugfs:file read;
-
-# execute gpu_device
-neverallow sdk_sandbox gpu_device:chr_file execute;
-
-# access files in /sys with the default sysfs label
-neverallow sdk_sandbox sysfs:file *;
-
-# Avoid reads from generically labeled /proc files
-# Create a more specific label if needed
-neverallow sdk_sandbox proc:file { no_rw_file_perms no_x_file_perms };
-
-# Directly access external storage
-neverallow sdk_sandbox { sdcard_type media_rw_data_file }:file {open create};
-neverallow sdk_sandbox { sdcard_type media_rw_data_file }:dir search;
-
-# Avoid reads to proc_net, it contains too much device wide information about
-# ongoing connections.
-neverallow sdk_sandbox proc_net:file no_rw_file_perms;
-
-# SDK sandbox processes have their own storage not related to app_data_file or privapp_data_file
-neverallow sdk_sandbox { app_data_file privapp_data_file }:dir no_rw_file_perms;
-neverallow sdk_sandbox { app_data_file privapp_data_file }:file no_rw_file_perms;
-
-# SDK sandbox processes don't have any access to external storage
-neverallow sdk_sandbox { media_rw_data_file }:dir no_rw_file_perms;
-neverallow sdk_sandbox { media_rw_data_file }:file no_rw_file_perms;
-
-neverallow { sdk_sandbox } tmpfs:dir no_rw_file_perms;
-
-neverallow sdk_sandbox hal_drm_service:service_manager find;
-
-# Only certain system components should have access to sdk_sandbox_system_data_file
-# sdk_sandbox only needs search. Restricted in follow up neverallow rule.
-neverallow {
- domain
- -init
- -installd
- -system_server
- -vold_prepare_subdirs
-} sdk_sandbox_system_data_file:dir { relabelfrom };
-
-neverallow {
- domain
- -init
- -installd
- -sdk_sandbox
- -system_server
- -vold_prepare_subdirs
- -zygote
-} sdk_sandbox_system_data_file:dir { create_dir_perms relabelto };
-
-# sdk_sandbox only needs to traverse through the sdk_sandbox_system_data_file
-neverallow sdk_sandbox sdk_sandbox_system_data_file:dir ~{ getattr search };
-
-# Only dirs should be created at sdk_sandbox_system_data_file level
-neverallow { domain -init } sdk_sandbox_system_data_file:file *;
