1typeattribute simpleperf_app_runner coredomain;
2
3domain_auto_trans(shell, simpleperf_app_runner_exec, simpleperf_app_runner)
4
5# run simpleperf_app_runner in adb shell.
6allow simpleperf_app_runner adbd:fd use;
7allow simpleperf_app_runner shell:fd use;
8allow simpleperf_app_runner devpts:chr_file { read write ioctl };
9
10# simpleperf_app_runner reads package information.
11allow simpleperf_app_runner system_data_file:file r_file_perms;
12allow simpleperf_app_runner system_data_file:lnk_file getattr;
13allow simpleperf_app_runner packages_list_file:file r_file_perms;
14
15# The app's data dir may be accessed through a symlink.
16allow simpleperf_app_runner system_data_file:lnk_file read;
17
18# simpleperf_app_runner switches to the app UID/GID.
19allow simpleperf_app_runner self:global_capability_class_set { setuid setgid };
20
21# simpleperf_app_runner switches to the app security context.
22selinux_check_context(simpleperf_app_runner) # validate context
23allow simpleperf_app_runner self:process setcurrent;
24allow simpleperf_app_runner { ephemeral_app isolated_app platform_app priv_app untrusted_app_all }:process dyntransition; # setcon
25
26# simpleperf_app_runner/libselinux needs access to seapp_contexts_file to
27# determine which domain to transition to.
28allow simpleperf_app_runner seapp_contexts_file:file r_file_perms;
29
30# simpleperf_app_runner passes pipe fds.
31# simpleperf_app_runner writes app type (debuggable or profileable) to pipe fds.
32allow simpleperf_app_runner shell:fifo_file { read write };
33
34# simpleperf_app_runner checks shell data paths.
35# simpleperf_app_runner passes shell data fds.
36allow simpleperf_app_runner shell_data_file:dir { getattr search };
37allow simpleperf_app_runner shell_data_file:file { getattr write };
38
39###
40### neverallow rules
41###
42
43# simpleperf_app_runner cannot have capabilities other than CAP_SETUID and CAP_SETGID
44neverallow simpleperf_app_runner self:global_capability_class_set ~{ setuid setgid };
45neverallow simpleperf_app_runner self:global_capability2_class_set *;
46