82 lines
4.5 KiB
Plaintext
82 lines
4.5 KiB
Plaintext
# bg-upd (os.pawlet.bgupd) — platform-signed priv-app, background component updater.
|
|
# Scoped domain instead of inheriting blanket platform_app rules, since this app
|
|
# holds INSTALL_PACKAGES/DELETE_PACKAGES and switches the system webview provider.
|
|
# seapp_contexts maps this package to its own domain rather than platform_app, so
|
|
# it gets NONE of platform_app.te's/priv_app.te's blanket app_api_service grants —
|
|
# every service_manager lookup below is required explicitly, not defensive.
|
|
#
|
|
# Rules below were reconciled against every real code path in this repo (traced
|
|
# source-to-sepolicy, not live avc denials — no device was available for this
|
|
# pass): BootReceiver, BgUpdaterService/UpdateExecutor, PackageInstallerHelper,
|
|
# ManifestClient/CacheResolverClient (network + pawlet_cache binder),
|
|
# WebViewProviderSwitcher, PolicyReader, and the hardware-update path
|
|
# (DetectedHardwareStore/HardwareUpdateExecutor/HardwareUpdateClient/
|
|
# FirmwareInstaller). Still flip back to permissive and reconcile against real
|
|
# `avc: denied` output before shipping — static tracing can miss framework-
|
|
# internal binder calls that don't appear in this app's own source.
|
|
|
|
type bg_upd, domain, coredomain;
|
|
app_domain(bg_upd)
|
|
|
|
# App data type for bg-upd's private storage (referenced from seapp_contexts).
|
|
type bg_upd_data_file, file_type, data_file_type, app_data_file_type;
|
|
|
|
# Network access — manifest fetch (ota.php?mode=manifest) and component downloads.
|
|
net_domain(bg_upd)
|
|
|
|
# Own app data (downloaded update files, verified signatures cache, prefs).
|
|
allow bg_upd bg_upd_data_file:dir create_dir_perms;
|
|
allow bg_upd bg_upd_data_file:file create_file_perms;
|
|
|
|
# Package installation/removal via PackageInstaller -> system_server ->
|
|
# installd. Apps may never talk to installd directly over binder or socket —
|
|
# AOSP's installd.te has a hard neverallow restricting installd binder calls
|
|
# to system_server/dumpstate/servicemanager only, enforced at policy-compile
|
|
# time regardless of permissive mode. Go through the public PackageInstaller
|
|
# Session API (system_server), which reaches installd internally.
|
|
binder_call(bg_upd, system_server)
|
|
# PendingIntent.getBroadcast() (PackageInstallerHelper's completion receiver)
|
|
# and registerReceiver/unregisterReceiver both route through ActivityManager.
|
|
allow bg_upd activity_service:service_manager find;
|
|
# context.packageManager.packageInstaller (createSession/openSession/commit/
|
|
# uninstall) and setApplicationEnabledSetting both go through IPackageManager,
|
|
# service_contexts-labeled "package" -> package_service — NOT
|
|
# package_native_service (that's the separate PackageManagerNative AIDL
|
|
# surface, unused anywhere in this app).
|
|
allow bg_upd package_service:service_manager find;
|
|
|
|
# Reading the downloaded APK/update payload before handing it to PackageInstaller.
|
|
allow bg_upd bg_upd_data_file:file { read open getattr };
|
|
|
|
# WebView provider switching — hidden IWebViewUpdateService System API call.
|
|
allow bg_upd webviewupdate_service:service_manager find;
|
|
binder_call(bg_upd, webview_zygote)
|
|
|
|
# Binding os.pawlet.cache's IPawletCacheService before component downloads —
|
|
# see android_packages_apps_PawletCache/sepolicy/pawlet_cache.te.
|
|
binder_call(bg_upd, pawlet_cache)
|
|
|
|
# CHANGE_COMPONENT_ENABLED_STATE / WRITE_SECURE_SETTINGS already granted via
|
|
# manifest permissions + platform signature; no additional domain transition
|
|
# needed for those (handled by system_server's permission check, not sepolicy).
|
|
|
|
# DetectedHardwareStore reads the SetupWizard-written hardware inventory at
|
|
# /data/pawlet/detected_hardware.json — labeled pawlet_hw_data_file by
|
|
# android_vendor_pawlet/hwupdate/sepolicy/file_contexts (that daemon owns the
|
|
# whole /data/pawlet tree; bg-upd only ever reads this one file from it).
|
|
allow bg_upd pawlet_hw_data_file:dir search;
|
|
allow bg_upd pawlet_hw_data_file:file { read open getattr };
|
|
|
|
# PolicyReader reads the MDM "software-update" policy written by
|
|
# pawletprofiled's SoftwareUpdateHandler payload handler — same
|
|
# read-side-owns-the-type pattern as pawletcache_policy_file in
|
|
# PawletCache/sepolicy/pawlet_cache.te. NOTE: as of this pass,
|
|
# os.pawlet.profiled.payloads.SoftwareUpdateHandler referenced in
|
|
# PolicyReader.kt's doc comment does not exist yet in
|
|
# android_packages_apps_PawletProfiled — this grant is the read side only,
|
|
# ready for when that handler lands; until then the file never exists and
|
|
# PolicyReader fails open (returns null) as designed.
|
|
type bgupd_policy_file, file_type, data_file_type, core_data_file_type;
|
|
allow bg_upd bgupd_policy_file:file { read open getattr };
|
|
allow bg_upd bgupd_policy_file:dir { read open getattr search };
|