oxmc
a48077078c
Android counterpart to git.oxmc.me/PawletOS/profiled's Linux daemon -- independent implementation, not a port. Same .vconfig profile format and 17 payload types, but implemented against DevicePolicyManager/VpnManager/ WifiManager/WallpaperManager/KeyChain instead of a native NDK Binder daemon, since that's where AOSP actually exposes this functionality. Self-provisions as device owner at first boot (DeviceOwnerProvisioner.kt) to unlock the DevicePolicyManager-gated payload types (cert, pkcs12, passcode, proxy, screensaver lock enforcement). 16 of 17 payload types are real implementations; firewall is a documented platform dead end (no app UID gets CAP_NET_ADMIN). See README's capability matrix for the full per-payload breakdown. Reviewed against the documented @SystemApi/hidden-API surface, not compiled -- no AOSP toolchain available in this environment.
47 lines
2.5 KiB
Plaintext
47 lines
2.5 KiB
Plaintext
# vendor/oxmc/PawletProfiled/sepolicy/pawletprofiled.te
|
|
# SELinux policy for the PawletProfiled priv-app / device owner.
|
|
#
|
|
# Supersedes the native-daemon policy that used to live in the Linux
|
|
# pawletprofiled repo (init_daemon_domain-based) — that pattern doesn't
|
|
# apply to an app; this one uses app_domain like other PawletOS priv-apps
|
|
# (see android_packages_apps_PawletCache/sepolicy/pawlet_cache.te).
|
|
#
|
|
# To activate, add to your device's BoardConfig.mk:
|
|
# BOARD_SEPOLICY_DIRS += vendor/oxmc/PawletProfiled/sepolicy
|
|
|
|
type pawletprofiled, domain, coredomain;
|
|
app_domain(pawletprofiled)
|
|
permissive pawletprofiled;
|
|
|
|
type pawletprofiled_data_file, file_type, data_file_type, app_data_file_type;
|
|
|
|
net_domain(pawletprofiled)
|
|
|
|
allow pawletprofiled pawletprofiled_data_file:dir create_dir_perms;
|
|
allow pawletprofiled pawletprofiled_data_file:file create_file_perms;
|
|
|
|
# ── Profile store + preinstalled profiles ─────────────────────────────────
|
|
# /data/system/pawletos/{profiles,preinstalled,profile_ca.pem} — same paths
|
|
# the Linux daemon uses, so profile UUIDs and layout stay consistent across
|
|
# platforms even though nothing else about the implementation is shared.
|
|
type pawletos_system_file, file_type, data_file_type;
|
|
allow pawletprofiled pawletos_system_file:dir create_dir_perms;
|
|
allow pawletprofiled pawletos_system_file:file create_file_perms;
|
|
|
|
# ── Device policy / device owner ──────────────────────────────────────────
|
|
binder_call(pawletprofiled, system_server)
|
|
allow pawletprofiled device_policy_service:service_manager find;
|
|
allow pawletprofiled keystore_service:service_manager find;
|
|
|
|
# ── Content-cache runtime override (PawletOS-specific) ────────────────────
|
|
# Type declared in android_packages_apps_PawletCache/sepolicy/pawlet_cache.te
|
|
# (both dirs land in BOARD_SEPOLICY_DIRS) — see ContentCacheHandler.kt.
|
|
allow pawletprofiled pawletcache_policy_file:dir { create search getattr add_name };
|
|
allow pawletprofiled pawletcache_policy_file:file create_file_perms;
|
|
|
|
# ── Secure settings writes (WRITE_SECURE_SETTINGS) ────────────────────────
|
|
allow pawletprofiled system_server:binder call;
|
|
|
|
# ── Boot-completed / persistent process ───────────────────────────────────
|
|
allow pawletprofiled self:process { fork sigchld };
|