1 # zygote 2 type zygote, domain; 3 type zygote_exec, exec_type, file_type; 4 5 init_daemon_domain(zygote) 6 typeattribute zygote mlstrustedsubject; 7 # Override DAC on files and switch uid/gid. 8 allow zygote self:capability { dac_override setgid setuid fowner }; 9 # Drop capabilities from bounding set. 10 allow zygote self:capability setpcap; 11 # Switch SELinux context to app domains. 12 allow zygote system:process dyntransition; 13 allow zygote appdomain:process dyntransition; 14 # Allow zygote to read + write app data dirs (b/10455872 and b/10498304) 15 allow zygote appdomain:dir { getattr search }; 16 allow zygote appdomain:file { r_file_perms write }; 17 # Move children into the peer process group. 18 allow zygote system:process { getpgid setpgid }; 19 allow zygote appdomain:process { getpgid setpgid }; 20 # Write to system data. 21 allow zygote system_data_file:dir rw_dir_perms; 22 allow zygote system_data_file:file create_file_perms; 23 allow zygote dalvikcache_data_file:dir rw_dir_perms; 24 allow zygote dalvikcache_data_file:file { create_file_perms x_file_perms }; 25 # Execute dexopt. 26 allow zygote system_file:file x_file_perms; 27 # Control cgroups. 28 allow zygote cgroup:dir create_dir_perms; 29 allow zygote self:capability sys_admin; 30 # Check validity of SELinux context before use. 31 selinux_check_context(zygote) 32 # Check SELinux permissions. 33 selinux_check_access(zygote) 34 # Read /seapp_contexts and /data/security/seapp_contexts 35 security_access_policy(zygote) 36 37 # Setting up /storage/emulated. 38 allow zygote rootfs:dir mounton; 39 allow zygote sdcard_type:dir { write search setattr create add_name mounton }; 40 dontaudit zygote self:capability fsetid; 41 allow zygote tmpfs:dir { write create add_name setattr mounton search }; 42 allow zygote tmpfs:filesystem mount; 43 allow zygote labeledfs:filesystem remount; 44 45 # Handle --invoke-with command when launching Zygote with a wrapper command. 46 allow zygote zygote_exec:file { execute_no_trans open }; 47 48 # handle bugreports b/10498304 49 allow zygote ashmem_device:chr_file execute; 50 allow zygote init:binder call; 51 allow zygote shell_data_file:file { write getattr }; 52 allow zygote system:binder { transfer call }; 53 allow zygote servicemanager:binder { call }; 54
