Hello Stephen, Regarding your reply on my following query (in the mail below) :
> b) If there is another platform app, say X, which shares the same UI > as "com.example.contentprovideruser" but belongs to a different > domain say the default domain for platform apps, (assumption here is > that I have successfully modified the domain and database that belongs > to "com.example.contentprovideruser" to "hm_phonebookaccess_app" and > "hm_phonebookaccess_data_file" respectively) would platform app X, be > able to do a raw binary access of the database which belongs to > "com.example.contentprovideruser". You had mentioned - Not if it runs in a separate process in its own domain. But I am facing an issue here. The platform app X is running a HTTP server. Another application which is knowing about this HTTP server that the app X is running, is able to make a http request to app X and passing an URI : http://127.0.0.1/<path of the database>/database file and getting the entire database file through app X. How do I prevent app X from accessing the database. Thanks and Regards, Souvik -----Original Message----- From: Stephen Smalley [mailto:[email protected]] Sent: Monday, May 04, 2015 6:34 PM To: Datta, Souvik; [email protected] Subject: Re: Assigning domain and type to platform application and its data On 05/04/2015 04:00 AM, Datta, Souvik wrote: > Hi, > > I am using Android 4.4.4. > I have written a policy which prevents any app which belongs to > untrusted_t domain from accessing a database. The database belongs to > another user app (com.example.contentprovideruser) which has been > assigned a specific domain i.e., "hm_phonebookaccess_app" and the > database (which belongs to domain "hm_phonebookaccess_app") a specific > type i.e, "hm_phonebookaccess_data_file". > > I then added the following line in file > $MYDROID/external/sepolicy/seapp_contexts :- user=_app > domain=hm_phonebookaccess_app name=com.example.contentprovideruser > type=hm_phonebookaccess_data_file > > I have also added my policy file as part of BoardConfig.mk as > follows:- BOARD_SEPOLICY_DIRS := device/ti/jacinto6evm/sepolicy > BOARD_SEPOLICY_UNION := \ > healthd.te \ > file.te \ > phonebookaccess.te <--- My Policy file > > With the above changes, I am able to prevent any process which belongs > to untrusted_app from accessing the database which belongs to > com.example.contentprovideruser. For this ofcourse, I had to remove > "permissive untrusted_app" from untrustedapp_te. > > > Now there is a requirement that "com.example.contentprovideruser" is > to be made as a platform app. > I have two questions here:- > > a) Can some one please tell me how do I set the domain of > "com.example.contentprovideruser" which is now a platform app as > "hm_phonebookaccess_app" and the database (which belongs to > "com.example.contentprovideruser") as "hm_phonebookaccess_data_file"? > In otherwords, which files do I have to update to make my policy > (phonebookaccess.te) applicable for a platform app. Will it be signed by one of the four keys (platform, shared, media, or release) for which there is a specific entry in mac_permissions.xml and seapp_contexts? If so, then you just need to add an appropriate seinfo= input selector to your seapp_contexts entry above, e.g. if signed by the platform certificate, you want: user=_app seinfo=platform name=com.example.contentprovideruser domain=hm_phonebookaccess_app type=hm_phonebookaccess_data_file > b) If there is another platform app, say X, which shares the same UI > as "com.example.contentprovideruser" but belongs to a different > domain say the default domain for platform apps, (assumption here is > that I have successfully modified the domain and database that belongs > to "com.example.contentprovideruser" to "hm_phonebookaccess_app" and > "hm_phonebookaccess_data_file" respectively) would platform app X, be > able to do a raw binary access of the database which belongs to > "com.example.contentprovideruser". Not if it runs in a separate process in its own domain. _______________________________________________ Seandroid-list mailing list [email protected] To unsubscribe, send email to [email protected]. To get help, send an email containing "help" to [email protected].
