From 5b51730b8a6c06fdf7912016919209769136e8e2 Mon Sep 17 00:00:00 2001 From: Michael Peck Date: Fri, 8 Jan 2016 15:07:52 -0500 Subject: [PATCH] Pass targetSdkVersion specifier for SELinux labeling Motivation: Provide the ability to phase in new security policies by applying them to apps with a minimum targetSdkVersion Test: Marlin builds and boots. Apps targeting targetSdkVersion<=25 run in untrusted_app_25 domain. Apps targeting the current development build >=26 run in the untrusted_app domain with fewer permissions. No new denials observed during testing. Bug: 34115651 Change-Id: Ib9f6ded9bd2f426861a6d843861b4074084253b0 --- services/core/java/com/android/server/pm/SELinuxMMAC.java | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/services/core/java/com/android/server/pm/SELinuxMMAC.java b/services/core/java/com/android/server/pm/SELinuxMMAC.java index 27811508d5735..7e7de21eb9820 100644 --- a/services/core/java/com/android/server/pm/SELinuxMMAC.java +++ b/services/core/java/com/android/server/pm/SELinuxMMAC.java @@ -72,6 +72,9 @@ public final class SELinuxMMAC { // Append ephemeral to existing seinfo label private static final String EPHEMERAL_APP_STR = ":ephemeralapp"; + // Append targetSdkVersion=n to existing seinfo label where n is the app's targetSdkVersion + private static final String TARGETSDKVERSION_STR = ":targetSdkVersion="; + /** * Load the mac_permissions.xml file containing all seinfo assignments used to * label apps. The loaded mac_permissions.xml file is determined by the @@ -296,6 +299,8 @@ public final class SELinuxMMAC { if (pkg.applicationInfo.isPrivilegedApp()) pkg.applicationInfo.seinfo += PRIVILEGED_APP_STR; + pkg.applicationInfo.seinfo += TARGETSDKVERSION_STR + pkg.applicationInfo.targetSdkVersion; + if (DEBUG_POLICY_INSTALL) { Slog.i(TAG, "package (" + pkg.packageName + ") labeled with " + "seinfo=" + pkg.applicationInfo.seinfo);