From 7c4787b4df31600cc700c751222003fd6bab0af2 Mon Sep 17 00:00:00 2001 From: Michael Peck Date: Tue, 14 Feb 2017 09:07:04 -0800 Subject: [PATCH] Pass targetSdkVersion specifier for SELinux labeling Motivation: Provide the ability to phase in new security policies by applying them to apps with a minimum targetSdkVersion Test: Marlin builds and boots. Apps targeting targetSdkVersion<=25 run in untrusted_app_25 domain. Apps targeting the current development build >=26 run in the untrusted_app domain with fewer permissions. No new denials observed during testing. Bug: 34115651 Change-Id: Ib9f6ded9bd2f426861a6d843861b4074084253b0 --- services/core/java/com/android/server/pm/SELinuxMMAC.java | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/services/core/java/com/android/server/pm/SELinuxMMAC.java b/services/core/java/com/android/server/pm/SELinuxMMAC.java index 0fe15396fad7a..522c2e83a9ae7 100644 --- a/services/core/java/com/android/server/pm/SELinuxMMAC.java +++ b/services/core/java/com/android/server/pm/SELinuxMMAC.java @@ -69,6 +69,9 @@ public final class SELinuxMMAC { // Append autoplay to existing seinfo label private static final String AUTOPLAY_APP_STR = ":autoplayapp"; + // Append targetSdkVersion=n to existing seinfo label where n is the app's targetSdkVersion + private static final String TARGETSDKVERSION_STR = ":targetSdkVersion="; + /** * Load the mac_permissions.xml file containing all seinfo assignments used to * label apps. The loaded mac_permissions.xml file is determined by the @@ -290,6 +293,8 @@ public final class SELinuxMMAC { if (pkg.applicationInfo.isPrivilegedApp()) pkg.applicationInfo.seinfo += PRIVILEGED_APP_STR; + pkg.applicationInfo.seinfo += TARGETSDKVERSION_STR + pkg.applicationInfo.targetSdkVersion; + if (DEBUG_POLICY_INSTALL) { Slog.i(TAG, "package (" + pkg.packageName + ") labeled with " + "seinfo=" + pkg.applicationInfo.seinfo);