Is it possible to use the package name as the domain name in Android SELinux?

Issue

Android SELinux( or you can say SEAndroid) defines many domains which include system_app, platform_app, isolated_app, etc.

Each domain has different meanings, for example, system_app includes all the apps which share the system uid, and the platform_app includes all the apps which sign the platform key.

All the SE files are located in external/sepolicy, I can modify the rules from these files.

Is it possible to define a new domain which points to a specified package name (For example, com.google.android.music)?

I do not find any document or example about that, so I am not sure how to do that.

I will appreciate any suggestions or comments.

Thank you.

Solution

After a long research, I find a way to define a new domain for a specified package

Define a new domain in seapp_contexts

like this,

user=_app domain=googlemusic seinfo=platform name=com.google.android.music type=app_data_file

then define the permission of a new domain googlemusic

create a te file called googlemusic.te

type googlemusic_app,domain

app_domain(googlemusic)

#more permissions

Answered By - alec.tu