data/configs/apparmor_profiles/android_app

   1 profile android_app flags=(attach_disconnected, complain, mediate_deleted) {
   2   #include <local/android_app>
   3   /** ix,
   4   /dev** rw,
   5   network,
   6   unix,
   7   owner /proc** rw,
   8   / r,
   9   /* r,
  10   deny pivot_root,
  11   deny dbus,
  12   capability sys_nice,
  13   capability wake_alarm,
  14   capability setpcap,
  15   capability setgid,
  16   capability setuid,
  17   capability sys_ptrace,
  18   capability sys_admin,
  19   capability wake_alarm,
  20   capability block_suspend,
  21   capability sys_time,
  22   capability net_admin,
  23   capability net_raw,
  24   capability net_bind_service,
  25   capability kill,
  26   capability dac_override,
  27   capability chown,
  28   mount fstype=tmpfs -> /storage**,
  29   mount fstype=tmpfs -> /data/misc/profiles**,
  30   mount options in (rw,bind) options in (rw,rbind) -> /storage**,
  31   mount options in (rw,bind) options in (rw,rbind) -> /data/misc/profiles**,
  32   mount /dev/fuse -> /storage**,
  33   mount -> /,
  34   umount /storage**,
  35
  36   ptrace (read,readby,trace,tracedby) peer=android_app//&lxc-waydroid,
  37   ptrace (read,trace,readby,tracedby) peer=lxc-waydroid,
  38   ptrace (read,trace,readby,tracedby) peer=adbd//&lxc-waydroid,
  39
  40   signal (send,receive) peer=android_app//&lxc-waydroid,
  41   signal (receive) peer=adbd//&lxc-waydroid,
  42   signal (send,receive) peer=lxc-waydroid,
  43   signal (receive),
  44
  45   /acct** rwkl,
  46   /linkerconfig** r,
  47   owner /data** rwkl,
  48   /data/app** r,
  49   /data/system/unsolzygotesocket rw,
  50   /data/dalvik-cache** r,
  51   /data/misc** r,
  52   /data/lineageos_updates** r,
  53   /apex** mr,
  54   /data/system_ce/** rw,
  55   /data/data/com.android** rw,
  56   /data/misc/profiles** rw,
  57   /data/user_de/** rw,
  58   /storage** rwkl,
  59   /data/tombstone** rw,
  60   /mnt/user** rw,
  61   owner /proc** rw,
  62   /proc** r,
  63   /proc/*/timerslack_ns w,
  64   /system/bin** mr,
  65   /system/lib** mr,
  66   /system** r,
  67   /sys** r,
  68   /sys/kernel/debug/tracing** w,
  69   /vendor** r,
  70   /vendor_extra** r,
  71
  72 # This seems to be important for Magisk to function
  73 #  /system/framework** wk,
  74
  75
  76 }