avc: denied { connectto } when using uds on Android 10

user_2769167 0
Viewed 822

I'm running 2 applications on Android 10 device which communicate each other via uds. Everything worked fine until I changed the apps settings to target android 10. I get following error in logcat:

09-07 13:33:18.136 14573 14573 W <myapp_name>: type=1400 audit(0.0:1461891): avc: denied { connectto } for pid=14573 comm=474C546872656164203134353530 path=005368617265644D656D6F727953657276696365 scontext=u:r:untrusted_app_27:s0:c512,c768 tcontext=u:r:untrusted_app_25:s0:c512,c768 tclass=unix_stream_socket permissive=0

After some digging I found neverallow SELinux policy:

neverallow { all_untrusted_apps -mediaprovider } init:unix_stream_socket connectto;

Is there a way I can make it work on applications targeting Android 10?

android
1 Answers

UDS with abstract path doesn't work for API>=28 due to the following changes.

Per-app SELinux domains Apps that target Android 9 or higher cannot share data with other apps using world-accessible Unix permissions. This change improves the integrity of the Android Application Sandbox, particularly the requirement that an app's private data is accessible only by that app.

To share files with other apps, use a content provider.

https://developer.android.com/about/versions/pie/android-9.0-changes-28#framework-security-changes

user_153111880
Related