split untrusted_app SELinux domain to make app_data_file execute optional

[thestinger]

It should be possible to entirely remove this for all apps included in the base system. It will need to start out as opt-in for third party apps but it could become opt-out at a new API level if this feature was landed upstream. It needs to be implemented before considering that.

[thestinger]

See https://android-review.googlesource.com/#/c/169950/ for an earlier attempt.

[thestinger]

See https://android-review.googlesource.com/#/c/169950/ for an earlier attempt.

[thestinger]

This has been implemented for the base system by splitting the domain untrusted_base_app and untrusted_app. It would still be nice to allow third party apps to opt-in to similar hardening but it's very unlikely that it would see much adoption without upstream doing this, so this can be closed for now.

[thestinger]

This has been implemented for the base system by splitting the domain untrusted_base_app and untrusted_app. It would still be nice to allow third party apps to opt-in to similar hardening but it's very unlikely that it would see much adoption without upstream doing this, so this can be closed for now.