AppArmor Policy Groups

This document contains a full list of Ubuntu Touch’s available policy groups and a description of what they give your app permission to access.

Each entry follows this format

Title
-----

Description: Description from apparmor file

Usage: How common it is to use this policy (from apparmor file)

Optional longer description

Policy usage affects whether your app will be accepted by the OpenStore. Apps containing policies with common usage are generally accepted immediately, while reserved usage policies will need to be manually reviewed.

accounts

Description: Can use Online Accounts.

Usage: common

The accounts policy gives your app the permissions it needs to access the Online Accounts API.

audio

Description: Can play audio (allows playing remote content via media-hub)

Usage: common

The audio policy is needed for your app to play audio via pulseaudio or media-hub. The permission also gives it the ability to send album art to the thumbnailer service, which is then shown on the sound indicator.

bluetooth

Description: Use bluetooth (bluez5) as an administrator.

Usage: reserved

This policy grants unrestricted access to Bluetooth devices. It is provided for administration of bluetooth and as a stepping stone towards developing a safe bluetooth API all apps can access.

calendar

Description: Can access the calendar.

Usage: reserved

Calendar grants access to the Evolution dataserver’s calendar and alarms APIs. It also grants access to sync-monitor.

This policy is reserved since it grants free access to all calendars on the device at any time. The legacy bug about this situation is LP #1227824 .

camera

Description: Can access the camera(s)

Usage: common

The camera policy grants access to device cameras.

connectivity

Description: Can access coarse network connectivity information

Usage: common

The connectivity policy allows apps to determine rough information about the device’s connectivity. This includes whether the device is connected to the Internet and whether it is connected via a Wi-Fi or mobile data connection.

contacts

Description: Can access contacts.

Usage: reserved

The contacts policy allows apps to access the device user’s contacts list. It is marked as reserved because it allows access to sync-monitor and unfettered access to the address book.

content_exchange

Description: Can request/import data from other applications

Usage: common

Using the content_exchange policy allows your app to be a consumer of content on content-hub.

content_exchange_source

Description: Can provide/export data to other applications

Usage: common

The content_exchange_source policy allows your app to provide content on content-hub.

debug

Description: Use special debugging tools. This should only be used in development and not for production packages. Note: use of this policy group provides significantly different confinement than normal and is not considered secure. You should never run untrusted programs using this policy group.

Usage: reserved

document_files

Description: Can read and write to document files. This policy group is reserved for certain applications, such as document viewers. Developers should typically use the content_exchange policy group and API to access document files instead.

Usage: reserved

This policy allows apps to read and write to the “Documents” folders in the user’s home directory and external media.

document_files_read

Description: Can read all document files. This policy group is reserved for certain applications, such as document viewers. Developers should typically use the content_exchange policy group and API to access document files instead.

Usage: reserved

This policy allows apps to read the “Documents” folders in the user’s home directory and external media.

history

Description: Can access the history-service. This policy group is reserved for vetted applications only in this version of the policy. A future version of the policy may move this out of reserved status.

Usage: reserved

keep-display-on

Description: Can request keeping the screen on

Usage: common

location

Description: Can access Location

Usage: common

Allows an app to request access to the device’s current location.

microphone

Description: Can access the microphone

Usage: common

music_files

Description: Can read and write to music files. This policy group is reserved for certain applications, such as music players. Developers should typically use the content_exchange policy group and API to access music files instead.

Usage: reserved

The music_files policy group allows an app to read or write to the Music directories in the user’s home folder or on external media.

music_files_read

Description: Can read all music files. This policy group is reserved for certain applications, such as music players. Developers should typically use the content_exchange policy group and API to access music files instead.

Usage: reserved

The music_files_read policy group allows an app to read the Music directories in the user’s home folder or on external media.

networking

Description: Can access the network

Usage: common

The networking policy group allows an app to contact network devices and use the download manager.

picture_files

Description: Can read and write to picture files. This policy group is reserved for certain applications, such as gallery applications. Developers should typically use the content_exchange policy group and API to access picture files instead.

Usage: reserved

The picture_files policy group allows an app to read and write to the Pictures directories in the user’s home folder or on external media.

picture_files_read

Description: Can read all picture files. This policy group is reserved for certain applications, such as gallery applications. Developers should typically use the content_exchange policy group and API to access picture files instead.

Usage: reserved

The picture_files_read policy group allows an app to read the Pictures directories in the user’s home folder or on external media.

push-notification-client

Description: Can use push notifications as a client

Usage: common

sensors

Description: Can access the sensors

Usage: common

Allows apps to access device sensors

usermetrics

Description: Can use UserMetrics to update the InfoGraphic

Usage: common

Allows an app to write metrics to the UserMetrics service so they can be displayed on the InfoGraphic.

video

Description: Can play video (allows playing remote content via media-hub)

Usage: common

video_files

Description: Can read and write to video files. This policy group is reserved for certain applications, such as gallery applications. Developers should typically use the content_exchange policy group and API to access video files instead.

Usage: reserved

The video_files policy group allows an app to read and write to the Videos directories in the user’s home folder or on external media.

video_files_read

Description: Can read all video files. This policy group is reserved for certain applications, such as gallery applications. Developers should typically use the content_exchange policy group and API to access video files instead.

Usage: reserved

The video_files_read policy group allows an app to read the Videos directories in the user’s home folder or on external media.

webview

Description: Can use the UbuntuWebview

Usage: common

The webview policy group allows apps to embed a web browser view.