Xiaomi Redmi Note 8 Pro 64Gb+6Gb Dual LTE [119/132] Privacy

the policy MUST compile with all neverallow rules present, for both AOSP SELinux

domains as well as device/vendor specific domains.

[C-1-5] MUST run third-party applications targeting API level 28 or higher in per-

application SELinux sandboxes with per-app SELinux restrictions on each application's

private data directory.

SHOULD retain the default SELinux policy provided in the system/sepolicy folder of the

upstream Android Open Source Project and only further add to this policy for their own

device-specific configuration.

If device implementations use kernel other than Linux, they:

[C-2-1] MUST use a mandatory access control system that is equivalent to SELinux.

Android contains multiple defense-in-depth features that are integral to device security.

Device implementations:

[C-SR] Are STRONGLY RECOMMENDED not to disable Control-Flow Integrity (CFI) or

Integer Overflow Sanitization (IntSan) on components that have it enabled.

[C-SR] Are STRONGLY RECOMMENDED to enable both CFI and IntSan for any additional

security-sensitive userspace components as explained in CFI and IntSan .

9.8. Privacy

9.8.1. Usage History

Android stores the history of the user's choices and manages such history by UsageStatsManager .

Device implementations:

[C-0-1] MUST keep a reasonable retention period of such user history.

[SR] Are STRONGLY RECOMMENDED to keep the 14 days retention period as configured

by default in the AOSP implementation.

Android stores the system events using the StatsLog identifiers, and manages such history via the

StatsManager and the IncidentManager System API.

Device implementations:

[C-0-2] MUST only include the fields marked with DEST_AUTOMATIC in the incident report

created by the System API class IncidentManager .

[C-0-3] MUST not use the system event identifiers to log any other event than what is

described in the StatsLog SDK documents. If additional system events are logged, they

MAY use a different atom identifier in the range between 100,000 and 200,000.

9.8.2. Recording

Device implementations:

[C-0-1] MUST NOT preload or distribute software components out-of-box that send the

user's private information (e.g. keystrokes, text displayed on the screen) off the device

without the user's consent or clear ongoing notifications.

If device implementations include functionality in the system that captures the contents displayed on

the screen and/or records the audio stream played on the device, they:

Page 119 of 132