platform_system_sepolicy/apex/com.android.compos-file_contexts

(/.*)?                   u:object_r:system_file:s0
/bin/compsvc             u:object_r:compos_exec:s0
/bin/compos_verify_key   u:object_r:compos_verify_key_exec:s0
/bin/composd             u:object_r:composd_exec:s0
Add sepolicy for com.android.compos This is to unblock the apex setup. There is only a system_file in the context, but we might need more specific ones later. Bug: 186126404 Test: m Change-Id: Icf713c9bb92e7f7402c0b45bd0f1b06e9cb35d2b 2020-05-05 02:14:56 +02:00			`(/.*)? u:object_r:system_file:s0`
Add domain for compos binaries Bug: 191263171 Test: atest MicrodroidHostTestCases Test: atest ComposHostTestCases Change-Id: I1fd35d0efe83d2cecaa41580e6d1d0b8f6242b3f 2021-07-20 11:57:57 +02:00			`/bin/compsvc u:object_r:compos_exec:s0`
SEPolicy for compos_verify_key. Remove some allow rules for odsign, since it no longer directly modifies CompOs files. Instead allow it to run compos_verify_key in its own domain. Grant compos_verify_key what it needs to access the CompOs files and start up the VM. Currently we directly connect to the CompOs VM; that will change once some in-flight CLs have landed. As part of this I moved the virtualizationservice_use macro to te_macros so I can use it here. I also expanded it to include additional grants needed by any VM client that were previously done for individual domains (and then deleted those rules as now redundant). I also removed the grant of VM access to all apps; instead we allow it for untrusted apps, on userdebug or eng builds only. (Temporarily at least.) Bug: 193603140 Test: Manual - odsign successfully runs the VM at boot when needed. Change-Id: I62f9ad8c7ea2fb9ef2d468331e26822d08e3c828 2021-09-02 12:10:59 +02:00			`/bin/compos_verify_key u:object_r:compos_verify_key_exec:s0`
Initial sepolicy for composd Add what we need to allow composd to run and expose an AIDL service. Also delete the policy for compsvc; we never access it in the host now, and the real policy is in microdroid. Retain the compos_exec type, since it is referenced in the APEX sepolicy. Bug: 186126194 Test: adb shell cmd -w android.system.composd; no denials. Change-Id: I5f06b2b01852cdebd2d67009b363ec08b17ce33a 2021-09-09 18:08:15 +02:00			`/bin/composd u:object_r:composd_exec:s0`