platform_system_sepolicy/apex/com.android.compos-file_contexts

(/.*)?                   u:object_r:system_file:s0
/bin/compos_key_helper   u:object_r:compos_key_helper_exec:s0
/bin/compos_verify       u:object_r:compos_verify_exec:s0
/bin/composd             u:object_r:composd_exec:s0
/bin/compsvc             u:object_r:compos_exec:s0
Add sepolicy for com.android.compos This is to unblock the apex setup. There is only a system_file in the context, but we might need more specific ones later. Bug: 186126404 Test: m Change-Id: Icf713c9bb92e7f7402c0b45bd0f1b06e9cb35d2b 2020-05-05 02:14:56 +02:00			`(/.*)? u:object_r:system_file:s0`
Modify sepolicy for compos key changes Add the compos_key_helper domain for the process which has access to the signing key, make sure it can't be crashdumped. Also extend that protection to diced & its HAL. Rename compos_verify_key to compos_verify, because it doesn't verify keys any more. Move exec types used by Microdroid to file.te in the host rather than their own dedicated files. Bug: 218494522 Test: atest CompOsSigningHostTest CompOsDenialHostTest Change-Id: I942667355d8ce29b3a9eb093e0b9c4f6ee0df6c1 2022-02-14 15:33:37 +01:00			`/bin/compos_key_helper u:object_r:compos_key_helper_exec:s0`
			`/bin/compos_verify u:object_r:compos_verify_exec:s0`
Initial sepolicy for composd Add what we need to allow composd to run and expose an AIDL service. Also delete the policy for compsvc; we never access it in the host now, and the real policy is in microdroid. Retain the compos_exec type, since it is referenced in the APEX sepolicy. Bug: 186126194 Test: adb shell cmd -w android.system.composd; no denials. Change-Id: I5f06b2b01852cdebd2d67009b363ec08b17ce33a 2021-09-09 18:08:15 +02:00			`/bin/composd u:object_r:composd_exec:s0`
Modify sepolicy for compos key changes Add the compos_key_helper domain for the process which has access to the signing key, make sure it can't be crashdumped. Also extend that protection to diced & its HAL. Rename compos_verify_key to compos_verify, because it doesn't verify keys any more. Move exec types used by Microdroid to file.te in the host rather than their own dedicated files. Bug: 218494522 Test: atest CompOsSigningHostTest CompOsDenialHostTest Change-Id: I942667355d8ce29b3a9eb093e0b9c4f6ee0df6c1 2022-02-14 15:33:37 +01:00			`/bin/compsvc u:object_r:compos_exec:s0`